Atmel MCU Reverse Engineering

Atmel Corporation is an American manufacturer of semiconductors, founded in 1984. The company focuses on embedded system-level solutions built around flash microcontrollers. Its products include microcontrollers (8-bit AVR, 32-bit AVR, ARM-based, automotive grade, and 8051 derivatives,) radio frequency (RF) devices including Wi-fi, EEPROM, and flash memory devices, symmetric and asymmetric security chips, touch sensors and controllers, and a number of application-specific products.

Atmel supplies its devices as standard products, ASICs, or ASSPs depending on the requirements of its customers. Atmel serves a range of applications including consumer, communications, computer networking, industrial, medical, automotive, aerospace and military. It is an industry leader in microcontroller and touch systems, notably for embedded systems, the such as famous Arduino development kits.

Atmel’s corporate headquarters is in San Jose California. It has large locations in Trondheim, Norway, Colorado Springs, Colorado, Chennai, India, Shanghai, China, Taipei, Taiwan, Rousset, France, Heilbronn, Germany, Whiteley, UK and Munich, Germany, in addition to a number of other worldwide sites. Atmel is pursuing a “fab-lite” strategy, making much of its product line at vendor fabs. It owns a facility in Colorado Springs that manufactures its XSense line of flexible touch sensors.

 

 

Atmel AVR

Atmel ATmega8 in 28-pin narrow DIPThe AVR is a modified Harvard architecture 8-bit RISC single chip microcontroller which was developed by Atmel in 1996. The AVR was one of the first microcontroller families to use on-chip flash memory for program storage, as opposed to one-time programmable ROM, EPROM, or EEPROM used by other microcontrollers at the time.

Brief history[edit source | editbeta]The AVR architecture was conceived by two students at the Norwegian Institute of Technology (NTH) Alf-Egil Bogen and Vegard Wollan.[1][2]

The original AVR MCU was developed at a local ASIC house in Trondheim, Norway called Nordic VLSI at the time, now Nordic Semiconductor, where Bogen and Wollan were working as students.[citation needed] It was known as a μRISC (Micro RISC)[citation needed] and was available as silicon IP/building block from Nordic VLSI.[citation needed] When the technology was sold to Atmel from Nordic VLSI,[citation needed] the internal architecture was further developed by Bogen and Wollan at Atmel Norway, a subsidiary of Atmel. The designers worked closely with compiler writers fib laboratory & sem lab sertvice at IAR Systems to ensure that the instruction set provided for more efficient compilation of high-level languages.[3] Atmel says that the name AVR is not an acronym and does not stand for anything in particular. The creators of the AVR give no definitive answer as to what the term "AVR" stands for.[2] However, it is commonly accepted that AVR stands for Alf (Egil Bogen) and Vegard (Wollan)'s RISC processor.[4]

Note that the use of "AVR" in this article generally refers to the 8-bit RISC line of Atmel AVR Microcontrollers.

Among the first of the AVR line was the AT90S8515, which in a 40-pin DIP package has the same pinout as an 8051 microcontroller, including the external maker club multiplexed address and data bus. The polarity of the RESET line was opposite (8051's having an active-high RESET, while the AVR has an active-low RESET), but other than that, the pinout was identical.

Device overview[edit source | editbeta]The AVR is a modified Harvard architecture machine where program and data are stored in separate physical memory systems that appear in different address spaces, but having the ability to read data items from program memory using special instructions.

Basic families[edit source | editbeta]AVRs are generally classified into six broad groups:

tinyAVR — the ATtiny series
0.5–16 kB program memory
6–32-pin package
Limited peripheral set
megaAVR — the ATmega series
4–512 kB program memory
28–100-pin package
Extended instruction set (multiply instructions and instructions for handling larger program memories)
Extensive peripheral set
XMEGA — the ATxmega series
16–384 kB program memory
44–64–100-pin package (A4, A3, A1)
Extended performance features, such as DMA, "Event System", and cryptography support.
Extensive peripheral set with ADCs
Application-specific AVR
megaAVRs with special features not found on the other members of the AVR family, such as LCD controller, USB controller, advanced PWM, CAN, etc.
FPSLIC (AVR with FPGA)
FPGA 5K to 40K gates
SRAM for the AVR program code, unlike all other AVRs
AVR core can run at up to 50 MHz [5]
32-bit AVRs
Main article: AVR32
In 2006 Atmel released microcontrollers based on the new, 32-bit, AVR32 architecture. They include SIMD and DSP instructions, along with other audio and video snaileye processing features. This 32-bit family of devices is intended to compete with the ARM based processors. The instruction set is similar to other RISC cores, but it is not compatible with the original AVR or any of the various ARM cores.
Device architecture[edit source | editbeta]Flash, EEPROM, and SRAM are all integrated onto a single chip, removing the need for external memory in most applications. Some devices have a parallel external bus option to allow adding additional data memory or memory-mapped devices. Almost all devices (except the smallest TinyAVR chips) have serial interfaces, which can be used to connect larger serial EEPROMs or flash chips.

