Clone ATXMEGA128A4U-MH locked MCU program
November 14th, 2026 | 
Author: A sound clone ATXMEGA128A4U-MH locked MCU program assessment is a technical document, not a claim. The ATXMEGA128A4U-MH exposes its signature and fuse bytes over PDI while keeping a locked application array closed. MH selects the 44-pad QFN body on the top-capacity part, where board-level decoupling dominates the rework notes.
Limits and options for clone ATXMEGA128A4U-MH locked MCU program
At the top of the A4U line the same 8/16-bit XMEGA RISC pipeline delivers 32 MIPS at 32 MHz, but the larger SRAM and the doubled boot section change how a USB application is structured. Thirty-two working registers sit directly on the ALU, most instructions complete in one cycle, and a programmable multilevel interrupt controller handles peripheral traffic. The device runs from 1.6 to 3.6 V, with the full 32 MHz ceiling only above 2.7 V and a 12 MHz limit at the lowest rail. Source code, a compiled binary and the contents of flash are three different levels of evidence on any integrated circuit.
Application, boot and EEPROM regions
This member carries 128 Kbytes of in-system self-programmable flash, an 8 Kbyte boot code section, 8 Kbytes of SRAM and 2 Kbytes of EEPROM. The 8 Kbyte boot section is the family’s largest, and its independent lock bits mean a bootloader image has to be archived separately from the application. Flash endurance exceeds 10,000 erase/write cycles, EEPROM 100,000, both with 20-year retention, and CRC-16 and CRC-32 generators are provided for integrity checks. The 32 MHz ceiling only applies above 2.7 V; a board running at 1.8 V must stay within the 12 MHz limit stated in the datasheet. A heximal export must label application pages, boot pages, EEPROM, fuse bytes and the calibration row; collapsing them into one binary file makes later source code reconstruction unreliable. The surrounding XMEGA and general AVR material is linked here: ATXMEGA16A4U-AU flash documentation.
Identification without a readout
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 128 KB / 8 KB SRAM / 2 KB EEPROM |
| Program memory | 128 Kbytes of self-programmable flash, 8 Kbyte boot section |
| EEPROM | 2 Kbytes, byte-erasable, 100K cycles |
| SRAM | 8 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Independent lock-bit groups cover the boot section and the application flash, and the calibration row is separately protected on this member. The AES/DES engine, the DMA controller and the event system are application features and provide no service route around the lock field. Chip erase is the operation that clears protection, and it removes the application and EEPROM contents in the process. Related device notes on this site cover the wider family: ATXMEGA32A4U-AU flash documentation.
Clock, USB and ADC references
USB 2.0 full-speed device operation at 12 Mbps with 32 endpoints and an on-chip transceiver regulator is standard, as are the four-channel DMA controller and the eight-channel event system that let peripherals communicate without CPU involvement. Five USARTs (one IrDA capable), two TWI ports with dual address match and two SPI ports cover serial traffic. A microcontroller with its lock bits set still yields a usable documentation package: marking, memory, code and data regions, and a signed archive comparison. For background on a neighbouring part, see ATXMEGA64A4U-MHR flash documentation.
Footprint comparison across the line
AU is the 44-lead TQFP, AUR its reel-packed form and MH the 44-pad QFN; all three expose 34 programmable I/O lines and the dedicated PDI pair, and all carry the same 128 Kbyte die. An 8 Kbyte boot section can hold a complete USB bootloader, so its lock group deserves a separate entry in any archive manifest. Power sequencing and the reset source are recorded before a programmer is attached, because a misread rail on a dense QFN board is expensive to repair. A trailing R is a packing code, not a change to the memory map or the lock behaviour. The AVR cross-reference is documented in Break chip atmega48pa firmware.
Documentation deliverables and terms
This is the largest A4U member, and its 8 Kbyte boot section is double that of the lower capacities while SRAM reaches 8 Kbytes. Every member keeps the same 44-pin or 49-ball footprint, USB device controller, PDI interface and analogue block, so a schematic alone cannot identify which die is fitted. Our written scope covers the package marking, ordering code, PDI signature, fuse bytes, clock source and supply rails, then a comparison with the owner’s release archive. Where the array is unlocked we return separate labelled images for application flash, the 8 Kbyte boot section and the EEPROM calibration data. Where lock bits are set we supply an identification and documentation package and state plainly that chip erase destroys the application. A comparable recovery note is Break chip atmega48pa heximal.
Owners considering clone ATXMEGA128A4U-MH locked MCU program should expect a technical deliverable first: a datasheet-based identification record, a labelled image where the lock bits permit one, and a clear written statement where they do not. We explain that a chip erase removes the firmware together with the protection, require written authorisation before any destructive step, and never price a service that depends on defeating the lock field. That boundary is what keeps a recovered program file usable as evidence years later.
Posted in 
Break ATXMEGA128A4U-AUR protected microprocessor file
Owners who need to break ATXMEGA128A4U-AUR protected microprocessor file often hold a signed build archive but no longer have the programming fixture. With the ATXMEGA128A4U-AUR, that archive plus a PDI identification report is usually the fastest route to a usable answer. The AUR suffix adds reel packing to the 44-lead TQFP option and leaves the 128 Kbyte array and 8 Kbyte boot section untouched.
break ATXMEGA128A4U-AUR protected microprocessor file seen from the programming header
At the top of the A4U line the same 8/16-bit XMEGA RISC pipeline delivers 32 MIPS at 32 MHz, but the larger SRAM and the doubled boot section change how a USB application is structured. Thirty-two working registers sit directly on the ALU, most instructions complete in one cycle, and a programmable multilevel interrupt controller handles peripheral traffic. Attacking a protection field is not a service we offer; assessing what an authorised owner can archive is.
