Not everything a 144-pin controller runs is inside the controller. The PIC32MZ2048ECG144 exposes a 50 MHz external bus interface and a 50 MHz serial quad interface, and board designers use both — frame buffers, parameter memory, sometimes whole application modules in external flash. When a client asks for the firmware of such a board, the first engineering question is scope: what lives in the 2 MB on-chip array, and what was deliberately placed outside it. That question shapes the whole extraction.
Drawing The On-Chip Boundary
The on-chip program array is well defined: 0x1D000000 to 0x1D1FFFFF, 128 pages of 16 KB, row-programmed in 2 KB units. Around it, 512 KB of SRAM, two 80 KB boot panels at 0x1FC00000 and 0x1FC20000, and configuration blocks at the panel tails — DEVCFG0 through 3 plus a dedicated code-protection word, mirrored by an alternate set for ECC-fault fallback. The core fetching from this array is the EC-generation microAptiv: 200 MHz, about 330 DMIPS, 16 KB instruction and 4 KB data caches, DSP accumulators, microMIPS encoding, no FPU. The G feature set means no CAN controllers and no crypto engine, which simplifies the image’s communications footprint but says nothing about what the EBI pins carry.
What the recovered binary references beyond 0x1D1FFFFF tells the reviewer where the board’s other memories sit: addresses in the EBI window indicate external RAM or flash the code expects to find; SQI command sequences indicate serial memory the bootloader may fetch from. Mapping those references is part of the deliverable, because a firmware image re-hosted without its external memory content will fault on first boot. The hex reading workflow covers how external references are catalogued and reported.
Why 144 Pins Attracts This Problem
The largest packages get the largest designs. Graphics HMI boards hang frame buffers off the EBI; gateways hang parameter storage off SQI; and the application code that manages them is substantial — two megabytes fills with real logic, not padding. Extraction reviews at this size look for the seams: linker-placed code regions, jump tables crossing panel boundaries, version strings from both flash panels after live updates. The family overview explains how the two-panel mechanism works; the practical rule is that both panels get read and compared regardless of which boot word selects.
How External References Are Reported
The catalogue of off-chip references ships as a table: address window, bus interface, access pattern, and the code region that touches it. Windows inside the EBI range with sequential access patterns indicate RAM buffers; block-structured reads through SQI indicate code or parameters fetched from serial flash at boot. Each entry gets a plain-language interpretation, because the client’s board designer usually knows the hardware but not which firmware regions depend on it. Where a window maps to memory the client’s own documentation already names, the two are linked; where nothing matches, the finding is flagged, because an unmapped reference is how forgotten daughter-cards get rediscovered.
The Protection Gate, Again
Code protection on the MZ generation is a single active-low word in the boot configuration block, separate from the four DEVCFG registers. Cleared, it closes ICSP and the 4-wire JTAG port simultaneously; the only release is a chip-erase command that destroys both panels and both config copies. Regional read fences do not exist; write protection is a boot-time software construct in flash-controller registers. Every destructive decision therefore happens after ownership verification through the services desk, never during.
Deliverables For Bus-Master Boards
A complete engagement on this part returns the verified on-chip image, a report of external-memory references with their address windows, and — where the client’s board requires it — a re-hosting plan that pairs the firmware with correctly provisioned external memories. Projects that only need the on-chip binary skip the last item; projects that need the product working again never do. The 100-pin G-variant sibling, whose design typically centers on analog acquisition instead of external buses, is covered on the 2048ECG100 page.