How to Fully Jtag an Xbox 360 Console!

Discussion in 'Modding Tutorials' started by L14M333, Jun 26, 2010 with 266 replies and 95,867 views.

  1. L14M333

    L14M333 Senior Member

    Messages:
    936
    Likes Received:
    548
    Hello there, You are looking at my massive tut on how to Jtag an xbox from start to finish. If you want to jtag your console and dont know where to start, this is where you wana be!

    This whole tutorial relies on use of iHc NandTool Version 2 (you can get it from the links below)

    So to get started...

    Software Downloads:
    iHc Toolbox - Downloading Latest iHc Toolbox
    Microsoft .Net Framework 3.5 of above - Download details: Microsoft .NET Framework 4 (Web Installer)
    Jtag files - Mirrors in spoiler
    Mirrors:
    Code (Text):

    http://www.2shared.com/file/sjGf-wqV/NandToolDependenciesPack.html
    http://www.multiupload.com/SEX6WI9AQC
    http://rapidshare.com/#!download|258tl2|441170343|NandToolDependenciesPack.rar|20869
    http://hotfile.com/dl/94787440/9bb35a5/NandToolDependenciesPack.rar.html
    http://depositfiles.com/en/files/xqi4onchq
    http://www.megaupload.com/?d=TNWANM7F
     


    Once you have the software we can now move onto hardware...

    So lets begin....

    This tut will be done on an xenon console and the jtag wiring (diodes) will be different for other revisions, other than that i will always be the same

    This is gona be long, compacted and you are gona need alot of things.

    Requirements
    Parts list and quantities from maplins (UK) - (you can get from alternative sources if you wish)
    Switching diodes - Part Number QL80B Quantity - 2 (i recommend getting a spare)
    Ethernet cable - Part Number CW45Y - Quantity - 1 (1M of it)
    Soldier - Part Number N51AW - Quantity - 1 (tube)
    soldiering iron - Part Number N11BY - Quantity 1 (30W should be fine)
    100 ohm resistors - Part Number M100R - Quantity 6 (May not be needed but get to be on safe side)
    There the physical parts ^^^ now some things you need in your house...

    A tidy work area:
    [​IMG]

    A computer with one of these badboy ports (LTP Port, Usually used for Printers)
    [​IMG]

    A victim to exploit:
    It needs the 7371 dashboard or below.. (To get it, go to System Preferences > System Settings > System Info
    [​IMG]
    [​IMG]

    Right this can be a little more complicated than just having that dashboard... Although I say dashboard 7371 or below, if your console has a MFR date of 1st June 2009 or above and still has 7371 dashboard then it may have been patched already!

    However you could be lucky and it still isnt.. The only way to find out is to do a pre dump CB Check to be 100% sure...

    So Dashboard 7371 or below & a MFR of before 1st June 2009 = 100% Jtaggable

    If you have that mfr after 1st June 2009 you can take the risk but be prepared for a possible let down...

    So an overview of the above... This is what you need:
    x6 100 ohm Resistors (dependant on your computer (get them to be safe))
    x3 Switching Diodes
    1m of Cat 5 ethernet cable
    A PC with a LPT port
    Some soldier and a soldering iron

    [​IMG]


    Now you are ready to jtag your console...


    So, we have the parts we need? lets get to installing the new exploit wiring

    If you are using NandX, Look at the below spoiler, If you are using LPT then skip the NandX one

    Setting Up console for NandX
    Installing NAND-X QSB Jtag Wiring
    First off we need to install the JTAG wiring (two diodes and a jumper) what are included in official NAND-X bundles, This is simply two QSB's (Quick Solder Boards) and a cable, you can see it here:
    [​IMG]

    Now, we need to soldier these onto the motherboard, Here is a picture of where the QSB's need to go:
    [​IMG]

    first off, remove the sticky pad on the back and stick them where i do below:
    Make sure you align them with the holes on the motherboard!

    [​IMG]
    [​IMG]

    So now the motherboard should look a little like this:
    [​IMG]

    Now with your super slick soldering skills, Connect the connectors on the QSB with the holes under it:
    [​IMG]

    Now, you have soldiered on the QSB we can no add that blue and yellow wire, so connect it up

    Now we need to configure the switch and jumper. Here is a quote from the team-xecuter

    So i am going to go by what they say, i have switched the switch to the setting closest to the jumper (0) and removed the jumper. If i get errors later i will do what they say and change it if needed.

    So it should look like this (i blu tacked my jumper to the console for safe keeping :smile:)
    [​IMG]


    So that is the jtag wiring part done :smile:

    Now we need to install the NAND read/write points. I will also be using the QSB to do this as well. It is very simular to the above one so i recommend that your read that bit first as i may go a bit quick through this one...

    Installing NAND Read/Write NAND-X QSB:
    As i mentioned above, read through the Installing jtag wiring spoiler first...
    Now we need to do the same as we did above but in two different places... i am just going to whiz through here and show you where they need to go...

    So these are the two QSB's we have(sorry, i already used these ones so there a little dirty)
    [​IMG]

    Now as mentioned earlier, install them into these locations:
    [​IMG]

    Once you have installed them two, connect up the three pin headers to the two QSB's.

    Now i like to be a bit of a perfectionist so i wired mine back out to the outer shell of the case :smile:
    [​IMG]


    Now we have all this connected we can begin to dump our nand, so connect the cable up and move on..

    Now that we have it all setup we can get ready to dump, mod and write nand... this is also a lot easier than the LPT method.



    Setting Up console for LPT
    Installing JTAG Wiring
    So first off we need to open the xbox and remove the motherboard from the casing... the console i have had RROD so i will remove the heatsinks as well but you dont need to do that.

    To open the XBOX you will need a T8 and a T10 Screwdriver along with a very small (1.2MM) Flathead screwdriver... i do not have a tut on how to open it but if anyone has a good video feel free to post it and i will use it.

    [​IMG]

    now you removed the motherboard, chuck all the junk of your clean workspace and put the motherboard on there... first off we want to know where we are working... look at this picture below:

    wiring is spelt like this <<< i am aware lol
    [​IMG]

    That is the area where we will be working and i added some quick lines (took me ages really :tongue:) to show where we will have to soldier to for the jtag hack to work.

    Now we are going to install the two diodes and the jump wire. If you look at this close up you will see what needs doing

    [​IMG]

    You can see the I< on the two diodes wires... thats the end the black end points towards! it has to be that way! so it will look like this:

    [​IMG]

    And the jumper (Green line) couldn't be more easier... all you need to do is short them two pins together.

    So we can begin soldiering to the motherboard!

    You will need some soldiering skills and a steady hand here, My best method of soldiering into these little sockets is to turn the board onto its side and press the soldiering iron onto the rear of the hole melting it so that you can slide the cable into the whole. A picture:

    [​IMG]

    so using that tip, some wire (just ~3cm from the CAT5 cable) and the above installation instructions it should look like this:

    [​IMG]
    [​IMG]

    Once its done and secure i would recommend you cover it in insulation tape to stop any shorting. but thats it! you console can now run the JTAG hack... all we need to do is install the LPT cable and write to the nand.

    So now we have our JTAG hack diodes installed we now need to get the console ready for writing to the nand.

    Making and installing the LPT cable
    So now we have our Jtag wiring installed we now need to write the modded image (freeboot) but before we can do that we need to install the connection from our computer to the console... this will require more soldiering btw.


    so lets begin, first off, this can be done in two ways, install a permanent cable (im not going to go into it) or a temporary one (what im gona do)

    This cable is only needed once for reading and writing to the nand the modded image. For more experienced modders who will try loads of hacks to booting ect i would recomend that you use your brain and create a socket what lets you write to the nand with the console closed up (most common method is get an ethernet coupler and make a hole under the HDD... this will be more clearer later on in this spoiler.)

    anyway, the temporary method:
    (i will do a more permanent method later if i get a client who requests it)

    Right first... we need to get our cat5 cable and cut it down so it is no more than 40cm (anything more and it will corrupt the data giving bad nand dumps, some PC's may need it shorter)

    [​IMG]

    Now you want to cut about 9cm of the outer insulation (in my case the blue bit) so you can see 9cm of the 8 wires in side

