Microcontroller reverse engineer
Microcontroller reverse engineer
Everything they make, We can break! 
Disassembler Software   
World first mcu hack company
In business since 1998
Reversed tens of thousands of chips
Copied thousands of pcbs
Foreseen all pertential problems
Integrity with payments
crack ic
Atmel MCU Reverse Engineer

Atmel Corporation is an American manufacturer of semiconductors, founded in 1984. The company focuses on embedded system-level solutions built around flash microcontrollers. Its products include microcontrollers (8-bit AVR, 32-bit AVR, ARM-based, automotive grade, and 8051 derivatives,) radio frequency (RF) devices including Wi-fi, EEPROM, and flash memory devices, symmetric and asymmetric security chips, touch sensors and controllers, and a number of application-specific products.

Atmel supplies its devices as standard products, ASICs, or ASSPs depending on the requirements of its customers. Atmel serves a range of applications including consumer, communications, computer networking, industrial, medical, automotive, aerospace and military. It is an industry leader in microcontroller and touch systems, notably for embedded systems.

Atmel’s corporate headquarters is in San Jose California. It has large locations in Trondheim, Norway, Colorado Springs, Colorado, Chennai, India, Shanghai, China, Taipei, Taiwan, Rousset, France, Heilbronn, Germany, Whiteley, UK and Munich, Germany, in addition to a number of other worldwide sites. Atmel is pursuing a “fab-lite” strategy, making much of its product line at vendor fabs. It owns a facility in Colorado Springs that manufactures its XSense line of flexible touch sensors.

  • Mikatech Atmel MCU reverse engineer list:
  • AT89xx whole series microcontroller crack: AT89C51 AT89C52 AT89S52 AT89S53 AT89S54 AT89S58 AT89S64 AT89C1051 AT89C2051 AT89C4051 AT89C55 AT89C55WD AT89C5131A AT89C51WD AT89C51ED2 AT89C51CC01 AT89S51 AT89C51CC02 AT89C51CC03 AT89C51RB2 AT89C51RC AT89C51RD2 AT89C51RD-CM AT89C51RC2 AT89C51ID2 AT87C5101 AT89C1051U AT89C2051X2 AT89C5130AM AT89C5130A AT89C5131AL AT89C5131AM AT89C51AC3 AT89C5132 AT89C51AC2 AT89C51CC03C AT89C51SND1C AT89C51CC03U AT89C51IC2 AT89C51RE2 AT89C51SND2 AT89LP2051 AT89LP2052 AT89LP213 AT89LP214 AT89LP216 AT89LP4051 AT89LP4052 AT89LP828 AT89LP428 AT89LS51 AT89LS52 AT89LV51 AT89LS53 AT89LS8252 AT89LV52 AT89LV55 AT89S2051 AT89S4051 AT89S8252 AT89S8253 ...

  • AT90xx whole series microcontroller crack: AT90S1200 AT90S2323 AT90S2343 AT90S2331 AT90S4433 AT90S8515 AT90S8535 AT90S4414 AT90S4434 AT90S2313 90S1200 90S2323 90S2343 90S2331 90S4433 90S8515 90S8535 90S4414 90S4434 90S2313 ...

  • AT90CAN/PWM/USB/xx whole series microcontroller read: AT90CAN32 AT90CAN64 AT90CAN128 AT90PWM2 AT90PWM216 AT90PWM2B AT90PWM3 AT90PWM316 AT90PWM3B AT90USB1286 AT90USB1287 AT90USB162 AT90USB646 AT90USB647 AT90USB82 ...
  • AT91SAMxx whole series microcontroller firmware crack: AT91SAM9XE512 AT91SAM9XE256 AT91SAM9XE128 AT91SAM7S64B AT91SAM7S32B AT91SAM7SE512 AT91SAM7SE256 AT91SAM7SE32 AT91SAM7XC512 AT91SAM7XC256 AT91SAM7XC128 AT91SAM7X512 AT91SAM7X256 AT91SAM7X128 AT91SAM7S161 AT91SAM7S512 AT91SAM7S256 AT91SAM7S128 AT91SAM7S64 AT91SAM7S321 ...

  • ATTinyxx whole series microcontroller firmware crack: ATtiny4 ATtiny5 ATtiny10 ATtiny11 ATtiny12 ATtiny13 ATtiny15 ATtiny20 ATtiny22 ATtiny24 ATtiny25 ATtiny26 ATtiny261 ATtiny28 ATtiny2313 ATtiny40 ATtiny4313 ATtiny43 ATtiny44 ATtiny45 ATtiny461 ATtiny48 ATtiny84 ATtiny85 ATtiny861 ATtiny87 ATtiny88 ATtiny4A ATtiny5A ATtiny10A ATtiny11A ATtiny12A ATtiny13A ATtiny15A ATtiny20A ATtiny22A ATtiny24A ATtiny25A ATtiny26A ATtiny261A ATtiny28A ATtiny2313A ATtiny40A ATtiny4313A ATtiny43A ATtiny44A ATtiny45A ATtiny461A ATtiny48A ATtiny84A ATtiny85A ATtiny861A ATtiny87A ATtiny88A ATtiny4V ATtiny5V ATtiny10V ATtiny11V ATtiny12V ATtiny13V ATtiny15V ATtiny20V ATtiny22V ATtiny24V ATtiny25V ATtiny26V ATtiny261V ATtiny28V ATtiny2313V ATtiny40V ATtiny4313V ATtiny43V ATtiny44V ATtiny45V ATtiny461V ATtiny48V ATtiny84V ATtiny85V ATtiny861V ATtiny87V ATtiny88V ...

