Project to dump the new BenQ drive - VAD6038

[MODFREAKz]

ok here is a windows solution, (I think that will work with all chipsets)

Attention! there is a small bug. If you close the app your PC will freeze probably!!!

howto:
1. boot into windows/vista
2. flip the switch to “off” position
3. plug in SATA cable
4. power on x360 or use the connectivity kit
5. flip the switch to “on” position (no hurry)
6. and now start DosFlash32.exe
7. scroll the posts and you will see "MX(25L2005)(3,3V)"
8. read/write the flash now!!

[tecnormaster]

Flashing from windows  , i hope not freeze the pc .

great works ,

regards

tecnormaster

[caster420]

Flashing from windows  , i hope not freeze the pc .

A bad flash shouldnt matter.  You should simply be able to erase and write a good firmware.

Caster.

[zoogderrick2]

thanks i got a good read of my firmware and i found the key.  But now i have another problem lol.  I have an old MS25 laying around and my vad6038 is ver. 64930C. I was wondering how you spoof it, i tried using firmware toolbox 4.0 but it only has the option for 62430C. And when i turn on my xbox i get error 66. Thanks.

[NEO_X]

didnt get it to work on my via try my nforce 4 pc tomorrow let you guys know

[zoogderrick2]

didnt get it to work on my via try my nforce 4 pc tomorrow let you guys know

yeah u just gotta keep messing with it on the via, it litterally took me like 8 tries before i got it to recognize, but it finally did i guess its all in the timing of flipping the switch and starting the program. my key was @ E030 btw.

[MODFREAKz]

thanks i got a good read of my firmware and i found the key.  But now i have another problem lol.  I have an old MS25 laying around and my vad6038 is ver. 64930C. I was wondering how you spoof it, i tried using firmware toolbox 4.0 but it only has the option for 62430C. And when i turn on my xbox i get error 66. Thanks.

the detection string offset for TS is @20BC
PB string offset @26A8 or 26AD or 2D64

length 20 bytes

 here you see howto spoof TS firmware with hexeditor.                               check your spoof
                     

[LittleJonny]

i'd prefer trintiykate his way (as teh noob i am).

no cutting traces.. simply lifting the leg away from the chip and solder to the points.. and after flash, put leg back to chip.

how can that be anymore dangerous then cutting traces?

i think it's rather dangerous that a noob is cutting in chipboards with knifes etc.

The mx chip is very sensitive.......the pin stands a very very good chance to break if you lift it!  Do not do it if you don't have to peoples!  Cut the track like the diagram says.

[caster420]

The mx chip is very sensitive.......the pin stands a very very good chance to break if you lift it!  Do not do it if you don't have to peoples!  Cut the track like the diagram says.

I actually wouldnt recommend this method at all.  I just completed desoldering/resoldering the flash for the 3rd or forth time to cut the trace for pin #1.  I ran all the wires for my switch and test.... no difference for either side of the switch... the drive's going into recovery.  I test all my leads, etc... and they're fine.  Desolder everything and come to find my leg for pin #1 is f***ed.  So, needless to say, i need a new SPI flash.  All of my work on the flash with the exception of the wire was done with a pyropen, so there was no force applied to the legs when removing or placing.

I'd imagine that you'll break the pin every time by heating the single leg and trying to bend it.  Its probably not worth it for a system of which you dont have the drive key....

Caster.

[radsy]

some of those posted pics of traces being cut look horrendous.
some one has to post a tutorial on repairing traces as well , because when ixtreme benq 1.2 from c4eva firmware gets released , those traces have to work right. i can see alot of bricked benQ's  coming up after ixtreme release.

[zoogderrick2]

OK i finally got my samsung spoofed lol after looking in the BENQ firmware i found exactly what to spoof in the samsung firmware.  Hope this helps

[mulvad]

some of those posted pics of traces being cut look horrendous.
some one has to post a tutorial on repairing traces as well , because when ixtreme benq 1.2 from c4eva firmware gets released , those traces have to work right. i can see alot of bricked benQ's  coming up after ixtreme release.