    [​IMG]

    now we only need 7 wires so pick a colour and get rid of it

    [​IMG]

    Now because i jtag alot of consoles i want a more long lasting cable so i am attaching stronger bits of metal to the end of my cable so i can solider and disorder easily. If you want to copy me all i did was dug out some heat shrink tubing (2.4MM) and some old resistors (using the metal from each end of it) and did this (below) to each side:

    [​IMG]

    so now you have the cable made (if you dont want my fancy add on just strip the wires down and neaten it up ready to soldier into the holes) we can no get ready to soldier on the console motherboard.

    take a look at this picture, the coloured dots are where you need to soldier to, these will also be matched with a corresponding colour slot in on the LPT port of the PC:

    [​IMG]
    and they need to connect to here:
    [​IMG]

    Now unless you have a multimeter and can test the voltage the PC outputs to the LPT, i would install the 5 100 ohm resistors to cables; Orange, Orange/White, Green, Blue and Blue/White.
    The only way to tell if these are needed is if we get an error later on trying to read the nand, if we do we will take them off. I know in my case i don't need them so i wont bother with them but you all should.

    so now you know where you need to soldier to (We are only soldering to the motherboard, we only have to slide the cables into the PC port) we can get soldering! here is a pic of what it should look like when were done:

    [​IMG]

    Now we have the cable wired on we are now ready to connect it up to out PC!


    lets move on!

    So now we have our wiring done we now need to prepare our computer (the one with the LPT port) for dumping, making and writing to the nand... lets begin

    Setting up the computer
    first off we need a working os (unlike mine)

    [​IMG]

    Once you have a 64 Bit OS (Win XP, Vista or 7)

    Now we need to put the jtag files somewhere where iHc Toolbox can see them.. If you open the Jtag files rar you downloaded from one of the mirrors you will see a folder named 'nandtool' In there is all the dependencies that iHc NandTool needs.. Just simply copy the 'nandtool' folder into the same directory where iHc Toolbox.exe exists then load iHc Toolbox.

    iHc Toolbox should look a little like this when it loads

    [​IMG]

    To load up iHc NandTool, Click the arrow to the right of 'Xbox 360 Jtag / Dev Kit' Section and then click on 'iHc Nand Tool'

    It should look like this when it loads:

    [​IMG]

    If the console displays:

    Code (Text):

    iHc NandTool> Checking for Freeboot and its dependencies...
    iHc NandTool> Some dependencies for freeboot could not be found, Please ensure they exist
    iHc NandTool> File descovery complete, total of 3 errors.
     
    it means that it could not find one or more file in the nandtool folder that is needed. Make sure the folder exists in teh same directory as the exe!

    Now we have loaded nand tool and have the files in the right place we are ready to start! First we need to find out what console revision we have... Hover over each of the 'Console Revison' Buttons and compare the information with your console.. When you have found your revision click on it.

    Now we need to set up our Connection Type.. If you are using LPT select 'LPT Connection' and if you are using USB select 'USB Connection'


    Now we are ready to start!

    LPT Setup
    so first off get the console near to the LPT port and plug it into its power pack

    [​IMG]

    Now going back to earlier:

    [​IMG]

    you need to connect the console up to the LPT port...

    this is what it should look like:

    [​IMG]
    [​IMG]

    so now we have our wireing done, the program is in place... means its time to dump the nand!

    USB Setup
    This one is simple... Connect your Nand-X/ SPI Nand Flasher to your computer and plug your consoles power supply in!


    So we have the Jtag connected up to the computer, we can start! so lets go!


    PreDump CB Check (Make sure we can jtag)
    This pre-dump CB check is a handy feature as the only way tou be 100% sure you can jtag is to check the CB version... now if you are using a LPT your dumps can take a VERY long time... this pre-dump CB check only dumps 33KB instead of 16Mb,256Mb or 512Mb to possibly be let down... anyway lets do this shizzles!


    Once you have your settings in place, Head over to the 'Nand Pro' Tab and click on Read CB.

    If it can make a connection OK and read the block of your nand containing the CB then you should see a response in the console similar to this:

    Code (Text):

    CB Checker> Loading file...
    CB Checker> Your CB Version is: 1903. Checking for exploitability...
    CB Checker> Consoles CB is exploitable for the 'jtag hack'. Consoles motherboard revision is: Xenon (1903)
     
    If it states that your console IS exploitable for the 'jtag hack' you can continue.. If you get a response like so:
    Code (Text):
    CB Checker> Consoles CB is NOT exploitable for the 'jtag hack'. Consoles motherboard revision is: Xenon (1940)
    Then unfortunately you cannot jtag your console


    so if you have a jtaggable console, move on... if you dont... sorry you just waisted your time but this is the only way of being 100% sure you can dump

    so now if we have passed the CB check stage... we can now dump our nand!

    Dumping the nand
    This is just as simple.. Press the 'Read Nand' Button in the 'Nand Pro' tab and a CMD window will pop out, It will begin the dumping process of the Nand, It has to dump up to blocks 03FF, Once its done the console should say 'Press any key to continue'... Do as it says and if the nand was dumped correctly a save file dialogue will appear, Save your nand image as OrigDump1.bin or something like that to a SAFE location then repeat the above 2 more times so we have 3 Copys of your nand (to compare)

    Now you should have 3 Dumps, Hopefully they are all the same size

    [​IMG]

    If for some reason you receive any sort of error messages when dumping the nand they will be read into the built in console

    You can post the error and i will try to help you..

    if you have 3 dumps then you can move on.

    So now we have 3 copies of our original nand? lets check them!!!

    Checking the nand images
    right... now this couldn't be any easier, on iHc NandTool go to the 'Nand Tools' tab and click 'Dump Compare' and it will load a open file dialogue.. select the first dump then press open... then another box will popup, select your 2nd dump... once you click OK it will run the check process through:

    If the console reads something similar to this:
    Code (Text):
    Dump Compare> 1024 blocks checked... The two dumps are identicle!
    Then you are good to go! feel free to move onto the next spoiler..

    However if you get a response like so:

    Code (Text):
    Dump Compare> 1024 blocks checked... 1 Different block found... The two dumps are NOT identicle
    It shows that one of your dumps was corrupted in the dumping process... Just try different combinations of the 3 dumps until you get identical ones... If you keep getting corruption try make sure the LPT connection is as short as possible and that the ground wire IS connected.

    So you got a good dump? lets double check that is okay to jtag this consols


    Checking the CB version (Make sure we can jtag)
    if you did a predump CB check then you don't need to do this... move on

    But if you didn't then go to the 'Nand Tools' tab and click 'CB Check'

    It will load a Open file dialogue, Select one of them 'good' nands (what was identical with another one)

    then press OK, it will do its magic...

    if you get a response like so:
    Code (Text):

    CB Checker> Loading file...
    CB Checker> Your CB Version is: 1903. Checking for exploitability...
    CB Checker> Consoles CB is exploitable for the 'jtag hack'. Consoles motherboard revision is: Xenon (1903)
     
    If it states that your console IS exploitable for the 'jtag hack' you can continue.. If you get a response like so:
    Code (Text):
    CB Checker> Consoles CB is NOT exploitable for the 'jtag hack'. Consoles motherboard revision is: Xenon (1940)
    Then unfortunately you cannot jtag your console


    so if you have a jtaggable console, move on... if you dont... sorry you just waisted your time but this is the only way of being 100% sure you can dump

    Now we know for certian that our console can be jtaged, lets flash xell to the console

    Installing Xell to get the CPU key
    right, go back to iHc NandTool navigate to the 'Nand Tools' tab, You will see a 'Write Xellous' Button.. Press it and a command window will pop up (it may be pushed to the back to have a look)

    [​IMG]

    Don't ignore the warning! if you overwrite your nand without backups your console is useless!

    Press any key then it will do its work

    Check the console log to make sure it has wrote... if there are any errors then it hasn't worked so find out why!

    Got xellous on your xbox? now you can get your CPU key for the console,

    Obtaining your CPU key
    Right, so now you have xell installed to your xbox, turn your console on via the eject key, plugged into a tv and not the LPT port you should get a blue screen.

