The PIC16F1779 closes the 177x analogue generation at the top of the range: 28 KB of program flash, 2048 bytes of SRAM and thirty-six I/O lines in a 40- or 44-pin body, with four operational amplifiers, four 5-bit and four 10-bit DACs, eight high-speed comparators, four programmable ramp generators, four complementary output generators and a twenty-eight-channel 10-bit ADC on one die. Designs that wire all of that together internally – op amp into comparator into COG without spending a pin – hold their real value in the interconnect, and that is exactly what a careless copy loses. Our replicate secured PIC16F1779 firmware service exists for owners of such hardware: it returns the whole image, the configuration words and the analogue register state, from units you own.

Copying the hidden schematic

On this generation the peripherals are meant to be wired internally, so the shipped flash constants describe a schematic that appears on no drawing. Which op amp feeds which comparator, what the ramp slopes are, where the CLC gates route their four inputs – these are register values the startup code writes milliseconds after reset. A checksum-matched clone still boots and still runs, but its control loop is a stranger. Replication therefore proceeds in two captures: the flash array itself, and a powered register dump taken before reset, with the two reconciled line by line. Divergences go into the report as questions rather than footnotes, because on this part the questions are where the engineering value hides.

The four data signal modulators add a quieter capture target on this part: carrier words and modulation sources that LED-dimming firmware sets once and never touches again, yet which decide whether a lamp sings audibly or stays silent. Our powered-state dump reads the modulator registers with the rest, and the delivery notes list each carrier word beside the PWM channel it serves. On dimming products that pairing has explained flicker complaints the original vendor could not.

What the configuration words close

Access control lives in the configuration words above the code: a code-protect bit that refuses external reads of program flash, and write-protect bits that seal regions against self-programming. Clearing the protect bit demands a bulk erase – the one operation that destroys the array – so a disciplined job never approaches it. Instead the capture reads everything that still answers with protection engaged, checksums per sector, and records the configuration words verbatim so a replacement part inherits the maker’s policy. The 128-byte high-endurance flash block is captured alongside; it substitutes for data EEPROM on this die, and counters or serialisation data stored there vanish silently if a recovery treats it as scratch.

Automotive donors and their habits

The 177x family carries AEC-Q100 qualification, which means a fair share of donors arrive from vehicle-mounted boards with years of thermal history behind them. Lead inspection precedes every capture on these packages, and the read is broken into short sessions so a marginal socket contact costs minutes rather than the whole pass. Nothing in the sequence writes to the array, so a protected part leaves the bench exactly as protected as it arrived. Revision letters from the part marking travel with the image, which has settled more than one argument about why two identical-looking boards behaved differently.

Duplication and verification

Verified images are programmed into matching 40/44-pin blanks, configuration words restored, and proven against the donor on the bench before delivery – the procedure is the same one documented on the MCU flash EEPROM data cloning page. The reasoning behind treating analogue register state as part of the image is set out in the how the MCU memory works guide, and the storage layout itself in the microcontroller internal storage structure analysis reference.

Family links

The 28-pin 28 KB sibling is on the PIC16F1778 source code page, the smaller 178x analogue line on the PIC16F1782 code recovery, and the newer 180xx generation on the PIC16F18075 MCU page.

Scope

Work is accepted only for units you own or are authorised to service, recorded per job. Send the locked PIC16F1779 with its board if possible, and the return is a verified image, the register-state notes, and a protection map stating plainly what was sealed and what was read.