J
JoinTheResistance
Dead to the world, alive for the journey...
Wazzap guys?! Back with another tutorial! This time I'm going to be showing you how to do an S-RGH install, the best RGH method that you can use on a slim. As with RGH1.2, it was developed by 15432, who I would like to say a big "thank you" to!
Now, let's get this party started!
P.S. If some of the text is unreadable, switch to the dark theme!
Warning:
Soldering skills are required to perform this mod, needless to say you can damage your console while performing this mod.
Health warning:
Soldering, especially when using flux, generates toxic fumes, which you should not breath in! Therefore, it's recommended to either work in a well ventilated area or use a fume extractor. No solder joint is worth cancer!
Supported consoles
All Trinity and Corona slims
Unsupported consoles
All Phats
Winchester slims
Identifying your console
Trinity or a corona
Identifying the corona version.
If you have a Trinity you can skip this step
If you have a Corona disassemble your console and follow the picture from below to identify the sub model
After you know your exact motherboard version, proceed to the next step
Software
[Click here to view this link]/[Click here to view this link]([Click here to view this link])
[Click here to view this link]
Hardware needed
Depending on your motherboard revision, you might need some console specific things, but let's start with the standard stuff first.
Soldering iron
Solder (preferably lead free)
Wires (AWG 26 and AWG 30 work very well)
Flux
J-R Programmer or Nand-X (Both will work well)
A glitch board/chip
(Optional) Some pin headers, if you're going to use an ACE or DGX/RGX that doesn't have them and don't want to solder the programming cable directly
Supported glitch boards/chips (Glitchers)
X360 ACE
This is the easiest to find chip, it is also the best one for the task.
DGX/RGX
This one is a bit harder to find and might even cost you a bit more. It works, but I still recommend getting the ACE.
Console specific
Corona V3/V5
A postfix adapter
Now that you have everything ready, let's start!
The first thing to do is install the JR-programmer/matrix nand flasher drivers.
First connect the device to your computer and wait until windows tells you that it can't find the drivers. After that go into device manager and locate the JR programmer/Nand-X, it should show up as JR programmer, unknown device or memory access. Next right click on it, "Update Driver software", "Browse my computer for driver software" and point it to the jrunner folder.
Step 1: Reading the nand
After we have all the required software and hardware ready, we need to read the nand of the console. Simply put, the nand is the chip where the console's operating system is stored and we need to make a copy of it (nand dump), so that we can modify it. This process is going to vary by motherboard type.
First, connect your JR programmer or nand-x by following the diagrams from bellow.
Note: You'll need to cut the colored plugs off of the end of the nand cable on the JR programmer/Nand-x
Trinity
Corona V1/V3/V5
After you have the cables soldered to the motherboard, plug the power cable in the xbox, but do NOT power it on! Connect the usb cable to your programmer and your PC and launch jrunner.
You should see either the nand-x or JR programmer logo next to the "CPU key database" button, if it's not there your drivers probably aren't installed properly. If you see the logo you should be able to proceed.
You need to get two matching nand dumps so make sure that under reads you have at least 2. To begin reading the nand click on "Read Nand". After it's done doing all of the nand reads jrunner is going to compare them and tell you if they are the same. If you get "Nands are the same" then you are ready to continue. If you get any bad blocks, don't worry about them, jrunner will remap them automatically, just make sure that the nand dumps match. If your nand dumps don't match or you get a "Wrong version 0x0000000" error, then check your soldering and try again. Do NOT continue until you have at least 2 matching nand dumps.
Step 2 - Creating and flashing the ECC
After getting the matching nand dumps, select "glitch2" on the right hand side of jrunner and click on "create ECC". Once it says "ECC created", click on "Write ECC" and wait until jrunner writes the ECC back to your console.
Step 3 - Programming the glitch chip
First unplug the nand read/write cable from your JR programmer and connect the xsvf programming cable in the top plug. If you're using an ace (or an RGX without headers), you have probably seen that there is nowhere to plug the other end of the cable in, well this is where those headers from before come in. Here is what your chip will look like after soldering the headers.
Of course you can just solder the wires directly.
On the JRP cable you will have a few labels, when you are plugging the cable in the glitch board make sure that you match them with the labels on the board that you are using. The ace chip doesn't have labels so use this picture instead.
After you have the headers soldered and all of the cables plugged in, switch the switch near the xsvf port on the JRP to the side closer to the port itself.
To flash the timing file, open jrunner and go to advanced, then custom nand/cr functions, select Xsvf and click the "..." on the right. Next, use the the window that just popped up to navigate to where you have the S-RGH files extracted, go in the "Trinity" or "Corona" folder (depending on what console you have) and you will find 3 sub folders 150MHz, 200MHz and 300MHz. These folders hold the timing files that we will be programming onto the glitch chip. The folder names represent the working frequency of the chip when flashed with one of those files. Because every console is different, there is no way to determine witch file is going to work best for you. Once you open one of the folders you will see more folders labeled "timing_XX.X". The numbers represent the timing at which the glitch/reset pulse will be sent. Lower means earlier, higher means later. In these folders you will find the actual files. They will the labeled "TR_L_X.X_T_XX.X" for trinity files and "CO_L_X.X_T_XX.X" for corona files. The number after the "L" is the length of the reset/glitch pulse. The lower the number, the lower the pulse length, the higher the number the loner the pulse. Of course we can't be sure what is going to work best, so we will start by choosing the 300MHz, "TR_L_0.5_T_60.6" file for trinity consoles and the 300MHz "CO_L_0.5_T_66.2" file for coronas.
After the file is selected, click open and then "RUN". Wait until jrunner flashes the file onto the chip, after it's done disconnect the chip and proceed to the next step.
Step 4 - Soldering the glitch chip
After the ECC has been written and the glitch chip programmed, it's time to connect it to the motherboard. Follow the diagrams from below!
DGX/RGX
Trinity/Corona V1/V2
Corona V3/V4/V5/V6
X360 ACE
Tinity/Corona V1/V2
Corona V3/V4/V5/V6
You will also need to bridge a few points if you have one of these motherboard revisions.
Even though it says V3 and V4 only, this is also necessary on V5 and V6 boards. To bridge the points you can use 0 Ohm resistors/fuses, a small wire or just solder on its own. As the picture suggests, only make the bridges if the resistors are missing!
Step 5: Getting the CPU key
After you have soldered the chip onto the board it's time to get the cpu key. First, you need to disconnect the JR programmer/Nand-X from the motherboard. Simply unplug the cable from the JRP/Nand-X itself, no need to desolder it.
Once you have your nand reader disconnected from the motherboard, plug the power and HDMI/AV cables in and turn your console on. Now the glitch chip will attempt to glitch your console. If your console doesn't boot within a minute, program the chip with a different timing file. Note: Make sure that the console is both off and unplugged while programming the glitch chip.
Once your console boots you will see the Xell Reloaded screen.
Wait a bit and it will scroll down to your CPU and DVD key. The one we need now is the CPU key, so take a picture if it or write it down.
Once you have your CPU key turn your console off and continue to the next step.
Step 6: Building and flashing the hacked image
So, since jrunner no longer updates, you will either need to use 17511 for the initial XeBuild (even if your console was on a higher dash prior to RGHing it), or update it yourself like this.
Don't worry about that now, you can later update to the latest dashboard.
Make sure that you have 17511 selected under dash version.
Load one of your nand dumps into "source" in jrunner and enter your CPU key in the CPU key box.
Don't worry about mistyping your cpu key, jrunner will tell you "CPU key is correct" if you have entered it correctly.
Once you have entered your CPU key correctly and downloaded the latest dashboard, select "glitch2" from the right and click on "Create Xebuild image". Note: If you aren't getting instant boot times you can check the "CR4" box next to glitch2 to reduce the time between glitch attempts.
Once it's done creating your image connect your JR programmer/matrix nand flasher to your console and PC, then plug the xbox 360 power cable in the console, but do NOT turn the console on! Next click on "Write Nand" and wait for it to write the image onto the console.
After it's done writing the image unplug everything and wait 30s, after that plug the xbox 360 power and HDMI/AV cables in (make sure that your nand programmer is NOT connected to the console) and turn your xbox on. Your console should now boot into the default dashboard. And that's pretty much it, now all you have to do is desolder the nand cables, clean the flux and put your console back together.
If you can't get your console to glitch there are many things to try, too many for me to mention them all in this thread. I suggest that you head over to teamx360.co.uk and doing some reading in the S-RGH section. If you can't find a solution there, then open a thread in the "Xbox 360 support" section here on se7ensins or over at teamx360.co.uk and we'll try to help you as best as we can.
Now, let's get this party started!
P.S. If some of the text is unreadable, switch to the dark theme!
Warning:
Soldering skills are required to perform this mod, needless to say you can damage your console while performing this mod.
Health warning:
Soldering, especially when using flux, generates toxic fumes, which you should not breath in! Therefore, it's recommended to either work in a well ventilated area or use a fume extractor. No solder joint is worth cancer!
Supported consoles
All Trinity and Corona slims
Unsupported consoles
All Phats
Winchester slims
Identifying your console
Trinity or a corona
Identifying the corona version.
If you have a Trinity you can skip this step
If you have a Corona disassemble your console and follow the picture from below to identify the sub model
Software
[Click here to view this link]/[Click here to view this link]([Click here to view this link])
[Click here to view this link]
Hardware needed
Depending on your motherboard revision, you might need some console specific things, but let's start with the standard stuff first.
Soldering iron
(Optional) Some pin headers, if you're going to use an ACE or DGX/RGX that doesn't have them and don't want to solder the programming cable directly
Supported glitch boards/chips (Glitchers)
X360 ACE
This is the easiest to find chip, it is also the best one for the task.
DGX/RGX
This one is a bit harder to find and might even cost you a bit more. It works, but I still recommend getting the ACE.
Console specific
Corona V3/V5
A postfix adapter
Now that you have everything ready, let's start!
The first thing to do is install the JR-programmer/matrix nand flasher drivers.
First connect the device to your computer and wait until windows tells you that it can't find the drivers. After that go into device manager and locate the JR programmer/Nand-X, it should show up as JR programmer, unknown device or memory access. Next right click on it, "Update Driver software", "Browse my computer for driver software" and point it to the jrunner folder.
Step 1: Reading the nand
After we have all the required software and hardware ready, we need to read the nand of the console. Simply put, the nand is the chip where the console's operating system is stored and we need to make a copy of it (nand dump), so that we can modify it. This process is going to vary by motherboard type.
First, connect your JR programmer or nand-x by following the diagrams from bellow.
Note: You'll need to cut the colored plugs off of the end of the nand cable on the JR programmer/Nand-x
Trinity
Corona V1/V3/V5
After you have the cables soldered to the motherboard, plug the power cable in the xbox, but do NOT power it on! Connect the usb cable to your programmer and your PC and launch jrunner.
You should see either the nand-x or JR programmer logo next to the "CPU key database" button, if it's not there your drivers probably aren't installed properly. If you see the logo you should be able to proceed.
You need to get two matching nand dumps so make sure that under reads you have at least 2. To begin reading the nand click on "Read Nand". After it's done doing all of the nand reads jrunner is going to compare them and tell you if they are the same. If you get "Nands are the same" then you are ready to continue. If you get any bad blocks, don't worry about them, jrunner will remap them automatically, just make sure that the nand dumps match. If your nand dumps don't match or you get a "Wrong version 0x0000000" error, then check your soldering and try again. Do NOT continue until you have at least 2 matching nand dumps.