  • ATMegaxx whole series microcontroller crack: ATmega16 ATmega162 ATmega164 ATmega165 ATmega168 ATmega169 ATmega128 ATmega1280 ATmega1281 ATmega2560 ATmega2561 ATmega328 ATmega48 ATmega32 ATmega324 ATmega325 ATmega3250 ATmega329 ATmega3290 ATmega64 ATmega640 ATmega645 ATmega6450 ATmega649 ATmega6490 ATmega8 ATmega88 ATmega8515 ATmega8535 ATmega16L ATmega162L ATmega164L ATmega165L ATmega168L ATmega169L ATmega128L ATmega1280L ATmega1281L ATmega2560L ATmega2561L ATmega328L ATmega48L ATmega32L ATmega324L ATmega325L ATmega3250L ATmega329L ATmega3290L ATmega64L ATmega640L ATmega645L ATmega6450L ATmega649L ATmega6490L ATmega8L ATmega88L ATmega8515L ATmega8535L ATmega16P ATmega162P ATmega164P ATmega165P ATmega168P ATmega169P ATmega128P ATmega1280P ATmega1281P ATmega2560P ATmega2561P ATmega328P ATmega48P ATmega32P ATmega324P ATmega325P ATmega3250P ATmega329P ATmega3290P ATmega64P ATmega640P ATmega645P ATmega6450P ATmega649P ATmega6490P ATmega8P ATmega88P ATmega16A ATmega162A ATmega164A ATmega165A ATmega168A ATmega169A ATmega128A ATmega1280A ATmega1281A ATmega2560A ATmega2561A ATmega328A ATmega48A ATmega32A ATmega324A ATmega325A ATmega3250A ATmega329A ATmega3290A ATmega64A ATmega640A ATmega645A ATmega6450A ATmega649A ATmega6490A ATmega8A ATmega88A ATmega8515A ATmega8535A ...


  • AT88scxx/90scxx series microcontroller crack: AT88SC0104 AT88SC0104C AT88SC0204 AT88SC0204C AT88SC0404 AT88SC0404C AT88SC0808 AT88SC0808C AT88SC1003 AT88SC101 AT88SC102 AT88SC1281 AT88SC12816C AT88SC150 AT88SC153 ...



Atmel AVR

Atmel ATmega8 in 28-pin narrow DIPThe AVR is a modified Harvard architecture 8-bit RISC single chip microcontroller which was developed by Atmel in 1996. The AVR was one of the first microcontroller families to use on-chip flash memory for program storage, as opposed to one-time programmable ROM, EPROM, or EEPROM used by other microcontrollers at the time.

Brief history[edit source | editbeta]The AVR architecture was conceived by two students at the Norwegian Institute of Technology (NTH) Alf-Egil Bogen and Vegard Wollan.[1][2]

The original AVR MCU was developed at a local ASIC house in Trondheim, Norway called Nordic VLSI at the time, now Nordic Semiconductor, where Bogen and Wollan were working as students.[citation needed] It was known as a μRISC (Micro RISC)[citation needed] and was available as silicon IP/building block from Nordic VLSI.[citation needed] When the technology was sold to Atmel from Nordic VLSI,[citation needed] the internal architecture was further developed by Bogen and Wollan at Atmel Norway, a subsidiary of Atmel. The designers worked closely with compiler writers at IAR Systems to ensure that the instruction set provided for more efficient compilation of high-level languages.[3] Atmel says that the name AVR is not an acronym and does not stand for anything in particular. The creators of the AVR give no definitive answer as to what the term "AVR" stands for.[2] However, it is commonly accepted that AVR stands for Alf (Egil Bogen) and Vegard (Wollan)'s RISC processor.[4]

Note that the use of "AVR" in this article generally refers to the 8-bit RISC line of Atmel AVR Microcontrollers.

Among the first of the AVR line was the AT90S8515, which in a 40-pin DIP package has the same pinout as an 8051 microcontroller, including the external multiplexed address and data bus. The polarity of the RESET line was opposite (8051's having an active-high RESET, while the AVR has an active-low RESET), but other than that, the pinout was identical.

Device overview[edit source | editbeta]The AVR is a modified Harvard architecture machine where program and data are stored in separate physical memory systems that appear in different address spaces, but having the ability to read data items from program memory using special instructions.

