A single-panel microcontroller gives you one firmware image and one obvious answer. The PIC32MZ2048ECG064 refuses to be that simple. Its 2 MB program flash is physically split into two independent panels, and the live-update mechanism Microchip built into this generation means the running firmware may occupy either one — or, after an interrupted update, a mixture of both. Copying the program off this die is therefore a stitching exercise before it is anything else.
Two Panels, One Logical Array
From the core’s viewpoint the array is contiguous from 0x1D000000 to 0x1D1FFFFF. Physically, erase and program operations address panel 0 and panel 1 separately, and the boot panels — two 80 KB banks at 0x1FC00000 and 0x1FC20000 — hold the swap logic that decides which panel executes after reset. A field-updated device frequently runs its newest image in the panel the original build never touched, while the old image sits dormant in the other. Reading only the currently selected panel can therefore return obsolete code; reading both and comparing timestamps, build strings and vector tables identifies which panel the product actually shipped with. The family overview diagrams the swap.
What 2 MB Changes
The arithmetic of the larger die shows up in the recovered content. Two megabytes at 16 KB pages is 128 pages; row programming moves 2 KB at a time. Applications that fill an array this size — graphics buffers for PMP-driven displays, audio processing on the DSP-enhanced microAptiv core with its four 64-bit accumulators, protocol stacks for the Hi-Speed USB and Ethernet MAC — leave dense, structured regions rather than the tight code clusters of small parts. Recognition of those structures speeds up the functional review that follows any read.
The core itself stays family-standard: 200 MHz, roughly 330 DMIPS, five-stage pipeline, 16 KB instruction and 4 KB data caches, microMIPS encoding, no floating point unit. The G letter on this part means the dual CAN controllers and the crypto engine are absent — a point that matters when a client expects to find encryption key material behind a hardware cipher and there is no hardware cipher to look behind.
Building The Stitched Image
The working sequence runs: read both panels at full depth; read both boot banks including the configuration tails; identify the active panel from the boot sequence word; concatenate and de-duplicate any shared read-only regions; verify page checksums across the assembled 2 MB; then bench-test on a known-good board. Where an interrupted update left panels disagreeing mid-page, the newer version is reconstructed by taking the union of valid pages and confirming that no referenced address lands in a gap. It is meticulous work, and the copy workflow page documents the acceptance criteria each stitched image has to meet before delivery.
Verification Load At 128 Pages
Two megabytes doubles the page count the checksum pass walks, and the difference shows in how anomalies cluster. Read faults on this part tend to localize, one panel marginal and the other clean, which itself is diagnostic information about the fixture or the die. The workflow records per-page results separately for each panel, so a marginal contact shows as a column of retries rather than a smear across the whole image. Verification time is real but bounded, and the assembled image carries a combined manifest that the re-flash step consumes directly.
The Protection Gate
As on every MZ part, code protection is a single active-low word in the boot-panel configuration block, not a field inside DEVCFG0. When it is cleared, ICSP and the 4-wire JTAG port close together; the only release command is the full chip erase, which takes both panels and both config copies with it. There is no partial read path and no regional read fence. That binary reality frames every conversation at the start of an engagement: either the device is unlocked and the panels read directly, or the protection must be addressed at the silicon level under proper authorization, arranged through the service desk.
A 1 MB G-variant sibling is analyzed on the 1024ECG064 page, and the panel-swap corner cases particular to EF-generation parts appear on the 1024EFM124 page.