Tuesday, November 13, 2007

Atmega169P (Quick Peek)

We were curious if Atmel has finally shrunk the AVR series smaller than the current 350nm 3 metal layer process. Their main competitors (Microchip) have began showing 350nm 4 metal layer devices and Atmel has a few new product lines out (CAN, Picopower, and USB featured devices).

We chose to examine their picoPower line of AVR's since they claim true 1.8v operation. The only picoPower device in stock from Digikey was the ATMEGA169P. We used the 64 pin TQFP package for our review.

We took some quick images of some areas we think you will enjoy-

Delayering the device is one of the steps in analyzing any substrate. The part below was being delayered to remove it's top two metal layers. The part is in-between Metal3 (M3) and Metal1 (M1) right now. Some of Metal2 (M2) has begun to remove. More time would finish off the removal of M2 but this was enough for us.

We are very familiar with the Atmel AVR line (to include the AT90SC smartcard family) and thus left it in the package not being concerned (there are various reasons to remove it completely out of the carrier it is bonded in which we won't get into here).

The lower corner has the die identification (AT 355B6), Corporate logo, and the year.

A picture of the Flash and EEPROM output areas-

It is our opinion that this processor is one of the most secure from the less-than 32 bit MCU off-the-shelf choices out there. There are debug test-points spread around the device (we would love to hear feedback from whoever thinks they see them hint hint) but don't try to probe them if the device is locked. Atmel wised up around 2005 are turned those off if the lockbits are set (Hello Arne!).


  1. I believe the test pads are mostly at the top center and a few at the lower left. The picture isn't high enough resolution to see well, but those appear to be fused off, hence my guess.

  2. We placed small green dots inside the square test-pads Atmel's engineers liberally placed around the die. This photo was a crop of the larger one shown above.

    Don't get too excited, these pads do nothing when the chip is secured.

  3. is it possible to read code from locked mcu through chemical or using fbi machine?

  4. Hi,
    when i commented on this page one year back..i am looking for in formations on possibilities of reading locked micro-controllers/dsp/etc codes
    now i can say its definitely possible and 100% can crack any locked mcu device...
    for more information how it can be done contact with me on

  5. Cracking any MCU is always possible.

    You just need the right software and/or hardware tools :)