# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Protego

# PIC24FJ64GA0XX -- Flash Programming Specification

- 1
- 2
…
- 16
- 17
- 18
- 19
- 20
…
- 51
- 52

PIC24FJXXXGA0XX
DS39768D-page 18 © 2008 Microchip Technology Inc.
3.6 Writing Code Memory
The procedure for writing code memory is the same as
the procedure for writing the Configuration registers,
except that 64 instruction words are programmed at a
time. To facilitate this operation, working registers,
W0:W5, are used as temporary holding registers for the
data to be programmed.
Table 3-5 shows the ICSP programming details, includ-
ing the serial pattern with the ICSP command code
which must be transmitted, Least Significant bit first,
using the PGCx and PGDx pins (see Figure 3-2).
In Step 1, the Reset vector is exited. In Step 2, the
NVMCON register is initialized for programming a full
row of code memory. In Step 3, the 24-bit starting des-
tination address for programming is loaded into the
TBLPAG register and W7 register. (The upper byte of
the starting destination address is stored in TBLPAG
and the lower 16 bits of the destination address are
stored in W7.)
To minimize the programming time, A packed instruction
format is used (Figure 3-6).
In Step 4, four packed instruction words are stored in
working registers, W0:W5, using the MOV instruction,
and the Read Pointer, W6, is initialized. The contents of
W0:W5 (holding the packed instruction word data) are
shown in Figure 3-6.
In Step 5, eight TBLWT instructions are used to copy
the data from W0:W5 to the write latches of code mem-
ory. Since code memory is programmed 64 instruction
words at a time, Steps 4 and 5 are repeated 16 times to
load all the write latches (Step 6).
After the write latches are loaded, programming is
initiated by writing to the NVMCON register in Steps 7
and 8. In Step 9, the internal PC is reset to 200h. This
is a precautionary measure to prevent the PC from
incrementing into unimplemented memory when large
devices are being programmed. Lastly, in Step 10,
Steps 3-9 are repeated until all of code memory is
programmed.
FIGURE 3-6: PACKED INSTRUCTION
WORDS IN W<0:5>
15 8 7 0
W0 LSW0
W1 MSB1 MSB0
W2 LSW1
W3 LSW2
W4 MSB3 MSB2
W5 LSW3
TABLE 3-5: SERIAL INSTRUCTION EXECUTION FOR WRITING CODE MEMORY
Command
(Binary)
Data
(Hex)
Description
Step 1: Exit the Reset vector.
0000
0000
0000
000000
040200
000000
NOP
GOTO 0x200
NOP
Step 2: Set the NVMCON to program 64 instruction words.
0000
0000
24001A
883B0A
MOV #0x4001, W10
MOV W10, NVMCON
Step 3: Initialize the Write Pointer (W7) for TBLWT instruction.
0000
0000
0000
200xx0
880190
2xxxx7
MOV #<DestinationAddress23:16>, W0
MOV W0, TBLPAG
MOV #<DestinationAddress15:0>, W7
Step 4: Load W0:W5 with the next 4 instruction words to program.
0000
0000
0000
0000
0000
0000
2xxxx0
2xxxx1
2xxxx2
2xxxx3
2xxxx4
2xxxx5
MOV #<LSW0>, W0
MOV #<MSB1:MSB0>, W1
MOV #<LSW1>, W2
MOV #<LSW2>, W3
MOV #<MSB3:MSB2>, W4
MOV #<LSW3>, W5

- 1
- 2
…
- 16
- 17
- 18
- 19
- 20
…
- 51
- 52