“Copy the flash area” sounds like one operation on one region. A PIC18F4423 has four protection blocks, and the boundary between them is where copies quietly fail — one block comes back blank, the other three come back full, and the file looks complete.
The part carries 16 KB of program memory, which is 8,192 instruction words, plus 768 bytes of SRAM, 256 bytes of data EEPROM, 36 I/O pins, a 12-bit ADC with thirteen channels, one CCP and one ECCP module, and a parallel slave port. It comes in 40-pin PDIP and 44-pin TQFP or QFN, and it shares its datasheet, DS39755, with the smaller PIC18F4523 and the two 28-pin members of the family.
The Array in Four Pieces
The 16 KB is addressed from 0x000000 to 0x003FFF and split into four blocks of 4 KB each:
| Block | Byte range | Words | Protection bit |
|---|---|---|---|
| 0 | 0x000000–0x000FFF |
2,048 | CP0 |
| 1 | 0x001000–0x001FFF |
2,048 | CP1 |
| 2 | 0x002000–0x002FFF |
2,048 | CP2 |
| 3 | 0x003000–0x003FFF |
2,048 | CP3 |
All four bits sit in CONFIG5L at 0x300008. They are independent. A designer who protects only the first block does not get “a protected chip” — they get three readable blocks and one that refuses, and the refusal is invisible unless you know what to look for.
0xFFFF Means Empty. 0x0000 Means Locked.
This is the single most useful fact in this article. On PIC18 devices, a table read from an erased location returns 0xFFFF. A table read from a code-protected location returns 0x0000. The two states are deliberately distinguishable, and most people read both as “no data”.
They are not the same thing:
- A run of
0xFFFFat the top of an array is normal. The product used less memory than the part provides. - A run of
0x0000that starts exactly on a 4 KB boundary and ends exactly on the next one is a locked block. The silicon is refusing, not reporting.
A 16 KB file with one zeroed quarter is the most common incomplete copy in this family, and it assembles, links and programs without complaint. 0x0000 is a valid instruction word on PIC18 — it decodes as NOP — so a locked block does not look like an error in a hex editor. It looks like a long stretch of padding.
Config Lives Outside the Flash
The flash ends at 0x003FFF. The configuration words start at 0x300000 and run to 0x30000B: CONFIG1L through CONFIG5H. The device ID is at 0x3FFFFE and the silicon revision at 0x3FFFFF.
So a read that starts at 0x000000 and stops at 0x003FFF is a complete flash read and an incomplete device image. Load that into a blank part and the oscillator configuration comes up erased, which on this family does not select the HS mode a crystal-based board needs. The replacement sits there with a valid 16 KB of code and never starts. Whoever is testing it then blames the copy, and the copy was fine.
Ask for the four configuration blocks, the 256 bytes of EEPROM and the device ID in the same file. The code protection note should state which of the four bits were set, because that determines whether the file you receive can be complete at all.
Proving the Blocks Are All There
Three checks that need no reference file:
1. Boundary continuity. Disassemble across 0x0FFF, 0x1FFF and 0x2FFF. A branch target that lands mid-instruction at a boundary means a word was dropped at the seam. 2. Zero-run shape. A zero run that starts and ends on 4 KB boundaries is a locked block. A zero run that starts mid-block is real code containing NOP padding or a data table of zeros. 3. Device ID. 0x3FFFFE should read the expected value for a 4423. If it reads as a 4523, you have been handed a file from the 32 KB sibling and the top half of your array will be 0xFFFF.
The Donor Part Problem
The PIC18F4420 is pin-compatible, same package, same peripherals, and it is a different datasheet — DS39631 rather than DS39755. The visible difference is the ADC: 10-bit on the 4420, 12-bit on the 4423. A board rebuilt around a 4420 donor boots and runs, and every analog reading is four times coarser, which shows up as a control loop that hunts instead of settling. If the chip extraction analysis is being scoped for a 4423, keep the donor list to the same silicon.
Send a photograph of the marking and the board, plus a note on which blocks were protected, and the scope can be settled before anything is quoted. The services page lists what each route includes.