Microchip built the low end of the MX1 series to be interchangeable. The PIC32MX120F032B occupies the same 28-pin SOIC, SSOP, SPDIP and QFN footprints as the 110F016B, draws from the same peripheral set, and differs in exactly one headline number: 32 KB of program flash instead of 16, with 8 KB of SRAM instead of 4. A buyer can drop one into the other’s socket and the board will power up. That convenience has a forensic cost, and it lands squarely on firmware recovery.
The Marking Is Not The Whole Story
A part number on a package is a claim about the die underneath, and refurbished, remarked or mislabeled stock makes that claim unreliable. On this family the definitive answer costs one register read: the device ID returned by the programming interface states the density and revision unambiguously. A board whose BOM says 110F016B but whose ID answers with the 32 KB encoding is telling you the product was value-engineered at some point, or the assembler grabbed from the wrong reel. Either way, the recovery proceeds against the silicon that is actually present, because array geometry follows the ID, not the marking.
The same check closes the reverse error. An engineer migrating from the 110F016B to this part — the usual reason the two are confused — leaves archives that name the old density. When a lost source situation is reconstructed years later, the archive label and the die on the board can disagree, and only the ID settles it.
What Doubles, And What Does Not
The added flash spans 0x1D000000 through 0x1D007FFF. The boot partition is unchanged at 3 KB from 0x1FC00000 to 0x1FC00BFF, holding startup code and the four DEVCFG words at its top. Page and row geometry stay at 256-word erases and 32-word program rows, so programmers, scripts and fixtures built for the smaller sibling work here without edits. SRAM doubles to 8 KB, which mostly buys larger buffers; it is invisible in the image except through what the code does.
Because the array is twice as large but the silicon otherwise identical, filled fraction varies more. A 16 KB production image is typically near its ceiling; a 32 KB image might be two-thirds used with a revision table and a spare sector. Reading the erased tail accurately matters for one practical reason: a customer restoring a build wants to know which words were live, and a firmware extraction report that maps used versus erased regions makes that possible.
Packages And The Breadboard Generation
Four packages carry this density — SOIC, SSOP, SPDIP and QFN in 28 pins — and the SPDIP variant matters more than its sales volume suggests: through-hole parts from the breadboard generation live in sockets, and socketed parts read without any desoldering at all. That convenience cuts both ways. Sockets invite swaps, and a board serviced over the years may hold a part the BOM never named, which is one more reason the device ID read precedes every other step. Fixtures for the surface-mount variants are routine; the QFN presents its pads underneath and needs the gentler handling the smaller VTLA packages get elsewhere in the family, but at 28 pins the adapter ecosystem is mature and the logistics rarely dominate a quote.
Configuration Words Carry The Load
Density swapping makes the configuration page more valuable, not less. A migration that changed array size may also have changed oscillator setup, debug channel selection or watchdog policy, and the DEVCFG words at the top of the boot bank record the current truth. Recovering them alongside the two flash partitions is standard; treating them as optional is how reconstructed images come back “matching the HEX but not booting.”
The protection bit sits in DEVCFG0 and is active low — a programmed zero enables code protect, after which the flash controller blocks external reads of both partitions and only a chip erase, which destroys the image, clears it. Write-protect fields are different: they guard against modification during execution and do not stop a reader. Distinguishing the three before promising anything is the copy protection assessment in miniature.
Verification Against The Footprint Problem
Because this part shares sockets and footprints across the low-density range, verification leans harder on the ID and the configuration read-back. Two independent captures of both partitions are compared word for word, the ID is read twice, and the DEVCFG words are cross-checked against the ID so the report names the die it actually saw. The reading process page describes the capture mechanics, and contact starts the job with the board or the part alone.
The Practical Summary
The 120F032B rewards a simple discipline: trust the ID, read everything, verify twice. Its interchangeability with the 110F016B is a gift to production planners and a trap for everyone reconstructing history afterwards. The recovery itself is routine — the peripherals, geometry and protection behavior are the family standard — but the identification step deserves the attention usually spent on the exotic parts, because this is exactly the slot where the wrong density assumption survives the longest unnoticed.
Part numbers across the branch are collected on the PIC32MX family page, each with its page size and pin count.