How to JTAG your Xbox 360 and run homebrew

How to JTAG your Xbox 360 and run homebrew
I will be going over how to install XBR and Xell onto your Xbox 360.  Installing XBR allows you to do many things such run unsigned code(homebrew), install any sized hard drive(even 3.5in desktop hdds!), ftp into your box, and custom dashboards.  There are endless possibilities with being able to run any code you want.  You are able to modify Xbox 360 games to run custom maps and cheats.  You can also launch games off the hard drive without a disc.  It should cost you around $5 in parts, maybe even free if you have the parts already.
 
Remove these adsRemove these ads by Signing Up
 

Step 1Finding out if your Xbox is exploitable

Finding out if your Xbox is exploitable
Your kernel must be kernel 2.0.7371.0 or lower for this to work.  You can do this by opening up the system info tab.  After there is one more step to check if it still is exploitable, but you have to build your cable to dump your nand first.

« Previous StepDownload PDFView All StepsNext Step »
209 comments
1-40 of 209next »
Feb 7, 2012. 10:42 PMskibbadee says:
Easiest Method Available Here:

http://easyjtagmethod.blogspot.com/
Dec 10, 2011. 6:30 PMindijones2008 says:
I have an XBOX 360 Slim with Liteon 16D4s DVD (F/W 9504) since October 2011 when it was purchased anew. I have never connected it to internet, so the dashboard hasn't been updated ever though I haven't checked what the current version is. Will I be able to JTAG it to be able to play copied games? I'm not interested in XBOX Live at all. Thanks!
Dec 19, 2011. 5:18 PMSuperben51 says:
sorry but you can't jtag any slim however you can flash the dvd drive or Reset glitch hack it.
Feb 1, 2012. 4:00 PManque says:
wondering if u can help me out dont know if i have jtagable xbox my system info is as fallows d:2.0.7363.0 - k:2.0.7363.0 (bk:2.0.1888.0) x:4b5e-03a5-c6fc-d3ed its a non hdmi mnf date is 2006-03-02 thanks ahead of time
Feb 5, 2012. 10:21 AMSuperben51 says:
you should be able to just dont update the dash yet
Dec 14, 2011. 3:45 PMstephin99 says:
This goes out to all having trouble dumping nand through lpt
1. make shure 360 is plugged in both wall and motherboard
2.make shure plugged up to lpt good and snug

no results then go into to system bios and check if lpt is
1. enabled
2. set to EPP+ECP mode or into normal if in EPP+ECP

still no results
1.check soldering
2.check soldering
3.check soldering

nothing again?
1.check direction of diodes
2.add/remove the 100 ohm resisters on pins 1,2,14,16,17

nothing again bad lpt port/xbox
Dec 3, 2011. 3:32 PMMc T says:
Some things I've found which I hope will be useful:
While trying to read your nand, you get the flashconfig of 0x12000 and/or error: 0 reading block recheck all your points to the m/board. I spent a couple of hours trying to figure out what is wrong. In the end I removed and resoldered all my points again and it worked.

Reading your nand, a message of "error: 0 reading block xyz" doen't mean you have zero errors, it means it can't read the nand.  (Probable resolder time)

.....
Testing LPT device address:03BC
Could not detect a flash controller!

Means your soldering is bad or you haven't attached the power lead to your xbox (Don't switch your xbox on, just give it power.  This powers the eeprom so you can read and write to it). Word of Warning. It can't be in a RROD mode at this point as it still won't read even if your soldering is perfect.

Get several nand backups and compare them with a hex compare tool like wxHexEditor.  There should be no differences

As it takes an age to backup the nand, you might want to consider writing yourself a batch file to collect 4 copies of your nand or copy the 4 lines below and paste onto a dos window (they will run in turn)

nandpro lpt: -r16 nand2.bin > logfile.txt 2>&1
nandpro lpt: -r16 nand3.bin >> logfile.txt 2>&1
nandpro lpt: -r16 nand4.bin >> logfile.txt 2>&1
nandpro lpt: -r16 nand.bin >> logfile.txt 2>&1

You could set this off before you go to bed and when your up the next morning, you should have 4 nand.bin files waiting for you.

If your running Degraded to initially check the flash file and it keeps crashing on you, Open it up again and click "settings".  Set the following 2 settings
1BL key an enter DD88AD0C9ED669E7B56794FB68563EFA and tick the box.
File system start to 39.
If you've already done this, open a .bin file in a hex editor and look for the string near the top of the file:
2004 - 2007
Change it to:
2004 - 2005
and write back/save the file.  Downgraded should open the file now.... or use 360 flash tool at the top of this guide if you give up

If you don't like soldering, erm well tough really - neither do I, but you could buy a NandD-X (google it).  Currently £27 or $40US.  These are pins that are soldered onto your m/board, but you can't go too far wrong with them.  They connect back to a box of tricks which sends the data via usb back toy your PC.  This solution looks very neat, but if your tight like me and would like to reuse your item, you could look into getting just the "NAND-X Pin Header Cable" (google with quotes) £3 or $4.50, chop the ends off and attach to your LPT port cable *WITH RESISTORS AND DIODE" or buy some pin headers from ebay and make your own pin headers up ("8PIN GOLD DIP IC SOCKET PANEL ADAPTER SWAPPING").  Solder one to your m/board and cables to another.  They can act like plug and socket then, so you can flash again at a later date without resoldering again.  Note: Untested.  Just bought from ebay 30 mins ago (£1.30 for 10.)

Persevere.  It will take a while, but you will get there.  From 1 week ago when I had no idea about the 360 to now, running FreeStyle Dash and putting it back in its case for good.
Nov 27, 2011. 2:17 AMusman_segi says:
I have xbox 360 pro with Kernel 2.0.13604 is it exploitable?
Nov 17, 2011. 9:00 AMFurtchet says:
This is beautiful. It is always hard first getting into homebrewing a new system. Every system has its own lingo and this is AWESOME. Thanks!
Nov 9, 2011. 7:23 PMMumztheword says:
THERE are an awful lot of failures here. Either the info is wrong or a lot of people are just into screwing up a lot of consoles for nothing . What is happening?
I think a "Hands-on" instructional video, actually showing this info would help tremendously and curb the massive amount of failure questions.
Nov 12, 2011. 7:48 PMRegularChampion says:
Well, about 2 weeks ago Microsoft released a new patch that addresses almost all exploits to date. Not sure if this still works, but I doubt it. Sorry.
Nov 8, 2011. 3:56 PMstephin99 says:
hey i am a arduino fan and i have a arduino uno and a sd shield is there a way to jtag with that ?
just curious. please someone reply soon.
Oct 21, 2011. 11:35 AMjb35007 says:
i was wondering i have a old 360 with dash 6683 but somewhere along the way the dvd drive was taken out and LOST.. my question is can i j-tag the 360 and still be able to use it and play games via a external hard drive? haveing NO way to get any codes off the old dvd drive because it is long gone.
Sep 19, 2011. 12:09 PM02kingdam says:
I had tried reading the nand and got the error about flash cannot be found i resoldered everything and then after around an hour... i then read that the power plug had to be inserted into the xbox 360 and it plugged into the wall after i done this it read first time on port 0378 so this is just a tip for those who also receives this error
May 9, 2011. 12:55 PMModscientist says:
getting an error trying to dump:

Testing LPT device address:0378
Testing LPT device address:0278
Testing LPT device address:03BC
Could not detect a flash controller!
Can not continue

help !!?????
Sep 19, 2011. 12:06 PM02kingdam says:
Like a previous statement ensure that your XBOX POWER PLUG is inserted into the xbox when using nandpro but DO NOT TURN XBOX ON!!
Jun 29, 2010. 6:02 PMbrandon-scott says:
I have checked my soldering very many times and added the diodes and restarted my computer but nandpro still doesnt detect it, What do i do?
Sep 19, 2011. 12:05 PM02kingdam says:
Like a previous statement ensure that your XBOX POWER PLUG is inserted into the xbox when using nandpro but DO NOT TURN XBOX ON!!
Jul 13, 2010. 3:26 PMben ehrlich says:
did you make sure the diodes are facing the correct direction, thats what my problem was, it took me hours to discover it, i was about to give up too.
Aug 24, 2010. 9:26 PMeatmoreramen says:
I followed all the steps perfectly. Got the whole thing flashed. Before reassembling, I connected the power supply and a/v cables to the tv and attempted to boot, just to make sure it worked. However, I got three flashing red lights. I wasn't sure if it was due to the cables still being hooked up so I snipped them, still red lights. Any idea?
Sep 12, 2011. 12:30 PMTrainzboy says:
i have a xenon, pre nand dumped, no wire, so i run a huge risk here...
anyway, i got this too (about 5 mins ago so idk if its solved permanately)
and i fixed it simply by rebooting xbox with disc drive closed, and with a bit of luck, opening it at the right time... it booted flawlessly.. (without xexloader or whatever it is)

my question: is it supposed to stop at "Listening on port [blah blah blah]"???
May 5, 2011. 10:20 AMdanton721 says:
I think you have an Zephyr, Falcon, Opus or a Jasper motherboard right?
Try this tutorial instead
http://forums.xbox-scene.com/index.php?showtopic=719652
good luck ;)
Nov 14, 2010. 7:21 AMmodifiedAlex says:
NO, its not an overheating issue, when I attempted the JTAG hack the same thing happened to me. It is a hiden error code that only appears as 3rrod. - its a programing issue so I would erase the nand and flash the original back th the console.
Apr 29, 2011. 10:03 AMmachine156 says:
Then what....? Its not possible to JTAG these consoles then?
Nov 26, 2011. 6:02 PMmachine156 says:
THIS is the answer!!!
http://www.jtaggers.com/tutorials/71-remapping-bad-blocks
Aug 26, 2011. 3:09 PMarmedtoe says:
Amazing Instructable... but like thugzbaby said, it needs some updating. On my jtag, i followed the software-side to this, Set up the NAND flashing cables using this: http://forums.xbox-scene.com/index.php?showtopic=691873 ; and Installing the jtag wires using this: http://forums.xbox-scene.com/index.php?showtopic=691873.
Aug 30, 2011. 8:01 AMillflux says:
Those links you posted are the same - if this wasn't intentional, can you please update whichever one is wrong? Might be interested in doing this.
Aug 26, 2011. 12:17 PMocas890 says:
u should really dump the nand through nand-x instebd of lpt
Aug 31, 2010. 1:39 AM_-hcm-_ says:
So by doing this: 1.Can we still play games online? 2.What happens when we remove that resistor? I'm really curious please help
Aug 31, 2010. 7:36 PMryguy425425 says:
1. Yes, but only for a short period of time. It could be 1 min or 3 months.
Aug 31, 2010. 7:48 PMryguy425425 says:
2. The J-Tag exploit was closed with a dashboard update which blew a fuse on the motherboard. Removing the resistor means the fuse can't be blown, keeping the J-Tag exploit open.
Jul 24, 2011. 4:00 PMjrichards7 says:
If the fuse is already blown couldn't one just use a bit of solder to join it back together? Or is it something that may damage the system. I remember having to do something like that on a 360 reciever to get it working again. I suspect since it was an intentional software fuse blow then it must not have been too important. The reason I ask is if you did join it would it make a jtag available to newer kernels since there is no fuse to blow and the connection is still there?
Aug 26, 2011. 6:21 AMsevans14 says:
The fuse is an internal one, built into one of the microchips. Very very tiny. With an electron microscope, you might be able to see it, but there's no practical way to fix it.

They put fuses like this into microchips for security reasons, as you can see!
Jul 24, 2011. 4:21 PMryguy425425 says:
I believe it is a virtual fuse, and I want to say it effects the bios. The only real answer I have to that question is that if it was that easy, it would have been done already (and it hasn't). I hope that helps.
Aug 24, 2011. 4:21 PMlittlebites115 says:
ok i have one with a 2.0.8507.0 is that ok??????????????
Aug 14, 2011. 3:16 PMsg tu says:
where the orig.bin?please help me.............
Jul 20, 2011. 8:40 AMrdavis14 says:
Does anyone know where to buy an xbox 360 nalready jtagged with homebrew?
Aug 1, 2011. 1:47 AMdbarker4 says:
i got 2 for sale in australia!
look me up in facey.. username xboxsc
Jul 28, 2011. 1:40 PMsudburymods says:
http://www.sudburymods.com
Jul 29, 2011. 6:19 PMSmellyRat117 says:
Anyone know where i could get a pre-modded one? I dont want to risk my xbox so i was thinking i could just get a pre-modded one cheap. (Max would be around 150(i know its dumb and crazy)) I WANNA HACK ASSASSINS CREED BROTHERHOOD! I BELIEVE I CAN FLY!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

XD
1-40 of 209next »

Pro

Get More Out of Instructables

Already have an Account?

close

All Steps Viewing
View all steps of an Instructable on the same page when you're a Pro Member.

Upgrade to Pro today!
26
Followers
5
Author:CowGuy