Basic families[edit source | editbeta]AVRs are generally classified into six broad groups:

tinyAVR — the ATtiny series
0.5–16 kB program memory
6–32-pin package
Limited peripheral set
megaAVR — the ATmega series
4–512 kB program memory
28–100-pin package
Extended instruction set (multiply instructions and instructions for handling larger program memories)
Extensive peripheral set
XMEGA — the ATxmega series
16–384 kB program memory
44–64–100-pin package (A4, A3, A1)
Extended performance features, such as DMA, "Event System", and cryptography support.
Extensive peripheral set with ADCs
Application-specific AVR
megaAVRs with special features not found on the other members of the AVR family, such as LCD controller, USB controller, advanced PWM, CAN, etc.
FPGA 5K to 40K gates
SRAM for the AVR program code, unlike all other AVRs
AVR core can run at up to 50 MHz [5]
32-bit AVRs
Main article: AVR32
In 2006 Atmel released microcontrollers based on the new, 32-bit, AVR32 architecture. They include SIMD and DSP instructions, along with other audio and video processing features. This 32-bit family of devices is intended to compete with the ARM based processors. The instruction set is similar to other RISC cores, but it is not compatible with the original AVR or any of the various ARM cores.
Device architecture[edit source | editbeta]Flash, EEPROM, and SRAM are all integrated onto a single chip, removing the need for external memory in most applications. Some devices have a parallel external bus option to allow adding additional data memory or memory-mapped devices. Almost all devices (except the smallest TinyAVR chips) have serial interfaces, which can be used to connect larger serial EEPROMs or flash chips.

Program memory[edit source | editbeta]Program instructions are stored in non-volatile flash memory. Although the MCUs are 8-bit, each instruction takes one or two 16-bit words.

The size of the program memory is usually indicated in the naming of the device itself (e.g., the ATmega64x line has 64 kB of flash while the ATmega32x line has 32 kB).

There is no provision for off-chip program memory; all code executed by the AVR core must reside in the on-chip flash. However, this limitation does not apply to the AT94 FPSLIC AVR/FPGA chips.

Internal data memory[edit source | editbeta]The data address space consists of the register file, I/O registers, and SRAM.

Internal registers[edit source | editbeta]
Atmel ATxmega128A1 in 100-pin TQFP packageThe AVRs have 32 single-byte registers and are classified as 8-bit RISC devices.

In most variants of the AVR architecture, the working registers are mapped in as the first 32 memory addresses (000016–001F16) followed by the 64 I/O registers (002016–005F16).

Actual SRAM starts after these register sections (address 006016). (Note that the I/O register space may be larger on some more extensive devices, in which case the memory mapped I/O registers will occupy a portion of the SRAM address space.)

Even though there are separate addressing schemes and optimized opcodes for register file and I/O register access, all can still be addressed and manipulated as if they were in SRAM.

In the XMEGA variant, the working register file is not mapped into the data address space; as such, it is not possible to treat any of the XMEGA's working registers as though they were SRAM. Instead, the I/O registers are mapped into the data address space starting at the very beginning of the address space. Additionally, the amount of data address space dedicated to I/O registers has grown substantially to 4096 bytes (000016–0FFF16). As with previous generations, however, the fast I/O manipulation instructions can only reach the first 64 I/O register locations (the first 32 locations for bitwise instructions). Following the I/O registers, the XMEGA series sets aside a 4096 byte range of the data address space which can be used optionally for mapping the internal EEPROM to the data address space (100016–1FFF16). The actual SRAM is located after these ranges, starting at 200016.

EEPROM[edit source | editbeta]Almost all AVR microcontrollers have internal EEPROM for semi-permanent data storage. Like flash memory, EEPROM can maintain its contents when electrical power is removed.

In most variants of the AVR architecture, this internal EEPROM memory is not mapped into the MCU's addressable memory space. It can only be accessed the same way an external peripheral device is, using special pointer registers and read/write instructions which makes EEPROM access much slower than other internal RAM.

However, some devices in the SecureAVR (AT90SC) family [6] use a special EEPROM mapping to the data or program memory depending on the configuration. The XMEGA family also allows the EEPROM to be mapped into the data address space.

Since the number of writes to EEPROM is not unlimited — Atmel specifies 100,000 write cycles in their datasheets — a well designed EEPROM write routine should compare the contents of an EEPROM address with desired contents and only perform an actual write if the contents need to be changed.

Note that erase and write can be performed separately in many cases, byte-by-byte, which may also help prolong life when bits only need to be set to all 1s (erase) or selectively cleared to 0s (write).

Program execution[edit source | editbeta]Atmel's AVRs have a two stage, single level pipeline design. This means the next machine instruction is fetched as the current one is executing. Most instructions take just one or two clock cycles, making AVRs relatively fast among the eight-bit microcontrollers.

The AVR processors were designed with the efficient execution of compiled C code in mind and have several built-in pointers for the task.

Instruction set[edit source | editbeta]Main article: Atmel AVR instruction set
The AVR instruction set is more orthogonal than those of most eight-bit microcontrollers, in particular the 8051 clones and PIC microcontrollers with which AVR competes today. However, it is not completely regular:

Pointer registers X, Y, and Z have addressing capabilities that are different from each other.
Register locations R0 to R15 have different addressing capabilities than register locations R16 to R31.
I/O ports 0 to 31 have different addressing capabilities than I/O ports 32 to 63.
CLR affects flags, while SER does not, even though they are complementary instructions. CLR set all bits to zero and SER sets them to one. (Note that CLR is pseudo-op for EOR R, R; and SER is short for LDI R,$FF. Math operations such as EOR modify flags while moves/loads/stores/branches such as LDI do not.)
Accessing read-only data stored in the program memory (flash) requires special LPM instructions; the flash bus is otherwise reserved for instruction memory.
Additionally, some chip-specific differences affect code generation. Code pointers (including return addresses on the stack) are two bytes long on chips with up to 128 kBytes of flash memory, but three bytes long on larger chips; not all chips have hardware multipliers; chips with over 8 kBytes of flash have branch and call instructions with longer ranges; and so forth.

The mostly regular instruction set makes programming it using C (or even Ada) compilers fairly straightforward. GCC has included AVR support for quite some time, and that support is widely used. In fact, Atmel solicited input from major developers of compilers for small microcontrollers, to determine the instruction set features that were most useful in a compiler for high-level languages.

MCU speed[edit source | editbeta]The AVR line can normally support clock speeds from 0 to 20 MHz, with some devices reaching 32 MHz. Lower powered operation usually requires a reduced clock speed. All recent (Tiny, Mega, and Xmega, but not 90S) AVRs feature an on-chip oscillator, removing the need for external clocks or resonator circuitry. Some AVRs also have a system clock prescaler that can divide down the system clock by up to 1024. This prescaler can be reconfigured by software during run-time, allowing the clock speed to be optimized.

Since all operations (excluding literals) on registers R0 - R31 are single cycle, the AVR can achieve up to 1 MIPS per MHz, i.e. an 8 MHz processor can achieve up to 8 MIPS. Loads and stores to/from memory take two cycles, branching takes two cycles. Branches in the latest "3-byte PC" parts such as ATmega2560 are one cycle slower than on previous devices.

Development[edit source | editbeta]
Atmel STK500 development boardAVRs have a large following due to the free and inexpensive development tools available, including reasonably priced development boards and free development software. The AVRs are sold under various names that share the same basic core, but with different peripheral and memory combinations. Compatibility between chips in each family is fairly good, although I/O controller features may vary.

See external links for sites relating to AVR development.

Features[edit source | editbeta]Current[when?] AVRs offer a wide range of features:

Multifunction, bi-directional general-purpose I/O ports with configurable, built-in pull-up resistors
Multiple internal oscillators, including RC oscillator without external parts
Internal, self-programmable instruction flash memory up to 256 kB (384 kB on XMega)
In-system programmable using serial/parallel low-voltage proprietary interfaces or JTAG
Optional boot code section with independent lock bits for protection
On-chip debugging (OCD) support through JTAG or debugWIRE on most devices
The JTAG signals (TMS, TDI, TDO, and TCK) are multiplexed on GPIOs. These pins can be configured to function as JTAG or GPIO depending on the setting of a fuse bit, which can be programmed via ISP or HVSP. By default, AVRs with JTAG come with the JTAG interface enabled.
debugWIRE uses the /RESET pin as a bi-directional communication channel to access on-chip debug circuitry. It is present on devices with lower pin counts, as it only requires one pin.
Internal data EEPROM up to 4 kB
Internal SRAM up to 16 kB (32 kB on XMega)
External 64 kB little endian data space on certain models, including the Mega8515 and Mega162.
The external data space is overlaid with the internal data space, such that the full 64 kB address space does not appear on the external bus and accesses to e.g. address 010016 will access internal RAM, not the external bus.
In certain members of the XMega series, the external data space has been enhanced to support both SRAM and SDRAM. As well, the data addressing modes have been expanded to allow up to 16 MB of data memory to be directly addressed.
AVRs generally do not support executing code from external memory. Some ASSPs using the AVR core do support external program memory.
8-bit and 16-bit timers
PWM output (some devices have an enhanced PWM peripheral which includes a dead-time generator)
Input capture that record a time stamp triggered by a signal edge
Analog comparator
10 or 12-bit A/D converters, with multiplex of up to 16 channels
12-bit D/A converters
A variety of serial interfaces, including
I²C compatible Two-Wire Interface (TWI)
Synchronous/asynchronous serial peripherals (UART/USART) (used with RS-232, RS-485, and more)
Serial Peripheral Interface Bus (SPI)
Universal Serial Interface (USI) for two or three-wire synchronous data transfer
Brownout detection
Watchdog timer (WDT)
Multiple power-saving sleep modes
Lighting and motor control (PWM-specific) controller models
CAN controller support
USB controller support
Proper full-speed (12 Mbit/s) hardware & Hub controller with embedded AVR.
Also freely available low-speed (1.5 Mbit/s) (HID) bitbanging software emulations
Ethernet controller support
LCD controller support
Low-voltage devices operating down to 1.8 V (to 0.7 V for parts with built-in DC–DC upconverter)
picoPower devices
DMA controllers and "event system" peripheral communication.
Fast cryptography support for AES and DES
Programming interfaces[edit source | editbeta]There are many means to load program code into an AVR chip. The methods to program AVR chips varies from AVR family to family.

