Secured Microprocessor PIC18F8585 Read Out Heximal is a microcontroller reverse engineering process, which can help engineer to extract the firmware out from MCU’s memory include flash and eeprom;

Since the register pair is 16 bits wide, counting up to overflow the register directly from a 32.768 kHz clock would take 2 seconds. To force the overflow at the required one-second intervals, it is necessary to preload it; the simplest method is to set the MSb of TMR1H with a BSF instruction. Note that the TMR1L register is never preloaded or altered; doing so may introduce cumulative error over many cycles. For this method to be accurate, Timer1 must operate in Asynchronous mode and the Timer1 overflow interrupt must be enabled (PIE1<0> = 1), as shown in the
routine, RTCinit. The Timer1 oscillator must also be enabled and running at all times when copy firmware from MCU pic18f2320 eeprom.

The Timer2 module timer incorporates the following features:

• 8-bit timer and period registers (TMR2 and PR2, respectively)

• Readable and writable (both registers)
• Software programmable prescaler (1:1, 1:4 and 1:16)
• Software programmable postscaler (1:1 through 1:16)

• Interrupt on TMR2-to-PR2 match
• Optional use as the shift clock for the MSSP module

The module is controlled through the T2CON register (Register 13-1), which enables or disables the timer and configures the prescaler and postscaler. Timer2 can be shut off by clearing control bit, TMR2ON (T2CON<2>), to minimize power consumption. A simplified block diagram of the module is shown in Figure 13-1.In normal operation, TMR2 is incremented from 00h on each clock (FOSC/4). A 4-bit counter/prescaler on the clock input gives direct input, divide-by-4 and divide-by-16 prescale options; these are selected by the prescaler control bits, T2CKPS1:T2CKPS0 (T2CON<1:0>) if the code of microcontroller PIC18F2321 can be read out.

The value of TMR2 is compared to that of the period register, PR2, on each clock cycle. When the two values match, the comparator generates a match signal as the timer output. This signal also resets the value of TMR2 to 00h on the next cycle and drives the output counter/postscaler (see Section 13.2 “Timer2 Interrupt”). The TMR2 and PR2 registers are both directly readable and writable. The TMR2 register is cleared on any device Reset, while the PR2 register initializes at FFh. Both the prescaler and postscaler counters are cleared on the following events:
• a write to the TMR2 register
• a write to the T2CON register
• any device Reset (Power-on Reset, MCLR Reset,
Watchdog Timer Reset or Brown-out Reset) TMR2 is not cleared when T2CON is written.