# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Protego

# PIC24FJ64GA0XX -- Flash Programming Specification

- 1
- 2
…
- 33
- 34
- 35
- 36
- 37
…
- 51
- 52

© 2008 Microchip Technology Inc. DS39768D-page 35
PIC24FJXXXGA0XX
FIGURE 5-3: PROGRAMMING EXECUTIVE – PROGRAMMER COMMUNICATION PROTOCOL
5.2 Programming Executive
Commands
The programming executive command set is shown in
Table 5-1. This table contains the opcode, mnemonic,
length, time-out and description for each command.
Functional details on each command are provided in
Section 5.2.4 “Command Descriptions”.
5.2.1 COMMAND FORMAT
All programming executive commands have a general
format consisting of a 16-bit header and any required
data for the command (see Figure 5-4). The 16-bit
header consists of a 4-bit opcode field, which is used to
identify the command, followed by a 12-bit command
length field.
FIGURE 5-4: COMMAND FORMAT
The command opcode must match one of those in the
command set. Any command that is received which
does not match the list in Table 5-1 will return a “NACK”
response (see Section 5.3.1.1 “Opcode Field”).
The command length is represented in 16-bit words
since the SPI operates in 16-bit mode. The program-
ming executive uses the command length field to
determine the number of words to read from the SPI
port. If the value of this field is incorrect, the command
will not be properly received by the programming
executive.
5.2.2 PACKED DATA FORMAT
When 24-bit instruction words are transferred across
the 16-bit SPI interface, they are packed to conserve
space using the format shown in Figure 5-5. This
format minimizes traffic over the SPI and provides the
programming executive with data that is properly
aligned for performing table write operations.
FIGURE 5-5: PACKED INSTRUCTION
WORD FORMAT
5.2.3 PROGRAMMING EXECUTIVE
ERROR HANDLING
The programming executive will “NACK” all
unsupported commands. Additionally, due to the
memory constraints of the programming executive, no
checking is performed on the data contained in the
programmer command. It is the responsibility of the
programmer to command the programming executive
with valid command arguments or the programming
operation may fail. Additional information on error
handling is provided in Section 5.3.1.3 “QE_Code
Field”.
1 2 15 16
1 2 15 16
PGCx
PGDx
PGCx = Input
PGCx = Input (Idle)
Host Transmits
Last Command Word
PGDx = Input
PGDx = Output
P8
1 2 15 16
MSB X X X LSB
MSB X X X LSB
MSB X X X LSB
1 0
P20
PGCx = Input
PGDx = Output
P9
Programming Executive
Processes Command
Host Clocks Out Response
P21
15 12 11 0
Opcode Length
Command Data First Word (if required)
•
•
Command Data Last Word (if required)
Note: When the number of instruction words
transferred is odd, MSB2 is zero and
LSW2 can not be transmitted.
15 8 7 0
LSW1
MSB2 MSB1
LSW2
LSWx: Least Significant 16 bits of instruction word
MSBx: Most Significant Bytes of instruction word

- 1
- 2
…
- 33
- 34
- 35
- 36
- 37
…
- 51
- 52