Network-connected controllers leave fingerprints. The PIC32MZ1024EFH124 pairs a 10/100 Ethernet MAC with 1 MB of program flash, and boards built around it — gateways, industrial endpoints, building controllers — carry images whose structure betrays the stack inside: constant descriptor rings, protocol constant pools, and clock-configuration code tuned for a 25 MHz reference. Recognizing that anatomy speeds up everything after the read, because the reviewer knows which regions carry the interface contract the client usually needs most.
Reading The Array
Program flash spans 0x1D000000 to 0x1D0FFFFF: sixty-four pages of 16 KB, row-programmed in 2 KB units. The complete capture takes the array, the twin 80 KB boot panels at 0x1FC00000 and 0x1FC20000, and both configuration tails — DEVCFG0 through 3, the dedicated code-protection word, and the alternate mirror set that backs them up under ECC faults. Ethernet descriptor rings typically sit in SRAM at runtime, but their layouts, buffer counts and the PHY-management code live in flash and survive the capture; the MAC’s MII-versus-RMII mode selection, set in configuration-adjacent registers at boot, is one of the details the review reports because it decides what physical interface a re-hosted board must provide. The firmware reading pipeline lists what an Ethernet-flavored report contains.
The Die And Its Generation
EF parts run the microAptiv UC core to 252 MHz and about 415 DMIPS with a seven-stage FPU — single and double precision — plus equal-sized 32 KB caches. The H suffix marks a silicon revision, not a feature set: every EF letter carries the same hardware, including dual CAN controllers and the crypto engine, which frequently sit unused on Ethernet-centric boards. Behind the 1 MB array sit 256 KB of SRAM and the PPS remapping that lets the MAC pins land wherever the board layout put them. The family overview holds the full naming table.
Why 124 Pins Matters
The mid-size VTLA package of this die usually means a dense board: Ethernet magnetics, CAN transceivers, sometimes a display driven through PMP. Dense boards complicate physical access for any extraction route that needs it, and they raise the cost of mistakes — a damaged 124-pin VTLA is not a plug-in replacement. That practical pressure shapes the engagement: unlocked spares are read directly; locked units wait for documented authorization through the services desk before any invasive step is scheduled.
PHY Detail Worth Capturing
Ethernet brings one configuration decision the report always documents: MII or RMII, decided in the MAC’s interface configuration and reflected in which pins the board routed. The distinction matters when re-hosting, because a replacement board wired for RMII will not negotiate with firmware that initializes MII, and the failure is silent except for a link that never comes up. Alongside it, the census records PHY management code, autonegotiation setup, and the clock source feeding the MAC, since EF designs derive it from the PLL tree in more than one way. For clients rebuilding discontinued boards, this short section of the report prevents the most common first-boot surprise.
Auto-negotiation advertising is the last item in the section. It compiles into a handful of constants, but it decides what the board promises its link partner, and mismatches surface as intermittent half-duplex behavior that looks like a hardware fault. The report quotes the advertised abilities verbatim.
Verification Before Delivery
Checksums page by page; vector-table and jump-target sanity; a parse of the network regions into descriptor layouts and constant pools; and a boot test with the MAC interface looped or observed on a reference board. Configuration words get their ECC-context validation as a separate line item. The deliverable pairs the verified binary with the parsed report, because for network nodes the protocol behavior — IDs, endpoints, buffer sizing — is usually worth as much as the code. The contact desk handles intake and scoping.
The 144-pin sibling with more SRAM-intensive duties is treated on the 1024EFH144 page, where RAM-segment reconstruction takes the lead.