Program memory[edit source | editbeta]Program instructions are stored in non-volatile flash memory. Although the MCUs are 8-bit, each instruction takes one or two 16-bit words.

The size of the program memory is usually indicated in the naming of the device itself (e.g., the ATmega64x line has 64 kB of flash while the ATmega32x line has 32 kB).

There is no provision for off-chip program memory; all code executed by the AVR core must reside in the on-chip flash. However, this limitation does not apply to the AT94 FPSLIC AVR/FPGA chips.

Internal data memory[edit source | editbeta]The data address space consists of the register file, I/O registers, and SRAM.

Internal registers[edit source | editbeta]
Atmel ATxmega128A1 in 100-pin TQFP packageThe AVRs have 32 single-byte registers and are classified as 8-bit RISC devices.

In most variants of the AVR architecture, the working registers are mapped in as the first 32 memory addresses (000016–001F16) followed by the 64 I/O registers (002016–005F16).

Actual SRAM starts after these register sections (address 006016). (Note that the I/O register space may be larger on some more extensive devices, in which case the memory mapped I/O registers will occupy a portion of the SRAM address space.)

Even though there are separate addressing schemes and optimized opcodes for register file and I/O register access, all can still be addressed and manipulated as if they were in SRAM.

In the XMEGA variant, the working register file is not mapped into the data address space; as such, it is not possible to treat any of the XMEGA's working registers as though they were SRAM. Instead, the I/O registers are mapped into the data address space starting at the very beginning of the address space. Additionally, the amount of data address space dedicated to I/O registers has grown substantially to 4096 bytes (000016–0FFF16). As with previous generations, however, mcu reverse engineering the fast I/O manipulation instructions can only reach the first 64 I/O register locations (the first 32 locations for bitwise instructions). Following the I/O registers, the XMEGA series sets aside a 4096 byte range of the data address space which can be used optionally for mapping the internal EEPROM to the data address space (100016–1FFF16). The actual SRAM is located after these ranges, starting at 200016.

EEPROM[edit source | editbeta]Almost all AVR microcontrollers have internal EEPROM for semi-permanent data storage. Like flash memory, EEPROM can maintain its contents when electrical power is removed.

In most variants of the AVR architecture, this internal EEPROM memory is not mapped into the MCU's addressable memory space. It can only be accessed the same way an external peripheral device is, using special pointer registers and read/write instructions which makes EEPROM access much slower than other internal RAM.

However, some devices in the SecureAVR (AT90SC) family [6] use a special EEPROM mapping to the data or program memory depending on the configuration. The XMEGA family also allows the EEPROM to be mapped into the data address space.

Since the number of writes to EEPROM is not unlimited — Atmel specifies 100,000 write cycles in their datasheets — a well designed EEPROM write routine should compare the contents of an EEPROM address with desired contents and only perform an actual write if the contents need to be changed.

Note that erase and write can be performed separately in many cases, byte-by-byte, which may also help prolong life when bits only need to be set to all 1s (erase) or selectively cleared to 0s (write).

Program execution[edit source | editbeta]Atmel's AVRs have a two stage, single level pipeline design. This means the next machine instruction is fetched as the current one is executing. Most instructions take just one or two clock cycles, making AVRs relatively fast among the eight-bit microcontrollers.

The AVR processors were designed with the efficient execution of compiled C code in mind and have several built-in pointers for the task.

Instruction set[edit source | editbeta]Main article: Atmel AVR instruction set
The AVR instruction set is more orthogonal than those of most eight-bit microcontrollers, in particular the 8051 clones and PIC microcontrollers with which AVR competes today. However, it is not completely regular:

Pointer registers X, Y, and Z have addressing capabilities that are different from each other.
Register locations R0 to R15 have different addressing capabilities than register locations R16 to R31.
I/O ports 0 to 31 have different addressing capabilities than I/O ports 32 to 63.
CLR affects flags, while SER does not, even though they are complementary instructions. CLR set all bits to zero and SER sets them to one. (Note that CLR is pseudo-op for EOR R, R; and SER is short for LDI R,$FF. Math operations such as EOR modify flags while moves/loads/stores/branches such as LDI do not.)
Accessing read-only data stored in the program memory (flash) requires special LPM instructions; the flash bus is otherwise reserved for instruction memory.
Additionally, some chip-specific differences affect code generation. Code pointers (including return addresses on the stack) are two bytes long on chips with up to 128 kBytes of flash memory, but three bytes long on larger chips; not all chips have hardware multipliers; chips with over 8 kBytes of flash have branch and call instructions with longer ranges; and so forth.

The mostly regular instruction set makes programming it using C (or even Ada) compilers fairly straightforward. GCC has included AVR support for quite some time, and that support is widely used. In fact, Atmel solicited input from major developers of compilers for small microcontrollers, to determine the instruction set features that were most useful in a compiler for high-level languages.

MCU speed[edit source | editbeta]The AVR line can normally support clock speeds from 0 to 20 MHz, with some devices reaching 32 MHz. Lower powered operation usually requires a reduced clock speed. All recent (Tiny, Mega, and Xmega, but not 90S) AVRs feature an on-chip oscillator, removing the need for external clocks or resonator circuitry. Some AVRs also have a system clock prescaler that can divide down the system clock by up to 1024. This prescaler can be reconfigured by software during run-time, allowing the clock speed to be optimized.

Since all operations (excluding literals) on registers R0 - R31 are single cycle, the AVR can achieve up to 1 MIPS per MHz, i.e. an 8 MHz processor can achieve up to 8 MIPS. Loads and stores to/from memory take two cycles, branching takes two cycles. Branches in the latest "3-byte PC" parts such as ATmega2560 are one cycle slower than on previous devices.

Development[edit source | editbeta]
Atmel STK500 development boardAVRs have a large following due to the free and inexpensive development tools available, including reasonably priced development boards and free development software. The AVRs are sold under various names that share the same basic core, but with different peripheral and memory combinations. Compatibility between chips in each family is fairly good, although I/O controller features may vary.

See external links for sites relating to AVR development.

Features[edit source | editbeta]Current[when?] AVRs offer a wide range of features:

Multifunction, bi-directional general-purpose I/O ports with configurable, built-in pull-up resistors
Multiple internal oscillators, including RC oscillator without external parts
Internal, self-programmable instruction flash memory up to 256 kB (384 kB on XMega)
In-system programmable using serial/parallel low-voltage proprietary interfaces or JTAG
Optional boot code section with independent lock bits for protection
On-chip debugging (OCD) support through JTAG or debugWIRE on most devices
The JTAG signals (TMS, TDI, TDO, and TCK FIB集成电路失效分析) are multiplexed on GPIOs. These pins can be configured to function as JTAG or GPIO depending on the setting of a fuse bit, which can be programmed via ISP or HVSP. By default, AVRs with JTAG come with the JTAG interface enabled.
debugWIRE uses the /RESET pin as a bi-directional communication channel to access on-chip debug circuitry. It is present on devices with lower pin counts, as it only requires one pin.
Internal data EEPROM up to 4 kB
Internal SRAM up to 16 kB (32 kB on XMega)
External 64 kB little endian data space on certain models, including the Mega8515 and Mega162.
The external data space is overlaid with the internal data space, such that the full 64 kB address space does not appear on the external bus and accesses to e.g. address 010016 will access internal RAM, not the external bus.
In certain members of the XMega series, the external data space has been enhanced to support both SRAM and SDRAM. As well, the data addressing modes have been expanded to allow up to 16 MB of data memory to be directly addressed.
AVRs generally do not support executing code from external memory. Some ASSPs using the AVR core do support external program memory.
8-bit and 16-bit timers
PWM output (some devices have an enhanced PWM peripheral which includes a dead-time generator)
Input capture that record a time stamp triggered by a signal edge
Analog comparator
10 or 12-bit A/D converters, with multiplex of up to 16 channels
12-bit D/A converters
A variety of serial interfaces, including
I²C compatible Two-Wire Interface (TWI)
Synchronous/asynchronous serial peripherals (UART/USART) (used with RS-232, RS-485, and more)
Serial Peripheral Interface Bus (SPI)
Universal Serial Interface (USI) for two or three-wire synchronous data transfer
Brownout detection
Watchdog timer (WDT)
Multiple power-saving sleep modes
Lighting and motor control (PWM-specific) controller models
CAN controller support
USB controller support
Proper full-speed (12 Mbit/s) hardware & Hub controller with embedded AVR.
Also freely available low-speed (1.5 Mbit/s) (HID) bitbanging software emulations
Ethernet controller support
LCD controller support
Low-voltage devices operating down to 1.8 V (to 0.7 V for parts with built-in DC–DC upconverter)
picoPower devices
DMA controllers and "event system" peripheral communication.
Fast cryptography support for AES and DES
Programming interfaces[edit source | editbeta]There are many means to load program code into an AVR chip. The methods to program AVR chips varies from AVR family to family.

Arduino Uno
Arduino Nano
Arduino Nano
Arduino Nano
Arduino LilyPad
Arduino Mega 2560
Arduino Ethernet
Arduino Due
Arduino Leonardo
ArduinoYún [6-7]

ISP[edit source | editbeta]
6- and 10-pin ISP header diagramsThe in-system programming (ISP) programming method is functionally performed through SPI, plus some twiddling of the Reset line. As long as the SPI pins of the AVR are not connected to anything disruptive, the AVR chip can stay soldered on a PCB while reprogramming. All that is needed is a 6-pin connector and programming adapter. This is the most common way to develop with an AVR.

The Atmel AVR ISP mkII device connects to a computer's USB port and performs in-system programming using Atmel's software.

AVRDUDE (AVR Downloader/UploaDEr) runs on Linux, FreeBSD, Windows, and Mac OS X, and supports a variety of in-system programming hardware, including Atmel AVR ISP mkII, Atmel JTAG ICE, older Atmel serial-port based programmers, and various third-party and "do-it-yourself" programmers.[7]

Arduino GSM Shield
Arduino GSM Shield Front
Arduino GSM Shield Front
Arduino Ethernet Shield
Arduino Ethernet Shield
Arduino Ethernet Shield
Arduino WiFi Shield
Arduino Wireless SD Shield
Arduino USB Host Shield
Arduino Motor Shield
Arduino Wireless Proto Shield
Arduino Proto Shield

PDI[edit source | editbeta]The Program and Debug Interface (PDI) is an Atmel proprietary interface for external programming and on-chip debugging of XMEGA devices. The PDI supports high-speed programming of all non-volatile memory (NVM) spaces; flash, EEPROM, fuses, lock-bits and the User Signature Row. This is done by accessing the XMEGA NVM controller through the PDI interface, and executing NVM controller commands. The PDI is a 2-pin interface using the Reset pin for clock input (PDI_CLK) and a dedicated data pin (PDI_DATA) for input and output.[8]

High voltage serial[edit source | editbeta]High-voltage serial programming (HVSP)[9] is mostly the backup mode on smaller AVRs. An 8-pin AVR package does not leave many unique signal combinations to place the AVR into a programming mode. A 12 volt signal, however, is something the AVR should only see during programming and never during normal operation.

High voltage parallel[edit source | editbeta]High voltage parallel programming (HVPP) is considered the "final resort" and may be the only way to fix AVR chips with bad fuse settings.

Bootloader[edit source | editbeta]Most AVR models can reserve a bootloader region, 256 B to 4 KB, where re-programming code can reside. At reset, the bootloader runs first, and does some user-programmed determination whether to re-program, or jump to the main application. The code can re-program through any interface available, it could read an encrypted binary through an Ethernet adapter like PXE. Atmel has application notes and code pertaining to many bus interfaces.[10][11][12][13]

ROM[edit source | editbeta]The AT90SC series of AVRs are available with a factory mask-ROM rather than flash for program memory.[14] Because of the large up-front cost and minimum order quantity, a mask-ROM is only cost-effective for high production runs.

aWire[edit source | editbeta]aWire is a new one-wire debug interface available on the new UC3L AVR32 devices.

Debugging interfaces[edit source | editbeta]The AVR offers several options for debugging, mostly involving on-chip debugging while the chip is in the target system.

debugWIRE[edit source | editbeta]debugWIRETM is Atmel's solution for providing on-chip debug capabilities via a single microcontroller pin. It is particularly useful for obtain the code flash memory get read read protected HEX ROM data extracted from extract code (data+code+fuses unlock blocked protect erase lower pin count parts which cannot provide the four "spare" pins needed for JTAG. The JTAGICE mkII, mkIII and the AVR Dragon support debugWIRE. debugWIRE was developed after the original JTAGICE release, and now clones support it.

JTAG[edit source | editbeta]The Joint Test Action Group (JTAG) feature provides access to on-chip debugging functionality while the chip is running in the target system.[15] JTAG allows accessing internal memory and registers, setting breakpoints on code, and single-stepping execution to observe system behaviour.

Atmel provides a series of JTAG adapters for the AVR:

1.The JTAGICE 3[16] is the latest member of the JTAGICE family (JTAGICE mkIII). It supports JTAG, aWire, SPI, and PDI interfaces.
2.The JTAGICE mkII[17] replaces the JTAGICE and is similarly priced. The JTAGICE mkII interfaces to the PC via USB, and supports both JTAG and the newer debugWIRE interface. Numerous third-party clones of the Atmel JTAGICE mkII device started shipping after Atmel released the communication protocol.[18]
3.The AVR Dragon[19] is a low-cost (approximately $50) substitute for the JTAGICE mkII for certain target parts. The AVR Dragon provides in-system serial programming, copy data hex code copied obtain the source code high-voltage serial programming and parallel programming, as well as JTAG or debugWIRE emulation for parts with 32 KB of program memory or less. ATMEL changed the debugging feature of AVR Dragon with the latest firmware of AVR Studio 4 - AVR Studio 5 and now it supports devices over 32 KB of program memory.
4.The JTAGICE adapter interfaces to the PC via a standard serial port.[citation needed] Although the JTAGICE adapter has been declared "end-of-life" by Atmel, it is still supported in AVR Studio and other tools.
JTAG can also be used to perform a boundary scan test,[20] which tests the electrical connections between AVRs and other boundary scan capable chips in a system.extract the eeprom code remove the protection fuses read-out of an EEPROM processor dump flash and eeprom decapsulation and code recovery copy contents of crypto memory duplication Boundary scan is well-suited for a production line, while the hobbyist is probably better off testing with a multimeter or oscilloscope.

