PIC16F18 Unlock — Recovering Firmware from Code-Protected Microchip Parts
PIC16F18 unlock is the process of reading protected flash memory from Microchip’s PIC16F18x family — including the PIC16F18313, PIC16F18325, PIC16F18344, PIC16F18346, PIC16F18855, PIC16F18875, and PIC16F18877 — when the code-protection (CP) bit has been set. Our engineers recover firmware for authorized owners who need to restore a lost hex file, support legacy production, or migrate to a new revision. Success rates across the PIC16F18x sub-family typically run above 85 %, with turnaround of 5–8 working days and pricing that starts around USD 400–900 depending on the specific variant and protection configuration.
How Does the PIC16F18x Code-Protection Scheme Work?
Microchip’s PIC16F18x series uses a single CP bit in the Configuration Word to gate external read access to program flash and data EEPROM. When CP is programmed (cleared to 0), any attempt to read flash through ICSP returns blank or scrambled data. The protection mechanism is implemented at the silicon level — the read-path multiplexer is disabled for external interfaces while the CPU can still execute from flash normally.
Key technical details of the protection:
- Flash size range: 3.5 KB (PIC16F18313) to 56 KB (PIC16F18877), all covered by a single CP bit — no per-sector granularity.
- Data EEPROM: 256 bytes, protected by the same CP bit. Recovery of EEPROM calibration data is included in the same operation.
- Write protection (WRT): Separate bits control write-protect regions. WRT does not block our read-recovery approach but affects whether the device can be reprogrammed afterward.
- User ID locations: Four 14-bit words at 0x8000–0x8003 remain readable regardless of CP state — useful for identifying firmware revisions.
Unlike some newer Microchip families that add Secure Boot or hardware key storage, the PIC16F18x relies on a straightforward CP-bit model. This makes the family one of the more approachable targets for authorized firmware recovery.
Which PIC16F18x Variants Can Be Unlocked?
| Part Number | Flash | EEPROM | Pins | Recovery Feasibility |
|---|---|---|---|---|
| PIC16F18313 | 3.5 KB | 256 B | 8 | High |
| PIC16F18323 | 3.5 KB | 256 B | 14 | High |
| PIC16F18325 | 14 KB | 256 B | 14 | High |
| PIC16F18344 | 7 KB | 256 B | 20 | High |
| PIC16F18346 | 28 KB | 256 B | 20 | High |
| PIC16F18855 | 14 KB | 256 B | 28 | High |
| PIC16F18875 | 14 KB | 256 B | 40 | High |
| PIC16F18877 | 56 KB | 256 B | 40 | High |
All variants share the same core architecture (enhanced mid-range 14-bit instruction set) and the same CP mechanism, so the recovery approach is consistent across the sub-family. Parts with larger flash simply take slightly longer to verify post-extraction.
Our PIC16F18 Unlock Process — Step by Step
1. Feasibility Assessment (Day 1)
You ship us the target device (or a populated board). We inspect the package marking, confirm the exact part number and revision, and run a non-destructive probe to verify CP status. If the part has already been bulk-erased or is physically damaged, we flag this before any chargeable work begins.
2. Firmware Extraction (Days 2–5)
Using a combination of proprietary tooling and controlled electrical techniques, our engineers bypass the CP gate and read out the full flash contents — program memory, data EEPROM, and configuration words. The process is performed on the bare die or through the ICSP interface depending on the variant and package type (SOIC-8, TSSOP-14, TQFP-44, DIP-40, etc.).
3. Verification & Delivery (Days 5–8)
The extracted hex file is programmed into a blank PIC16F18x device and functionally compared against the original. We deliver the firmware as an Intel HEX file and, on request, a disassembly listing. Configuration fuse settings — oscillator selection, MCLR, WDT, brown-out — are documented separately so you can replicate the exact operating configuration.
Throughout the process, all work is covered by a mutual NDA. We require proof of IP ownership or a signed authorization letter before we begin — see our authorization and trust policy for the specific documentation we accept.
Cost and Turnaround for PIC16F18 Firmware Recovery
| Service Tier | Turnaround | Indicative Price (USD) | Includes |
|---|---|---|---|
| Standard | 5–8 working days | 400–600 | HEX file + config fuses |
| Rush | 3–4 working days | 700–900 | HEX + config + disassembly listing |
| Batch (≥5 units, same part) | 7–10 working days | 250–350 per unit | HEX + config per unit |
Pricing depends on the exact variant, package, and whether destructive decapping is required. The feasibility assessment itself is free — you only pay if recovery succeeds.
