Thread: Reset Glitch Hack Guide using TX Coolrunner

Corona
Xell may not show during boot on a Corona. There are a few ways around this to obtain your CPU key:

• Connect a LAN cable between the motherboard and your network router. When the green light on the Coolrunner stops flashing, wait 1 - 2 minutes and then click 'Scan IP Range'.
• If, after a few minutes, it's not detected, check your router's DHCP client list for a new IP Lease. This should be the console's IP address. Enter it in the 'Xbox IP' box and click 'Get CPU Key'.
• Use a COM cable with the Monitor COM function in J-Runner. J-Runner includes diagrams to make one and where to solder it.

*Coolrunner removal if RGH was used only for DVD key retrieval*
If RGH was only used to obtain the DVD key, it can be found in the \J-Runner\<ConsoleSerial#>\Fuses.txt file. After obtaining the DVD key, connect the Nand-X and console power, load up an original nanddump.bin file into 'Source File', and flash it to the Nand by clicking 'Write Nand' (this is the only way to remove Xell.) Remove power, Nand-X, Coolrunner, and wires. Removing any QSB's can easily cause damage that bricks the console (we're talking no power bricking) if you've never desoldered before. So leave them installed. They're designed to stay once installed anyway. Transfer the newly obtained DVD key to a replacement drive's firmware and enjoy a fully functioning retail console.

5. Building and flashing Freeboot (hacked dash)

Build the Freeboot image
If needed, click on the 'Dash Version' drop down menu, select 'Add Dash', and choose the dash version of FreeBoot you're building.


Click on the 'Dash Version' drop down menu again and select the dash version being built. Click on 'Create Image' to build FreeBOOT. (Choose the correct motherboard type if needed.)


Flashing FreeBOOT
This can be done one of 2 ways.

1. If the Xbox 360 still has Xell Reloaded running, copy the file 'updflash.bin' from \J-Runner\<ConsoleSerial#>\ to the root of a FAT32 formatted USB flash drive. Then plug it into the console and FreeBOOT will be flashed automatically to the Nand. This is the quickest and recommended method.

2. Turn off the console. Unplug the power, connect the Nand-X, reconnect power, and click 'Write Nand'.


Disconnect the Nand-X and power from the console and wait for 30 seconds. Plug the power back in and turn on the console. The green LED on the Coolrunner should flash again every 5 seconds until it glitches. This time, it should boot to the regular dash and look the same as it did before the hack. Leave the Coolrunner installed as it's now required every time the console boots, and put everything back together.

Corona 4GB
Click 'Write Nand' and J-Runner should bring up the Corona 4GB sub-menu and write the FreeBOOT image. If not, manually do it.

If everything went as planned, congratulations on your newly hacked console.

Thanks to:
Ubergeek, Xecuter, Xmods, and YoshiB1 for their individual guides and pictures
Robinsod, TheSpecialist, and SeventhSon for 360 Flash Dump Tool
J-Runner team for J-Runner

(Please PM me with any corrections.)


Troubleshooting tips and misc:

Console won't glitch

RGH1
Xenon: Good Luck! Really nothing more to say.
Zephyr: Hit or miss. If it doesn't boot within 10 - 15 seconds, cycle the power switch.
Falcon: You did something wrong! Should boot on first glitch cycle every time.
Jasper: 50 Ohm shielded cable can make a huge difference, try grounded and ungrounded.

RGH2
Xenon: Not compatible
Zephyr: Worse than RGH1
Falcon: Glitch times from 5 seconds to 5 minutes, may not glitch at all, try A,B,C,D timing files; I have an RGH2 Falcon that typically glitches within 90 seconds, but if booted from the Guide button on a wired controller, will glitch within 10 seconds consistently.
Jasper: Glitch times from 5 seconds to 5 minutes, should be able to tune it to within 90 seconds or less.
Trinity: Glitch times from 5 seconds to 5 minutes, should be able to tune it within 90 seconds or less. CR3 Pro tuned with Rater feature should give 5 - 30 second boot times (most times 5 seconds).
Corona v1, v2: Glitch times from 5 seconds to 5 minutes, should be able to tune it to within 90 seconds or less. CR3 Pro tuned with Rater feature should give 5 - 30 second boot times (most times 5 seconds).
Corona v3, v4: Glitch times from 5 seconds to 5 minutes, should be able to tune it to within 90 seconds or less. CR3 Pro Rater feature not compatible due to missing POST_OUT.
There are multiple RGH2 timing files, try all of them to find which ones glitch (give plenty of time). Out of those, use the one that gives the best glitch time, then start fine tuning.

There are many posts, mostly on TX forums, on what wire length/capacitor/resistor combos have worked for specific Coolrunner/motherboard combos. If you're lost on where to start, just ask, but be prepared to post pictures of your soldering. Too many times I've seen someone say, "My soldering is fine," and it looks as if they used a blow torch instead of a soldering iron. More ofter than not, poor solding is at fault.