    Now get a camera handy and when you turn it on, you should see this:

    [​IMG]

    now wait a second and you will see something like this

    [​IMG]

    Now thats ^^^ is what you want to take a picture of. The console fusesets.... if you look you will see set's 3&4 and 5&6 are identical... now take either set 3&4 and 5&6 and put them together. This makes your CPU key.

    So mine are

    Set 4: AF39DF25B0CD3878
    Set 5: 36C083CF14E6E4D6

    So my CPU key is: AF39DF25B0CD387836C083CF14E6E4D6

    Note that down and save it! you will need it in the future!

    Now its safe to turn off your xbox once you get your key.

    Now we have everything we need to build our Freeboot 0.032 image... lets move on

    So we have our CPU key and original image, we can now make our freeboot image what will actually carry the hack

    Making the FbBuild image (Kinect Dash)
    Right, there are three things we need to make this image:

    Your CPU key
    Your original nand dump
    iHc NandTool Version 2

    If you have them continue, If not look above for info on getting them!


    Now, lets make our image...

    Head over to the 'Freeboot' Tab, you should see something like this:

    put your CPU key what you got from xellous in the 'CPU Key:' Text field.

    Now we need the 1BL Key of the xbox, I cannot provide this but this can help you find it:

    https://encrypted.google.com/search...L Key&aq=0p&aqi=p-p2g8&aql=&oq=xbox &gs_rfai=

    The 1BL key is a 32 Character HEX key what will look similar to the CPU key, Once you have it put it in the '1BL Key:' Text field

    Now lets customise our build...

    If you want dashlanunch patches obviously select the 'DashLaunch Patches' Button, I recommend these but they sill are optional

    If your console does not have a DVD drive then select 'No DVD Drive' if it has one then select 'Use DVD Drive' (simples)

    Now if your console is using the wiring methods shown by me in the guide (for jtag wiring) Then select 'No Aud_Clamp Fix' But if you use the Aud_Clamp wiring method then select 'Aud_Clamp_fix' For the patched SMC

    Now we have customised it it should look a little like so:

    [​IMG]

    Now press Build then an open file dialogue will pop up, Select one of the good original nand images and press Open

    Now just simply let it do its stuff!

    The console will be very active over the next few seconds but when its done if all went well an save file dialogue will appear, Save the file and something like FbBuild.bin then just check that the console looks similar to this:

    [​IMG]

    If it does you are all good to go! You move on

    So your nearly there... made your image, now lets write it back.

    Writing freeboot image back to xbox
    Right, were nearly there, you should be able to smell the ability to hack shizzles! We just need to get the modded freeboot image back onto the console,

    now just go back to the 'NandPro' tab and click 'write nand', then you will need to select the newly made freeBOOT image and click open

    Another window will pop up again, read the warning and press any key.. now let it do its writing..

    Once its done it will say 'Press any key to continue'

    once it has write fully you have no jtagged your xbox! congrats!

    once its done, unplug the console from the computer, desoldier the LPT cable. NOT THE TWO DIODES AND JUMPER! Just the 7 that go into the pc, unless you want to keep them of course and you xbox will now officially be jtaged!

    Well done for doing it yourself and not going off to buy one!
     
    71 people like this.
  2. Ayers12345

    Ayers12345 Enthusiast

    Messages:
    38
    Likes Received:
    3
    Nicee post man sticky worthy :tongue:, could u help me over MSN or AIM please relaly need help with my Jtag ! Thanks Great post.
     
  3. L14M333

    L14M333 Senior Member

    Messages:
    936
    Likes Received:
    548

    i can try my best :biggrin:... my AIM is L14M333, dont be offended if i donk know what your on about, i get like tonnes of people adding me 24/7 lol
     
    1 person likes this.
  4. Ells

    Ells #yoloswag Retired

    Messages:
    7,516
    Likes Received:
    2,940
    This is an awsome tut :biggrin:

    Just to inform you though, "if you look you will see set's 3&4 and 5&6 are identical... now take either set 3&4 and 5&6 and put them together. This makes your CPU key."

    Its 3&5 or 4&6.

    :smile:
     
  5. L14M333

    L14M333 Senior Member

    Messages:
    936
    Likes Received:
    548

    Or 4&5 or 3&6, thats why i did it that way :tongue:
     
    1 person likes this.
  6. Ells

    Ells #yoloswag Retired

    Messages:
    7,516
    Likes Received:
    2,940
    :lol: Just confused me a little when I read it.
    Anyway, I'm sure a lotta people appreciate this, also with it having the stuff you can buy from Maplins its good for all UK guys over here :smile:
     
  7. L14M333

    L14M333 Senior Member

    Messages:
    936
    Likes Received:
    548
    ill try make it in a less confusing way later..


    thanks :biggrin: and yeah, when i first jtaged i didnt really know where to get the stuff from so i put them order codes up, and later ill get some from radio shack over in the us :biggrin:



    Liam
     
  8. Alexebbs

    Alexebbs Getting There

    Messages:
    242
    Likes Received:
    104
    Great TUT, the one that is already here is not that detailed.

    +Rep.
     
  9. AntzC

    AntzC Getting There

    Messages:
    1,194
    Likes Received:
    61
    Really Good Tut + rep :smile:
     
    1 person likes this.
  10. L14M333

    L14M333 Senior Member

    Messages:
    936
    Likes Received:
    548

    Thanks you two :biggrin:


    and yeah i did try to make it really detailed :tongue:


    Thanks you two :biggrin:


    and yeah i did try to make it really detailed :tongue:
     
  11. I3ROKEN HEART

    I3ROKEN HEART Newbie

    Messages:
    2
    Likes Received:
    0
    i have windows 7 and if i am trying to read my nand from my xbox i have error [​IMG]


    and my lpt is [​IMG]

    if i want run CMD i wright "nandpro.exe lpt: -r16 nand1.bin" to dump my nand
    What is the shortcut my device "lpt or usb or what?"?
    *sorry for my english*
     
  12. 360Modder

    360Modder Enthusiast

    Messages:
    399
    Likes Received:
    19
    Very nice dude
     
  13. twochikenwang

    twochikenwang Chuck Norris

    Messages:
    358
    Likes Received:
    22
    great tut getting my friends xbox to jtag(Now i will have 2 jtags)
     
  14. L14M333

    L14M333 Senior Member

    Messages:
    936
    Likes Received:
    548

    sorry, i dont think nandpro supports it. as far as im aware, it only supports the actuall lpt port orn usb spi nand flashers


    Edit... try this: http://forums.xbox-scene.com/index.php?showtopic=699212

    find out the address of the new port and use that program on the 2nd post.


    Good luck

    Liam
     
  15. BossDawgBullies

    BossDawgBullies Newbie

    Messages:
    48
    Likes Received:
    1


    You say you know you didnt need the resistors

    i just checked both of my PC 's one pc all ports are running on milli volts except lpt port 11 which is 5 volts

    The other PC all ports are running @ 4.5 volts except for lpt port 17 which is running 177 milli volts

    so i am assuming what ever port is below 3.3 volts i do not use the resistors ? And i dunno how the lpt port 11 running 5 volts works with the switching diode

    Any knowledge about my findings?
     
  16. L14M333

    L14M333 Senior Member

    Messages:
    936
    Likes Received:
    548
    Yeah, if it is 5 get them, i believe mine runs at 3.3 thats why i dont need them
     
  17. BossDawgBullies

    BossDawgBullies Newbie

    Messages:
    48
    Likes Received:
    1

    Ya , but should the others be running on millivolts?
     
  18. Halibut Lord

    Halibut Lord Enthusiast

    Messages:
    231
    Likes Received:
    49
    Very well written tut. Read the whole thing took me 20 minutes... now I might have to actually try this. Thanks +rep well deserved.
     
  19. L14M333

    L14M333 Senior Member

    Messages:
    936
    Likes Received:
    548

    yeah, there data, there fine. i think, lol

    thanks :biggrin:
     
  20. Gamgam0

    Gamgam0 Enthusiast

    Messages:
    234
    Likes Received:
    14
    Can you post what points to solder the ethernet cable to for the other motherboards. Thanks