Live update is a promise with a failure mode. The PIC32MZ1024EFM124’s dual-panel flash lets a field device rewrite itself while running from the other bank, and the promise holds only until power disappears mid-write. What remains is two panels in disagreement: the old image, the new image, and sometimes a page that belongs to neither. Extracting the binary from a part in that state is less a read than a forensic comparison — and the boot-sequence word, not the newest timestamp, decides which panel the product actually executes.
The State Machine Nobody Drew
After reset, the boot logic in the 80 KB boot panels selects a panel and starts executing. An interrupted update leaves that selection pointing at the panel the update intended to retire — or at the new one, depending on where the sequence stopped. Neither fact is visible from outside the package. The extraction therefore reads both panels in full, plus both boot banks and all four configuration contexts, and reconstructs the sequence: which pages of the target panel were written, whether the boot-sequence word was flipped, and whether the configuration copies were updated as part of the swap. Only then can anyone say what a reset will run. The family overview covers the panel mechanics.
A useful diagnostic precedes all of it: how the device behaves at power-up tells the lab which panel is live without opening anything. A node that comes up running its old behavior points one way; a node that hangs partway through boot points at a vector table half written. The observation costs nothing and calibrates what the comparison pass should expect.
Reassembling A Usable Image
The comparison pass classifies every one of the sixty-four 16 KB pages in each panel: identical in both, different, or erased in one. Identical pages pass straight into the verified image. Divergent pages get resolved by build metadata — version strings, linker stamps, interrupt-vector consistency — and a page containing half-written ECC-invalid content is excluded and flagged, because executing it is how boards brick. The output is a complete image for the panel the boot word selects, plus a report describing what the abandoned panel holds. The binary reading workflow documents the classification rules.
The Die, Quickly
EF hardware throughout: microAptiv UC at up to 252 MHz and about 415 DMIPS, 32 KB instruction and data caches, seven-stage FPU for single and double precision, dual CAN controllers and the crypto engine with TRNG — the M suffix being one of four revision letters that share this single feature set. The 1 MB array carries 256 KB of SRAM behind it. Bench verification boots the selected panel and checks that interfaces enumerate in the order the original device showed.
How The Delta Report Reads
The panel comparison ships as a page-numbered listing: identical, divergent, or excluded, with the reason for each exclusion. Divergent pages carry their build metadata side by side, version strings, timestamps and vector-table checksums, so a client’s engineer can see at a glance which panel advanced and how far the interrupted update got. Where the abandoned panel contains feature code absent from the running one, that code is disassembled and summarized separately; half-updated firmware is often the only surviving record of a fix that never fully shipped. Clients deciding between restoring the old image and completing the update use this report to make the call with evidence instead of instinct.
Protection In A Post-Failure Device
The active-low code-protection word complicates recovery from failed updates — a locked part holding a half-written image can only be released by the chip erase that also destroys the evidence, so the read must happen at the silicon level before any release attempt. That decision belongs to the owner and proceeds under documented authorization through the contact desk. The ECC-guarded configuration scheme adds its own discipline, as covered on the 1024EFM100 page.
For a part where both panels agree, the 64-pin EF profile shows the straightforward case: the 1024EFK064 page.