On some consoles, changing the PHAT/SLIM switch can help.
It can take up to 24 hours for a Xenon to glitch and boot Xell - have patience.
Putting the console back together can change boot times, or pugging in a hard drive, for better or worse.
THIS IS A GLITCH AND THEREFORE THE SETTINGS AND HARDWARE CONFIG ARE DIFFERENT FOR EVERY CONSOLE. THIS IS ESPECIALLY TRUE OF RGH2 - IT'S NOT AS CONSISTENT AS RGH1.


Bad Blocks in the .ecc file (first 50 blocks)
J-Runner should correctly remap any bad blocks in the first 50 region. But if for some reason it doesn't, the console won't boot to Xell and they'll have to be remapped. Open an original Nand dump in J-Runner (or 360 Flash Dump Tool). The Bad Block tab on the right side will indicate which block(s) and where it's remapped to.

A guide to manually remapping the first 50 blocks can be found HERE.

Jtag Tool 4.25
Coolshrimp's Jtag Tool isn't available anymore from him, so get it HERE. It's still very useful if you're using an LPT cable to read/write to the Nand. J-Runner doesn't support LPT connections (obviously TX wants you to buy their Nand flasher). It doesn't need to be installed; just extract to wherever you want and it's ready to run.

When started, it may try to connect to a non-existent server and lock up. To prevent this, you'll need to disconnect your internet connection, or block the outgoing connection with a firewall that blocks connections by application. There are many; my personal favorite is LooknStop if all you want is control over outgoing network connections.

Windows 7 firewall permits all outgoing connections by default, but it's rather easy to block Jtag Tool.

Control Panel>System and Security>Windows Firewall>Advanced Settings>Outbound Rules>New Rule
Choose the 'Program' type rule (Click Next)
Click 'Browse' and select the path to where 'Jtag Tool.exe' was extracted to (Click Next)
Select 'Block This Connection' (Click Next)
Ensure all 3 zones are checked (Click Next)
Name the rule (Click Finish)

Now Jtag Tool is blocked from accessing Coolshrimp's obsolete server.

*AutoGG can also be used for LPT reading/writing.

Now that your newly RGH'd console is successfully booting, you're asking yourself, "This looks no damn different than what I had before. I thought this was supposed to allow gaming ecstasy? What am I supposed to do with this?"

The following should help getting started with a newly RGH'd or Jtag'd console.

To begin, here are some definitions and explanations of Xbox 360 storage devices and file formats.

• The Xbox 360 can read 2 types of file formats: FAT32 (universal hard and flash drive format) and FATX (proprietary Xbox drive format) hereinafter referred to as FAT32 and FATX respectively.
• An internal drive is connected to a SATA port and includes the type that slide inside SLIMs and the type the attach to side/top of PHATs. All the space on the drive is formatted as FATX. The console natively looks for Xbox Content, hereinafter called Content, such as profiles, installed games, DLC, Arcade games, Title Updates, LIVE Apps, Avatar files, Themes, Gamer pics, and System Files on FATX.
• An external drive is connected to a USB port and includes portable hard drives and flash drives. They are formatted as FAT32 and the console natively looks for videos, music, pictures, and System Updates on FAT32.
• Up to 32GB of FAT32 on a USB drive can be 'converted' to FATX (System Settings>Storage>Device Options). The console accomplishes this by creating a hidden folder named 'Xbox360' and inside that folder hidden files are created that when added together make a 'virtual partition'. The console sees this as a continuous FATX drive. Since the FATX 'drive' is made up of files, the FAT32 format is unchanged and the drive can continue to be used as a regular USB drive on a PC.
• FATX drives are commonly said to have partitions. This isn't entirely true. These 'partitions' are main folders programmed to show as 'partitions' in various file managers. System files are in System folders and the Xbox1 Emulator (compatibility files) is in a Compatibility folder.The main folders reside in the root of the drive. Custom folders and sub-folders can be created alongside the main folders. The Xbox1 Emulator will not work unless it's on an internal FATX drive.
• Almost all Content is contained within the \Content\ folder on a FATX drive. The exception is Title Updates which can reside in the Cache folder. Here are examples:
  
  • Game Content (install, DLC, Arcade) - \Content\0000000000000000\1A2B3C4D\
  • Profile Content (profile, avatar, gamer pics) - \Content\E00001A2B3C4D5E6\FFFE07D1\
  • Profile Game Saves - \Content\E00001A2B3C4D5E6\1A2B3C4D\
  
  
• Data such as game rips, Homebrew, Emulators, and other non-Content can be contained on FAT32 and FATX. The console won't see it either way, but 3rd party file managers (Homebrew) can.
• On a hacked console, any make of drive can be used internally/externally up to 2TB. The console will show all space on an internal FATX drive as available.