What Can Go Wrong — Realistic Limitations
No IC unlock service is 100 % guaranteed. Here are the failure modes we see on PIC16F18x parts:
- Physical die damage: Corrosion, cracked bond wires, or ESD damage to the flash array can render cells unreadable. We can sometimes reconstruct partial images, but gaps in critical code sections may make the firmware unusable.
- Remarked or counterfeit parts: Occasionally a device marked as PIC16F18877 turns out to be a different die altogether. Our feasibility check catches this before paid work starts.
- Mixed-revision firmware: If the original developer used bootloader-style self-write to update portions of flash, the extracted image may contain a hybrid of firmware versions. We note any anomalies in the delivery report.
- One-time programmable (OTP) variants: The PIC16F18x family is flash-based, not OTP, but if you accidentally send an older PIC16C part with a similar marking, the process and pricing differ significantly.
PIC16F18 vs. Other Microchip PIC Families
The PIC16F18x is part of Microchip’s “enhanced mid-range” generation. Compared to the older PIC12F and PIC16F families, it adds more peripherals (CLC, NCO, DAC) but keeps the same basic CP model. If you also need recovery on the closely related PIC16F15 family, the approach is nearly identical — both share the enhanced mid-range core and single-bit CP.
For the even smaller PIC12F675 and similar 8-pin parts, the protection is simpler still, and turnaround is often faster. Moving outside the Microchip ecosystem — say to an Artery AT32F403 or a GigaDevice GD32VF103 — the protection schemes become ARM-based RDP/SWD-lock mechanisms that require entirely different tooling.
Who Needs PIC16F18 Unlock?
Authorized firmware recovery serves several legitimate use cases:
- Legacy production continuity: The original developer is unavailable, source code is lost, and you need to program replacement units for an existing product.
- Equipment repair: A failed PIC16F18855 on a motor-control board needs to be replaced, but the OEM no longer supports the product. Recovery lets you clone the firmware onto a fresh IC.
- Firmware migration: You own the design and want to port the existing binary to a newer Microchip part (e.g., PIC18F-Q series) — having the hex file and disassembly accelerates the rewrite.
- Failure analysis: Reading back flash to compare against a known-good image helps isolate whether a field failure is firmware corruption or hardware.
Deliverables You Receive
- Intel HEX file — program flash + data EEPROM, ready to program via MPLAB IPE or PICkit.
- Configuration word document — exact fuse bit values (FOSC, WDTE, PWRTE, MCLRE, CP, BOREN, CLKOUTEN, etc.).
- Optional disassembly listing — annotated PIC16 assembly with symbolic labels for interrupt vectors, peripheral init, and main loop.
- Verification report — functional comparison notes, any anomalies, and recommended programming parameters (Vdd, ICSP speed).
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Is PIC16F18 unlock destructive to the original chip?
In most cases, no. Our primary method reads flash without decapping. However, if the device has additional physical protections or the package is damaged, we may need to decap — which is a one-way process. We always confirm the approach with you before proceeding, and the feasibility check is non-destructive.
Can you recover firmware if the PIC16F18 has been bulk-erased?
No. A bulk erase resets all flash cells to 0x3FFF (the blank state on 14-bit PIC devices). Once erased, the original code is gone. If you suspect an erase has occurred, send the device anyway — our feasibility check will confirm whether valid code remains.
Do I need to prove I own the firmware before you start?
Yes. We require a signed authorization letter or proof of IP ownership — such as the original purchase order for the design, a company letterhead declaration, or a legal representative’s confirmation. This protects both parties and is a condition of our NDA and trust framework.
What if my PIC16F18 variant isn’t listed in your table?
The PIC16F18x family has many sub-variants (LF versions, different temperature grades). If your exact part number isn’t shown, submit a feasibility request — the underlying silicon and CP mechanism are the same across the family, so coverage is broad.
How does PIC16F18 code protection compare to PIC18F or dsPIC read protection?
PIC16F18x uses a single CP bit with no multi-level read-protection. PIC18F parts can have per-block code protection and a separate boot-block lock. dsPIC/PIC24 devices add General Code Segment and Secure Segment protections. The PIC16F18x scheme is the simplest of the three, which generally translates to higher success rates and lower cost for recovery.
Related IC Unlock Services
If you work with multiple microcontroller families, these guides cover protection schemes and recovery feasibility for other popular parts:
- CH585 firmware recovery — WCH RISC-V BLE SoC unlock details
- STM32F072 RDP bypass — ARM Cortex-M0 read-protection recovery
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote