Reset Glitch Hack RGH

[Rodent]

Reset Glitch Hack RGH

Acidmods and Myself are Not Responsible for Damages done to your console

***NOTE: READ!! The whole post and replys. ***
***Updates applied for future updates***

Introduction
 This will tell you everything there is to know about  The RGH Reset Glitch Hack and what is needed For every console out there. I can not say it any more clearer then to Read this carefully and ask questions if needed before you do anything. You must have good soldering skills and you must pay attention to everything you do. This tutorial will teach you everything you need to RGH a xbox 360 console and the tools you will need for each type of console and what you will need for each dashboard.


Parts Needed

• J-Runner Program (http://www.ixtreme.net/jtag-rgh/25690-j-runner-ultimate-jtag-rgh-app-download.html)
• Coolrunner Rev A,B,C,
• Matrix Glitcher Chip (this can be used instead of cool runner)
• Xbox 360 Motherboard (xenon) not good for RGH at this time (Zephyr, Falcon, Jasper SB/BB, Trinity or Corona)
• Corona Varies on parts you need qsb  micro card reader  so please Research for your type of Corona Motherboard

Tools Needed

• 15 Watt Soldering Iron
• Flux paste
• Solder
• Nand X  or jr programmer or USB Nand Reader or LPT

[smg id=2917]

• jr Programmer

[smg id=2918]

• Nand X to Coolrunenr Jtag Cable

[smg id=2916]

• DGX ( use only on dashboards 15574 to 16202 and above) This is used to get the cpu key from them Dashboard Kernals)" Slim Consoles only at this time

[smg id=2919]

• For Corona boards and to update jr.programmer or nand x USB to NAND-X Update Cable/ Comm v3

[smg id=2920]

Difficulty rating: 5/5


Average Time to Complete: 45mins to 1 1/2 hours


Notes:
What makes it difficult : small soldering , must have good soldering skills , small points, easy to bridge or remove small components if your not careful very easy to lift traces . I can not say it enough please becareful when soldering.

• 8955 to 14699 RGH 1
• 14717 to 17150 RGH 2
• Slim Trinitys Wired like RGH2
• Slim Coronas Best to check Version first

 
Step By Step Tutorial
1- Check to make sure the Xbox 360 has no issues such as damage to the console or Motherboard , checking to make sure no one else has tried to rgh the console. Or making sure that it powers on and boots up normally.
2- Check to see what dashboard it is on by going to Console Settings, System Info This will tell you what type of RGH can be done ont the console. "NOTE"  If it is a jasper you need to make sure what size it is 16mb , 256mb, 512mb,
3- Power off the console. Once turned off unplug it and carefully removing the dvd drive , fan shroud and the mother board from the cage.
4- After you figured out what RGH Version you have. you can now go ahead and program the coolrunner to the type of board you have. If it is RGH2 you need to make sure that is marked in J-runner RGH2 there are different settings for RGH2 when programming the coolrunner. and If its a jasper you need to make sure you check its 16mb , 256mb or 512mb
"NOTE" Coolrunner must be on phat for phat and slim for slim consoles, also set to program when programming the coolrunner
5-Now  you can wire the motherboard and the coolrunner and the nand wires for your nand reader/writer
6-put mother board back in the cage before going to next step so many people short things out or get RROD from flexing mother board around or doing this on there bed or floor.
7 Now once you have wired everything and double checked your work its time to test your soldering. make sure the coolrunner is still set to Prog(program)  and you can turn on the console to make sure there are no issues,  being that the coolrunner is turned to Prog(program) it will not have power to the cool runner, If console boots normal, we can move to next step
"NOTE" if console doesn't boot after you wired everything you bridged something or have something touching.
8- Now time to turn the console off after you checked everything
9- keeping it hooked up to the power brick and av cables, you can now move to next step
10 - open j-runner program make sure your nand X or jr-Programmer or usb or lpt is detected.
11- make sure Glitch is marked and on J-runner
12- Dump the nands 2 times, or more if needed till they compare
13- once nands are compared Create the ECC. and always watch what is going on in the window of j-runner 
14- Now Write the Ecc img  should only take couple seconds  will say done and make a sound when its done writing.
15- Now unplug your Nand X , jr programmer and usb or lpt.
16- Turn switch on the coolrunner to Nor(normal) the Red led should power on now showing that the coolrunner is activated
17- press the powerbutton or eject button to power the console on and it should boot with in seconds to Xell Reloaded to get your Cpu and Dvd Keys and make sure you write them down or take a picture of them you will need them for the next step
18- Now type in the Cpu key where it says Cpu key once you type it there it will say CPU is correct and load all the KV info.
19- Once you do that you can power off the console and hook back up your Nand x or jr-programmer or usb or lpt
20-Now its time to create the Freeboot img/updflash.bin  so select the dash you want to make and press create and let it do its stuff it will make a folder with the serial number of the console and will be ready to write the nand now!
21- Once done you can now press Write nand and it will write the new img to the console.
22- It is best that after writen to unplug your nand x or device you are using to read and write to the console
23- Unplug the console from the power brick i believe they say for 2 minutes to reset the SMC ,  then plug it back in and boot the console .
24- One you turn it on the console the  coolrunner should glitch just as i meant to meantion when you boot in xell.
25- The coolrunner green leds should flash about every 5 seconds untill it boots, lately I been getting them to glitch one time and some  console boot instantly.
26- now you have completed your Reset Glitch Hack Console.
27- if you have any issue please read steps 5 thru 25 over again. if any other issues contact a member to help you



Pics
RGH 1


RGH 2


Slim RGH


Corona RGH


FAQ/ Troubleshooting

• problem one that usually happens
• problem two that usually happens
• Note: Just From my Experience I always use the blue wire instead of the the Low Loss cable the blue wire seems to work best for me.
• Console wont power on after RGH installed ? Always make sure your  soldering points are correct bridge or short can cause this issue.
• Cool runner not Glitching?  double check your wiring. make sure you programmed it correctly for the specific motherboard you have.
• Errors in j-runner when reading nand ?  Restart j-runner, double check your nand wires. could be soldering issues , bridged wires can burn up your nand x.

[Rodent]

RGH 1Coolrunner REV  A, B. RGH 2.0 Coolrunner A, B & For Matrix Glitcher Boards & DGX For Slims for Cpu Keys

Coolrunner REV A For SLIM

Coolrunner REV A, B  For XENON

Coolrunner  REV A, B,  Phat  RGH2.0

Matrix Glitcher Phat  And Slim Trinity

Matrix Glitcher Phat 2.0

Zephry,Opus, Falcon,  Jasper

DGX

Slims Only at this time and for Dashboards 15574 16719 16202 and Up

This is used to retrieve your Dvd key

Step by Step
1- Get a full clean dump of  your NAND before you do anything else
2- Trinity Dip #8: ON  Corona DIP #8: OFF
3- Use latest J-Runner to write the DGX Ecc
4- Use latest J-runner to get your CPU KEY!

[Modded Matt]

nice work rodent.

[Rodent]

I think I have completed everything that is needed to know about RGH for now. I will be adding some more stuff for the corona boards  If any one has anything I missed or needed to add please reply and i will add it asap.. this is fully up to date , if members have any questions feel free to ask. I wlll try to make a hands on video , of a rgh install

[Anonamous]

Great job bro.

Just a side note, RGH 2.0 is extremely unreliable on falcon motherboards. I have ever got it to work on my falcon.

[Rodent]

Great job bro.

Just a side note, RGH 2.0 is extremely unreliable on falcon motherboards. I have ever got it to work on my falcon.

I think theodor613 had the same issue on 14719 dashboard do to it being RGH2.0 , he wasn't able to to create the ecc.  he had sent me the nands i kept getting a error , I need to try it again since they updated j-runner since i last tried it.

Edit just tried it now here is what i got

Nand Initialization Finished
Comparing...
Bad Block ID @ 0x0388 [Offset: 0xE91000]
Bad Block ID @ 0x0389 [Offset: 0xE95200]
Bad Block ID  0388 Found @ 0x03FF [Offset: 0x107BE00]
Block ID 03FF [Offset: 0x107BE00] remapped to Block ID 0388 [Offset: 0xE91000]
Bad Blocks Remapped
Bad Block ID @ 0x0388 [Offset: 0xE91000]
Bad Block ID @ 0x0389 [Offset: 0xE95200]
Bad Block ID  0388 Found @ 0x03FF [Offset: 0x107BE00]
Block ID 03FF [Offset: 0x107BE00] remapped to Block ID 0388 [Offset: 0xE91000]
Bad Blocks Remapped
Nands are the same
* unpacking flash image, ....
Spare Data found, will remove.
Removed
* found decrypted CD
* found XeLL binary, must be linked to 0x1c000000
 * we found the following parts:
SMC: 1.6
CB_A: 5773
CB_B: 5773
CD (image): missing
CD (decrypted): 9452
 * checking required versions...
ok
 * patching SMC...
 ! Warning: can't patch this Falcon type SMC!
 * Replacing CD...

* XOR HACK NEEDED FOR CB 5773
 * patching CB_B...
patchset for 5772 found, 4 patch(es)
 * Applying XOR Hack to CB_B 5773
 *** Re-encrypting CB_B with xor keystream
 *** Fixing entrypoint
 * Replacing CB_A 5773 with 5772
 * encrypting CB...
 * constructing new image...
Failed to create ecc image

[Gizmo613]

that was my first attempt at rgh, and i corrupted the nand while reading it. i have since rgh2.0 2 falcons and both have decent glitch times. Both glitches in about 10-25 secs. the longest a rgh 2 falcon glitched on me was 2 minutes.

[Rodent]

Incase anyone wants to build a LPT Programer for programing the cool runners or mod chips  you will have to supply 3.3 volts to the chip to program it . I used the 3,3 volts off a dvd drive or off my ck. made a jumper wire for it.

[snowcolt17]

nice tutorial.. if i didnt use my SLIM (thanks rodent for pointing that out) alot on live i would do this

[Rodent]

here are some pics of a RGH jasper 512 i just did phat console, this one boots in about 5 to 7 seconds, not my best but still good. will add some more pics of finished console and video , waiting on whisper fan and clear case to come this week.

bottom of the board

top of the board

testing after i installed it to make sure it still boots

shows it booted started on 13599 dashboard

Customer wanted orange Leds.


Video finished for a customer
XE_Will Jasper 512mb RGH By Rodent_Modz.mov

[Rodent]

Bump because i can ,  Reason I bumped is cause i updated  the Matrix Glitcher chip for RGH 2.0 For phat consoles.   when i get time i will add the R-Jtag  to this or new tutorial

[Rodent]

Team Xecuter's Xenon Reset Glitch Hack
Categories: Featured Articles
We are happy to finally release the Xenon RGH Hack. This is by no means meant to be used for an everyday RGH as its as bad if not worse than a Zephyr, however it does work and will be perfect for those who have a Xenon where they lost their DVD key or an unbanned key vault.

Here is the readme included with the release:

Wiring

Generate your ecc image using the latest version of J-Runner and flash to your NAND (+w16 just like a regular RGH).

Program your TX CoolRunner (or whatever flavor RGH mod you are using) with the tx-xenon.xsvf or tx-xenon.jed file.

The Xenon has a capacitor on CPU_RST that was removed in later models.  C7R112 (located near the xclamp under the CPU) must be de-soldered, and the CPU_RST wire from the TX CoolRunner(D) must be soldered to the left pad (non grounded pad).

A 47nf ( 0.047uf) capacitor needs to be added between PLL_BYPASS(+) and GND(-).  (If you have a genuine TX CoolRunner REV B you can use the on-board by bridging the CAP jumper)

A 220-270pf capacitor should be added between CPU_RST(+) and GND(-) on the cpld. (If you have a genuine TX CoolRunner REV B this is already included in the design so not required)

An easy to follow picture guide can be found here:  http://www.team-xecuter.com/coolrunner/install/phat_xenon.jpg

Troubleshooting

Using a TX CoolRunner Rev B, and after applying various troubleshooting measures we have had glitches ranging from instant to 20 minutes.

The debug LED should flash on for less than a second and repeat every 5 seconds.  If your LED stays on or does not come on at all, it is usually because of something being wrong with PLL_BYPASS.  Try different values of capacitors and wires. If you have enabled the CAP on REV B of the TX CoolRunner, simply un-bridge it and try a 47nF cap instead as per the instructions above.

If it still has not glitched after several hours, try different values of capacitors on CPU_RST of your RGH mod.  A longer wire / low-loss 50 ohm double shielded cable may also help with this.

To help increase boot times and stability (on all RGH installs not just Xenon) we recommend that you try Low-Loss Double Shielded 50 ohm cable. It's very cheap to use and quite effective – so a quick shout out to www.xconsoles.com who supplied a batch of high quality cable for our development team to use. It's less than 75 cents a foot – not bad.

NOTE: Remember when programming the TX CoolRunner that the Xbox power is NOT connected and that the switch is set to PRG before you connect the JTAG cable. If you connect the JTAG cable and it is set to NOR with the Xbox power connected, it can damage your NAND-X and/or CoolRunner. When you have finished programming, switch it back to NOR and then power on the Xbox.

The Xenon Hack

Please note that this hack is not available on consoles updated to dashboards 14717 or 14719.

If you are seeing the debug led it means that the cpu is probably not crashing and the issue addressed by gligli/tiros has been fixed (This can of course be a false positive as sometimes the CPU could be crashing but the SMC restarts fine – we can never be 100% sure)

So far, this is really only useful for a one time cpu_key dump. There will undoubtedly be ways of optimizing this hack in the future and who knows, it may become a reliable glitch one day.

We would appreciate that you give as much feedback to our support forums as possible to help others achieve better results and to improve this method. For now we can leave this and go back to RGH2.0 for Zephyr, Falcon, Jasper and also of course, the Corona.

TX CoolRunner Support Forums: http://www.team-xecuter.com/forums/forumdisplay.php?f=174

Enjoy!

Xbox 360 Xenon RGH Hack brought to you by the Xecuter RGH Development Team

www.team-xecuter.com

Thanks

Thanks are extended to Tiros & Gligli, without your work none of this would have been possible.

A special thanks goes out to cOz – your work on Dashlaunch proved to be an invaluable contribution and we look froward to your next exciting project.

Greets: Team Jungle, Team FSD, Freeboot, Libxenon & RGLoader.

Just another update for those of you trying to retrieve keys on Xenons. i meant to add this a while ago just been very busy

*just tried this and found out mine has a spit CB_A 1926   CB_B1926 can not creat ecc. 

[Rodent]

 For RGH2 Jasper and RGH2 Falcon  run the wires like this using Slim Blue Wire

Coolrunner REV C

Remove the C8 Cap
and bridge points  2 and 3
switching the coolrunner to slim after programming it works the best for boot times

Program the coolrunner for jasper RGH2   with timing file A
Program the coolrunner for Falcon RGH2   with timing file B


images shown here for wiring this is a jasper 512mb bb   i do them all the same way
for all jaspers 16mb and 256mb  and falcon 16mb rgh 2 14717 and up dashboards to previous 16756
(sorry for the dirty pics)





nand dumps make sure its on RGH2 not R-jtag



shown here part 1 first boot times

Part1
http://youtu.be/O44iVkyL5U8

shown here part 2 consistant boot times
Part 2
http://youtu.be/xyOMrzn-NAw


shown here part 3 fully assembled and great boot times still
Part 3
http://youtu.be/icvb1nlrIV4

Falcon RGH2 just as the same wiring as the jasper

Shown here Part 1
http://youtu.be/GrvdxvbhQhk


Shown here part 2 fully assembled now 16 second boot time
Part 2
http://youtu.be/jKaygxGKuRY

[Rodent]

Just another update for cheap nand programmer  to program and to read/write the nand 

I been talking to KingMike_OS  and both of us are having issues with Matrix Triple nand  if anyone has any info on how to read and write the nand with a Matrix Triple nand please post.  having issues detecting the USB device that reads and writes the nand to the Triple nand chip

[Gizmo613]

what programs are you using to program the nands? i know recent jrunner are not properly detecting other brand products.

