Success with morcheeba's pv2mod (ported to windows by Drmn4ea). IMO safest method because it only reads and writes necessary blocks and allows a verify of CRC - great work by morcheeba! My particular change modifies only one instruction for added safety from hardware errors/glitches.
T28-6520:  e101 --> e002, XP SP1, 11/18/04 Libusb, pv2mod
T27-6520: [619E] e101 --> e002, XP SP1, 11/18/04 Libusb, pv2mod
Both working with Irfan using Che-ez Foxz2 smalunhj.inf modified by changing 23 to 27 and 24 to 28 (3 places each). I removed all but libusb driver before making any firmware changes and only installed foxz2 afterwards. It is very important to unplug and replug after each execution of pv2mod (I have a fried blue because I tried to verify without unplugging).
pv2mod scripts (commands placed here on one line just to compact - do not copy, semicolon inserts):
CVS Red 27 - GetChallenge; PrintBuffer; VerifyBufferCRC 0x0ea3bb88; SetBuffer 0 4c614d530000000...zeros for length of 128; SendResponse;
ResetChecksum; ReadFileBlock FIRMWARE.BIN 0x30; PrintBuffer; VerifyBufferCRC 0x8dab64e1; SetBuffer 0x19E e002; PrintBuffer; WriteFileBlock
CVS Blue 28 - GetChallenge; PrintBuffer; VerifyBufferCRC 0x0ea3bb88; SetBuffer 0 4c614d530000000...zeros for length of 128; SendResponse;
ResetChecksum; ReadFileBlock FIRMWARE.BIN 0x31; PrintBuffer; VerifyBufferCRC 0x7584eb5f; SetBuffer 0x19 e002; PrintBuffer; WriteFileBlock