The PIC18F6525 carries 48 KB of flash, 3,840 bytes of RAM and 1,024 bytes of data EEPROM in a 64-pin package, with two CCP modules and three enhanced ECCP modules driving up to 12 PWM outputs. Microchip has marked it Not Recommended for New Designs — which does not stop it appearing in production boards, and it does introduce a problem that current parts do not have: two boards of the same product model can carry different silicon revisions of the same part, with small behavioral differences that matter after a rebuild.
The array and its blocks
The 6525 divides its 48 KB — 0x0000 to 0x0BFFF — the DS39612 way: a 2 KB boot block at the bottom, then Block 0 from 0x0800 to 0x3FFF (14 KB), then Block 1 (0x4000–0x7FFF) and Block 2 (0x8000–0xBFFF) at 16 KB each. Three code-protect bits, CP0 through CP2, cover the three blocks; CP3 exists in the register description but is unimplemented on this part and must be left set. Each block also carries its own write-protect and table-read bits.
A partially locked unit therefore returns a distinctive pattern: firmware for some ranges, 0x0000 for others, and the zeros still disassemble because 0x0000 is a legal NOP on this core. The per-block map is the real deliverable of a first read — it says exactly which ranges are missing without opening the package.
What NRND changes
Silicon revisions differ in errata, and errata on this family touched peripherals — Timer1 and PWM-adjacent behavior among them. The revision nibble sits in the device ID at 0x3FFFFE, next to the part number, and it survives code protection: the ID is always readable. Before comparing a dump against anything, or promising that a rebuilt unit will behave identically, read the ID and record the revision.
Two practical consequences follow. First, a firmware image copied from a rev A1 unit and burned into a rev C unit usually runs, but the PWM edge behavior on the three ECCPs can differ slightly on a motor or bridge output — the kind of difference that passes a bench test and shows up as audible noise or extra heating in the field. Second, the semi-invasive route that reads the die directly may need revision-aware setup, because the memory layout under the covers follows the same family map but the process changed between revisions.
The EEPROM is the second half of the product
The 1,024 bytes of data EEPROM at 0xF00000 sit under their own CPD bit, separate from the flash blocks. On a 64-pin controller driving PWM-heavy loads, the EEPROM typically holds phase offsets, dead-time trim and per-unit serial data. A rebuild with a correct flash image and a blank EEPROM runs and then outputs slightly wrong PWM — the failure that gets reported as “the clone is not identical” rather than as an incomplete read. Any engagement should treat flash and EEPROM as one deliverable from the start; the cost factors page explains why splitting them mid-project costs more than including them at the start.
How a read-out is verified
The completeness test for a 6525 image is arithmetic: 48 KB of array data ending at 0x0BFFF, plus the config words from 0x300000, plus 1,024 EEPROM bytes, plus the ID. Where blocks read as zeros and the protection state shows them locked, the die-level route described by the code protection overview applies, and the services page sets out the options. Its 48 KB sibling from the newer family, the PIC18F6527, has the same array size and a different block map — one more reason the device ID is read first.
Two reads, one revision
The revision nibble in the device ID is also the cheapest cross-check available: read it twice, from the same unit, before and after any other work. A mismatch means the wrong part was assessed — the 6525’s package is shared across its family, and mixed inventory bins have shipped before. For engagements where the rebuilt unit must behave identically to a specific original, the revision is recorded in the deliverable alongside the dump, because a rev-A1 dump burned into a rev-C die is a different machine in the small ways that errata describe. None of this is visible from the part marking, which carries no revision; only the ID does.