[Rodent]

what programs are you using to program the nands? i know recent jrunner are not properly detecting other brand products.

Most are reconized thru J-runner   the matrix nand reader shows up as nand x  but the programmer for the Matrix Triple nand chip is different  I have tried nandpro2 and nand pro 3  neither seem to detect the USB  Not sure if this is a issue with DOS for windows 7 or just missing something . I talked to Kingmike last night he is having the same issues

[Gizmo613]

Programmer for the Matrix Triple Nand? Last i checked it works with any nand reader. have you tried programming with a jr programmer??

[Rodent]

Programmer for the Matrix Triple Nand? Last i checked it works with any nand reader. have you tried programming with a jr programmer??

the matrix trident triple nand uses a nand reader that looks like this needed to read and write the nands to each seperate nand on the trident  here is also a pic of the Matrix Trident Triple nand

[Gizmo613]

that's your problem right there!! that's not a nand programmer, that is a optimizing tool for the matrix glitcher v2 rev C and the firmware tool for the matrix freedom pcb boards for dvd drive flashing.

http://www.infinitymod.com/matrixfreedomPCB.html

[Rodent]

http://forums.xbox-scene.com/index.php?/topic/741156-team-infinity-matrix-trident-triple-nand-solution/

shows here that is the nand reader

[Gizmo613]

Nowhere in that link does that say it is the nand programmer. In fact i too have that External programmer and have used it for optimizing the matrix glitcher V2 rev c. Also it states that the trident is compatible with any usb/spi nand reader.

You have plenty of nand reader/writer at your disposal??, so use those. You'll only be giving your self a headache trying to reprogram the external programmer for the freedom pcb/glitcher V2. But that's up to you.

[Rodent]

Nowhere in that link does that say it is the nand programmer. In fact i too have that External programmer and have used it for optimizing the matrix glitcher V2 rev c. Also it states that the trident is compatible with any usb/spi nand reader.

You have plenty of nand reader/writer at your disposal??, so use those. You'll only be giving your self a headache trying to reprogram the external programmer for the freedom pcb/glitcher V2. But that's up to you.

- Compatible with every glitching solution present in the market, including Matrix Glitcher II.

the glitcher chip not the programmer

[Gizmo613]

works similar to the tx demon, you have to switch to the nands you want to write too.

[Rodent]

IDK just seems me and KingMike discussed this and having same issue   really a poor  instructions on everything i read.



So this is what i will have to try is  to  Read the nand and switch them manually and see if i can manually write the nands thru the motherboard its self   like your explaining but i just don't see how that will work the way the chip is made.. but i will give it a shot when i get time.  I appreciate your time with trying to help resolve this issue  and hopefully between a couple of us we can make a good tutorial for it

[Gizmo613]

That is exactly how it is done. The tx demon is done the same way. in fact the installation point are the same as well. You are familiar with how the demon works? There isn't much of a difference other that the demon having its' own software to be able to switch nands with the program.

[Gizmo613]

https://www.youtube.com/watch?v=WEIUuM-BeHQ

Here is a video of my rgh2 Jasper with a Matrix Glitcher wired exactly like how it's described in this thread.

Edit Notes from you tube
"Jasper rgh2 with a matrix glitcher v3. C8 removed, crystal unbridged and on fat switch."

[Rodent]

told you it works   great job 

[Gizmo613]

told you it works   great job

i've always run my wires that way. I just never knew about the c8 removal. That made the difference.

[rafaliyo86]

Hi guys, could you post a pic showing where is the C8 point you remove? If you talk about coolrunner I underatand it but gizmo says ( in the yellow edit) matrix glitcher v3

When you unbridge the crystal that means that you use hanna point (C point in matrix V3)

[Gizmo613]

Hi guys, could you post a pic showing where is the C8 point you remove? If you talk about coolrunner I underatand it but gizmo says ( in the yellow edit) matrix glitcher v3

When you unbridge the crystal that means that you use hanna point (C point in matrix V3)

Credits goes to Dgenx