# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Protego

# PIC24FJ64GA0XX -- Flash Programming Specification

- 1
- 2
…
- 40
- 41
- 42
- 43
- 44
…
- 51
- 52

PIC24FJXXXGA0XX
DS39768D-page 42 © 2008 Microchip Technology Inc.
5.4 Programming the Programming
Executive to Memory
5.4.1 OVERVIEW
If it is determined that the programming executive is
not present in executive memory (as described
in Section 4.2 “Confirming the Presence of the
Programming Executive”), it must be programmed
into executive memory using ICSP, as described in
Section 3.0 “Device Programming – ICSP”.
Storing the programming executive to executive
memory is similar to normal programming of code
memory. Namely, the executive memory must be
erased, and then the programming executive must be
programmed 64 words at a time. Erasing the last page
of executive memory will cause the FRC oscillator
calibration settings and device diagnostic data in the
Diagnostic and Calibration Words, at addresses
8007F0h to 8007FEh, to be erased. In order to retain
this calibration, these memory locations should be read
and stored prior to erasing executive memory. They
should then be reprogrammed in the last words of pro-
gram memory. This control flow is summarized in
Table 5-5.
TABLE 5-5: PROGRAMMING THE PROGRAMMING EXECUTIVE
Command
(Binary)
Data
(Hex)
Description
Step 1: Exit Reset vector and erase executive memory.
0000
0000
0000
000000
040200
000000
NOP
GOTO 0x200
NOP
Step 2: Initialize pointers to read Diagnostic and Calibration Words for storage in W6-W13.
0000
0000
0000
0000
0000
200800
880190
207F00
2000C2
000000
MOV #0x80, W0
MOV W0, TBLPAG
MOV #0x07F0, W1
MOV #0xC, W2
NOP
Step 3: Repeat this step 8 times to read Diagnostic and Calibration Words, storing them in W registers, W6-W13.
0000
0000
0000
BA1931
000000
000000
TBLRDL [W1++].[W2++]
NOP
NOP
Step 4: Initialize the NVMCON to erase executive memory.
0000
0000
240420
883B00
MOV #0x4042, W0
MOV W0, NVMCON
Step 5: Initialize Erase Pointers to first page of executive and then initiate the erase cycle.
0000
0000
0000
0000
0000
0000
0000
0000
00000
0000
200800
880190
200001
000000
BB0881
000000
000000
A8E761
000000
000000
MOV #0x80, W0
MOV W0, TBLPAG
MOV #0x0, W1
NOP
TBLWTL W1, [W1]
NOP
NOP
BSET NVMCON, #15
NOP
NOP
Step 6: Repeat this step to poll the WR bit (bit 15 of NVMCON) until it is cleared by the hardware.
0000
0000
0000
0000
0001
0000
040200
000000
803B02
883C22
000000
<VISI>
000000
GOTO 0x200
NOP
MOV NVMCON, W2
MOV W2, VISI
NOP
Clock out contents of the VISI register.
NOP

- 1
- 2
…
- 40
- 41
- 42
- 43
- 44
…
- 51
- 52