PIC16F887 Unlock — Authorized Firmware Recovery for Engineers
The PIC16F887 can be unlocked with a high probability of full flash and EEPROM recovery when code-protection fuses (CP, CPD, WRT) are the only barrier. Our lab handles this particular mid-range PIC regularly; typical turnaround is 3–5 working days, and pricing starts around $350–$600 USD depending on fuse configuration and quantity. Authorization and proof of ownership are required before any work begins.
What Protection Does the PIC16F887 Use?
The PIC16F887 belongs to Microchip’s enhanced mid-range 8-bit family. It uses a set of configuration-word bits to restrict external access to its 8 192-word flash program memory and 256-byte data EEPROM. Understanding these bits is the first step in any recovery assessment.
Configuration Word Fuses
| Fuse Bit | Location | Function |
|---|---|---|
| CP | CONFIG1, bit 13 | Code protection — blocks external read of flash via ICSP |
| CPD | CONFIG1, bit 8 | Data code protection — blocks external read of data EEPROM |
| WRT1:WRT0 | CONFIG2, bits 10–9 | Flash self-write protection (4 regions) |
| BOR | CONFIG1, bit 12 | Brown-out reset — indirectly relevant to voltage-glitch approaches |
| LVP | CONFIG1, bit 7 | Low-voltage programming enable — affects entry-mode options |
When CP is cleared (0), the programmer returns all-zeros or all-ones on a read attempt. The flash contents remain physically intact inside the die; the fuse simply gates the ICSP read path. This is a fundamentally different — and weaker — mechanism compared to hardware-encrypted parts like certain ARM Cortex-M devices with AES-backed readout protection.
How Is PIC16F887 Unlock Performed?
Our engineers use a combination of techniques selected after an initial die-level and electrical assessment. The exact method depends on the silicon revision (we have seen at least three mask revisions of this part) and the specific fuse state.
Common Recovery Approaches
- Voltage-glitch / timing-fault injection: Precisely timed VDD or MCLR transients during the ICSP entry sequence can bypass the CP gate on many PIC16F887 revisions. This is non-invasive and preserves the original device.
- UV-assisted fuse reset: On older mask revisions with a quartz-window package (rare for production units), UV exposure can clear the CP fuse without erasing flash — but the window is extremely narrow, typically under 30 seconds of controlled exposure.
- Micro-probing (semi-invasive): After controlled decapsulation with fuming nitric acid, internal bus lines can be probed during a self-read cycle. This is reserved for cases where non-invasive methods fail. The chip is consumed in the process.
We always attempt non-invasive methods first. If the device must be decapsulated, we request a minimum of two sample chips — one for process calibration and one for the actual extraction.
Realistic Success Rate and Limitations
No responsible lab quotes a 100 % guarantee. Here is what we see across hundreds of PIC16F88x-family jobs:
| Scenario | Estimated Success | Notes |
|---|---|---|
| CP set, CPD clear, standard revision | ~95 % | Flash only; most straightforward |
| CP + CPD both set | ~90 % | EEPROM recovery adds one step |
| CP + WRT set (self-write locked) | ~85 % | Glitch window is tighter |
| Damaged / corroded device | Case-by-case | Bond-wire or pad damage may prevent probing |
Failure modes include die cracks during decapsulation, bond-wire lift-off, and — rarely — a mask revision with a modified security cell layout that resists known glitch vectors. In such cases we report findings transparently and do not charge for the extraction itself.
Cost and Turnaround Breakdown
Pricing varies with complexity and urgency. The table below reflects our standard pricing tiers for PIC16F887 unlock as of 2024.
| Service Tier | Turnaround | Price Range (USD) |
|---|---|---|
| Standard (non-invasive first) | 5 working days | $350 – $500 |
| Priority | 3 working days | $500 – $700 |
| Semi-invasive (decap required) | 7–10 working days | $600 – $900 |
| Batch (5+ identical devices) | 5–7 working days | $250 – $350 per unit |
Pricing includes a feasibility assessment, the extraction attempt, and delivery of the recovered .hex or .bin file. If we cannot recover usable firmware, you pay only a nominal assessment fee (typically $50–$80).
What You Receive After Recovery
- Firmware image: Intel HEX (.hex) covering all 8 K words of flash and 256 bytes of data EEPROM.
- Configuration word dump: Both CONFIG1 and CONFIG2 values, so you can re-program a blank PIC16F887 with identical fuse settings.
- Verification report: Checksum comparison and, where applicable, a brief disassembly summary confirming code integrity.
- Re-programming support: We can program the recovered firmware onto new blank PIC16F887 chips (or pin-compatible PIC16F884/886 parts) at $5–$10 per unit.
Authorization and Legal Requirements
PIC16F887 unlock is performed exclusively for authorized purposes: recovering firmware you developed, maintaining legacy equipment you own, or supporting a product redesign where the original source code is lost. Before starting, we require a signed declaration of ownership or a letter of authorization from the IP holder. All work is covered by our mutual NDA. For full details on our compliance framework, see our IC unlock compliance and authorization policies.
PIC16F887 vs. Related Microchip Parts
If your project involves a different PIC variant, the protection mechanism — and therefore the difficulty — can differ significantly. The PIC16F887 sits in a middle tier of complexity.
| Part | Flash Size | Protection Type | Relative Difficulty |
|---|---|---|---|
| PIC16F887 | 8 K words | CP / CPD fuses | Moderate |
| PIC16F877A | 8 K words | CP fuse (older cell) | Low–Moderate |
| PIC16F1509 | 8 K words | Enhanced CP (newer core) | Moderate–High |
| PIC18F2550 | 16 K words | CP + CONFIG fuse bank | Moderate |
| PIC18F452 | 16 K words | CP per block | Moderate |
We also handle non-Microchip MCUs. Engineers working with TI parts may find our MSP430 firmware recovery guide useful, and those dealing with NXP ARM parts can review Kinetis KV unlock details.
When Does PIC16F887 Unlock Make Sense?
Not every situation warrants a chip-level extraction. Here is a quick decision framework:
- Lost source code, device still functional: High-value scenario. Recovery gives you a working .hex and a path to re-spin the product on new silicon.
- Legacy equipment repair: A single PIC16F887 failure on an obsolete control board can halt an entire production line. Recovering firmware lets you program replacement chips without a full redesign.
- Design audit or second-source qualification: Verifying that a contract manufacturer programmed the correct firmware revision.
- Prototype recovery: Early-stage startups sometimes lose the only copy of firmware when a developer leaves. We see this more often than you would expect.
If your goal is broader — recovering an entire board design including schematic, Gerber files, and BOM — our PCB reverse engineering services cover that end-to-end workflow alongside IC-level extraction.
How to Submit a PIC16F887 Unlock Request
- Contact us with the part marking (full Microchip date code and revision suffix, e.g., PIC16F887-I/PT 1823).
- Provide authorization — ownership declaration or IP-holder letter.
- Ship the device(s) — we recommend anti-static packaging and tracked courier. Two units preferred for semi-invasive work.
- Feasibility assessment — our lab evaluates fuse state and silicon revision within 1 working day of receipt.
- Recovery and delivery — firmware file delivered via encrypted transfer; physical chips returned if non-invasive method was used.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can the PIC16F887 be unlocked without destroying the chip?
In most cases, yes. Non-invasive voltage-glitch methods succeed on approximately 90–95 % of PIC16F887 devices we process. The chip remains fully functional afterward and can be returned to service. Semi-invasive decapsulation is only used as a fallback and does consume the device.
Is PIC16F887 unlock legal?
Firmware recovery is legal when performed on devices you own or with documented authorization from the IP holder. Common lawful scenarios include lost-source-code recovery, legacy equipment maintenance, and design audits. We require signed proof of ownership before starting any job. Review our authorization and compliance framework for specifics.
What if my PIC16F887 has a damaged package or corroded pins?
Physical damage does not automatically disqualify recovery. If the die and bond wires are intact, micro-probing can still extract the flash contents. We assess viability during the feasibility step and provide an honest go/no-go recommendation before incurring extraction charges.
How does PIC16F887 protection compare to PIC18F2550?
Both use configuration-word CP fuses, but the PIC18F2550 has a larger flash (32 KB) and supports per-block code protection across multiple CONFIG registers. Recovery is still feasible for both; the PIC18F2550 unlock process simply involves additional fuse analysis. Difficulty is comparable.
Can you re-program recovered firmware onto a different PIC variant?
If the target part is instruction-compatible and has equal or greater flash — for example, moving from a PIC16F887 to a PIC16F884 or PIC16F886 — we can adapt and program the .hex file directly. Cross-family ports (e.g., to PIC18F) require disassembly and manual adjustment, which we offer as a separate engineering service.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote