Add twelve pins to a microcontroller and you rarely change the recovery. The PIC32MX150F128D is the exception that proves the rule: the 44-pin package exposes the full analog front end of the 1XX family — up to 13 inputs on the 10-bit, 1 Msps converter, three comparator modules and the charge-time measurement unit — and products built on it are analog products first. Their firmware reads differently, and their recovery has one step the digital-only parts do not.
The Analog Fingerprint In A Dump
Converter-heavy firmware is recognizable before a single line is disassembled. The initialization block configures sample-and-hold sequencing, trigger sources and scan order; the interrupt service routines shuttle results out of the result registers at conversion rate; lookup tables — calibration curves, thermistor linearization, touch thresholds — sit in the flash as constant arrays with distinctive value patterns. On a 150F128D dump those arrays are the customer’s real intellectual property. Code can be rewritten; the calibration table measured against thousands of production units cannot, and it lives in the same 128 KB array from 0x1D000000 to 0x1D01FFFF as everything else.
The CTMU adds its own signature: it measures time in nanoseconds and charge in picocoulombs, which makes it the engine behind capacitive touch and precision timing loops. Firmware using it pairs tight constant loops with the CTMU control registers, and those constants — the current trim, the charge intervals — are exactly the values a reconstruction must not approximate.
Peripheral Pin Select Changes The Meaning Of Code
The 1XX family can remap peripheral functions to pins at runtime. Two UARTs, two SPI/I2S ports, timer inputs and outputs — all route through the pin-select matrix, configured by writes to a register bank at startup. The consequence for recovery is direct: the code alone does not tell you which pin carries which signal. A reconstruction that disassembles the firmware and finds “UART2 active” knows the module is used, not where its pins went. Only the configuration writes in the image reveal the actual routing, and they are part of the recovered data, not an afterthought.
This matters most when the job is replication — rebuilding a board whose design files are gone. The pin map lives nowhere except in those startup writes and in the traces of the board itself. The chip extraction analysis service pairs the image with the board so the two agree.
The 210F016B page covers the same family at the smallest USB density; this article’s concern is what the extra pins and the analog budget do to the job. The answer, in short: more of the product’s value lives in constant tables, and fewer of its secrets live in the package choice.
The Debug Port And The Boundary Scan
The 44-pin package also exposes the family’s full debug machinery: a 4-wire enhanced JTAG port with unlimited program breakpoints, six complex data breakpoints, and IEEE 1149.2-compatible boundary scan across the I/O. On a healthy production board, boundary scan verifies every net the part touches before any capture attempt, which on a fine-pitch QFN is worth the extra step. The debug channel’s pin selection is configurable, so a fixture wired to the default pins meets a silent port on boards that steered it elsewhere; the configuration words say where it went.
Current ratings round out the fixture planning: 10 mA source and sink on the standard pins. Analog fixtures built around the 13 converter inputs need that margin — the converter samples at 1 Msps and the CTMU measures charge in nanosecond-scale intervals, so clean rails and short traces are not vanity; they are what keeps a recovered calibration table worth restoring.
Capture, Verify, Report
The mechanical part is family-standard: 128 KB of program flash, 3 KB of boot flash from 0x1FC00000 to 0x1FC00BFF, four DEVCFG words at the top of the boot partition. Two independent captures of each region, compared word for word, with the device ID read back to pin the die — the 44-pin package shares footprints across the density range, and the ID is the only thing that distinguishes a 150F128D from a 130F064D on the same board. The reading process page covers the sequence.
Code protect, if armed, sits in DEVCFG0 bit 28, active low, and blocks external reads of both partitions; its only documented exit is a chip erase that destroys the image. Write-protect fields do not block reads and are never a reason to stop. Both facts are checked from the configuration words before any quoting, because they change the answer, not just the price.
The Deliverable That Matters Here
For a digital product, the HEX plus the boot bank is the product. For an analog one, the constant tables are the product, and the report has to make them findable: calibration arrays, CTMU constants, comparator thresholds, converter scan tables, each located and annotated. A customer restoring production or porting the design uses those directly. The firmware extraction overview describes the packaging; the NDA page governs the exchange. Analog firmware hides nothing exotic — it simply concentrates its value in a handful of kilobytes that look like noise until someone knows what they are looking at.
Package and page size for the neighbouring parts are listed in the PIC32MX family index.