Development tools and evaluation kits[edit source | editbeta]Official Atmel AVR development tools and evaluation kits contain a number of starter kits and debugging tools with support for most AVR devices:

STK600 starter kit[edit source | editbeta]The STK600 starter kit and development system is an update to the STK500.[21] The STK600 uses a base board, a signal routing board, and a target board.

The base board is similar to the STK500, in that it provides a power supply, clock, in-system programming, an RS-232 port and a CAN (Controller Area Network, an automotive standard) port via DE9 connectors, and stake pins for all of the GPIO signals from the target device.

The target boards have ZIF sockets for DIP, SOIC, QFN, or QFP packages, depending on the board.

The signal routing board sits between the base board and the target board, and routes the signals to the proper pin on the device board. There are many different signal routing boards that could be used with a single target board, depending on what device is in the ZIF socket.

The STK600 allows in-system programming from the PC via USB, leaving the RS-232 port available for the target microcontroller. A 4 pin header on the STK600 labeled 'RS-232 spare' can connect any TTL level USART port on the chip to an onboard MAX232 get the hex code in source code recovery extract encryption copy data code safety backup chip to translate the signals to RS-232 levels. The RS-232 signals are connected to the RX, TX, CTS, and RTS pins on the DB-9 connector.

STK500 starter kit[edit source | editbeta]The STK500 starter kit and development system features ISP and high voltage programming (HVP) for all AVR devices, either directly or through extension boards. The board is fitted with DIP sockets for all AVRs available in DIP packages.

STK500 Expansion Modules: Several expansion modules are available for the STK500 board:

STK501 - Adds support for microcontrollers in 64-pin TQFP packages.
STK502 - Adds support for LCD AVRs in 64-pin TQFP packages.
STK503 - Adds support for microcontrollers in 100-pin TQFP packages.
STK504 - Adds support for LCD AVRs in 100-pin TQFP packages.
STK505 - Adds support for 14 and 20-pin AVRs.
STK520 - Adds support for 14 and 20, and 32-pin microcontrollers from the AT90PWM and ATmega family.
STK524 - Adds support for the ATmega32M1/C1 32-pin CAN/LIN/Motor Control family.
STK525 - Adds support for the AT90USB microcontrollers in 64-pin TQFP packages.
STK526 - Adds support for the AT90USB microcontrollers in 32-pin TQFP packages
STK200 starter kit[edit source | editbeta]The STK200 starter kit and development system has a DIP socket that can host an AVR chip in a 40, 20, or 8-pin package. The board has a 4 MHz clock source, 8 light-emitting diodes, 8 input buttons, an RS-232 port, a socket for a 32k SRAM and numerous general I/O. The chip can be programmed with a dongle connected to the parallel-port.

Supported microcontrollers (according to the manual) Chip Flash size EEPROM SRAM Frequency
[MHz] Package
AT90S1200 1k 64 0 12 PDIP-20
AT90S2313 2k 128 128 10 PDIP-20
AT90S/LS2323 2k 128 128 10 PDIP-8
AT90S/LS2343 2k 128 128 10 PDIP-8
AT90S4414 4k 256 256 8 PDIP-40
AT90S/LS4434 4k 256 256 8 PDIP-40
AT90S8515 8k 512 512 8 PDIP-40
AT90S/LS8535 8k 512 512 8 PDIP-40

AVR ISP and AVR ISP mkII[edit source | editbeta]The AVR ISP and AVR ISP mkII are inexpensive tools allowing all AVRs to be programmed via ICSP.

The AVR ISP connects to a PC via a serial port and draws power from the target system. The AVR ISP allows using either of the "standard" ICSP pinouts, either the 10-pin or 6-pin connector. The AVR ISP has been discontinued, replaced by the AVR ISP mkII.

The AVR ISP mkII connects to a PC via USB and draws power from USB. LEDs visible through the translucent case indicate the state of target power.

AVR Dragon[edit source | editbeta]
AVR Dragon with ISP programming cable and attached, blue ZIF Socket.The Atmel Dragon is an inexpensive tool which connects to a PC via USB. The Dragon can program all AVRs via JTAG, HVP, PDI,[22] or ICSP. The Dragon also allows debugging of all AVRs via JTAG, PDI, or debugWire; a previous limitation to devices with 32 kB or less program memory source code retreived preak the security retrieving the code open a locked Microcontroller mcu at89c51 lockbit lock duplicate has been removed in AVR Studio 4.18.[23] The Dragon has a small prototype area which can accommodate an 8, 28, or 40-pin AVR, including connections to power and programming pins. There is no area for any additional circuitry, although this can be provided by a third-party product called the "Dragon Rider".[24]

JTAGICE mkI[edit source | editbeta]The JTAG In Circuit Emulator (JTAGICE) debugging tool supports on-chip debugging (OCD) of AVRs with a JTAG interface. The original JTAGICE mkI uses an RS-232 interface to a PC and can only program AVR's with a JTAG interface. The JTAGICE mkI is no longer in production, however it has been replaced by the JTAGICE mkII.

JTAGICE mkII[edit source | editbeta]The JTAGICE mkII debugging tool supports on-chip debugging (OCD) of AVRs with SPI, JTAG, PDI, and debugWIRE interfaces. The debugWire interface enables debugging using only one pin (the Reset pin), allowing debugging of applications running on low pin-count microcontrollers.

The JTAGICE mkII connects using USB, but there is an alternate connection via a serial port, which requires using a separate power supply. In addition to JTAG, the mkII supports ISP programming (using 6-pin or 10-pin adapters). Both the USB and serial links use a variant of the STK500 protocol.

JTAGICE3[edit source | editbeta]The JTAGICE3 updates the mkII with more advanced debugging capabilities and faster programming. It connects via USB and supports the JTAG, aWire, SPI, and PDI interfaces.[25] The kit includes several adapters for use with most interface pinouts.

AVR ONE![edit source | editbeta]The AVR ONE! is a professional development tool for all Atmel 8-bit and 32-bit AVR devices with On-Chip Debug capability. It supports SPI, JTAG, PDI, and aWire programming modes and debugging using debugWIRE, JTAG, PDI, and aWire interfaces.[26]

Butterfly demonstration board[edit source | editbeta]
Atmel ATmega169 in 64-pad MLF package on the back of an Atmel AVR Butterfly boardMain article: AVR Butterfly
The very popular AVR Butterfly demonstration board is a self-contained, battery-powered computer running the Atmel AVR ATmega169V microcontroller. It was built to show-off the AVR family, especially a new built-in LCD interface. The board includes the LCD screen, joystick, speaker, serial port, real time clock (RTC), flash memory chip, and both temperature and chip cloning code read copy-protect chips source code extract code read its Memory copy those eeproms voltage sensors. Earlier versions of the AVR Butterfly also contained a CdS photoresistor; it is not present on Butterfly boards produced after June 2006 to allow RoHS compliance.[27] The small board has a shirt pin on its back so it can be worn as a name badge.

The AVR Butterfly comes preloaded with software to demonstrate the capabilities of the microcontroller. Factory firmware can scroll your name, display the sensor readings, and show the time. The AVR Butterfly also has a piezoelectric transducer that can be used to reproduce sounds and music.

The AVR Butterfly demonstrates LCD driving by running a 14-segment, six alpha-numeric character display. However, the LCD interface consumes many of the I/O pins.

The Butterfly's ATmega169 CPU is capable of speeds up to 8 MHz, but it is factory set by software to 2 MHz to preserve the button battery life. A pre-installed bootloader program allows the board to be re-programmed via a standard RS-232 serial plug with new programs that users can write with the free Atmel IDE tools.

AT90USBKey[edit source | editbeta]This small board, about half the size of a business card, is priced at slightly more than an AVR Butterfly. It includes an AT90USB1287 with USB On-The-Go (OTG) support, 16 MB of DataFlash, LEDs, a small joystick, and a get the .bin code code protected read program get the firmware read out memory get the program Read Data from the EEprom temperature sensor. The board includes software which lets it act as a USB mass storage device (its documentation is shipped on the DataFlash), a USB joystick, and more. To support the USB host capability, it must be operated from a battery, but when running as a USB peripheral, it only needs the power provided over USB.

Only the JTAG port uses conventional 2.54 mm pinout. All the other AVR I/O ports require more compact 1.27 mm headers.

The AVR Dragon can both program and debug since the 32 KB limitation was removed in AVR Studio 4.18, and the JTAGICE mkII is capable of both programming and debugging the processor. The processor can also be programmed through USB from a Windows or Linux host, using the USB "Device Firmware Update" protocols. Atmel ships proprietary (source code included but distribution restricted) example programs and a USB protocol stack with the device.

LUFA[28] is a third-party free software (MIT license) USB protocol stack for the USBKey and other 8-bit USB AVRs.

Raven wireless kit[edit source | editbeta]The RAVEN kit supports wireless development using Atmel's IEEE 802.15.4 chipsets, for ZigBee and other wireless stacks. It resembles a pair of wireless more-powerful Butterfly cards, plus a wireless USBKey; and costing about that much (under $US100). All these boards support JTAG-based development.

The kit includes two AVR Raven boards, each with a 2.4 GHz transceiver supporting IEEE 802.15.4 (and a freely licensed ZigBee stack). The radios are driven with ATmega1284p processors, which are supported by a custom segmented LCD display driven by an ATmega3290p processor. extracting exact software decrypting this memory dump recover code from an encrypted hacking hex file readback of a protected extracting the code break the protect code copy an encrypted IC Raven peripherals resemble the Butterfly: piezo speaker, DataFlash (bigger), external EEPROM, sensors, 32 kHz crystal for RTC, and so on. These are intended for use in developing remote sensor nodes, to control relays, or whatever is needed.

The USB stick uses an AT90USB1287 for connections to a USB host and to the 2.4 GHz wireless links. These are intended to monitor and control the remote nodes, relying on host power rather than local batteries.

