The 32 KB Wide J10
The PIC18F45J10 doubles the PIC18F44J10: 32 KB of program memory (0x0000-0x7FFF), 1,024 bytes of SRAM, thirteen channels of ten-bit ADC, the PMP parallel port, two MSSPs, one CCP plus one ECCP, two comparators, 40 MHz ceiling, 2.0-3.6 V supply with the VDDCORE/VCAP pin, no EEPROM, 1,000-cycle flash endurance.
Lock And Sweep
PIC18 configuration at 0x300000: CP0/CP1, WRT, boot-block bits; ID at 0x3FFFFE. Sweep:
– Array: 0x0000-0x7FFF, 0x0000 under CP. – Configuration: 0x300000 window. – ID: 0x3FFFFE-0x3FFFFF.
Image Anatomy
The parallel-port interface and the dual MSSPs define the init block; the ECCP handles the board’s PWM with auto-shutdown wiring. The 1 KB SRAM keeps everything fixed-size. Emulated-EEPROM parameter blocks, where the application persists data, sit near the array top and are delivered as their own annotated table.
The Session
Identify, read the configuration window, sweep 0x0000-0x7FFF, verify decoding. Nothing is erased; the part returns to service. Lock policy documented as found.
Deliverables
HEX file, annotated disassembly with the parallel and control regions labeled, configuration report, checksum tied to the die. For the XLP successor at the same size, see the PIC18F45J11 page.
Erase Blocks And What A Reprogram Costs
The 45J10 erases in 1 KB blocks and writes in 64-byte rows, so a 32 KB array is thirty-two independently erasable regions. That granularity matters after a recovery, not during it: when a client takes the recovered image and flashes a replacement, every self-write routine in the code has to be told the same block size or the parameter store lands in the wrong place. The datasheet endurance figure is 1,000 erase/write cycles per block, which is low by modern standards and is the reason so many boards built on this part show a worn low block and a pristine remainder.
Bench Setup For A 40-Pin J10
The J10 family has no internal regulator bypass option on the 28-pin members, but the 40 and 44-pin parts route the core supply out to VDDCORE and require a 100 nF capacitor on VCAP. Probing a board where that capacitor has failed gives a part that appears dead at every address; check VCAP before concluding anything about the die. Programming access is the standard five-line ICSP header – MCLR, VDD, VSS, PGD, PGC – and on most industrial boards it is left unpopulated but still routed.
– Array: 0x0000-0x7FFF for the 32 KB member, 0x3FFF per erased word. – Configuration: 0x300000-0x300007. – ID: 0x3FFFFE-0x3FFFFF.
Reading A Part That Has Been In The Field
Field-returned 45J10s carry two common histories. The first is a firmware update that was interrupted, leaving a half-written block whose checksum no longer matches the rest of the image; the read succeeds but the disassembly shows a gap. The second is deliberate protection applied late in production, after the part had already been programmed and tested unprotected. In that case the configuration bytes show a protect bit set in a revision that also has stale write-protect bits, and the report has to record both states so the client understands what was locked and when.
Handover Notes
The image is delivered as HEX at word addresses with a memory-map summary that names each 1 KB block and its content class – vectors, application, constant tables, self-write buffer. Where the original design used the parallel master port, the PMP configuration registers are decoded in the report, because the pin assignment encoded there is not recoverable from the code alone. Protection is left as found and the part goes back without modification.
Delivery
The 1 KB block map is printed with a content class per block. On a 32 KB part that map is the fastest way for a client to see whether the recovered image matches the memory layout their linker script expects.
To schedule a 45J10 recovery, write to the services desk or the contact form.