The Middle Of The J11 Ladder
The PIC18F25J11 sits between the 16 KB PIC18F24J11 and the 64 KB PIC18F26J11: 32 KB of program memory (0x0000-0x7FFF), 3,776 bytes of SRAM, 48 MHz (12 MIPS), nanoWatt XLP with Deep Sleep, PPS, a hardware RTCC, the CTMU, two ECCP modules, two EUSARTs, two MSSPs, ten ADC channels and two comparators. No EEPROM anywhere; persistent data lives in emulated-EEPROM flash regions.
Lock And Sweep
PIC18 configuration at 0x300000: CP0/CP1, WRT, boot-block bits. Erased config bytes 0xFF; locked array 0x0000. Sweep:
– Array: 0x0000-0x7FFF. – Configuration: 0x300000 window. – ID: 0x3FFFFE-0x3FFFFF.
Image Anatomy
The 3.8 KB SRAM supports dual serial ring buffers and a touch-sensing state machine; the RTCC scheduler appears as table-driven wake logic. PPS routing tables in the constants region record the pin map, and emulated-EEPROM parameter blocks near the top of the array carry the persistent values a clone must reproduce byte-for-byte.
The Session
Twenty-eight pins carrying two serial ports and two I2C buses means the ICSP pads usually share a bus, so the session starts by holding the other devices on that bus in reset. The configuration window is read first, the ID second, and the array from 0x0000-0x7FFF in blocks that are checksummed as they arrive.
Deliverables
HEX file, annotated disassembly with the communication, touch, scheduler and parameter regions labeled, configuration report, checksum tied to the die. The 40/44-pin sibling is covered on the PIC18F45J11 page.
Thirty-Two Kilobytes On Twenty-Eight Pins
The 25J11 is the largest flash option in the 28-pin J11 body: 32 KB at 0x0000-0x7FFF, 3,776 bytes of SRAM, ten ten-bit ADC channels, two ECCP, two EUSART, two MSSP, RTCC, CTMU and the PPS remap fabric, all at 48 MHz with Deep Sleep at 13 nA. The J11 generation replaced the J10 with more SRAM and a remappable pin layer, and that remap layer is what most recovered images are judged by – it is the only record of which pin did what on a board that may no longer exist.
Protection And Access
Configuration registers sit at 0x300000-0x300007 with the protect bits in CONFIG1L; device ID at 0x3FFFFE. The part is 2.0-3.6 V and has no EEPROM, so all persistent data is inside the protected array. Access is through the five-line ICSP header, and on 28-pin boards those pads are frequently shared with the SPI bus of a display or a memory device, which means the session has to hold the other bus members in reset while reading.
– Array: 0x0000-0x7FFF, erased 0x3FFF, protected 0x0000. – Configuration: 0x300000-0x300007. – ID: 0x3FFFFE-0x3FFFFF.
What The Firmware Looks Like
Twenty-eight pins with two serial ports and two I2C buses leaves almost nothing unused, so images on this part are peripheral-heavy: a communications layer near the vectors, a scheduler in the middle, and a compact application body. The CTMU constants sit in a low page and are the one thing that cannot be reconstructed from behaviour, because they encode the physical geometry of a capacitive pad on the client’s board rather than any protocol.
Verifying The Result
The session checks that every interrupt vector points at a plausible handler, that no call target falls outside 0x0000-0x7FFF, and that the PPS table references only pins the package actually provides. A table entry pointing at a pin the 28-pin body does not have is a reliable sign that the image came from a different family member and the client has the wrong part in hand – worth catching before the report is written.
Practical Notes
The 25J11 shares its die with the 26J11 and differs only in array size, so a client who has both parts in a product line can have them read in the same session and receive two images whose low 32 KB are directly comparable – a fast way to confirm that the smaller build is a subset of the larger one.
To book a 25J11 recovery, use the services desk or the contact form.