Third-party programmers[edit source | editbeta]A wide variety of third-party programming and debugging tools are available for the AVR. These devices use various interfaces, including RS-232, PC parallel port, and USB. AVR Freaks has a comprehensive list.

Atmel AVR usage[edit source | editbeta]
Atmel AVR Atmega328 28-pin DIP on an Arduino Duemilanove board
Atmel AVR Atmega8 28-pin DIP on a custom development boardAVRs have been used in various automotive applications such as security, safety, read firmware code read eeprom data copy locked program read EEprom and ROM disassemble file recovering protected code unprotect powertrain and entertainment systems. Atmel has recently launched a new publication "Atmel Automotive Compilation" to help developers with automotive applications. Some current usages are in BMW, Daimler-Chrysler and TRW.

The Arduino physical computing platform is based on an ATmega328 microcontroller (ATmega168 or ATmega8 in board versions older than the Diecimila). The ATmega1280 and ATmega2560, with more pinout and memory capabilities, have also been employed to develop the Arduino Mega platform. Arduino boards can be used with its language and IDE, or with more conventional programming environments (C, assembler, etc.) as just standardized and widely available AVR platforms.

USB-based AVRs have been used in the Microsoft Xbox hand controllers. The link between the controllers and Xbox is USB.

Numerous companies produce AVR-based microcontroller boards intended for use by hobbyists, robot builders, experimenters and small recovery and read data recover the program break password extracting program from Microcontroller retrieving the hex source code lockbit locked copy source code blocked lockbits activated read security bytes system developers including: Cubloc,[29] gnusb,[30] BasicX,[31] Oak Micros,[32] ZX Microcontrollers,[33] and myAVR.[34] There is also a large community of Arduino-compatible boards supporting similar users.

Schneider Electric produces the M3000 Motor and Motion Control Chip, incorporating an Atmel AVR Core and an advanced motion controller for use in a variety of motion applications.[35]

FPGA clones[edit source | editbeta]With the growing popularity of FPGAs among the open source community, people have started developing open source processors compatible with the AVR instruction set. The OpenCores website lists the following major AVR clone projects:

pAVR,[36] written in VHDL, is aimed at creating the fastest and maximally featured AVR processor, by implementing techniques not found in the original AVR processor such as deeper pipelining.
avr_core,[37] written in VHDL, is a clone aimed at being as close as possible to the ATmega103.
Navré[38] written in Verilog, implements all Classic Core instructions and is aimed at high performance and low resource usage. It does not support interrupts.

General Questions About Microcontroller Firmware Extraction

---

• Is it safe to send payment to MikaTech ?

  If MikaTech was a bad company, you could find tons of bad reputations about its service on the internet over the 28 years history

  So, the answer is YES! We are good people.

  Why choose Mikatech, please click here to find out
  

  
  
• Can Mikatech break ics not listed on this site ?

  Different chip manufacturers have different part numbers, but the inner core of the chip can be make with same technology, it would be quite impossible to list all the part numbers where our technology can apply such as MYSON, STK, FEELING, ANALOG, FUJITSU, NOVATEK, LG/HYNDAI.
  
  Also by the advancing of the technology, everyday we gain more and more experience and develope new methods for reverse engineering for different Intergated Circuit parts. Full list of Integrated Circuit part numbers which is within our scope of capability is always getting bigger, please contact us to find out.

• Will my privacy be protected ?

  Mikatech Innovative Limited understands the importance of its clients' privacy. At the moment you contact Mikatech, the personal information from you will be put under protection by our management regulations which was developed by our years of practice, Mikatech uses these information to customize its service to you, it will never disclose these information to third party out of any reason.
  Every project we did, we will delete all the data, materials, and codes 60days after deliverig the files, it iwll protect us and protect your privacy.

• Is it legal to get service from Mikatech ?

  Yes, it is totally legal.
  Mikatech deliver its reverse engineering services for educational purposes only, it can be illegal to use above mentioned services in some coutries or regions, please check your local laws. Mikatech does not take any responsibility in relation to the use of above mentioned services that may be considered illegal.

  
  
• I sent you an email, why there is no answer ?

  • A. Our mail server is temperally broke down, your message has not been delivered to our mailbox even the mail sent successfully message is showed on the screen, please contact us again.
  • B. Our email is recognised as junk mail email by your mail server, so our reply has been rejected by your mail server or it is diverted to your junk mailbox, please remove our account from junkmail list or check your junk mailbox, or use another email account to contact such as gmail.
  • C. Your email is recognised as junk mail email by our mail server, so your email was put to our junk mailbox, please use another email account to contact us again.

