A flash dump answers for the code and the constants. It stays silent about a parallel half of the machine: what the firmware puts in RAM. On the PIC32MZ1024EFH144, with 256 KB of SRAM feeding a 252 MHz core, an 8-channel programmable DMA engine and eighteen dedicated channels behind it, the RAM-side content is substantial — buffer pools sized at boot, descriptor rings the Ethernet MAC walks on its own, calibration values written during production tests. Copying the code off this die is necessary; making a replacement board behave like the original sometimes requires reconstructing what the SRAM held at steady state.
What The Dump Captures First
The flash-side inventory is family-standard: 0x1D000000 to 0x1D0FFFFF of program flash in 16 KB pages, twin 80 KB boot panels, configuration tails with the dedicated code-protection word and its alternate mirror. The core is EF-generation hardware — microAptiv UC to 252 MHz, about 415 DMIPS, 32 KB instruction and data caches, seven-stage FPU for single and double precision — and the H suffix marks a silicon revision, not a feature difference. The family overview places this part in the full twenty-variant matrix.
The RAM Side Of The Ledger
Reconstruction starts from the binary itself: initialization code writes patterns into SRAM — buffer sizes, ring lengths, default parameter sets — and those writes are static analysis work, not guesswork. Runtime-only state cannot be lifted that way. Where a client needs it, two routes exist: instrument a running board through its legitimate diagnostic interfaces and record what the firmware maintains, or rely on the fact that most steady-state structures re-derive themselves within seconds of boot. Which route applies depends on what the state actually is, decided case by case in the scoping call. The copy workflow page explains how RAM-reconstruction findings attach to the deliverable.
Boot order matters when the map is read: channels initialized before the peripherals they serve indicate firmware that survived a redesign, and the sequencing itself sometimes documents why a board behaves the way it does under load.
Cataloguing The DMA Setup
Eight programmable channels and eighteen dedicated ones give this die a transport layer the review treats as its own subsystem. The captured image shows each channel’s setup: trigger source, pattern matching, CRC attachment, the data-size detection the dedicated channels apply automatically. Reconstructing the map matters for two client types. Integrators rebuilding a board need to know which peripheral talks to which memory region, because the arbitration the original designer chose is invisible on the schematic. Auditors need the same map for a different reason: DMA moves data outside the CPU’s view, and any review that only follows code paths misses half the traffic. The census lists every channel initialization the image performs, in boot order, with the registers each one touches.
Why The Biggest Package Gets Asked
A 144-pin EF die is the top of this selection, and boards around it are the most complex: graphics through PMP or EBI, Hi-Speed USB, Ethernet, CAN, and the analog front end of a 12-bit, 18 Msps converter with six sample-and-hold circuits. Complexity cuts both ways — more structures to reconstruct, but also more interface surface through which behavior can be observed and verified. Reviews at this size lean on that surface: boot the recovered image, watch each interface come up in the order the original board exhibited, and treat deviations as findings rather than noise.
Protection And Process
One active-low code-protection word guards the array; cleared, ICSP and 4-wire JTAG lock together and only a chip erase releases them, destroying both panels. The destructive path waits for verified ownership through the contact desk; verification and bench evidence precede any delivery, as the extraction services overview records.
The 124-pin sibling, where Ethernet descriptor layouts take the lead instead, is profiled on the 1024EFH124 page.