A cloned USB board that lights up and runs its own code has proved almost nothing. The device is only working when a host reads its descriptors, assigns an address and starts moving data. Everything before that is a board with a good power LED.
The PIC18F4455 is a 24 KB part: 12,288 instruction words, 2,048 bytes of SRAM, 256 bytes of data EEPROM, 35 I/O pins, thirteen channels of 10-bit ADC, one CCP and one ECCP module, and a full-speed USB 2.0 interface with sixteen endpoints. It runs at 48 MHz for 12 MIPS and shares DS39632 with the 32 KB PIC18F4550 and the two 28-pin members of the family.
The Kilobyte That Is Not in the File
The USB serial interface engine on this family has its own 1 KB of dual-port RAM. It sits at a different address range from program memory, it is not flash, and it is not part of any hex file.
That memory is where the endpoint buffers live. The host writes into it during enumeration and during every subsequent transfer. It is volatile: on power-down it is gone, and on the next boot the SIE rebuilds it from the descriptors and the endpoint configuration the firmware writes at startup.
Descriptors Are const Data in Flash
On this family, USB descriptors are compiled into program memory as constant tables. The device descriptor carries the vendor ID and product ID. The configuration descriptor carries the power requirement and the interface count. The string descriptors carry the manufacturer and product names that appear in the host’s device list.
All of it is in the 24 KB, and a complete read returns it. Two consequences follow:
1. A clone inherits the original identity. Same VID, same PID, same strings. On Windows the original INF file matches and the device installs with no driver work. 2. Changing the identity is a firmware edit, not a hardware one — but it breaks the INF match, so the replacement needs its own driver package.
The vendor ID is not a technical choice. It is allocated to a company, and a clone carrying someone else’s VID is a compliance problem regardless of how well it enumerates.
What a Complete 4455 Image Contains
- 24 KB of program memory at
0x000000–0x005FFF, four 4 KB protection blocks - Twelve configuration bytes at
0x300000, including the USB clock source selection - 256 bytes of data EEPROM at
0xF00000— on this part it may hold trim, a serial number, or nothing - Device ID at
0x3FFFFEand revision at0x3FFFFF
The configuration block deserves attention on a USB design. The 48 MHz USB clock is derived from the 96 MHz PLL divided by two, and the PLL is enabled in CONFIG1H. Load a valid 24 KB image with erased configuration and the CPU may still run from the internal oscillator while the USB peripheral never sees a legal clock. The board boots, the code executes, and the host sees nothing.
The Acceptance Sequence
Four steps, in order, and each one can fail independently:
| Step | What it proves | What a failure looks like |
|---|---|---|
| Bus power and D+ pull-up | The transceiver is enabled and the SIE is alive | Host reports nothing at all |
| Descriptor read | The const tables are intact and correctly addressed |
“Unknown device” or a descriptor request error |
| Address assignment and configuration | Endpoint setup code ran | Device appears then disappears |
| Bulk or interrupt transfer | The application’s buffer handling works | Device present, no data |
A clone that clears all four is a working clone. One that stalls at the second has a descriptor-table problem — usually a file truncated at a block boundary.
The chip extraction analysis step matters here because USB designs often protect only the lower blocks. If the descriptor tables sit in block 0 and the application in blocks 1 to 3, a partial read gives you working enumeration and a device that cannot do its job — a confusing failure to debug if you do not know the map.
Where the Sibling Helps
The 4455 and 4550 are the same die with different flash sizes and the same datasheet. A 4455 image programs into a 4550 and runs, which is useful when the 24 KB part is unavailable. The reverse is not true: a 4550 image will not fit.
What does not substitute is a part from the 2458/4458 branch, which has the same 24 KB and the same package but a twelve-bit ADC instead of ten. That difference is invisible until an analogue channel is read.
One board and a photograph of both sides is enough to start. Everything runs under the non-disclosure agreement, and the services page sets out what each route includes — including which blocks a partial read cannot reach.