# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Protego

# PIC24FJ64GA0XX -- Flash Programming Specification

- 1
- 2
…
- 19
- 20
- 21
- 22
- 23
…
- 51
- 52

© 2008 Microchip Technology Inc. DS39768D-page 21
PIC24FJXXXGA0XX
3.7 Writing Configuration Words
The PIC24FJXXXGA0XX family configuration is stored
in Flash Configuration Words at the end of the user
space program memory and in multiple register
Configuration Words located in the test space.
These registers reflect values read at any Reset from
program memory locations. The values can be changed
only by programming the content of the corresponding
Flash Configuration Word and resetting the device. The
Reset forces an automatic reload of the Flash stored
configuration values by sequencing through the
dedicated Flash Configuration Words and transferring
the data into the Configuration registers. To change the
values of the Flash Configuration Word once it has been
programmed, the device must be Chip Erased, as
described in Section 3.5 “Erasing Program Memory”,
and reprogrammed to the desired value. It is not
possible to program a ‘0’ to ‘1’, but they may be
programmed from a ‘1’ to ‘0’ to enable code protection.
Table 3-7 shows the ICSP programming details for pro-
gramming the Configuration Word locations, including
the serial pattern with the ICSP command code which
must be transmitted, Least Significant bit first, using the
PGCx and PGDx pins (see Figure 3-2).
In Step 1, the Reset vector is exited. In Step 2, the
NVMCON register is initialized for programming of
code memory. In Step 3, the 24-bit starting destination
address for programming is loaded into the TBLPAG
register and W7 register.
The TBLPAG register must be loaded with the
following:
• 96 and 64 Kbyte devices – 00h
• 128 Kbyte devices – 01h
To verify the data by reading the Configuration Words
after performing the write in order, the code protection
bits initially should be programmed to a ‘1’ to ensure
that the verification can be performed properly. After
verification is finished, the code protection bit can be
programmed to a ‘0’ by using a word write to the
appropriate Configuration Word.
TABLE 3-6: DEFAULT CONFIGURATION
REGISTER VALUES
Address Name Default Value
Last Word CW1 7FFFh
(1)
Last Word – 2 CW2 FFFFh
Note 1: CW1<15> is reserved and must be
programmed to ‘0’.

- 1
- 2
…
- 19
- 20
- 21
- 22
- 23
…
- 51
- 52