The 32 KB 28-Pin J10
The PIC18F25J10 doubles the PIC18F24J10: 32 KB of program memory (0x0000-0x7FFF), 1,024 bytes of SRAM, ten ADC channels, two comparators, an MSSP, an enhanced USART, two CCP modules, and the J10 generation’s signature constraints – 40 MHz ceiling, 2.0-3.6 V supply with the VDDCORE/VCAP regulator pin, no EEPROM, and 1,000-cycle flash endurance with emulated-data routines for persistent storage.
Lock And Sweep
PIC18 configuration at 0x300000 with CP0/CP1 and WRT bits; ID at 0x3FFFFE. Rules:
– Array: 0x0000-0x7FFF, 0x0000 under CP. – Configuration: 0x300000 window. – ID: 0x3FFFFE-0x3FFFFF.
The 32 KB boundary separates the 25J10 from the 16 KB 24J10 and the 40/44-pin PIC18F45J10 – packages repeat, the ID decides.
Image Anatomy
With 1 KB of SRAM the application is compact; the listing shows the enhanced USART and MSSP setup, CCP timing, and – in firmware that persists data – emulated-EEPROM blocks near the top of the array holding parameters the clone must reproduce. Sixteen-bit instructions pair into byte addresses; the disassembly reads linearly once the pairing is handled.
The Session
Identify, read the configuration window, sweep 0x0000-0x7FFF, verify. Nothing is erased; the part returns to service. A silent interface on the board is statistically a VCAP capacitor fault – check it before blaming the lock.
Deliverables
HEX file, annotated disassembly, configuration report, checksum tied to the die. Clone policy documented.
The 28-Pin J10
The 25J10 is 32 KB at 0x0000-0x7FFF with 1,024 bytes of SRAM, ten ten-bit ADC channels, no EEPROM, and a 40 MHz maximum at 2.0-3.6 V. It predates the J11 remap layer, so its pin functions are fixed rather than assignable – a detail that makes the recovered image easier to interpret, because every peripheral register maps to a pin the datasheet names.
Fixed Pinout, Readable Image
Without PPS, the initialisation code names its pins implicitly through the peripheral enables. A UART transmit block therefore implies the fixed TX pin, and the ADC channel selection implies the analog input. That mapping is what lets a 32 KB image be understood without the schematic: the code itself is the pinout. This is the main practical difference between recovering a J10 and recovering a J11, and it is why J10 jobs often need less client input.
– Array: 0x0000-0x7FFF, erased 0x3FFF, protected 0x0000. – Configuration: 0x300000-0x300007. – ID: 0x3FFFFE-0x3FFFFF.
Endurance And Wear
The J10 line is rated at 1,000 erase/write cycles per block. On a 32 KB array with 1 KB blocks that is a real limit for any product that stores parameters in flash: after a few years of periodic writes the low block or the parameter block can fail to erase cleanly, and the part arrives with a checksum mismatch that precedes any protection question. The session reads such blocks three times, takes the majority value, and reports the instability instead of hiding it.
What Comes Back
A HEX file at word addresses, an annotated disassembly with the fixed-pin peripheral blocks labelled, a configuration report listing correct protect state, and a checksum bound to the die. Where the client needs the image flashed onto new silicon, the same report records the lock policy so the replacement can be protected identically.
Turnaround
A single 25J10 is normally quoted at one to two working days. Units from the same production run are read in one batch and compared against each other, so a variant that carries a later build is separated out before the report is issued rather than after a replacement has been flashed.
Delivery
The annotated listing includes a pin table derived from the fixed peripheral enables, which for a J10 is exact rather than inferred – a property the later remappable parts do not have.
To extract a locked 25J10, write to the services desk or the contact form.