• Invasive Decapsulation Workflows for Key Recovery

  Invasive Decapsulation Workflows for Locked Industrial MCU Code and Key Recovery. Among all existing MCU security attack methodologies, decapsulation and code recovery remain the most reliable, fully effective techniques to defeat permanently blown mcu lockbit lock configurations on industrial-grade embedded microcontrollers. Industrial MCUs deployed in manufacturing machinery, process control systems, and smart grid infrastructure implement the highest tier of OTP lockbit protection that cannot be altered, glitched, or bypassed through purely software means. These devices comply with IEC 62443 industrial cybersecurity standards, which mandate irreversible debug lockdown and isolated secure memory domains by default. When software and semi-invasive glitching attacks fail to bypass hardened lockbit barriers, security researchers and malicious actors alike must resort to physical invasive processing via decapsulation. The decapsulation workflow begins with precise device preparation to isolate the targeted MCU from its host printed circuit board (PCB). Technicians desolder the microcontroller using temperature-controlled rework stations to avoid thermal damage to the silicon die and internal bonding wires. Improper desoldering introduces thermal stress that can crack the die, corrupt OTP lockbit cells, or destroy delicate EEPROM memory arrays before analysis begins. Once removed from the PCB, the MCU undergoes visual inspection under a high-magnification metallurgical microscope to identify packaging thickness, epoxy compound type, and die positioning within the cavity. This inspection determines the optimal chemical agent and exposure time required for controlled material removal. The primary decapsulation method for standard epoxy-packaged MCUs is wet chemical etching using concentrated fuming nitric acid or sulfuric acid mixtures. These corrosive chemicals dissolve the mold compound epoxy without damaging the passivation layer covering the underlying silicon die. Technicians submerge the MCU in heated chemical solutions for calibrated durations, removing small layers of packaging material incrementally to avoid over-etching. After chemical etching completes, the die surface, aluminum bonding wires, and peripheral circuitry become fully visible under microscopic imaging. Advanced high-security MCUs use ceramic hermetic packaging instead of epoxy, which requires dry laser ablation decapsulation rather than chemical processing. Laser ablation uses focused ultraviolet laser beams to vaporize ceramic material layer by layer with zero thermal transfer to the die surface. This precision is critical for military and aerospace MCUs where thermal exposure would corrupt sensitive memory cells and lockbit OTP data. Once fully decapsulated, the silicon die undergoes surface cleaning with solvent rinses to remove residual packaging debris and etching byproducts. A final microscopic scan maps the physical layout of critical circuitry including lockbit logic gates, memory controller buses, EEPROM array peripherals, and crypto memory isolation modules. With direct physical access to the die circuitry, researchers can attach nanoscale tungsten probe tips to internal bus nodes that lie downstream of the mcu lockbit lock gating logic. These probe points bypass the hardware access restrictions imposed by blown lockbits, creating an unrestricted data pathway to all internal memory domains. This direct probing capability enables the completely unfiltered read-out of an EEPROM processor core registers, hidden configuration partitions, and runtime state data that is permanently blocked to external debug interfaces. The EEPROM processor’s internal control registers contain factory calibration offsets, temperature compensation values, and access permission tables that shape overall memory behavior. Extracting these registers allows analysts to reverse-engineer undocumented memory access rules used by the MCU during normal operation. Following register extraction, researchers execute systematic data acquisition sequences to fully dump flash and eeprom raw binary data from all non-volatile memory banks on the die. Flash memory dumps capture the complete industrial control firmware responsible for regulating machinery operation, safety interlocks, and communication protocols. EEPROM dumps retrieve persistent operational logs, device unique identifiers, and tamper event records stored across years of field deployment. These comprehensive memory dumps form the complete foundational dataset required for deep, granular microcontroller reverse engineering of locked industrial devices. Reverse engineers use the physical die layout map alongside dumped binary data to reconstruct undocumented instruction sets, hidden firmware modules, and proprietary communication protocols. The most high-value objective of post-decapsulation analysis is to access and copy contents of crypto memory, the hardware-isolated secure partition storing industrial root keys and safety verification hashes. Unlike user memory domains, crypto memory has no external bus connections and can only be accessed through direct die probing of dedicated security controller circuitry. Successfully copying these contents allows actors to decrypt encrypted firmware updates, forge safety certification signatures, and clone authenticated industrial control nodes. This capability poses severe physical security risks to critical infrastructure by enabling unauthorized device modification and malicious process manipulation. The complete invasive decapsulation and probing pipeline remains the gold standard for definitive firmware extraction from legacy industrial MCUs with irreversible OTP lockbit protection. No non-invasive technique can match its reliability for retrieving full memory contents and cryptographic secrets from the most securely locked embedded devices. To mitigate these invasive threats, industrial MCU manufacturers integrate active tamper detection circuitry that triggers crypto memory erasure if die probing or packaging removal is detected. Tamper sensors monitor capacitance, light exposure, and mechanical stress to identify decapsulation attempts in real time. When triggered, the security controller immediately overwrites all crypto memory contents with random noise, permanently eliminating sensitive key material before extraction can occur. This layered physical security complements traditional mcu lockbit lock barriers to raise the cost and complexity of invasive attacks beyond the reach of most non-state threat actors.