So you want to glitch your Xbox 360?

I'm going to assume you have at least a background in what the glitch is and what it's for. I'm also going to assume that you've read all about the JTAG hack and are familiar with Nandpro, Xbox 360 nand reading/writing and the associated tools to do all of this. I'm also going to assume you have a coolrunner board that has been flashed with the glitching code. If not then see here about how to use a Nand-X to do that, or google on how to do it some other way (e.g. LPT JTAG).

Can my console be glitched?

Well it depends on a few things. First thing, if it doesn't have a HDMI port and isn't a refurbished console returned to you (or the person you bought it from) by Microsoft after an RROD repair then no, you cannot - your console is a Xenon and they cannot be glitched at this time. If you do have a refurbished non-HDMI console then maybe you have an Opus model, which might be glitchable. It depends on the CB version (See further down the guide where we'll check the CB).

If you have a Phat HDMI console we'll start off by saying it can probably be glitched - it depends on the CB version, which can only be retrieved by opening up the console and reading the Nand (See further down the guide where we'll check the CB).

Phat model detection - Look at the power socket in the console


If you have a Slim then it's another maybe. Some of the newer revisions of the Slim console do not have the HANA chip (just like the Xenon) which means that currently the glitch will not work. It may be possible in the future to do these consoles but you're out of luck for now.

One thing that's important to note is that right up to the latest Xbox 360 dashboard (13604 as of this writing), all dashboards are glitchable - it is a hardware flaw and the guys who know all about this reverse engineering are confident it can't be patched by software. Nonetheless, I don't know enough about it to say with certainty that they're right, so glitch now if you want it glitched

Reading/Writing to the Xbox 360's NAND (memory)

Reading the 360's memory is done over LPT port or USB.

LPT is an ancient standard and many newer computers (and laptops) do not have LPT ports. You need what's known as a "native" port, that is one that's built into the laptop or motherboard. There may be sporadic reports of somebody buying an LPT expansion card and that working but it is taking a risk, it probably won't work. LPT is slow, much slower than USB. A 16mb memory dump over LPT takes approximately 40 minutes. For arcade consoles (256MB/512MB internal storage) you need to dump the first 64MB, which will take 3 hours over LPT. LPT is also prone to problems caused by poor soldering, interference and device polling. That isn't to say it can't be done, just that USB is the way forward.

USB is much faster than LPT. Dumping with a PIC18F2555 board with a 12MHz crystal and a 64MB nand takes 35-40 minutes and a 16MB nand takes 6 minutes. There are faster solutions out there, like the Nand-X by Xecutor that can dump a 16MB nand in around 2 minutes. USB is less affected by interference and is generally less fussy than the LPT reader in a "It just works" kinda way. Myself? I own a Nand-X, they are so worth the money if you're doing more than one console.

There are two headers on the xbox 360 motherboard, they are labelled J1D2 and J2B1. You need to solder 4 wires to J1D2 and 2 wires to J2B1, no matter what method you choose. In addition to this, you need a ground wire which can be taken from any ground point. I choose to use the little thin stems from the outside of any xbox 360 connector port (e.g. the AV port, the hard drive port, the memory unit port). This is because heating them up to flow the solder is much easier than heating other suggested ground points (for example J1D2.6, or J2B1.12).



Up-close look at J1D2, complete with numbering for the nand reader:



This is J2B1:



Nandpro & Checking your CB (for Jasper consoles)

So you've hooked up a nand reader. Your next step is to get a copy of Nandpro, the latest version at the time of writing is 3.0. Put the power plug into your console, but do not turn it on. You just want the console in standby mode.

To begin the glitch you need to take a backup of some data from your console, including the all important keyvault.

There are two ways to do this, one is to take a dump of the first 2MB of memory, install Xellous and then take a dump of the rest by hooking up the xbox and computer with a network cable. The other is to take a full backup from your reader (highly recommended for all consoles).

For starters I'm going to go with dumping the first 2MB of the nand and checking the CB version first to see if the console is glitchable. I'll follow with a full backup via the nand-reader after that. If you want to try dumping the rest of the nand over HTTP (may or may not work) then go to the next section after dumping the first 2MB and the Keyvault, you can skip the bit about dumping 16 or 64MB. If the HTTP dump doesn't work, come back here and take the full backup.

