# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Protego

# PIC24FJ64GA0XX -- Flash Programming Specification

- 1
- 2
…
- 27
- 28
- 29
- 30
- 31
…
- 51
- 52

© 2008 Microchip Technology Inc. DS39768D-page 29
PIC24FJXXXGA0XX
4.4 Blank Check
The term “Blank Check” implies verifying that the
device has been successfully erased and has no
programmed memory locations. A blank or erased
memory location is always read as ‘1’.
The Device ID registers (FF0002h:FF0000h) can be
ignored by the Blank Check since this region stores
device information that cannot be erased. The device
Configuration registers are also ignored by the Blank
Check. Additionally, all unimplemented memory space
should be ignored by the Blank Check.
The QBLANK command is used for the Blank Check. It
determines if the code memory is erased by testing
these memory regions. A ‘BLANK’ or ‘NOT BLANK’
response is returned. If it is determined that the device
is not blank, it must be erased before attempting to
program the chip.
4.5 Code Memory Programming
4.5.1 PROGRAMMING METHODOLOGY
Code memory is programmed with the PROGP
command. PROGP programs one row of code memory
starting from the memory address specified in the
command. The number of PROGP commands
required to program a device depends on the number
of write blocks that must be programmed in the device.
A flowchart for programming code memory is shown in
Figure 4-4. In this example, all 44K instruction words of
a PIC24FJ128GA device are programmed. First, the
number of commands to send (called
‘RemainingCmds’ in the flowchart) is set to 688 and the
destination address (called ‘BaseAddress’) is set to ‘0’.
Next, one write block in the device is programmed with
a PROGP command. Each PROGP command
contains data for one row of code memory of the
PIC24FJXXXGA0XX device. After the first command is
processed successfully, ‘RemainingCmds’ is decre-
mented by 1 and compared with 0. Since there are
more PROGP commands to send, ‘BaseAddress’ is
incremented by 80h to point to the next row of memory.
On the second PROGP command, the second row is
programmed. This process is repeated until the entire
device is programmed. No special handling must be
performed when a panel boundary is crossed.
FIGURE 4-4: FLOWCHART FOR
PROGRAMMING CODE
MEMORY
Is
PROGP response
PASS?
Are
RemainingCmds
‘0’?
BaseAddress = 00h
RemainingCmds = 688
RemainingCmds =
RemainingCmds – 1
BaseAddress =
BaseAddress + 80h
No
No
Yes
Yes
Start
Failure
Report Error
Send PROGP
Command to Program
BaseAddress
Finish

- 1
- 2
…
- 27
- 28
- 29
- 30
- 31
…
- 51
- 52