Memory budget of this capacity
This member carries 128 Kbytes of in-system self-programmable flash, an 8 Kbyte boot code section, 8 Kbytes of SRAM and 2 Kbytes of EEPROM. The 8 Kbyte boot section is the family’s largest, and its independent lock bits mean a bootloader image has to be archived separately from the application. Flash endurance exceeds 10,000 erase/write cycles, EEPROM 100,000, both with 20-year retention, and CRC-16 and CRC-32 generators are provided for integrity checks. The 128 KB / 8 KB SRAM / 2 KB EEPROM specification is unique to this ordering group. Further reading on adjacent microcontrollers: ATXMEGA128A4U-MH flash documentation.
Protection behaviour under chip erase
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 128 KB / 8 KB SRAM / 2 KB EEPROM |
| Program memory | 128 Kbytes of self-programmable flash, 8 Kbyte boot section |
| EEPROM | 2 Kbytes, byte-erasable, 100K cycles |
| SRAM | 8 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Independent lock-bit groups cover the boot section and the application flash, and the calibration row is separately protected on this member. PDI exposes the device signature, fuse bytes and reported memory size, but an external read of a locked application array returns no usable instructions. With 8 Kbytes of SRAM, endpoint buffers and DMA descriptors occupy a larger share of the map and must be documented alongside the program file. The AES/DES engine, the DMA controller and the event system are application features and provide no service route around the lock field. Chip erase is the operation that clears protection, and it removes the application and EEPROM contents in the process. The surrounding XMEGA and general AVR material is linked here: ATXMEGA16A4U-CU flash documentation.
Peripheral settings worth archiving
USB 2.0 full-speed device operation at 12 Mbps with 32 endpoints and an on-chip transceiver regulator is standard, as are the four-channel DMA controller and the eight-channel event system that let peripherals communicate without CPU involvement. Five USARTs (one IrDA capable), two TWI ports with dual address match and two SPI ports cover serial traffic. Endpoint buffers and DMA descriptors therefore belong in any complete software documentation, not just the executable program. Decapsulate, decode and retrieve are useful verbs in a keyword, but on a locked integrated circuit only the decode of an unlocked array is technically available. Related device notes on this site cover the wider family: ATXMEGA32A4U-MH flash documentation.
Ordering suffixes and what they change
AU is the 44-lead TQFP, AUR its reel-packed form and MH the 44-pad QFN; all three expose 34 programmable I/O lines and the dedicated PDI pair, and all carry the same 128 Kbyte die. Power sequencing and the reset source are recorded before a programmer is attached, because a misread rail on a dense QFN board is expensive to repair. For background on a neighbouring part, see Break chip atmega1280 flash.
Owner consent and final handover
This is the largest A4U member, and its 8 Kbyte boot section is double that of the lower capacities while SRAM reaches 8 Kbytes. That is precisely why the marked ordering code and the reported array size come first in any service note. The 32 MHz ceiling only applies above 2.7 V; a board running at 1.8 V must stay within the 12 MHz limit stated in the datasheet. A board laid out for this part can be assembled with a smaller sibling, and the only visible symptom of that substitution may be a linker or runtime failure months later. Our written scope covers the package marking, ordering code, PDI signature, fuse bytes, clock source and supply rails, then a comparison with the owner’s release archive. Where the array is unlocked we return separate labelled images for application flash, the 8 Kbyte boot section and the EEPROM calibration data. The AVR cross-reference is documented in Break chip atmega162l firmware.
To discuss break ATXMEGA128A4U-AUR protected microprocessor file for a specific board, send the marking, the schematic if available and the reason the original build output is no longer accessible. We return a feasibility note that separates what the silicon exposes from what would require destroying the application, and we only proceed after the owner confirms the scope in writing. Legacy USB controllers are our regular work, and the handover is a documented file set rather than an undocumented promise about a locked chip.
Retrieve ATXMEGA128A4U-AU secured chip binary
For legacy USB boards the first question behind retrieve ATXMEGA128A4U-AU secured chip binary is which memory region is actually needed. The ATXMEGA128A4U-AU keeps application flash, boot code and calibration data in distinct areas. AU on the largest member denotes the 44-lead TQFP, still pin compatible with the 16 Kbyte device in the same family.
What retrieve ATXMEGA128A4U-AU secured chip binary can realistically deliver
At the top of the A4U line the same 8/16-bit XMEGA RISC pipeline delivers 32 MIPS at 32 MHz, but the larger SRAM and the doubled boot section change how a USB application is structured. An 8 Kbyte boot section can hold a complete USB bootloader, so its lock group deserves a separate entry in any archive manifest. The device runs from 1.6 to 3.6 V, with the full 32 MHz ceiling only above 2.7 V and a 12 MHz limit at the lowest rail. A cloned image without its fuse bytes and calibration row rarely behaves like the original firmware on the same board.
Region labels in a usable image
This member carries 128 Kbytes of in-system self-programmable flash, an 8 Kbyte boot code section, 8 Kbytes of SRAM and 2 Kbytes of EEPROM. The 8 Kbyte boot section is the family’s largest, and its independent lock bits mean a bootloader image has to be archived separately from the application. A heximal export must label application pages, boot pages, EEPROM, fuse bytes and the calibration row; collapsing them into one binary file makes later source code reconstruction unreliable. The 128 KB / 8 KB SRAM / 2 KB EEPROM specification is unique to this ordering group. A comparable recovery note is ATXMEGA128A4U-AUR flash documentation.
Lock bits, calibration row and fuses
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 128 KB / 8 KB SRAM / 2 KB EEPROM |
| Program memory | 128 Kbytes of self-programmable flash, 8 Kbyte boot section |
| EEPROM | 2 Kbytes, byte-erasable, 100K cycles |
| SRAM | 8 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Independent lock-bit groups cover the boot section and the application flash, and the calibration row is separately protected on this member. PDI exposes the device signature, fuse bytes and reported memory size, but an external read of a locked application array returns no usable instructions. The AES/DES engine, the DMA controller and the event system are application features and provide no service route around the lock field. Further reading on adjacent microcontrollers: ATXMEGA16A4U-MH flash documentation.
USB stacks and their memory footprint
USB 2.0 full-speed device operation at 12 Mbps with 32 endpoints and an on-chip transceiver regulator is standard, as are the four-channel DMA controller and the eight-channel event system that let peripherals communicate without CPU involvement. With 8 Kbytes of SRAM, endpoint buffers and DMA descriptors occupy a larger share of the map and must be documented alongside the program file. A twelve-channel 12-bit ADC at 2 Msps, a two-channel 12-bit DAC at 1 Msps, two window comparators, five 16-bit timer/counters, a 16-bit RTC and QTouch library support complete the peripheral set. Endpoint buffers and DMA descriptors therefore belong in any complete software documentation, not just the executable program. Owners sometimes ask for a duplicate chip when what they actually need is the EEPROM file and the firmware that addresses it. The surrounding XMEGA and general AVR material is linked here: ATXMEGA32A4U-AUR flash documentation.
Choosing the right body for rework
AU is the 44-lead TQFP, AUR its reel-packed form and MH the 44-pad QFN; all three expose 34 programmable I/O lines and the dedicated PDI pair, and all carry the same 128 Kbyte die. A trailing R is a packing code, not a change to the memory map or the lock behaviour. Related device notes on this site cover the wider family: Break AVR atmega64a binary.
How the service is quoted
This is the largest A4U member, and its 8 Kbyte boot section is double that of the lower capacities while SRAM reaches 8 Kbytes. Every member keeps the same 44-pin or 49-ball footprint, USB device controller, PDI interface and analogue block, so a schematic alone cannot identify which die is fitted. That is precisely why the marked ordering code and the reported array size come first in any service note. Our written scope covers the package marking, ordering code, PDI signature, fuse bytes, clock source and supply rails, then a comparison with the owner’s release archive. The 32 MHz ceiling only applies above 2.7 V; a board running at 1.8 V must stay within the 12 MHz limit stated in the datasheet. Where lock bits are set we supply an identification and documentation package and state plainly that chip erase destroys the application. For background on a neighbouring part, see Break AVR MCU attiny84 protected source code.
Any retrieve ATXMEGA128A4U-AU secured chip binary request is handled the same way on every A4U board: identify the fitted capacity, record the memory map and clock tree, then compare the customer’s archived build output with what PDI reports. Where the array is unprotected a labelled program heximal and a separate EEPROM data file can be returned; where it is protected we supply an identification and documentation package instead. All work is scoped in writing for the owner or an authorised agent, with the erase consequence stated up front.
Duplicate ATXMEGA64A4U-CUR encrypted memory firmware
The phrase duplicate ATXMEGA64A4U-CUR encrypted memory firmware covers several different deliverables – a program file, an EEPROM data set or simply an identification report. This page separates those outcomes for the ATXMEGA64A4U-CUR. CUR is the reel-packed 49-ball version; neither the flash geometry nor the lock-bit behaviour changes with the shipping form.
An honest answer to duplicate ATXMEGA64A4U-CUR encrypted memory firmware
With 64 Kbytes of program flash this member is often chosen when a USB device stack, a bootloader, a calibration table and application logic all have to coexist. The XMEGA core executes most instructions in a single cycle from a two-stage pipeline, with 32 registers directly connected to the ALU and up to 32 MIPS at 32 MHz. The power management controller supports five sleep modes, and brown-out detection plus a watchdog on a separate oscillator guard the 1.6 to 3.6 V supply window. The term heximal appears throughout legacy service notes, but what an engineer actually needs is a labelled program and data file set.
Flash endurance and image integrity
The ordering table gives 64 Kbytes of self-programmable flash plus a 4 Kbyte boot section, 2 Kbytes of EEPROM and 4 Kbytes of SRAM. The NVM controller manages page erase and write, and the CRC generators support integrity checking of a captured region. For a QFN body the exposed pad carries ground and heat, so rework notes should record the solder profile as well as the marking. Flash endurance is above 10,000 cycles, EEPROM above 100,000, both with 20-year retention. The 64 KB / 4 KB SRAM / 2 KB EEPROM combination identifies this member. The AVR cross-reference is documented in ATXMEGA128A4U-AU flash documentation.
Why the crypto engine is not a backdoor
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 64 KB / 4 KB SRAM / 2 KB EEPROM |
| Program memory | 64 Kbytes of self-programmable flash, 4 Kbyte boot section |
| EEPROM | 2 Kbytes, byte-erasable, 100K cycles |
| SRAM | 4 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Lock bits on this device separate the boot section from the application array, and the calibration row is protected in its own right. Neither the AES/DES crypto engine nor the four-channel DMA controller offers an alternative path into the locked array, since both are application peripherals. A chip erase clears the lock field and the application in one operation, which is why an owner’s archived build output is worth more than any destructive attempt. Where a signed release archive exists, comparing its checksum with the board’s observable behaviour is the reliable route to reconstruction. A comparable recovery note is ATXMEGA16A4U-AU flash documentation.
Converter and timer configuration
The on-chip USB 2.0 device controller supports 12 Mbps full speed and 1.5 Mbps low speed with 32 endpoints and flexible endpoint configuration, plus an internal regulator for the transceiver. A four-channel DMA controller and an eight-channel event system move data between peripherals without CPU intervention. Five 16-bit timers, a 16-bit RTC and QTouch support complete the list. Recording the USB descriptor, endpoint allocation and ADC reference selection is part of documenting any recovered software. Protective lock bits, an encrypted data region and a secured boot section are three separate concepts that an identification report must distinguish. Further reading on adjacent microcontrollers: ATXMEGA32A4U-AU flash documentation.
Marking, schematic and supply checks
The CU suffix selects the 49-ball VFBGA body, MHR the reel-packed 44-pad QFN and CUR the reel version of the ball grid; all three carry the same 64 Kbyte die and 34 programmable I/O lines. Calibration constants held in EEPROM are board specific, so a copied program image without the matching data file rarely reproduces the original behaviour. Supply decoupling needs 100 nF ceramics at VCC and AVCC plus a 10 uF bulk part, and the analogue rail benefits from a ferrite bead when the 12-bit converter is used close to one LSB. A trailing R never indicates a different silicon revision or a different protection scheme. The surrounding XMEGA and general AVR material is linked here: Break atmega8 encrypted MCU fuse bit.
Technical findings, not a bypass
Among the four A4U capacities this is the first with 2 Kbytes of EEPROM, which is why industrial boards often use it for calibration-heavy designs. All members share the 44-pin or 49-ball footprints, the USB device interface, the event system and the analogue block, and all are programmed over PDI. On an unlocked sample we return a labelled heximal for application flash and boot code plus a separate EEPROM data file, since calibration data lives outside the program array. When lock bits are set, the deliverable is documentation rather than a claimed bypass. Related device notes on this site cover the wider family: Break atmel AVR MCU atmega8535l heximal.
If you need to duplicate ATXMEGA64A4U-CUR encrypted memory firmware, the practical first step is a written identification report: package marking, ordering code, PDI signature, fuse bytes and clock source, followed by a comparison with any build archive you hold. Our engineers document those findings, explain whether a clean read is possible, and state the chip-erase limit before any destructive work is authorised. We work under NDA for legitimate owners and their appointed repair partners, and we do not quote a readout that depends on suppressing a protection state.
Decode ATXMEGA64A4U-CU locked flash program
Most decode ATXMEGA64A4U-CU locked flash program enquiries can be resolved on paper: read the datasheet, note the fuse settings and compare the owner’s release archive. The ATXMEGA64A4U-CU is a good example, because its protection behaviour is documented in plain terms. The CU ordering code selects the 49-ball grid, which hides the PDI pads under the package on a production board.
Clarifying decode ATXMEGA64A4U-CU locked flash program for an A4U board
With 64 Kbytes of program flash this member is often chosen when a USB device stack, a bootloader, a calibration table and application logic all have to coexist. The XMEGA core executes most instructions in a single cycle from a two-stage pipeline, with 32 registers directly connected to the ALU and up to 32 MIPS at 32 MHz. An unlocked microcontroller yields a clean software image; a locked chip yields documentation and a comparison exercise instead.
Boot section and its independent locks
The ordering table gives 64 Kbytes of self-programmable flash plus a 4 Kbyte boot section, 2 Kbytes of EEPROM and 4 Kbytes of SRAM. The NVM controller manages page erase and write, and the CRC generators support integrity checking of a captured region. A usable heximal names the application, boot, EEPROM, fuse and calibration regions explicitly; a single flat binary loses that distinction. The 64 KB / 4 KB SRAM / 2 KB EEPROM combination identifies this member. For background on a neighbouring part, see ATXMEGA64A4U-CUR flash documentation.
Protect, erase, or document
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 64 KB / 4 KB SRAM / 2 KB EEPROM |
| Program memory | 64 Kbytes of self-programmable flash, 4 Kbyte boot section |
| EEPROM | 2 Kbytes, byte-erasable, 100K cycles |
| SRAM | 4 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Lock bits on this device separate the boot section from the application array, and the calibration row is protected in its own right. PDI is the only exposed programming and debug interface; it returns the device signature, fuse bytes and reported memory size even when external reads of application flash are disabled. The dual address match on the two-wire interfaces lets a service tool share a bus without interrupting the application firmware. Neither the AES/DES crypto engine nor the four-channel DMA controller offers an alternative path into the locked array, since both are application peripherals. A chip erase clears the lock field and the application in one operation, which is why an owner’s archived build output is worth more than any destructive attempt. The AVR cross-reference is documented in ATXMEGA128A4U-MH flash documentation.
DMA, event routing and USB timing
The on-chip USB 2.0 device controller supports 12 Mbps full speed and 1.5 Mbps low speed with 32 endpoints and flexible endpoint configuration, plus an internal regulator for the transceiver. Five USARTs, two TWI interfaces and two SPI ports handle external devices; a twelve-channel 12-bit 2 Msps ADC, a two-channel 12-bit 1 Msps DAC and two analog comparators cover measurement. Five 16-bit timers, a 16-bit RTC and QTouch support complete the list. Recording the USB descriptor, endpoint allocation and ADC reference selection is part of documenting any recovered software. A source code archive, a compiled binary and a raw heximal each answer a different question about the same microcontroller. A comparable recovery note is ATXMEGA16A4U-CU flash documentation.
Tray versus reel packing codes
The CU suffix selects the 49-ball VFBGA body, MHR the reel-packed 44-pad QFN and CUR the reel version of the ball grid; all three carry the same 64 Kbyte die and 34 programmable I/O lines. On the ball-grid option the PDI pads sit beneath the package, so the schematic and ball map are required before any authorised access is planned. Further reading on adjacent microcontrollers: Break atmega32u2 au microcontroller flash memory.
Written scope and NDA practice
Among the four A4U capacities this is the first with 2 Kbytes of EEPROM, which is why industrial boards often use it for calibration-heavy designs. The differences are the flash size, the boot section size and the SRAM and EEPROM budgets. For a QFN body the exposed pad carries ground and heat, so rework notes should record the solder profile as well as the marking. On an unlocked sample we return a labelled heximal for application flash and boot code plus a separate EEPROM data file, since calibration data lives outside the program array. We state the chip-erase consequence in writing, require the owner’s authorisation before any destructive step, work under NDA, and do not quote a service that depends on suppressing a protection state. The surrounding XMEGA and general AVR material is linked here: Break atmega64l secured microcontroller flash memory.
Owners considering decode ATXMEGA64A4U-CU locked flash program should expect a technical deliverable first: a datasheet-based identification record, a labelled image where the lock bits permit one, and a clear written statement where they do not. We explain that a chip erase removes the firmware together with the protection, require written authorisation before any destructive step, and never price a service that depends on defeating the lock field. That boundary is what keeps a recovered program file usable as evidence years later.
Attack ATXMEGA64A4U-MHR protected source code
A technician asked to attack ATXMEGA64A4U-MHR protected source code should begin with the package marking and the supply rails. On the ATXMEGA64A4U-MHR the die is shared across several ordering codes, so the suffix is the first thing worth recording. MHR combines the 44-pad QFN body with tape-and-reel packing, a distinction that matters for procurement rather than for the memory map.
Where attack ATXMEGA64A4U-MHR protected source code meets the datasheet
With 64 Kbytes of program flash this member is often chosen when a USB device stack, a bootloader, a calibration table and application logic all have to coexist. Calibration constants held in EEPROM are board specific, so a copied program image without the matching data file rarely reproduces the original behaviour. The power management controller supports five sleep modes, and brown-out detection plus a watchdog on a separate oscillator guard the 1.6 to 3.6 V supply window. Retrieving EEPROM data from a secured MCU is a separate task from reconstructing the program that once used it.
Separating program and data memory
The ordering table gives 64 Kbytes of self-programmable flash plus a 4 Kbyte boot section, 2 Kbytes of EEPROM and 4 Kbytes of SRAM. Flash endurance is above 10,000 cycles, EEPROM above 100,000, both with 20-year retention. A usable heximal names the application, boot, EEPROM, fuse and calibration regions explicitly; a single flat binary loses that distinction. The 64 KB / 4 KB SRAM / 2 KB EEPROM combination identifies this member. Related device notes on this site cover the wider family: ATXMEGA64A4U-CU flash documentation.
PDI identification on a locked device
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 64 KB / 4 KB SRAM / 2 KB EEPROM |
| Program memory | 64 Kbytes of self-programmable flash, 4 Kbyte boot section |
| EEPROM | 2 Kbytes, byte-erasable, 100K cycles |
| SRAM | 4 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Lock bits on this device separate the boot section from the application array, and the calibration row is protected in its own right. PDI is the only exposed programming and debug interface; it returns the device signature, fuse bytes and reported memory size even when external reads of application flash are disabled. Neither the AES/DES crypto engine nor the four-channel DMA controller offers an alternative path into the locked array, since both are application peripherals. Where a signed release archive exists, comparing its checksum with the board’s observable behaviour is the reliable route to reconstruction. For background on a neighbouring part, see ATXMEGA128A4U-AUR flash documentation.
The analogue and serial blocks
The on-chip USB 2.0 device controller supports 12 Mbps full speed and 1.5 Mbps low speed with 32 endpoints and flexible endpoint configuration, plus an internal regulator for the transceiver. The dual address match on the two-wire interfaces lets a service tool share a bus without interrupting the application firmware. A four-channel DMA controller and an eight-channel event system move data between peripherals without CPU intervention. Five USARTs, two TWI interfaces and two SPI ports handle external devices; a twelve-channel 12-bit 2 Msps ADC, a two-channel 12-bit 1 Msps DAC and two analog comparators cover measurement. Five 16-bit timers, a 16-bit RTC and QTouch support complete the list. An attack on the lock field is explicitly out of scope; what remains is documenting the microprocessor, its flash geometry and its program file. The AVR cross-reference is documented in ATXMEGA16A4U-MH flash documentation.
Footprints, rails and PDI pads
The CU suffix selects the 49-ball VFBGA body, MHR the reel-packed 44-pad QFN and CUR the reel version of the ball grid; all three carry the same 64 Kbyte die and 34 programmable I/O lines. On the ball-grid option the PDI pads sit beneath the package, so the schematic and ball map are required before any authorised access is planned. A trailing R never indicates a different silicon revision or a different protection scheme. A comparable recovery note is AVR MCU atmega64 flash firmware cloning.
Deliverables for a legitimate owner
Among the four A4U capacities this is the first with 2 Kbytes of EEPROM, which is why industrial boards often use it for calibration-heavy designs. All members share the 44-pin or 49-ball footprints, the USB device interface, the event system and the analogue block, and all are programmed over PDI. The differences are the flash size, the boot section size and the SRAM and EEPROM budgets. For a QFN body the exposed pad carries ground and heat, so rework notes should record the solder profile as well as the marking. When lock bits are set, the deliverable is documentation rather than a claimed bypass. Further reading on adjacent microcontrollers: Break atmega16l locked MCU flash memory.
To discuss attack ATXMEGA64A4U-MHR protected source code for a specific board, send the marking, the schematic if available and the reason the original build output is no longer accessible. We return a feasibility note that separates what the silicon exposes from what would require destroying the application, and we only proceed after the owner confirms the scope in writing. Legacy USB controllers are our regular work, and the handover is a documented file set rather than an undocumented promise about a locked chip.
Decapsulate ATXMEGA32A4U-MH secured integrated circuit code
Before you decapsulate ATXMEGA32A4U-MH secured integrated circuit code, identify which A4U capacity is fitted. The ATXMEGA32A4U-MH has a specific flash, SRAM and EEPROM budget, and those three numbers determine the rest of the workflow. The MH suffix keeps the QFN-style 44-pad body while the 32 Kbyte array is shared with the AU and AUR codes.
Before attempting to decapsulate ATXMEGA32A4U-MH secured integrated circuit code
At the 32 Kbyte capacity the same XMEGA RISC pipeline reaches 32 MIPS from a 32 MHz clock, but the design question shifts to how much of that array a USB stack and a bootloader consume. The core keeps 32 registers tied to the ALU, single-cycle execution for most instructions and a multilevel interrupt controller with programmable priority. Brown-out detection, power-on reset and a watchdog on a separate low-power oscillator supervise the supply window of 1.6 to 3.6 V. An encrypted binary is not the same thing as a protected flash array, and the AES engine here serves the application rather than the readout.
Pages, word width and fuse bytes
The memory map here is 32 Kbytes of self-programmable flash, a 4 Kbyte boot section with independent lock bits, 4 Kbytes of SRAM and 1 Kbyte of EEPROM. When the PLL is fed from the calibrated internal oscillator rather than a crystal, full-speed USB timing can drift far enough to fail enumeration. Flash is rated above 10,000 erase/write cycles and EEPROM above 100,000, with 20-year retention. The surrounding XMEGA and general AVR material is linked here: ATXMEGA64A4U-MHR flash documentation.
What the identification registers report
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 32 KB / 4 KB SRAM / 1 KB EEPROM |
| Program memory | 32 Kbytes of self-programmable flash, 4 Kbyte boot section |
| EEPROM | 1 Kbyte, byte-erasable, 100K cycles |
| SRAM | 4 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Two groups of lock bits protect the boot and application sections independently, which is useful on a device that boots over USB but also means a readout request has to state which region is actually wanted. Chip erase is the only operation that clears the lock field, and it removes the application at the same time. For a legacy board with no build archive, the achievable result is a documented identification and a comparison against whatever release artefacts the owner can supply. Related device notes on this site cover the wider family: ATXMEGA128A4U-AU flash documentation.
USB descriptors and endpoint buffers
Full-speed USB device operation at 12 Mbps with 32 endpoints is joined by a four-channel DMA controller and an eight-channel event system, so endpoint traffic and timer events can progress without constant CPU service. Five USARTs (one with IrDA support), two TWI ports with dual address match and two SPI ports cover the serial side. Five 16-bit timer/counters include high-resolution extensions and an advanced waveform extension on one unit, and a 16-bit RTC runs from its own oscillator. Any reconstructed software archive must record the fuse settings that select the clock source for these peripherals. Retrieving data from a secured MCU, reviewing an encrypted binary or cloning a locked file all reduce to the same PDI identification step on this family. For background on a neighbouring part, see ATXMEGA16A4U-AU flash documentation.
How the ATXMEGA32A4U-MH differs from its siblings
AU denotes the 44-lead TQFP, MH the 44-pad VQFN and CU the 49-ball VFBGA; the AUR and MHR codes are the reel-packed equivalents and carry the identical die. The USB descriptor strings and the endpoint allocation are often the only surviving evidence of which firmware variant a legacy board was built for. The reordering suffix is a procurement detail; confusing it with a different silicon revision is a common and avoidable documentation error. The AVR cross-reference is documented in Attack MCU atmega162 flash.
Authorisation, archive and handover
Pin compatibility across the four capacities means this member drops onto a board laid out for larger siblings, but a firmware image compiled for the top capacity will not fit and a linker script written for the smallest wastes the upper pages. Boot section size is 4 Kbytes here, shared with two other members, while the largest part doubles it. The ordering code and the reported array size are what identify the fitted part. On an unlocked part the handover is a labelled heximal for application flash, a separate boot section image and an EEPROM data file. On a locked part it is an identification and documentation package, because a chip erase would destroy the application along with the lock bits. A comparable recovery note is Attacking atmega328p lock bit protection how the fuse and lock bytes work.
Any decapsulate ATXMEGA32A4U-MH secured integrated circuit code request is handled the same way on every A4U board: identify the fitted capacity, record the memory map and clock tree, then compare the customer’s archived build output with what PDI reports. Where the array is unprotected a labelled program heximal and a separate EEPROM data file can be returned; where it is protected we supply an identification and documentation package instead. All work is scoped in writing for the owner or an authorised agent, with the erase consequence stated up front.
Clone ATXMEGA32A4U-AUR protective microcontroller software
When a board arrives with no source code, the request is often phrased as clone ATXMEGA32A4U-AUR protective microcontroller software. For the ATXMEGA32A4U-AUR the honest answer starts with the flash geometry and ends with a written record of what PDI reports. The trailing R marks tape-and-reel packing; the silicon, the 44-lead TQFP body and the electrical limits are unchanged from the AU code.
Technical basis for clone ATXMEGA32A4U-AUR protective microcontroller software
At the 32 Kbyte capacity the same XMEGA RISC pipeline reaches 32 MIPS from a 32 MHz clock, but the design question shifts to how much of that array a USB stack and a bootloader consume. The core keeps 32 registers tied to the ALU, single-cycle execution for most instructions and a multilevel interrupt controller with programmable priority. Above 2.7 V the full 32 MHz ceiling is available; below it the datasheet caps the clock at 12 MHz. An internal oscillator is factory calibrated and can be trimmed at runtime, while an external crystal or the PLL supplies the accurate timing that full-speed USB requires. Whether the target is data, code or a complete heximal, the PDI identification step is identical and always comes first.
The NVM controller and its regions
The memory map here is 32 Kbytes of self-programmable flash, a 4 Kbyte boot section with independent lock bits, 4 Kbytes of SRAM and 1 Kbyte of EEPROM. The 32 KB / 4 KB SRAM / 1 KB EEPROM specification is the middle-lower option in the ordering table. Further reading on adjacent microcontrollers: ATXMEGA32A4U-MH flash documentation.
The lock field and the erase consequence
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 32 KB / 4 KB SRAM / 1 KB EEPROM |
| Program memory | 32 Kbytes of self-programmable flash, 4 Kbyte boot section |
| EEPROM | 1 Kbyte, byte-erasable, 100K cycles |
| SRAM | 4 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Two groups of lock bits protect the boot and application sections independently, which is useful on a device that boots over USB but also means a readout request has to state which region is actually wanted. PDI remains the sole programming and debug interface, and it still returns the device signature and fuse settings on a locked sample. A 4 Kbyte boot section with its own lock group allows a field updater to be protected independently of the application image. Chip erase is the only operation that clears the lock field, and it removes the application at the same time. The surrounding XMEGA and general AVR material is linked here: ATXMEGA64A4U-CUR flash documentation.
Peripherals that shape a firmware archive
Full-speed USB device operation at 12 Mbps with 32 endpoints is joined by a four-channel DMA controller and an eight-channel event system, so endpoint traffic and timer events can progress without constant CPU service. On the analogue side a twelve-channel 12-bit ADC samples at 2 Msps and a two-channel 12-bit DAC at 1 Msps, with two window comparators and current sources. Five 16-bit timer/counters include high-resolution extensions and an advanced waveform extension on one unit, and a 16-bit RTC runs from its own oscillator. Any reconstructed software archive must record the fuse settings that select the clock source for these peripherals. Reviewing a protected part is not the same as decoding an unprotected one, and a decapsulated chip still needs the owner’s build archive before any code is reconstructed. Related device notes on this site cover the wider family: ATXMEGA128A4U-MH flash documentation.
Package suffixes and board access
AU denotes the 44-lead TQFP, MH the 44-pad VQFN and CU the 49-ball VFBGA; the AUR and MHR codes are the reel-packed equivalents and carry the identical die. All options expose 34 programmable I/O lines and the dedicated PDI data and clock pair. For background on a neighbouring part, see Attack chip atmega8a binary.
Commercial terms of the service
Pin compatibility across the four capacities means this member drops onto a board laid out for larger siblings, but a firmware image compiled for the top capacity will not fit and a linker script written for the smallest wastes the upper pages. When the PLL is fed from the calibrated internal oscillator rather than a crystal, full-speed USB timing can drift far enough to fail enumeration. The ordering code and the reported array size are what identify the fitted part. Our engagement begins with a written scope: marking, ordering code, PDI signature, fuse bytes, clock source and supply rails, followed by a comparison with the owner’s release archive. On an unlocked part the handover is a labelled heximal for application flash, a separate boot section image and an EEPROM data file. The AVR cross-reference is documented in Attack chip attiny2313 firmware.
If you need to clone ATXMEGA32A4U-AUR protective microcontroller software, the practical first step is a written identification report: package marking, ordering code, PDI signature, fuse bytes and clock source, followed by a comparison with any build archive you hold. Our engineers document those findings, explain whether a clean read is possible, and state the chip-erase limit before any destructive work is authorised. We work under NDA for legitimate owners and their appointed repair partners, and we do not quote a readout that depends on suppressing a protection state.
Retrieve ATXMEGA32A4U-AU encrypted binary file
Any retrieve ATXMEGA32A4U-AU encrypted binary file job is mostly an exercise in documentation. On the ATXMEGA32A4U-AU the useful evidence is the ordering code, the fuse bytes and the customer’s archived build output, not a promise about the protection bits. AU here means a 44-lead TQFP supplied in tray form, with the same die as every other 32A4U variant.
retrieve ATXMEGA32A4U-AU encrypted binary file: what the silicon exposes
At the 32 Kbyte capacity the same XMEGA RISC pipeline reaches 32 MIPS from a 32 MHz clock, but the design question shifts to how much of that array a USB stack and a bootloader consume. The USB descriptor strings and the endpoint allocation are often the only surviving evidence of which firmware variant a legacy board was built for. Brown-out detection, power-on reset and a watchdog on a separate low-power oscillator supervise the supply window of 1.6 to 3.6 V. Above 2.7 V the full 32 MHz ceiling is available; below it the datasheet caps the clock at 12 MHz. Decapsulation can confirm a die marking on a protected microprocessor; it cannot return a locked memory array without the owner’s build archive.
Array sizes and heximal structure
The memory map here is 32 Kbytes of self-programmable flash, a 4 Kbyte boot section with independent lock bits, 4 Kbytes of SRAM and 1 Kbyte of EEPROM. Flash is rated above 10,000 erase/write cycles and EEPROM above 100,000, with 20-year retention. The 32 KB / 4 KB SRAM / 1 KB EEPROM specification is the middle-lower option in the ordering table. A comparable recovery note is ATXMEGA32A4U-AUR flash documentation.
Why a locked read returns nothing
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 32 KB / 4 KB SRAM / 1 KB EEPROM |
| Program memory | 32 Kbytes of self-programmable flash, 4 Kbyte boot section |
| EEPROM | 1 Kbyte, byte-erasable, 100K cycles |
| SRAM | 4 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Two groups of lock bits protect the boot and application sections independently, which is useful on a device that boots over USB but also means a readout request has to state which region is actually wanted. PDI remains the sole programming and debug interface, and it still returns the device signature and fuse settings on a locked sample. For a legacy board with no build archive, the achievable result is a documented identification and a comparison against whatever release artefacts the owner can supply. Further reading on adjacent microcontrollers: ATXMEGA64A4U-CU flash documentation.
Clock sources and PDI access
Full-speed USB device operation at 12 Mbps with 32 endpoints is joined by a four-channel DMA controller and an eight-channel event system, so endpoint traffic and timer events can progress without constant CPU service. A 4 Kbyte boot section with its own lock group allows a field updater to be protected independently of the application image. Five USARTs (one with IrDA support), two TWI ports with dual address match and two SPI ports cover the serial side. On the analogue side a twelve-channel 12-bit ADC samples at 2 Msps and a two-channel 12-bit DAC at 1 Msps, with two window comparators and current sources. Five 16-bit timer/counters include high-resolution extensions and an advanced waveform extension on one unit, and a 16-bit RTC runs from its own oscillator. The terms software, program, file and firmware overlap in an enquiry, yet a cloned or duplicated image is only useful when its EEPROM data is documented. The surrounding XMEGA and general AVR material is linked here: ATXMEGA128A4U-AUR flash documentation.
Sibling capacities on the same footprint
AU denotes the 44-lead TQFP, MH the 44-pad VQFN and CU the 49-ball VFBGA; the AUR and MHR codes are the reel-packed equivalents and carry the identical die. All options expose 34 programmable I/O lines and the dedicated PDI data and clock pair. The reordering suffix is a procurement detail; confusing it with a different silicon revision is a common and avoidable documentation error. Related device notes on this site cover the wider family: Attack atmega32u2 mu microprocessor fuse bit.
Service boundaries and deliverables
Pin compatibility across the four capacities means this member drops onto a board laid out for larger siblings, but a firmware image compiled for the top capacity will not fit and a linker script written for the smallest wastes the upper pages. Boot section size is 4 Kbytes here, shared with two other members, while the largest part doubles it. When the PLL is fed from the calibrated internal oscillator rather than a crystal, full-speed USB timing can drift far enough to fail enumeration. On a locked part it is an identification and documentation package, because a chip erase would destroy the application along with the lock bits. For background on a neighbouring part, see Attack AVR atmega64l program.
Owners considering retrieve ATXMEGA32A4U-AU encrypted binary file should expect a technical deliverable first: a datasheet-based identification record, a labelled image where the lock bits permit one, and a clear written statement where they do not. We explain that a chip erase removes the firmware together with the protection, require written authorisation before any destructive step, and never price a service that depends on defeating the lock field. That boundary is what keeps a recovered program file usable as evidence years later.
Duplicate ATXMEGA16A4U-CU locked EEPROM data
To duplicate ATXMEGA16A4U-CU locked EEPROM data responsibly you first need the memory map, the programming interface and the lock-bit behaviour of the device in front of you. The ATXMEGA16A4U-CU belongs to the AVR XMEGA A4U line, and its datasheet separates what is readable from what is not. The CU code selects the 49-ball grid on this entry-capacity part, whose landing pattern differs from both 44-pin bodies.
Framing a duplicate ATXMEGA16A4U-CU locked EEPROM data request
The AVR XMEGA A4U core is an 8/16-bit RISC machine with a two-stage pipeline and 32 general-purpose working registers wired directly to the ALU, so most instructions retire in one clock cycle and throughput reaches 32 MIPS at 32 MHz. Supply range is 1.6 to 3.6 V; the datasheet permits 0 to 12 MHz from 1.6 V and 0 to 32 MHz once the rail reaches 2.7 V. A programmable multilevel interrupt controller, five sleep modes and a separate ultra-low-power oscillator for the watchdog make this capacity a natural fit for battery-powered USB sensors. A duplicate or clone built from an unverified dump is less useful than a documented original, because the EEPROM calibration data is board specific.
Application flash versus calibration data
Program storage on this member is 16 Kbytes of in-system self-programmable flash plus a separate 4 Kbyte boot code section carrying its own lock bits, alongside 1 Kbyte of byte-erasable EEPROM and 2 Kbytes of internal SRAM. Flash endurance exceeds 10,000 erase/write cycles while the EEPROM is rated for 100,000, and a 20-year retention figure applies to both. The NVM controller owns erase and program sequencing, and CRC-16 and CRC-32 generators are available for checking a captured image. Because the smallest array leaves little room for a USB bootloader, many production boards program the part once over PDI and never expose that header again. The AVR cross-reference is documented in ATXMEGA32A4U-AU flash documentation.
Protection, retention and chip erase
| Item | What the data sheet states |
|---|---|
| Core | AVR XMEGA 8/16-bit RISC, up to 32 MHz / 32 MIPS |
| Memory | 16 KB / 2 KB SRAM / 1 KB EEPROM |
| Program memory | 16 Kbytes of self-programmable flash, 4 Kbyte boot section |
| EEPROM | 1 Kbyte, byte-erasable, 100K cycles |
| SRAM | 2 Kbytes |
| Package | 44-lead TQFP / 44-pad VQFN / 49-ball VFBGA |
| USB | USB 2.0 full-speed device, 12 Mbps, 32 endpoints |
| Programming / debug | PDI (Program and Debug Interface) |
Lock bits divide protection between the boot section and the application array, and the PDI interface is the only programming and debug path exposed on this package. A chip erase clears the lock bits and the application together, so it destroys the very firmware an owner wanted to archive. The defensible deliverable on a protected sample is an identification record plus a comparison against the owner’s signed build output. A comparable recovery note is ATXMEGA64A4U-MHR flash documentation.
The USB interface in practice
One USB 2.0 device interface runs at full speed (12 Mbps) or low speed (1.5 Mbps) with 32 endpoints and full configuration flexibility, backed by dedicated DMA channels for double-buffered endpoint transfers. A 16-bit real-time counter with its own oscillator, five 16-bit timer/counters and QTouch library support complete the set. For documentation purposes the USB descriptor and the endpoint map are as important as the code itself. Decapsulation can confirm a die marking on an integrated circuit; it cannot return locked memory, and no separate EEPROM chip is fitted here. Further reading on adjacent microcontrollers: ATXMEGA128A4U-AU flash documentation.
Identifying the fitted ordering code
Three bodies share the same die: 44-lead TQFP (ordering code AU), 44-pad VQFN (MH) and 49-ball VFBGA (CU), with 34 programmable I/O lines in each case. PDI uses a dedicated data and clock pair, so a production board must keep those pads accessible if any authorised read is to be planned. The fuse bytes that select the clock source and the brown-out level should be transcribed before the board is powered from a bench supply. On the VFBGA body the ball map replaces the pin-out as the rework reference. The surrounding XMEGA and general AVR material is linked here: Attack atmega MCU microcontroller firmware.
Documentation, service and consent
Within the A4U line this is the entry capacity, and all four members are pin compatible in the same 44-pin bodies, so a board can move to a larger flash device by recompiling rather than re-laying-out the PCB. The practical risk is the opposite: a board built for the top capacity and populated with this variant will appear to work until the linker map overruns. USB device capability, the event system and the analogue block are common across the four capacities; only the memory numbers and the boot section change. Where the lock bits leave the array unprotected, a complete heximal and a separate EEPROM data file can be returned with their regions labelled. Related device notes on this site cover the wider family: Attack atmega165pv microcontroller flash memory.
To discuss duplicate ATXMEGA16A4U-CU locked EEPROM data for a specific board, send the marking, the schematic if available and the reason the original build output is no longer accessible. We return a feasibility note that separates what the silicon exposes from what would require destroying the application, and we only proceed after the owner confirms the scope in writing. Legacy USB controllers are our regular work, and the handover is a documented file set rather than an undocumented promise about a locked chip.