Open a command prompt (Start->Run->cmd.exe) and change directory to to wherever you extracted nandpro (e.g. "cd c:\xbox\nandpro") and type the following (replace usb: with lpt: where necessary)

nandpro usb: -r2 2mb_dump1.bin

This will use USB to read the first 2MB of your nand into the file 2mb_dump1.bin.

If you get an error about "Could not detect flash controller" there is a problem with your reader so check your soldering with a multimeter, ensure you have the right drivers installed for USB etc etc. This isn't a troubleshooting guide so start your own thread here on the forum and we'll try help. If you have any bad blocks within the first 50 blocks of your nand when reading it, then you may have issues getting Xellous working so create your own thread and we'll look at your problem. Make sure to create a thread if you've got a bad block at block #1 (your Keyvault). If you have more than 32 bad blocks, something is wrong with your reader.

Here's a very old picture back from my first Xbox 360 mod using an LPT reader with Nandpro 2.0b where I'm taking a 16MB full dump just so you know what it all looks like.




Run the same command again changing dump1 to dump2. Do not unplug the console between dumps. Now you've two separate reads of the nand. Next, run the following command:

fc 2mb_dump1.bin 2mb_dump2.bin

This will compare the two files to each other. They need to be the same. FC should state no file differences found. If they are not the same, and FC reports a few changes between the files then dump a third time, checking your wires etc for problems. You need matching dumps. If they don't match, re-check your wires and reader and dump again until you have two (or ideally 3) matching dumps. That way you can be pretty sure you got a valid dump.


You should open up a hex editor and then open up your 2MB nand dump. Press the find button, make sure ASCII is selected, and type CB. It should bring you to line number 8400 where there first two numbers are 43 42 (which is CB in Hex). If it doesn't, click Find again until it brings you to line 8400. Take note of the next two numbers after 43 42. In the following picture, they are 1a 43:

.

Open up the Windows Calculator (Start->Run->calc.exe) then press View->Programmer. Make sure the radio button for Hex is pressed, then type in the characters you see in HexEdit (no space required). Then click DEC to convert it into decimal. 1a43 converts to 6723 in decimal, so this Jasper console of mine is glitchable.

Noteworthy CB versions:
CB | JTAG | GLITCH
1921 | Yes | No
4558 | Yes | No
4577 | No | No
5770 | Yes | No
5771 | No | Yes (try both Opus & Falcon XSVF files)
5772 | No | No
6723 | Yes | No
6751 | No | Yes (using a Donor CB [6750])
6752 | No | No

If your CB doesn't appear in the above table then it's glitchable.

Full backup via NANDpro

Consoles that do not have any internal memory have 16MB nands, so to back up the full nand you should use this command:

nandpro usb: -r16 xbox_backup1.bin

If you have a console with internal memory (e.g. 256MB/512MB jasper) then you should use this command:

nandpro usb: -r64 xbox_backup1.bin 0 1000

There is no need to dump all 256MB or 512MB of memory, anything after block 0x0FFF (i.e. 0x1000 or higher) is on-board storage, and you have already backed that up, right?

When that dump is completed, run the same command again, but change the filename to xbox_backup2.bin.

Once that's done, type the following:

fc xbox_backup1.bin xbox_backup2.bin

Again, you don't want any differences between the dumps. I dump my nand 3 times to make extra sure.

Flashing Xell Reloaded

For simplicity here I'm going to recommend the use of a tool by Rogero called 360 Multi Builder, currently at v3.0. Download it from the official site and extract the files to a folder (e.g. C:\360MultiBuilder).

Copy your full backup file into the 'Data/my360' directory in the place where you extracted 360MultiBuilder (360MB) and rename it to nanddump.bin.

Open a command prompt and go to the 360MB directory and type:

run.exe

You'll get this screen:


Pick your console type and you'll get a warning that you've got no CPU key and it'll be generating a Xell ECC image.



Finally you'll generate a file in the Data folder called image_00000000.ecc.



Write this to your nand using the +w16 switch (note the use of +):

nandpro usb: +w16 image_00000000.ecc 0

Disconnect the console power and get ready to solder your coolrunner board. I'll go into it in the next post.