Every USB-capable AVR family has a small sibling, and on the U4 line that sibling is the ATmega16U4. It carries 16 KB of ISP flash, 1.25 KB of SRAM and 512 bytes of EEPROM in a 44-lead TQFP (10 x 10 mm) or QFN (7 x 7 mm) package, with 26 programmable I/O lines doing the work. When a client asks us to extract encrypted ATmega16U4 firmware, the job usually begins with a board that enumerates on USB but misbehaves in exactly one corner of its protocol, or with a discontinued part whose only copy of the application lives on a locked die.
Three Regions Worth Reading
A U4 die holds more than the application image, and a partial readout is a rebuild that fails in the field. The flash array of 16 KB holds the application, optionally a bootloader section whose size the BOOTSZ fuses select, and the lock bits at the very top of the fuse space. The 512-byte EEPROM sits in its own address space and typically carries calibration values, serial numbers or HID report strings. Finally, three fuse bytes and the lock byte record the clock source, the debug and boot configuration, and the protection level. We image all of them in one pass, because an application that depends on an 8 MHz internal oscillator calibration or a specific boot size will not survive being dropped onto a blank chip with default fuses.
Two Doors Into A Locked Part
The 16U4 exposes two programming interfaces, and they fail differently under protection. The SPI path is the classic ISP: MOSI, MISO, SCK and RESET, entering through the standard six-pin header. Lock-bit mode 2 blocks further programming; mode 3 blocks programming and verification, which is the setting that actually hides the image from a programmer. The second door is JTAG, IEEE 1149.1 compliant, wired to four dedicated pins on the 44-lead package. JTAG supports boundary scan, on-chip debug, and programming of flash, EEPROM, fuses and lock bits. Under lock-bit mode 3 the debug system is gated as well, but the JTAG access path follows a different enable chain (the JTD bit and the JTAGEN fuse) than the SPI chain (SPIEN), so a part whose SPI entry was closed by a cleared fuse is sometimes still reachable through JTAG, and the reverse also happens. Working out which door is open is the first measurement of the session, not an afterthought.
Image Anatomy
The readout is delivered as two Intel HEX files plus a fuse report. The flash image runs from 0x0000 up to 16 KB, and if a bootloader section exists we keep the boundary in the report so a rebuild team knows where the application may and may not write. The EEPROM file covers the full 512 bytes. Because the U4 core writes flash by page with read-while-write support, a factory bootloader may legitimately occupy the top of the array; erasing that region on a replacement chip would break USB re-enumeration, so the report states which pages came from the application and which from boot code.
How The Session Runs
We work from the board whenever the socket would damage a conformally coated assembly. The 2.7 to 5.5 V supply range of the U4 family means the board itself usually provides a legal VCC; we measure it before applying anything. Entry attempts proceed from the least invasive interface to the most, and every readback is verified twice against the die before it leaves the bench. Nothing is erased; the part returns to service with its original content intact. Where both entry paths are closed, the report records the exact fuse and lock combination that blocks each one, so the client’s own engineers can evaluate whether a redesign of the protection – on a replacement part, never on the donor – is worth the effort.
Deliverables
Each engagement closes with the flash HEX, the EEPROM HEX, the decoded fuse and lock-byte table, and a pin-level note describing which entry path produced the image. A rebuild bench can then flash an identical 16U4 – or its 32 KB sibling, the ATmega32U4, when a code-growth retrofit is planned – and compare enumeration behaviour against the donor board. For smaller bridge-type replacements, the 32-pin ATmega8U2 is the part we most often see specified as a substitute, and the same image-handling discipline applies. Request a written quotation through the services desk or the contact form.