ATtiny85 Unlock — What Is Actually Possible?
The ATtiny85 is an 8-pin, 8-bit AVR microcontroller from Microchip (formerly Atmel) with 8 KB of flash, 512 bytes of EEPROM, and 512 bytes of SRAM. Its code-protection scheme relies on two lock bits (LB1 and LB2) configured through the fuse/lock byte — not hardware encryption or a secure boot chain. When a client provides proof of ownership and authorization, our engineers can recover the firmware from a locked ATtiny85 in most lock-bit configurations, with a realistic success rate above 90 % for Mode 3 (full lock) devices and near 100 % for Mode 2 (partial lock) devices.
How Does ATtiny85 Code Protection Work?
Understanding the protection is the first step toward a credible ATtiny85 unlock assessment. The ATtiny85 datasheet defines three lock-bit modes:
| Lock Mode | LB2 | LB1 | Flash/EEPROM Read via ISP | Self-Programming | Unlock Difficulty |
|---|---|---|---|---|---|
| Mode 1 (no lock) | 1 | 1 | Allowed | Allowed | None — standard readout |
| Mode 2 (partial) | 1 | 0 | Blocked | Allowed | Low |
| Mode 3 (full) | 0 | 0 | Blocked | Blocked | Moderate |
Mode 1 requires no unlock at all — the hex file reads out through any ISP programmer. Mode 2 disables external read but still permits internal self-programming, which opens side-channel and glitch-based recovery paths. Mode 3 disables both, requiring more invasive techniques. Crucially, the ATtiny85 lacks the die-level shielding, encrypted buses, or active tamper meshes found in modern 32-bit secure MCUs such as the STM32WB55 with its Cortex-M0+ security co-processor. This architectural simplicity is why AVR lock-bit bypass has a long, well-documented track record.
Fuse Byte Considerations
Beyond lock bits, the ATtiny85’s low, high, and extended fuse bytes control clock source, brown-out detection (BOD), watchdog, and reset-disable settings. A misconfigured RSTDISBL fuse (using the reset pin as I/O) blocks ISP access entirely, requiring high-voltage serial programming (HVSP) at 12 V on the reset pin just to communicate with the device — before any lock-bit work begins. Our lab keeps HVSP fixtures on hand for exactly this scenario.
ATtiny85 Unlock Techniques We Use
Every project starts with a non-destructive feasibility check. We verify the exact device revision (ATtiny85-20PU, ATtiny85V-10SU, etc.), read the fuse/lock signature, and choose the lowest-risk approach.
- Voltage-glitch attack: Precisely timed VCC transients during the lock-bit verification cycle can cause the security check to fail open. This is the primary method for Mode 3 devices and preserves the original die.
- UV exposure (older die revisions): Some pre-2012 ATtiny85 die revisions used EPROM-style lock cells that respond to focused UV through a decapped window. This technique is revision-dependent and destructive to the package but non-destructive to flash contents.
- HVSP fuse reset + re-read: For Mode 2 locks where only the ISP read path is blocked, a high-voltage reset can restore communication without a full chip erase — under specific timing conditions.
- Micro-probing (rare): Direct bus probing on a decapped die is technically possible but almost never cost-justified on an 8-bit AVR. We mention it for completeness; in practice the glitch path succeeds first.
What Can Go Wrong
Honesty matters here. Failure modes include:
- Die damage during decapping (chemical over-etch or mechanical cracking) — risk is under 5 % in our lab but non-zero.
- Flash charge degradation on very old devices (10+ years, high-temperature environments) leading to partial data corruption independent of lock bits.
- Counterfeit or remarked ATtiny85 chips that do not match the expected die layout — more common in grey-market sourced parts.
If the device cannot be recovered, our no-success-no-fee policy means you pay only the evaluation fee.
Cost and Turnaround for ATtiny85 Unlock
| Service Tier | Scope | Typical Price (USD) | Turnaround (Working Days) |
|---|---|---|---|
| Feasibility assessment | Lock-bit ID, fuse read, go/no-go report | Free – $50 | 1–2 |
| Standard unlock (Mode 2) | Firmware .hex + EEPROM dump | $350 – $500 | 5–8 |
| Advanced unlock (Mode 3) | Glitch/decap + firmware .hex + EEPROM | $500 – $900 | 7–12 |
| Rush service | Any mode, priority queue | +40 % | 3–5 |
Pricing varies with volume (batch discounts start at 5 units), device condition, and whether EEPROM extraction is needed alongside flash. We quote per-project after the feasibility check.
Deliverables You Receive
- Intel HEX file — full flash image, ready to program into a blank ATtiny85.
- EEPROM binary dump — separate .eep file if EEPROM contains calibration or configuration data.
- Fuse/lock byte report — original settings documented so you can replicate the exact configuration.
- Optional disassembly listing — annotated AVR assembly if you need to understand or modify the firmware (additional fee).
Who Needs an ATtiny85 Unlock?
The ATtiny85 appears in USB dongles, LED controllers, sensor nodes, hobby boards (Digispark clones), and countless low-cost embedded products. Typical authorized use cases include:
- Recovering firmware from a legacy product where the original source code was lost.
- Transferring firmware to replacement ATtiny85 chips when originals are damaged or end-of-life.
- Auditing your own product’s programmed firmware against source for quality control.
- Extracting calibration constants stored in EEPROM during factory programming.
Authorization and proof of IP ownership are required before we begin any ATtiny85 unlock project. We operate under NDA and follow the principles outlined on our trust and legal compliance page.
ATtiny85 vs. Other Common Unlock Targets
How does the ATtiny85 compare to other chips our clients frequently send?
| Parameter | ATtiny85 | PIC16F15 series | MSP430F2 series | 24C64 EEPROM |
|---|---|---|---|---|
| Architecture | 8-bit AVR | 8-bit PIC | 16-bit RISC | Serial EEPROM |
| Protection | 2 lock bits | CP/WRT config bits | JTAG fuse + BSL password | Write-protect pin only |
| Typical success rate | > 90 % | > 85 % | ~80 % | ~99 % |
| Typical cost | $350–$900 | $400–$800 | $500–$1,200 | $150–$300 |
| Turnaround | 5–12 days | 5–10 days | 7–15 days | 2–5 days |
If you are working with a PIC16F15 series device or need to recover data from a 24C64 serial EEPROM, we handle those under similar workflows. For 16-bit targets like the MSP430F2 family, the process is more involved due to JTAG fuse and BSL password layers.
How to Submit Your ATtiny85 for Unlock
- Request a feasibility assessment — send us the chip marking, your application context, and proof of ownership.
- Ship the device — we accept bare chips or populated PCBs. Pack in anti-static bags; include at least one spare unit if possible.
- Receive the go/no-go report — within 1–2 working days we confirm the lock mode and quote the project.
- Approve and wait — standard turnaround is 5–12 working days depending on lock mode.
- Download deliverables — encrypted file transfer; physical media on request.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can the ATtiny85 be unlocked without destroying the chip?
In most cases, yes. Voltage-glitch techniques are non-destructive and leave the original device fully functional. UV-based methods require package removal (decapping), which destroys the plastic housing but preserves the silicon and flash contents. We always attempt non-destructive paths first.
Is ATtiny85 unlock legal?
Firmware recovery is legal when performed on devices you own or are authorized to service. Common scenarios include lost source code, legacy maintenance, and quality audits. We require proof of ownership or a signed authorization letter before starting work, and every project is covered by NDA. See our compliance and trust policies for details.
What if my ATtiny85 has the reset pin disabled (RSTDISBL fuse)?
Disabling the reset pin blocks standard ISP access. We use high-voltage serial programming (HVSP) at 12 V to regain communication. This adds minimal time — typically less than one working day — and does not affect the lock-bit bypass procedure that follows.
Do you also extract EEPROM data from the ATtiny85?
Yes. The ATtiny85 has 512 bytes of EEPROM that is often used for calibration, serial numbers, or runtime configuration. We dump it as a separate .eep file alongside the flash .hex. EEPROM extraction is included in the standard unlock fee.
How does ATtiny85 security compare to newer AVR devices like ATtiny1614?
The newer tinyAVR 1-series (ATtiny1614, ATtiny3217, etc.) introduced UPDI programming and a more robust lock-bit scheme with a dedicated USERROW. They are harder to glitch than the classic ATtiny85 but still lack true hardware encryption. Success rates on newer tinyAVR parts are lower (roughly 70–80 %) and costs are higher. The ATtiny85’s simpler architecture remains one of the more straightforward AVR unlock targets.
Related Chip Unlock Services
- EFM32HG firmware recovery — Silicon Labs Cortex-M0+ with debug lock
- SST25VF SPI flash readout — Microchip serial flash with block protection
- PIC16F15 series unlock — Microchip 8-bit PIC with CP/WRT bits
- 24C64 EEPROM data extraction — I²C serial EEPROM recovery
- MSP430F2 JTAG fuse bypass — TI 16-bit ultra-low-power MCU
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote