MT1335 MX/WB unlocking

[gavingt]

Use a PMT on MPX01 with Jungleflasher -> Vendor Modus on VIA/nforce/ICH7 -Y Close Jungleflasher and run unlockSPI.exe

No go, 0225 drive always stays at 0x51 for me using this method...

1. Run JF
2. Power on -> LW
3. Press Intro Device ID
4. Put the PMT on MPX01
5. MTK Vendor -> Yes
6. Power off -> on
7. done!! Vendor Mode

You've just saved me hours of internet searching!

BTW, I think step 2 just means "Power on Liteon drive". Worked for me.

[Joka Macer]

Geremia!!!
you the man!!!
the best info of the year!

good bless you!

Geremia = Xbox Jesus!

[primo1337]

...
BTW, I think step 2 just means "Power on Liteon drive". Worked for me.
...

That's german. LW -> Laufwerk -> Drive 

[mat989]

Thnx Geremia! Others learned their lesson, and they stopped doubting Geremia's work, but it seems misterfly is so unbelievably dense!

[Blown240sx]

First of all, you did not answer any of my questions. no disrespect to geremia for his work as it actually works but it YOU think that feeding 3.3V trough a resistor to ground could kill other components on the board, what do you think happens before the bond-wire gets cut? does the voltage hits the ground? yes it does. and after the drilling and cutting you are told to use a electric lighter to get the unlock-status, how many volts do you need o get a spark like that and how do you know it only hits the wp-bond-wire? you could compare it to a electro static discharge.  if  you dont have the answer to the question, why do you answer?

Nope, I never said it would kill other components, I said that lifting the pin and forcing 3.3v wouldn't work as that pin is shared with other components, so you'd be raising expected ground potential to 3.3v. winbond has vcc protection so it wouldn't work, I didn't say it would destroy components. I believe I've answered your question

also where WP line is cut, it is floating and susceptible to voltage spikes ala ignitor spark.. other lines on that pin are grounded so there would be no change in potential

It's maybe not a completely stupid question, although I know it won't work. If you look at the image below it may look like the WP bond wire just goes directly to the pin, in which case why indeed wouldn't it work? But if you look closely you can just see there is another bond wire coming off the same pin, which is why, i'm assuming, you have to cut further in after that other wire has branched off.



Although it's probably been tried, I like the idea of just touching the lifted pin with Vcc (or lower??) momentarily in case you hit the timing.

As for me, I think I'll sit back and watch more results come in before I reach for my dremel   

That still wouldnt make much sense though because the drilling isnt gonna give you a clean cut voltage only this way hit. The bit is charged at 3.3v and when it hits and cuts the ground its still going to send voltage down the other wire/trace.
So why would it be any different that to just lift one of the two ground pins I can see and tap the 3.3v to that leg.

Best bet is to get someone who already has the TX replacement board and have them test this on the other factory board.

[oc]

That don't work because the ground pin connect internally to other ground pin. 

[Blown240sx]

That don't work because the ground pin connect internally to other ground pin. 

I understand that but this mod is taking a drill bit and cutting down into that trace/wire which bridges off to two pins. The drill/cutting head is going to make contact with both sides of the trace/wire when cut and send voltage down both legs and to the other side which goes the actual chip.

Or is the mothod to drill and cut the trace/wire internally then only supply voltage to one side?

[cyanarnofsky]

0401, flashed with Geremia hack on Nforce chipset. Thanks for the PMT probe walk through for vendor mode
worked like a treat! Unlocked, swapped back to my x360usb pro and flashed with JF.

[phonsey]

That don't work because the ground pin connect internally to other ground pin. 

I understand that but this mod is taking a drill bit and cutting down into that trace/wire which bridges off to two pins. The drill/cutting head is going to make contact with both sides of the trace/wire when cut and send voltage down both legs and to the other side which goes the actual chip.

Or is the mothod to drill and cut the trace/wire internally then only supply voltage to one side?

i have a easier way to do this mod rather than drilling a hole in the chip! i will update when i have tried it on a few other drives

[Blown240sx]

That don't work because the ground pin connect internally to other ground pin. 

I understand that but this mod is taking a drill bit and cutting down into that trace/wire which bridges off to two pins. The drill/cutting head is going to make contact with both sides of the trace/wire when cut and send voltage down both legs and to the other side which goes the actual chip.

Or is the mothod to drill and cut the trace/wire internally then only supply voltage to one side?

i have a easier way to do this mod rather than drilling a hole in the chip! i will update when i have tried it on a few other drives

Crude drawing but see what I mean when you drill down with this bit and hit the trace/wire thats got to send voltage back through all the trace/wire so why would it matter if you hit just the legs.
Or does the trace/wire going into the chip have to be cut to stay unlocked? ( I could be answering my question there lol )

[gavingt]

I've got a few questions:

- For the 100 Ohm resistor, how many watts should it be? I bought a 100 Ohm, 1/2 watt resistor, will this work?

- What happens if I destroy the Mediatek chip by drilling too far? Can I just buy a replacement, solder it on, and continue with this method?

[cyanarnofsky]

I've got a few questions:

- For the 100 Ohm resistor, how many watts should it be? I bought a 100 Ohm, 1/2 watt resistor, will this work?

- What happens if I destroy the Mediatek chip by drilling too far? Can I just buy a replacement, solder it on, and continue with this method?

Watt will not matter. You can just buy a replacement IC as long as you don't drill into the PCB and destroy anything.

[gavingt]

Thanks cyan. I've got some epoxy questions as well:
 
- Is there any reason I should remove the epoxy around the pins? There's none on top of the IC, but it would make the job of counting the pins and drawing the lines easier if it were removed.

- If so, what should I use to remove it? If I use hot air, is there a particular temperature zone in which I can melt the epoxy and not the surrounding components? What about acetone instead?

Thanks. I promise to come back here after I get my EE degree and absolutely rock the Xbox 720.

[bluemimmos]

That don't work because the ground pin connect internally to other ground pin. 

I understand that but this mod is taking a drill bit and cutting down into that trace/wire which bridges off to two pins. The drill/cutting head is going to make contact with both sides of the trace/wire when cut and send voltage down both legs and to the other side which goes the actual chip.

Or is the mothod to drill and cut the trace/wire internally then only supply voltage to one side?

well thats why there we used 100 ohms of resistor as load, it is certain that at point 3.3v drill bit will contact the gnd but at the mean time the resistor uses will work as load and prevent the uc from damaging or resseting itself, so when you cut the wire apart and eventually touch the wp side of the pin with 3.3v then u r unlocked.

[Pacote-san]

Thanks to the user who posted the Isopropilic alcool trick

Worked like a charm to re-unlock

[glaze83]

finally someone took advantage of what I discovered You're welcome

P.S You mean Isopropyl Alcohol

[oc]

I guess use a drop of wine will work also

[bluemimmos]

The tough part is over, so i think someone can have a full fw dump off the 0225 drive and check for the bugs in it to have a software solution. and FYI, i dont have dremel tool. If someone can suggest me a model no. of dremel that is cheap and works with 0.5mm engraving bit.

[glaze83]

they've had full fw dumps for ages -- that was the point of decapping.

You can pick up dremel'like' tools for cheaper. In canada I picked up a jobmate at Canadian tire a few years ago.

[engine620]

Use a PMT on MPX01 with Jungleflasher -> Vendor Modus on VIA/nforce/ICH7 -Y Close Jungleflasher and run unlockSPI.exe

No go, 0225 drive always stays at 0x51 for me using this method...

1. Run JF
2. Power on -> LW
3. Press Intro Device ID
4. Put the PMT on MPX01
5. MTK Vendor -> Yes
6. Power off -> on
7. done!! Vendor Mode

doesn't work for me on via 6421. BTW, where is exactly MPX01 on slim drive? i've two point, one on top and other on the bottom of the write. i'll try later with ich7 but i think the problem is that driver, with this chipset, can't going in vendor mode. please suggest a chipset that might work. thanks in advance.