ISP[edit source | editbeta]
6- and 10-pin ISP header diagramsThe in-system programming (ISP) programming method is functionally performed through SPI, plus some twiddling of the Reset line. As long as the SPI pins of the AVR are not connected to anything disruptive, the AVR chip can stay soldered on a PCB while reprogramming. All that is needed is a 6-pin connector and programming adapter. This is the most common way to develop with an AVR.

The Atmel AVR ISP mkII device connects to a computer's USB port and performs in-system programming using Atmel's software.

AVRDUDE (AVR Downloader/UploaDEr) runs on Linux, FreeBSD, Windows, and Mac OS X, and supports a variety of in-system programming hardware, including Atmel AVR ISP mkII, Atmel JTAG ICE, older Atmel serial-port based programmers, and various third-party and "do-it-yourself" programmers.[7]

PDI[edit source | editbeta]The Program and Debug Interface (PDI) is an Atmel proprietary interface for external programming and on-chip debugging of XMEGA devices. The PDI supports high-speed programming of all non-volatile memory (NVM) spaces; flash, EEPROM, fuses, lock-bits and the User Signature Row. This is done by accessing the XMEGA NVM controller through the PDI interface, and executing NVM controller commands. The PDI is a 2-pin interface using the Reset pin for clock input (PDI_CLK) and a dedicated data pin (PDI_DATA) for input and output.[8]

High voltage serial[edit source | editbeta]High-voltage serial programming (HVSP)[9] is mostly the backup mode on smaller AVRs. An 8-pin AVR package does not leave many unique signal combinations to place the AVR into a programming mode. A 12 volt signal, however, is something the AVR should only see during programming and never during normal operation.

High voltage parallel[edit source | editbeta]High voltage parallel programming (HVPP) is considered the "final resort" and may be the only way to fix AVR chips with bad fuse settings.

Bootloader[edit source | editbeta]Most AVR models can reserve a bootloader region, 256 B to 4 KB, where re-programming code can reside. At reset, the bootloader runs first, and does some user-programmed determination whether to re-program, or jump to the main application. The code can re-program through any interface available, it could read an encrypted binary through an Ethernet adapter like PXE. Atmel has application notes and code pertaining to many bus interfaces.[10][11][12][13]

ROM[edit source | editbeta]The AT90SC series of AVRs are available with a factory mask-ROM rather than flash for program memory.[14] Because of the large up-front cost and minimum order quantity, a mask-ROM is only cost-effective for high production runs.

aWire[edit source | editbeta]aWire is a new one-wire debug interface available on the new UC3L AVR32 devices.

Debugging interfaces[edit source | editbeta]The AVR offers several options for debugging, mostly involving on-chip debugging while the chip is in the target system.

debugWIRE[edit source | editbeta]debugWIRETM is Atmel's solution for providing on-chip debug capabilities via a single microcontroller pin. It is particularly useful for obtain the code flash memory get read read protected HEX ROM data extracted from extract code (data+code+fuses unlock blocked protect erase lower pin count parts which cannot provide the four "spare" pins needed for JTAG. The JTAGICE mkII, mkIII and the AVR Dragon support debugWIRE. debugWIRE was developed after the original JTAGICE release, and now clones support it.

JTAG[edit source | editbeta]The Joint Test Action Group (JTAG) feature provides access to on-chip debugging functionality while the chip is running in the target system.[15] JTAG allows accessing internal memory and registers, setting breakpoints on code, and single-stepping execution to observe system behaviour.

Atmel provides a series of JTAG adapters for the AVR:

1.The JTAGICE 3[16] is the latest member of the JTAGICE family (JTAGICE mkIII). It supports JTAG, aWire, SPI, and PDI interfaces.
2.The JTAGICE mkII[17] replaces the JTAGICE and is similarly priced. The JTAGICE mkII interfaces to the PC via USB, and supports both JTAG and the newer debugWIRE interface. Numerous third-party clones of the Atmel JTAGICE mkII device started shipping after Atmel released the communication protocol.[18]
3.The AVR Dragon[19] is a low-cost (approximately $50) substitute for the JTAGICE mkII for certain target parts. The AVR Dragon provides in-system serial programming, copy data hex code copied obtain the source code high-voltage serial programming and parallel programming, as well as JTAG or debugWIRE emulation for parts with 32 KB of program memory or less. ATMEL changed the debugging feature of AVR Dragon with the latest firmware of AVR Studio 4 - AVR Studio 5 and now it supports devices over 32 KB of program memory.
4.The JTAGICE adapter interfaces to the PC via a standard serial port.[citation needed] Although the JTAGICE adapter has been declared "end-of-life" by Atmel, it is still supported in AVR Studio and other tools.
JTAG can also be used to perform a boundary scan test,[20] which tests the electrical connections between AVRs and other boundary scan capable chips in a system.extract the eeprom code remove the protection fuses read-out of an EEPROM processor dump flash and eeprom decapsulation and code recovery copy contents of crypto memory duplication Boundary scan is well-suited for a production line, while the hobbyist is probably better off testing with a multimeter or oscilloscope.

Development tools and evaluation kits[edit source | editbeta]Official Atmel AVR development tools and evaluation kits contain a number of starter kits and debugging tools with support for most AVR devices:

STK600 starter kit[edit source | editbeta]The STK600 starter kit and development system is an update to the STK500.[21] The STK600 uses a base board, a signal routing board, and a target board.

The base board is similar to the STK500, in that it provides a power supply, clock, in-system programming, an RS-232 port and a CAN (Controller Area Network, an automotive standard) port via DE9 connectors, and stake pins for all of the GPIO signals from the target device.

The target boards have ZIF sockets for DIP, SOIC, QFN, or QFP packages, depending on the board.

The signal routing board sits between the base board and the target board, and routes the signals to the proper pin on the device board. There are many different signal routing boards that could be used with a single target board, depending on what device is in the ZIF socket.

The STK600 allows in-system programming from the PC via USB, leaving the RS-232 port available for the target microcontroller. A 4 pin header on the STK600 labeled 'RS-232 spare' can connect any TTL level USART port on the chip to an onboard MAX232 get the hex code in source code recovery extract encryption copy data code safety backup chip to translate the signals to RS-232 levels. The RS-232 signals are connected to the RX, TX, CTS, and RTS pins on the DB-9 connector.

STK500 starter kit[edit source | editbeta]The STK500 starter kit and development system features ISP and high voltage programming (HVP) for all AVR devices, either directly or through extension boards. The board is fitted with DIP sockets for all AVRs available in DIP packages.

STK500 Expansion Modules: Several expansion modules are available for the STK500 board:

STK501 - Adds support for microcontrollers in 64-pin TQFP packages.
STK502 - Adds support for LCD AVRs in 64-pin TQFP packages.
STK503 - Adds support for microcontrollers in 100-pin TQFP packages.
STK504 - Adds support for LCD AVRs in 100-pin TQFP packages.
STK505 - Adds support for 14 and 20-pin AVRs.
STK520 - Adds support for 14 and 20, and 32-pin microcontrollers from the AT90PWM and ATmega family.
STK524 - Adds support for the ATmega32M1/C1 32-pin CAN/LIN/Motor Control family.
STK525 - Adds support for the AT90USB microcontrollers in 64-pin TQFP packages.
STK526 - Adds support for the AT90USB microcontrollers in 32-pin TQFP packages
STK200 starter kit[edit source | editbeta]The STK200 starter kit and development system has a DIP socket that can host an AVR chip in a 40, 20, or 8-pin package. The board has a 4 MHz clock source, 8 light-emitting diodes, 8 input buttons, an RS-232 port, a socket for a 32k SRAM and numerous general I/O. The chip can be programmed with a dongle connected to the parallel-port.

Supported microcontrollers (according to the manual) Chip Flash size EEPROM SRAM Frequency
[MHz] Package
AT90S1200 1k 64 0 12 PDIP-20
AT90S2313 2k 128 128 10 PDIP-20
AT90S/LS2323 2k 128 128 10 PDIP-8
AT90S/LS2343 2k 128 128 10 PDIP-8
AT90S4414 4k 256 256 8 PDIP-40
AT90S/LS4434 4k 256 256 8 PDIP-40
AT90S8515 8k 512 512 8 PDIP-40
AT90S/LS8535 8k 512 512 8 PDIP-40

AVR ISP and AVR ISP mkII[edit source | editbeta]The AVR ISP and AVR ISP mkII are inexpensive tools allowing all AVRs to be programmed via ICSP.

The AVR ISP connects to a PC via a serial port and draws power from the target system. The AVR ISP allows using either of the "standard" ICSP pinouts, either the 10-pin or 6-pin connector. The AVR ISP has been discontinued, replaced by the AVR ISP mkII.

The AVR ISP mkII connects to a PC via USB and draws power from USB. LEDs visible through the translucent case indicate the state of target power.

AVR Dragon[edit source | editbeta]
AVR Dragon with ISP programming cable and attached, blue ZIF Socket.The Atmel Dragon is an inexpensive tool which connects to a PC via USB. The Dragon can program all AVRs via JTAG, HVP, PDI,[22] or ICSP. The Dragon also allows debugging of all AVRs via JTAG, PDI, or debugWire; a previous limitation to devices with 32 kB or less program memory source code retreived preak the security retrieving the code open a locked Microcontroller mcu at89c51 lockbit lock duplicate has been removed in AVR Studio 4.18.[23] The Dragon has a small prototype area which can accommodate an 8, 28, or 40-pin AVR, including connections to power and programming pins. There is no area for any additional circuitry, although this can be provided by a third-party product called the "Dragon Rider".[24]

JTAGICE mkI[edit source | editbeta]The JTAG In Circuit Emulator (JTAGICE) debugging tool supports on-chip debugging (OCD) of AVRs with a JTAG interface. The original JTAGICE mkI uses an RS-232 interface to a PC and can only program AVR's with a JTAG interface. The JTAGICE mkI is no longer in production, however it has been replaced by the JTAGICE mkII.

JTAGICE mkII[edit source | editbeta]The JTAGICE mkII debugging tool supports on-chip debugging (OCD) of AVRs with SPI, JTAG, PDI, and debugWIRE interfaces. The debugWire interface enables debugging using only one pin (the Reset pin), allowing debugging of applications running on low pin-count microcontrollers.

The JTAGICE mkII connects using USB, but there is an alternate connection via a serial port, which requires using a separate power supply. In addition to JTAG, the mkII supports ISP programming (using 6-pin or 10-pin adapters). Both the USB and serial links use a variant of the STK500 protocol.

JTAGICE3[edit source | editbeta]The JTAGICE3 updates the mkII with more advanced debugging capabilities and faster programming. It connects via USB and supports the JTAG, aWire, SPI, and PDI interfaces.[25] The kit includes several adapters for use with most interface pinouts.

AVR ONE![edit source | editbeta]The AVR ONE! is a professional development tool for all Atmel 8-bit and 32-bit AVR devices with On-Chip Debug capability. It supports SPI, JTAG, PDI, and aWire programming modes and debugging using debugWIRE, JTAG, PDI, and aWire interfaces.[26]

Butterfly demonstration board[edit source | editbeta]
Atmel ATmega169 in 64-pad MLF package on the back of an Atmel AVR Butterfly boardMain article: AVR Butterfly
The very popular AVR Butterfly demonstration board is a self-contained, battery-powered computer running the Atmel AVR ATmega169V microcontroller. It was built to show-off the AVR family, especially a new built-in LCD interface. The board includes the LCD screen, joystick, speaker, serial port, real time clock (RTC), flash memory chip, and both temperature and chip cloning code read copy-protect chips source code extract code read its Memory copy those eeproms voltage sensors. Earlier versions of the AVR Butterfly also contained a CdS photoresistor; it is not present on Butterfly boards produced after June 2006 to allow RoHS compliance.[27] The small board has a shirt pin on its back so it can be worn as a name badge.

The AVR Butterfly comes preloaded with software to demonstrate the capabilities of the microcontroller. Factory firmware can scroll your name, display the sensor readings, and show the time. The AVR Butterfly also has a piezoelectric transducer that can be used to reproduce sounds and music.

The AVR Butterfly demonstrates LCD driving by running a 14-segment, six alpha-numeric character display. However, the LCD interface consumes many of the I/O pins.

The Butterfly's ATmega169 CPU is capable of speeds up to 8 MHz, but it is factory set by software to 2 MHz to preserve the button battery life. A pre-installed bootloader program allows the board to be re-programmed via a standard RS-232 serial plug with new programs that users can write with the free Atmel IDE tools.

AT90USBKey[edit source | editbeta]This small board, about half the size of a business card, is priced at slightly more than an AVR Butterfly. It includes an AT90USB1287 with USB On-The-Go (OTG) support, 16 MB of DataFlash, LEDs, a small joystick, and a get the .bin code code protected read program get the firmware read out memory get the program Read Data from the EEprom temperature sensor. The board includes software which lets it act as a USB mass storage device (its documentation is shipped on the DataFlash), a USB joystick, and more. To support the USB host capability, it must be operated from a battery, but when running as a USB peripheral, it only needs the power provided over USB.

Only the JTAG port uses conventional 2.54 mm pinout. All the other AVR I/O ports require more compact 1.27 mm headers.

The AVR Dragon can both program and debug since the 32 KB limitation was removed in AVR Studio 4.18, and the JTAGICE mkII is capable of both programming and debugging the processor. The processor can also be programmed through USB from a Windows or Linux host, using the USB "Device Firmware Update" protocols. Atmel ships proprietary (source code included but distribution restricted) example programs and a USB protocol stack with the device.

LUFA[28] is a third-party free software (MIT license) USB protocol stack for the USBKey and other 8-bit USB AVRs.

Raven wireless kit[edit source | editbeta]The RAVEN kit supports wireless development using Atmel's IEEE 802.15.4 chipsets, for ZigBee and other wireless stacks. It resembles a pair of wireless more-powerful Butterfly cards, plus a wireless USBKey; and costing about that much (under $US100). All these boards support JTAG-based development.

The kit includes two AVR Raven boards, each with a 2.4 GHz transceiver supporting IEEE 802.15.4 (and a freely licensed ZigBee stack). The radios are driven with ATmega1284p processors, which are supported by a custom segmented LCD display driven by an ATmega3290p processor. extracting exact software decrypting this memory dump recover code from an encrypted hacking hex file readback of a protected extracting the code break the protect code copy an encrypted IC Raven peripherals resemble the Butterfly: piezo speaker, DataFlash (bigger), external EEPROM, sensors, 32 kHz crystal for RTC, and so on. These are intended for use in developing remote sensor nodes, to control relays, or whatever is needed.

The USB stick uses an AT90USB1287 for connections to a USB host and to the 2.4 GHz wireless links. These are intended to monitor and control the remote nodes, relying on host power rather than local batteries.

Third-party programmers[edit source | editbeta]A wide variety of third-party programming and debugging tools are available for the AVR. These devices use various interfaces, including RS-232, PC parallel port, and USB. AVR Freaks has a comprehensive list.

Atmel AVR usage[edit source | editbeta]
Atmel AVR Atmega328 28-pin DIP on an Arduino Duemilanove board
Atmel AVR Atmega8 28-pin DIP on a custom development boardAVRs have been used in various automotive applications such as security, safety, read firmware code read eeprom data copy locked program read EEprom and ROM disassemble file recovering protected code unprotect powertrain and entertainment systems. Atmel has recently launched a new publication "Atmel Automotive Compilation" to help developers with automotive applications. Some current usages are in BMW, Daimler-Chrysler and TRW.

The Arduino physical computing platform is based on an ATmega328 microcontroller (ATmega168 or ATmega8 in board versions older than the Diecimila). The ATmega1280 and ATmega2560, with more pinout and memory capabilities, have also been employed to develop the Arduino Mega platform. Arduino boards can be used with its language and IDE, or with more conventional programming environments (C, assembler, etc.) as just standardized and widely available AVR platforms.

USB-based AVRs have been used in the Microsoft Xbox hand controllers. The link between the controllers and Xbox is USB.

Numerous companies produce AVR-based microcontroller boards intended for use by hobbyists, robot builders, experimenters and small recovery and read data recover the program break password extracting program from Microcontroller retrieving the hex source code lockbit locked copy source code blocked lockbits activated read security bytes system developers including: Cubloc,[29] gnusb,[30] BasicX,[31] Oak Micros,[32] ZX Microcontrollers,[33] and myAVR.[34] There is also a large community of Arduino-compatible boards supporting similar users.

Schneider Electric produces the M3000 Motor and Motion Control Chip, incorporating an Atmel AVR Core and an advanced motion controller for use in a variety of motion applications.[35]

FPGA clones[edit source | editbeta]With the growing popularity of FPGAs among the open source community, people have started developing open source processors compatible with the AVR instruction set. The OpenCores website lists the following major AVR clone projects:

pAVR,[36] written in VHDL, is aimed at creating the fastest and maximally featured AVR processor, by implementing techniques not found in the original AVR processor such as deeper pipelining.
avr_core,[37] written in VHDL, is a clone aimed at being as close as possible to the ATmega103.
Navré[38] written in Verilog, implements all Classic Core instructions and is aimed at high performance and low resource usage. It does not support interrupts.


PCB Copying Service
PCB Projects Overview
PCB Clone
PCB Reverse Engineering
PCB Prototype
PCB Assembly Production
Mcu Hacking Service
Atmel Microcontroller Hack
Actel Mcu Attack
Altera Microcontroller Crack
Cygnal Mcu Unlock
Cypress IC Reverse Engineer
Elan Mcu Code Extract
Fujitsu Microprocessor Decryption
Freescale IC Code Extraction
Gould integrated circuit Hack
Hitachi Mcu Code Extract
Holtek Chip Reverse Engineer
Infineon Microcontroller Dump
Intel Mcu Read Code Protection
ICT Microcontroller Duplication
Lattice Microcontroller Clone
Microchip Source Code Recovery
Motorola Microcontroller Crack
Maxim Mcu Attack
MDT Controller Hack
Magawin Microcontroller Unlock
NEC Mcu Reverse Engineer
NTK Microcontroller Code Extract
Nuvoton Chip Decryption
NXP Semiconductor Code Extraction
Philips integrated circuit Crack
Renesas Microcontroller Dump
ST Processor Reverse Engineer
Silicon Labs Mcu Read Protection
Samsung Mcu Duplication
SST Mcu Clone
Sinowealth Source Code Recovery
SyncMOS Mcu Unlock
Sonix Mcu Read Source Code
STC Microprocessor Code Extract
Tenx Microcontroller Decryption
Texas Instuments MCU Hack
Winbond MCU Code Extraction
Xilinx integrated circuit Crack
Zilog MCU Reverse Engineer
More MCU brands we can reverse engineer below, please contact us if yours not listed here:
AMD Feeling LG / Hyundai Myson STK
ChipON Hynix Mitsubishi National Semi Temic
Coreriver ICSI Mosel Vitelic Portek Toshiba
Dallas ISSI MXIC SSSC Gal / Pal / Palce
Copyright © 2013 Mikatech. All rights reserved. Full dedicated reverse engineering company