Short answer: most classic tinyAVR parts — ATtiny13/13A, ATtiny25/45/85, ATtiny24/44/84, ATtiny2313/4313, ATtiny26, ATtiny261/461/861 — are routinely readable, and ATtiny unlock work on these is bread-and-butter for a lab like ours. The newer 0-series, 1-series and 2-series parts (ATtiny202, 412, 814, 1614, 3216, 1627 and relatives) use a different programming interface and a different lock scheme, and feasibility there is decided case by case. If you tell us the exact marking on the package, we can tell you which group yours falls in.
Why the ATtiny family splits into two very different problems
Everything Atmel shipped before the 2016 redesign uses the same basic protection idea as the rest of classic AVR: two lock bits (LB1/LB2) in a separate fuse space, plus BLB bits on the larger parts. Set them, and the ISP or HVSP programmer will refuse to hand back flash and EEPROM contents. Erase them, and the chip erases flash first — that ordering is the whole point of the mechanism.
The 0/1/2-series parts replaced ISP and TPI with UPDI, moved the lock byte into a fuse row, and added a key-based access path plus CRCSCAN for integrity. Functionally that means a locked modern tinyAVR does not present the same surface as an ATtiny85. So when someone asks “can you do ATtiny unlock,” the first thing an engineer here does is read the part number, not quote a price.
How to tell which group you have in thirty seconds
- Three or four digits, no dash-suffix generation — ATtiny13A, ATtiny85, ATtiny2313A: classic. ISP (SPI) or TPI on the 4/5/9/10/20/40 parts.
- Digits where the last two indicate flash size — ATtiny814, ATtiny1614, ATtiny3216: modern series, UPDI only, single-wire on the RESET/UPDI pin.
- ATtiny4, 5, 9, 10, 20, 40, 102, 104 — very small TPI parts, a separate sub-case with its own quirks.
Which ATtiny parts we usually read, and which are harder
The table below reflects how we triage incoming samples. Nothing here is a promise for your specific device — silicon revision, date code, and whether a previous engineer already attempted something all move the needle.
| Part group | Interface | Protection | Typical feasibility |
|---|---|---|---|
| ATtiny13 / 13A | ISP | LB1/LB2 lock bits | Commonly readable; large body of prior work |
| ATtiny25 / 45 / 85 | ISP, HVSP | Lock bits, optional debugWIRE disable | Commonly readable |
| ATtiny24 / 44 / 84 | ISP | Lock bits | Commonly readable |
| ATtiny2313 / 4313, ATtiny26, ATtiny261/461/861 | ISP | Lock bits, BLB on larger flash | Usually readable |
| ATtiny4 / 5 / 9 / 10 / 20 / 40 | TPI | Single lock bit in config | Case by case; tiny die, few pads |
| ATtiny1634, ATtiny87/167 | ISP | Lock bits | Case by case |
| ATtiny202/204, 402/404/412/414, 804/814, 1604/1614, 1616/3216, 1627 | UPDI | Fuse-row LOCKBIT, key-gated access | Evaluation required before any commitment |
If your board carries an ATmega instead, or a mix of both, the same triage logic applies with different specifics — the classic AVR lock-bit story is shared across the line. The comparison worth reading is how AVR stacks up against Microchip’s own 8-bit alternatives; engineers deciding between the two usually also look at how PIC16F parts behave under the same kind of evaluation.
What actually happens to your chip in the lab
No marketing language here, just the sequence. It rarely changes.
- Intake and identification. We photograph the package under a stereo microscope, log the full top marking including date and lot code, and confirm the die generation. An ATtiny85-20SU and an ATtiny85V from a different fab period are not automatically the same job.
- Non-destructive interrogation first. The part goes onto a socket or a fixture. We confirm the device signature responds, check whether the reset pin has been repurposed as I/O by a fuse setting, and read the fuse and lock byte states we can read. Sometimes a chip that “won’t read” is only a signature or clock-source problem, and the job ends here cheaply.
