This is what I found so far (on a Mac - on Windows the paths will be a bit different):
I have a Uno Rev 3, so the Atmega16U2 has a 6-pin ISP breakout plug-thing on it. So that's a start.

I plugged my USBtinyISP into this header, and tried this:
avrdude -c usbtiny -v -p m328p
Got this response:
avrdude: Device signature = 0x1e9489
avrdude: Expected signature for ATMEGA328P is 1E 95 0F
So, wrong signature, which I expected. So I needed to find the chip code for the signature 0x1e 0x94 0x89. That was not in my avrdude.conf file. You can test by trying this:
avrdude -c usbtiny -v -p m16u2
I got:
avrdude: AVR Part "m16u2" not found.
A bit of a Google search, and I turned up this patch:
http://www.nmj.sumomo.ne.jp/suz-avr/USB162/avrdude-5.8-confu2.patch
Who knows if it is the right one?
However inside that file was this:
+#------------------------------------------------------------
+# ATMEGA16U2
+#------------------------------------------------------------
+
+part
+ id = "m16u2";
+ desc = "ATMEGA16U2";
+ has_jtag = no;
+ has_debugwire = yes;
+ signature = 0x1e 0x94 0x89;
(Note: that isn't the complete file - you have to download it).
Looks like the right signature, and the right part number.
I found my avrdude.conf file here:
/usr/local/CrossPack-AVR-20100115/etc/avrdude.conf
Changing to the directory /usr/local/CrossPack-AVR-20100115/etc/ I tried to patch it, as follows:
cp avrdude.conf avrdude.conf.orig # make backup!!!
patch < avrdude-5.8-confu2.patch # patch file
That gave this:
can't find file to patch at input line 4
Perhaps you should have used the -p or --strip option?
The text leading up to this was:
--------------------------
|diff -ru avrdude-5.8/avrdude.conf.in avrdude-5.8-wk/avrdude.conf.in
|--- avrdude-5.8/avrdude.conf.in 2010-12-06 13:47:47.000000000 +0900
|+++ avrdude-5.8-wk/avrdude.conf.in 2010-12-06 13:49:52.000000000 +0900
--------------------------
File to patch:
I replied: avrdude.conf
Got this:
File to patch: avrdude.conf
patching file avrdude.conf
Hunk #1 succeeded at 12785 (offset -383 lines).
Tried to read the chip again:
avrdude -c usbtiny -v -p m16u2
Got:
Reading | ################################################## | 100% 0.01s
avrdude: Device signature = 0x1e9489
avrdude: safemode: lfuse reads as EF
avrdude: safemode: hfuse reads as D9
avrdude: safemode: efuse reads as F4
avrdude: safemode: lfuse reads as EF
avrdude: safemode: hfuse reads as D9
avrdude: safemode: efuse reads as F4
avrdude: safemode: Fuses OK
avrdude done. Thank you.
So far so good. It recognized the chip and gave me the fuses.
Now to read the existing flash:
avrdude -c usbtiny -p m16u2 -U flash:r:usb_chip.hex:i
Success! ...
avrdude: AVR device initialized and ready to accept instructions
Reading | ################################################## | 100% 0.01s
avrdude: Device signature = 0x1e9489
avrdude: reading flash memory:
Reading | ################################################## | 100% 30.30s
avrdude: writing output file "usb_chip.hex"
avrdude: safemode: Fuses OK
avrdude done. Thank you.
Convert to machine-readable:
avr-objdump -j .sec1 -d -m avr3 usb_chip.hex > usb_chip.asm
Edit that:
usb_chip.hex: file format ihex
Disassembly of section .sec1:
00000000 <.sec1>:
0: 90 c0 rjmp .+288 ; 0x122
2: 00 00 nop
4: a9 c0 rjmp .+338 ; 0x158
6: 00 00 nop
8: a7 c0 rjmp .+334 ; 0x158
...
122: 11 24 eor r1, r1
124: 1f be out 0x3f, r1 ; 63
126: cf ef ldi r28, 0xFF ; 255
128: d2 e0 ldi r29, 0x02 ; 2
12a: de bf out 0x3e, r29 ; 62
... blah blah
And further down after a lot of FFs:
3000: 4b c0 rjmp .+150 ; 0x3098
3002: 00 00 nop
3004: 64 c0 rjmp .+200 ; 0x30ce
3006: 00 00 nop
3008: 62 c0 rjmp .+196 ; 0x30ce
...
3098: 11 24 eor r1, r1
309a: 1f be out 0x3f, r1 ; 63
309c: cf ef ldi r28, 0xFF ; 255
309e: d2 e0 ldi r29, 0x02 ; 2
30a0: de bf out 0x3e, r29 ; 62
30a2: cd bf out 0x3d, r28 ; 61
30a4: 11 e0 ldi r17, 0x01 ; 1
30a6: a0 e0 ldi r26, 0x00 ; 0
Looks like something. And is that a bootloader at the bottom? Who knows?
Now if you have a replacement .hex file (eg. firmware.hex in my example), you should be able to flash it like this:
avrdude -c usbtiny -p m16u2 -U flash:w:firmware.hex
The new firmware file should look something like this inside:
:2000000090C00000A9C00000A7C00000A5C00000A3C00000A1C000009FC000009DC00000DB
:200020009BC0000099C0000097C0000048C400000CC4000091C000008FC000008DC00000EC
:200040008BC0000089C0000087C0000085C0000083C0000081C000007FC0000002C10000FA
:200060007BC0000079C0000077C0000075C0000073C0000071C000006FC000006DC00000E0
Don't blame me if this goes wrong, but this is a pointer to the direction you might take.