Twelve Bits Change The Image
The PIC18F26J13 belongs to the J13 revision of the J-line: 64 KB of program memory (0x0000-0xFFFF), 3.8 KB of SRAM, 48 MHz, Deep Sleep at nine nanoamps, PPS, hardware RTCC, CTMU, three ECCP modules, two EUSARTs, two MSSPs, three comparators – and a twelve-bit ADC with ten external channels, the upgrade that distinguishes J13 from the 10-bit J11. No USB on this member; that stays with the J50/J53 lines. No EEPROM either.
Lock And Sweep
PIC18 configuration at 0x300000: CP0/CP1, WRT, boot-block bits. Erased config 0xFF; locked array 0x0000. Sweep:
– Array: 0x0000-0xFFFF. – Configuration: 0x300000 window. – ID: 0x3FFFFE-0x3FFFFF.
Image Anatomy
Twelve-bit results arrive as two bytes per sample, so the listing’s scan loops and averaging accumulators are visibly wider than J11 code – a quick structural fingerprint separating the generations. The three ECCP time bases with auto-shutdown wiring indicate power-stage control; the RTCC scheduler and CTMU touch logic appear as before. Emulated-EEPROM parameter blocks near the top of the array hold persistent values a clone must reproduce.
The Session
The twelve-bit converter dominates this part’s firmware, so the ADC sequencer and its coefficient table are located early and the rest of the image is reviewed around them. The configuration window is sampled twice, the ID checked against the package, and the 64 KB array read in 1 KB blocks with per-block checksums recorded in the report.
Deliverables
HEX file, annotated disassembly with the analog, control and parameter regions labeled, configuration report, checksum tied to the die. For the 128 KB sibling, see the PIC18F27J13 page.
Sixty-Four Kilobytes And A Twelve-Bit Converter
The 26J13 is the 28-pin member of the J13 line: 64 KB at 0x0000-0xFFFF, 4 KB of SRAM, a twelve-bit ADC, three comparators, three ECCP modules, two EUSART, two MSSP, RTCC, CTMU and PPS, at 64 MHz and 2.0-3.6 V. The twelve-bit converter is the reason this part appears in instrumentation rather than in motor control, and it explains why the recovered images carry long calibration tables.
Calibration Is The Payload
On a twelve-bit design the firmware spends a noticeable fraction of its code on offset and gain correction: a table of per-channel coefficients, a temperature compensation curve, and a small routine that applies both. Those coefficients were derived on the client’s own test rig against their own sensor batch, and they are the part of the image that cannot be regenerated from a reference design. The disassembly labels the table and the routine that walks it; the values are reproduced verbatim.
– Array: 0x0000-0xFFFF, 0x3FFF erased, 0x0000 protected. – Configuration: 0x300000-0x300007. – ID: 0x3FFFFE-0x3FFFFF.
Access And Power Notes
Twenty-eight pins, 4 KB of SRAM and no EEPROM: persistent data lives in flash and is written through the same self-programming routine that a firmware update would use. Because the part runs at 64 MHz from an internal PLL, the ICSP clock has to stay well below the core clock during the read, and a programmer that tries to run fast returns plausible but corrupt data – the failure is silent, which is why every block is read twice and compared.
What The Disassembly Shows
Three PWM clusters sit close together in address order, which on this family is the signature of a design driving three half-bridges. The comparator setup follows, then the ADC sequencer with its coefficient table. Interrupt vectors are spread through the low pages rather than concentrated, so the vector table is reconstructed by scanning for the handler prologues rather than read from a single location.
Handover Package
HEX at word addresses, annotated disassembly with the PWM clusters, comparator block, ADC sequencer and coefficient table labelled, configuration report, checksum tied to the die. Protection left as found.
Turnaround
Instrumentation parts usually arrive with a calibration certificate and a description of the sensor. Neither is required for the read, but both shorten the review, because the coefficient table can be checked against the known sensor range instead of being described as an unlabelled block of constants.
To extract a locked 26J13, write to the services desk or the contact form.