An ATtiny crack is the process of reading the flash and EEPROM out of a locked ATtiny microcontroller so you get a usable binary back. Feasibility depends almost entirely on the exact part number and the lock bit state — an ATtiny13A behaves nothing like an ATtiny817. Send us clear photos of the chip marking and the board, and you get a straight yes, probably, or no before anything ships.
This page is written for the person who already has a locked part in hand: a maintenance engineer with a dead controller, or a product owner whose contract programmer disappeared with the hex file.
Why ATtiny parts land on our bench
ATtiny devices are small, cheap, and they end up in places nobody planned to maintain for fifteen years. Motor soft-starters, battery packs, HVAC damper actuators, coffee machine boilers, LED dimmer modules, sensor pods on agricultural equipment. Somebody programmed an ATtiny85 in 2011, shipped 40,000 units, and the source lives on a laptop that got recycled.
The other common case is obsolescence. An ATtiny2313 or ATtiny26 goes end-of-life, the drop-in replacement has a different fuse layout and a different peripheral map, and you cannot port firmware you do not have. Recovering the binary gives you something to disassemble, understand, and re-target.
Failure analysis is the third reason. A field return behaves oddly, and you want to compare what is actually in flash against what you believe you programmed. That comparison only works if you can read the part.
We work on the assumption that you own the design or have written authorization from whoever does. That is your responsibility to confirm, ours to keep confidential — every project runs under NDA, and we do not take on work aimed at copying a third party’s product.
What actually determines whether an ATtiny crack works
Four things, in this order of importance.
1. The exact part number, not the family
“ATtiny” covers about twenty years of silicon. The old classic tinyAVR parts — ATtiny13, ATtiny25/45/85, ATtiny2313, ATtiny24/44/84, ATtiny261/461/861 — use the traditional AVR lock bit scheme with LB1/LB2 plus separate boot lock bits on the larger parts. The newer 0-series and 1-series devices (ATtiny412, ATtiny814, ATtiny1614, ATtiny3216 and relatives) moved to UPDI programming with a fuse-controlled lockbit register and, on some parts, a completely different access model. Those are two different engineering problems. Give us the full marking including the suffix and the date code.
2. Which lock bits are actually set
Many boards ship with only the programming lock enabled and verification still possible, or with lock bits that were never written at all because someone forgot the last step in production. We check this first, because it takes minutes and it sometimes ends the job right there with a clean read. When full lock is set, we move to the harder approaches.
3. Package and die access
A SOIC-8 ATtiny85 or a PDIP-20 ATtiny2313 is comfortable to work with. A 3×3 mm QFN or the WLCSP variants are tighter, and if the part is under conformal coating or potting compound the prep work adds time before any electrical work starts. Tell us the package if you know it; if you don’t, a sharp photo tells us.
4. Whether the part is still alive
If the board was hit by a surge, the ATtiny may be damaged in a way that makes the flash array unreadable no matter what we do. A part that was drawing 200 mA before it went dark is a poor candidate. We check for basic signs of life early and tell you if the outlook is bad, rather than billing you for a week of effort.
ATtiny variants: rough difficulty picture
This is a general orientation, not a promise about your specific part. Every quote is based on the actual sample.
| Group | Typical parts | Programming interface | General difficulty |
|---|---|---|---|
| Early classic tinyAVR | ATtiny11, ATtiny12, ATtiny15, ATtiny26 | ISP / HVSP | Usually the most tractable group; often also the parts you most need, since they’re long obsolete |
| Mainstream classic tinyAVR | ATtiny13/13A, ATtiny25/45/85, ATtiny24/44/84 | ISP / HVSP / debugWIRE | Well-understood family, handled routinely |
| Larger classic tinyAVR | ATtiny2313/4313, ATtiny861, ATtiny1634 | ISP / debugWIRE / TPI on some | Comparable to above; bigger flash means longer verification |
| 0/1/2-series tinyAVR | ATtiny412, ATtiny816, ATtiny1614, ATtiny3217 | UPDI | Newer security model, case-by-case, sometimes not feasible |
If your part sits in that bottom row, expect a more cautious answer from us. We would rather tell you “we don’t think we can do this one” than take your money and spend three weeks proving it. The same logic applies across other 8-bit families — the difficulty profile of a PIC16F crack or a Winbond W78E crack is driven by its own generation of security features, not by anything in common with AVR.
What to send us before you ship anything
The free check exists so you don’t pay shipping and customs on a job we can’t do. Send this by email or WhatsApp:
- Photos of the chip, in focus, readable marking. Top line and bottom line both. Use a phone macro mode against a dark background, no flash glare across the laser mark.
- Photos of both sides of the whole board, entire board in frame, on a dark background. This tells us about coating, potting, connector access, and whether the ISP header is still populated.
- Board dimensions, roughly, in mm. Helps us judge scale from the photos.
- Quantity. One sample for evaluation, or twenty units you need reprogrammed afterward — different job.
- One line on what you need back. Flash binary only? Flash plus EEPROM plus fuse settings? Blank chips programmed and returned? Say it plainly.
- Anything you already know. “It was programmed by a subcontractor in Poland in 2014”, “the ISP header works but verify fails”, “we have the old .eep but not the .hex” — all of that shortens our work.
What comes back from us: a feasibility read (yes / likely / case-by-case / no), an estimated lead time, and a price. If we need the physical part to answer, we say so instead of guessing.
How to ship, if we go ahead
Send two samples if you can spare them. Working parts are better than dead ones. If the ATtiny is soldered down and you’re not comfortable removing it, ship the whole board — we’d rather desolder it here than receive a part with a lifted pad. Anti-static bag, rigid box, and put the declared value low but honest for customs.
The process, in the order it happens
- Intake and identification. We confirm the marking under a stereo microscope, check for remarking or sanding, and log the package and revision. Fake and relabeled AVR parts are common enough that this step matters.
- Non-destructive electrical assessment. Power the part on a test fixture, confirm it’s alive, attempt a standard read, and read back the lock and fuse state where accessible. Sometimes this is where the job ends successfully.
- Approach selection. Based on step 2, the engineer picks a route for that specific ATtiny generation. Classic tinyAVR parts and UPDI parts go down different paths. We do not publish the technique details, and we don’t attempt anything that can’t be reversed if it fails halfway.
- Extraction. Flash read out, EEPROM read out where requested, fuse bytes recorded so you can reproduce the original configuration.
- Verification. This is the part most vendors skip describing. We re-read and compare dumps for consistency, sanity-check the reset vector and interrupt table against what an AVR image should look like, look at whether the tail of flash is plausible (0xFF fill vs. garbage), and where you’ve given us a working board we program a blank ATtiny of the same type and run it in the original circuit to confirm behavior matches.
- Handover. Binary and Intel HEX, EEPROM image if applicable, fuse and lock bit notes, and your original samples back.
Honest limits worth knowing
No lab can guarantee any specific ATtiny crack. Here’s where things get difficult or stop:
- Newer UPDI-based tinyAVR with the lockbit fully engaged. Genuinely case-by-case. Sometimes no.
- Physically damaged die. Cracked packages, surge damage, water ingress that has corroded bond wires — often unrecoverable.
- Only one sample, and it’s the customer’s only unit. We’ll tell you the risk before starting. Some approaches carry a chance the part doesn’t survive.
- Firmware that’s encrypted or obfuscated at the application level. We can give you the bytes. If the developer XORed the
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quoteRelated reading