- Feasibility call. Based on generation, protection state, and what the initial probing shows, we tell you readable / probably readable / not with current methods. This is where you decide whether to spend money.
- Extraction. Depending on the part, this is done electrically or, for some parts, after the kind of preparation we describe for MSP430 fuse work — the surface has to be accessible before anything else matters. We do not publish method detail, for obvious reasons.
- Verification. This is the step most customers forget to ask about, and it’s the one that decides whether the dump is worth anything. We program the recovered image into a blank ATtiny of the same variant, reproduce the fuse configuration, and run it on your board or on our own harness. Then we compare behavior against the original: clock output, PWM duty, UART framing, EEPROM contents after a normal power cycle.
The verification step catches the failure mode that matters most on small AVRs: an image that reads out clean but was captured with the wrong fuse assumptions, so the clock divider or brown-out level differs and the firmware misbehaves in ways that look like a hardware fault.
The EEPROM problem, specific to ATtiny
ATtiny parts have small EEPROM arrays — 64 bytes on an ATtiny13, 512 on an ATtiny85 — and product firmware very often stores calibration constants, run hours, or a unit serial number there. Flash without EEPROM gives you a program that boots and then behaves like a factory-fresh unit. Tell us up front if the board is calibrated, because the EEPROM image has to be captured from your unit, not from a golden sample.
Honest limits on ATtiny unlock
Four situations genuinely change the answer, and we’d rather say so before you ship anything.
- Modern 0/1/2-series parts. UPDI-locked tinyAVR is a harder class than an ATtiny85. Some are workable, some are not, and the honest answer depends on the specific device and revision. We will not quote one sight unseen.
- Prior attempts. If a previous shop or a technician already ran a chip erase, tried high-voltage programming with the wrong pin voltages, or decapped the part badly, the flash may already be gone. Erase-on-unlock is the designed behavior, not a mistake.
- Physically damaged silicon. Field failures — lightning-struck controllers, boards that saw reverse polarity — can leave a die with a shorted I/O cell. Sometimes the flash array is still intact and readable; sometimes the whole quadrant is dead.
- Single sample, no spare. With one irreplaceable part, we go the slowest and most conservative route, and we tell you the risk before starting. If you can send two identical units, do.
We don’t publish success-rate percentages for ATtiny unlock, because the number would be meaningless across such a wide family. What we do commit to is a straight yes / probably / no after evaluation, before you’re committed to the full cost.
What to send us, and what comes back
Getting a real quote instead of a vague one takes about five minutes of preparation on your side.
Send us
- The complete top marking of the chip — all lines, including the date/lot code. A macro photo is fine and better than typing it out.
- Clear photos of both sides of the board against a dark background, whole board in frame, in focus, no flash glare. Add a close-up of the ATtiny and its immediate surroundings.
- Board dimensions and whether the part is socketed, through-hole, or SMD (SOIC-8, SOIC-14, QFN-20, TSSOP).
- Whether anyone has already tried to read or erase the device, and what tool they used.
- One line on deliverables: raw binary only, or binary plus fuse map, or a programmed replacement chip you can drop in.
You get back
- A feasibility answer tied to your specific part number and revision.
- Lead time, and price with the cost drivers named — generation, protection state, whether EEPROM is included, how many units you need programmed.
- On completion: the flash image, the EEPROM image if requested, the fuse and lock byte settings needed to reproduce the original behavior, and the verification notes from the test run.
What drives the price is not mysterious. Classic ISP parts sit at the low end. TPI micro-packages and modern UPDI devices sit higher because the evaluation itself takes real bench time. Adding programmed replacement chips or a full board-level check adds to it. We quote per project rather than off a rate card, and the same logic applies to newer 32-bit families where evaluation dominates the effort.
Legitimate reasons people ask for this
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote
Related reading
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote