The Biggest USB J50
The PIC18F26J50 completes the 28-pin J50 line: 64 KB of program memory (0x0000-0xFFFF), 3,776 bytes of SRAM, full-speed USB 2.0 with host clock recovery, 48 MHz core, Deep Sleep, PPS, hardware RTCC, CTMU, two ECCP modules, two EUSARTs, two MSSPs, ten channels of ten-bit ADC, two comparators, and no EEPROM on a 2.0-3.6 V supply. USB instruments and loggers that outgrew the 32 KB PIC18F25J50 land here.
Lock And Sweep
PIC18 configuration at 0x300000 with CP0/CP1 and WRT bits; ID at 0x3FFFFE. Sweep:
– Array: 0x0000-0xFFFF, 0x0000 under CP. – Configuration: 0x300000 window. – ID: 0x3FFFFE-0x3FFFFF.
Image Anatomy
The USB stack fills much of the array: descriptor tables with readable product strings, endpoint handling, class logic. The buffer descriptors sit in the dual-access RAM. Beyond the stack: dual EUSART bridges, the RTCC wake schedule, and emulated-EEPROM parameter blocks near the array top. Verification focuses on the stack’s integrity – a corrupted descriptor table is the most common symptom of a truncated read.
The Session
Sixty-four kilobytes is read in two halves with a checksum between them, which on this part is a practical necessity: the array is long enough that a single uninterrupted sweep gives no indication of where a fault occurred. The configuration window is sampled before and after the sweep, and the descriptor block near the vectors is decoded first so the client gets the USB identity even if the rest of the image needs a second day.
Deliverables
HEX file, annotated disassembly with the USB, scheduler and parameter regions labeled, configuration report, checksum tied to the die. For the 44-pin siblings, see the PIC18F45J50 and PIC18F46J50 pages.
Sixty-Four Kilobytes With USB On Twenty-Eight Pins
Sixty-four kilobytes without external memory means the design carries its own file system or record store, and that store is usually the least documented part of the firmware. It appears as a region of flash with a header, a record length and a checksum, plus a scan routine that runs at start-up. Recovering it matters because the stored records are product data, not code, and a replacement built from the code alone comes up empty.
Structure Of A 64 KB Image
Three regions are almost always visible. The first holds vectors, startup and the descriptor tables. The second holds the USB stack and the class handlers, which on this family is a recognisable block of endpoint configuration writes. The third, the largest, holds the application plus its constant tables. Because there is no PPS-free fallback on J11-derived parts, the PPS table appears near the vectors and names every peripheral pin.
– Array: 0x0000-0xFFFF. – Configuration: 0x300000-0x300007. – ID: 0x3FFFFE-0x3FFFFF.
Access On A Crowded Board
Twenty-eight pins carrying USB, two serial ports and ten analog inputs leave the ICSP pads fighting for space. On production boards the header is often omitted and the pads are test points under a connector shield. The session maps each pad to its device pin by continuity before applying power, and where a pad is inaccessible the part is lifted onto a socket – a step that takes minutes and removes an entire class of ambiguous failures.
Verification And Report
Every 1 KB block is checksummed individually and the per-block values appear in the report, so a client flashing a replacement can verify block by block rather than only end to end. The configuration window is read twice, the protect and write-protect states are recorded as found, and the image is delivered as HEX at word addresses with an annotated disassembly that separates stack, protocol layer and application by address range.
Turnaround And Batch Handling
A single 26J50 is quoted at one to two working days. Where a client sends a batch, all units are read against the same reference and the per-block checksums are listed so that identical builds can be grouped and the odd unit investigated separately.
Delivery
The descriptor set is reproduced as text alongside the binary, so a host driver can be checked against it without a hex editor.
To extract a locked 26J50, use the services desk or the contact form.