I can't see how repairing the trace can be a problem. Simply solder the trace together, or if the cut is too big just solder a wire on either side of the cut.

[kleeenerprinz]

@Team MODFREAKz
what PC Mainboard do you use ? this one : MSI K8n Neo4-F with NForce4 Chipset or another one ?
or which SATA Adaptercard ?

[MODFREAKz]

testet board for Benq drives:
DFI LANPARTY UT NF590 SLI-M2R/G
DFI LANPARTY UT nF4  (all versions)
MSI K8N  (all versions)
ASUS A8N  (all versions)

they all working fine (DOS and windows)

[thedove75]

HI EVERYBODY

i just recieved my elite in baghdad after facing 3rlod in my ex premium and will be happy if anybody helped me to extract my elite benq key and insert it in my old ms25

what excatly looking for:
1-how can you identified the key using hex edit in the benq firmware and the ms25 firmware.
2-what is the best way to insert it in my ms25 drive firmware.
3 is it working with ICH7 sata motherboard

am not a dumb but have alot things to think about this is why i will need your support, thx alot

[kleeenerprinz]

@Team MODFREAKz
thank your very much

[huggo]

All good here, my key was at C030 on FW Ver 62430CR, spoofed an ms25 and its all working a treat.
Thanks for your great work Team MODFREAKz.

[trintiykate]

The mx chip is very sensitive.......the pin stands a very very good chance to break if you lift it!  Do not do it if you don't have to peoples!  Cut the track like the diagram says.

I actually wouldnt recommend this method at all.  I just completed desoldering/resoldering the flash for the 3rd or forth time to cut the trace for pin #1.  I ran all the wires for my switch and test.... no difference for either side of the switch... the drive's going into recovery.  I test all my leads, etc... and they're fine.  Desolder everything and come to find my leg for pin #1 is f***ed.  So, needless to say, i need a new SPI flash.  All of my work on the flash with the exception of the wire was done with a pyropen, so there was no force applied to the legs when removing or placing.

I'd imagine that you'll break the pin every time by heating the single leg and trying to bend it.  Its probably not worth it for a system of which you dont have the drive key....

Caster.

if you do not know how to repair this it's not worth my time ive done over 20 this way now without a problem as team mod mentioned not for noobs, to fix your problem simply dremel the silicon above pin 1 and re connect trace to pad fix your problem ive worked in this industry for years i am not just a fly by night modder, this would be the correct way to do this mod not a hack and slash job team mod has found the solution which is great it just is not neat.

[mandrake]

I´m thinking about the problem of adaptation to c4evar ixtreme in phillips vad due differents drive key locations.  I not share if ixtreme  one  address  drive key fix can help MS to detect frashed drives.

[caster420]

I´m thinking about the problem of adaptation  c4evar ixtreme at phillips vad due different drive key locations.  I not share if ixtreme  one  address  drive key fix can help MS to detect frashed drives.

Well, its a case of either,

A) Having multiple firmwares like the hitachi fw and the app that patch's them checks for the correct version and patch's the correct hacked firmware

B) Using just one version

if you do not know how to repair this it's not worth my time ive done over 20 this way now without a problem as team mod mentioned not for noobs, to fix your problem simply dremel the silicon above pin 1 and re connect trace to pad fix your problem ive worked in this industry for years i am not just a fly by night modder, this would be the correct way to do this mod not a hack and slash job team mod has found the solution which is great it just is not neat.

Twenty in a few days, damn thats pretty good.  I was by no means bitching about messing up the flash.  It was a warning to those who may think it is easier BUT have a lot of value in their drive (IE: a non-usable system if they mess it up).  This drive was purchased with the intention of testing and is not out of a particular console.  It will be fixed - i'll simply get a new/replacement flash from another device.

Caster.