With all that said, let's get started.

Installing XeXMenu and Freestyle Dash

First, XeXMenu or Freestyle Dash needs to be installed. It allows FTP to the console, along with directly starting .xex files (360 executables.) You'll need the following:

• A USB Drive with FATX space (if it's a flash drive, don't use up all the space, leave some FAT32 space)
• Party Buffalo - download HERE (single executable, virus free, recommend over device explorers like Xtaf, Xplorer360, etc.)

Download XeXMenu HERE, Freestyle 3 HERE, and F3 quicklaunch shortcut HERE. Extract all.

Start Party Buffalo with the USB drive connected to the computer. Open the drive.


Select the Data folder. Copy the contents of the extracted XexMenu and F3 Shortcut folders to the USB drive keeping the same folder/file path.


Close the USB drive from within Party Buffalo. Copy the Freestyle folder to the root of the USB drive in Windows. Make sure default.xex is only one folder level deep, e.g. \Freestlye\default.exe not \Freestyle\Freestyle\default.xex. Connect it to the console. Go into System Settings>Storage and select the USB drive. XeXMenu should show under Demos, and the F3 shortcut should show under Games. If you used an external hard drive then you're done.

If not, move XeXMenu and the F3 Shortcut to the internal drive. Start XeXMenu (under games) and move the Freestyle folder from the USB drive to the root. Use LB or RB to switch to the file manager, then use D-left or D-right to toggle between storage devices, hit 'Y' to bring up the copy/move menu.

Freestyle 3 can now be started from games>My Games on the regular dash. Now you'll be able to put files on your console easily by file copy or FTP. You probably won't use XeXMenu much, but it's excellent for deleting any F3 database files that get corrupted and can't be deleted while F3 is running.

Installing Dashlaunch
If you didn't include the Dashlaunch patches during the FreeBOOT image build or want to change options, you'll need this. (It's pretty much a required set of patches these days.)

Download Dashlaunch 3.07 HERE. Instructions on how to use it are included. Put the Installer folder on any storage device (FAT32 or FATX) and start default.xex from XeXMenu or F3.

Optional Media Update
The latest Optional Media Update files can be found HERE.
Extract or copy them to the correct folder on your HDD or an Xbox formatted USB drive (no FAT32 USB drives).

Xbox1 Emulator (Compatibility Update)
Download it HERE. The package already has the hacked Xbox1 Compatibility files integrated.
Delete any 'Compatibility' folders (and their contents) in the drive root or HDDX folder or you may have issues (HDDX is hidden unless you change it in F3's settings. Install instructions are in the README file included in the download.

Multi-Disc Games
FSD allows you to play multi-disc games without changing discs. You can either rip the discs, FTP the files, or install them as GOD.

Discs ripped within FSD or FTP'd to the console need to be in their own folder. For example, L.A. Noire should be installed like this:

HDD\360Games\LA Noire\Disc 1\
HDD\360Games\LA Noire\Disc 2\
HDD\360Games\LA Noire\Disc 3\

or

HDD\360Games\LA Noire Disc 1\
HDD\360Games\LA Noire Disc 2\
HDD\360Games\LA Noire Disc 3\


(More to come)

hi i have a xbox with 12625 dash and i cant update it becuase i dont have its original dvd drive thus i cant update the console becuase i dont have the dvd key and no working drive. Is there anyway i can still perform the RGH with this lower dash? Please help!

What you'll want to do is follow the guide up to Step 6 and flash the .ecc file to the Nand. Then you can retrieve the CPU and DVD keys. At this point you should also be able to verify in 360 Flash Dump Tool what type of replacement drive you need to get.

After that, unsolder either the red (3.3v) or black (ground) wire from either end so the Coolrunner won't power up when the 360 is turned on to update the dash.

Don't turn the console back on just yet. Flash one of the original Nand.bin dumps you made back to the Nand so the console is back to normal. Then update the console to dash 13604. Discard the Nand.bin dumps and .ecc you made as you won't need them anymore and to prevent from mixing them up with the new files you'll make (which could lead to a CPU LDV value mismatch.)

Dump the Nand again creating new Nand.bin dumps and re-solder whichever cable (red or black) back to the Coolrunner. Resume following the guide at step 6 and re-create the .ecc file. Then follow the rest of the guide.


UPDATE: J-Runner now supports using any dash version to build the latest hacked dash. I still recommend updating to the dash outlined in my guide to prevent any mishaps with the LDV.

nice tutorial, great work

thanks

nice tut, you should post this up on tx forums.

Awesome guide! Thanks! Just one thing, there are two typo's:

"DON'T UPDATE A PHAT CONSOLE ABOVE DASH VERSION 13406!" -> should be 13604. Only mistyped in the warnings. Guide's is correct.

Fixed it. Thanks.