Step 2 - Creating and flashing the ECC
After getting the matching nand dumps, select "glitch2" on the right hand side of jrunner and click on "create ECC". Once it says "ECC created", click on "Write ECC" and wait until jrunner writes the ECC back to your console.
Step 3 - Programming the glitch chip
First unplug the nand read/write cable from your JR programmer and connect the xsvf programming cable in the top plug. If you're using an ace (or an RGX without headers), you have probably seen that there is nowhere to plug the other end of the cable in, well this is where those headers from before come in. Here is what your chip will look like after soldering the headers.
On the JRP cable you will have a few labels, when you are plugging the cable in the glitch board make sure that you match them with the labels on the board that you are using. The ace chip doesn't have labels so use this picture instead.
After you have the headers soldered and all of the cables plugged in, switch the switch near the xsvf port on the JRP to the side closer to the port itself.
To flash the timing file, open jrunner and go to advanced, then custom nand/cr functions, select Xsvf and click the "..." on the right. Next, use the the window that just popped up to navigate to where you have the S-RGH files extracted, go in the "Trinity" or "Corona" folder (depending on what console you have) and you will find 3 sub folders 150MHz, 200MHz and 300MHz. These folders hold the timing files that we will be programming onto the glitch chip. The folder names represent the working frequency of the chip when flashed with one of those files. Because every console is different, there is no way to determine witch file is going to work best for you. Once you open one of the folders you will see more folders labeled "timing_XX.X". The numbers represent the timing at which the glitch/reset pulse will be sent. Lower means earlier, higher means later. In these folders you will find the actual files. They will the labeled "TR_L_X.X_T_XX.X" for trinity files and "CO_L_X.X_T_XX.X" for corona files. The number after the "L" is the length of the reset/glitch pulse. The lower the number, the lower the pulse length, the higher the number the loner the pulse. Of course we can't be sure what is going to work best, so we will start by choosing the 300MHz, "TR_L_0.5_T_60.6" file for trinity consoles and the 300MHz "CO_L_0.5_T_66.2" file for coronas.
After the file is selected, click open and then "RUN". Wait until jrunner flashes the file onto the chip, after it's done disconnect the chip and proceed to the next step.
Step 4 - Soldering the glitch chip
After the ECC has been written and the glitch chip programmed, it's time to connect it to the motherboard. Follow the diagrams from below!
DGX/RGX
Trinity/Corona V1/V2
Corona V3/V4/V5/V6
X360 ACE
Tinity/Corona V1/V2
Corona V3/V4/V5/V6
You will also need to bridge a few points if you have one of these motherboard revisions.
Even though it says V3 and V4 only, this is also necessary on V5 and V6 boards. To bridge the points you can use 0 Ohm resistors/fuses, a small wire or just solder on its own. As the picture suggests, only make the bridges if the resistors are missing!
Step 5: Getting the CPU key
After you have soldered the chip onto the board it's time to get the cpu key. First, you need to disconnect the JR programmer/Nand-X from the motherboard. Simply unplug the cable from the JRP/Nand-X itself, no need to desolder it.
Once you have your nand reader disconnected from the motherboard, plug the power and HDMI/AV cables in and turn your console on. Now the glitch chip will attempt to glitch your console. If your console doesn't boot within a minute, program the chip with a different timing file. Note: Make sure that the console is both off and unplugged while programming the glitch chip.
Once your console boots you will see the Xell Reloaded screen.
Wait a bit and it will scroll down to your CPU and DVD key. The one we need now is the CPU key, so take a picture if it or write it down.
Once you have your CPU key turn your console off and continue to the next step.
Step 6: Building and flashing the hacked image
First you will need to add the dashboard files. To do this in jrunner open the drop down menu under Dash version, click on add dash, check the box next to the dashboard version you wish to create, select the latest one if unsure, which is 17349 at the time of writing this tutorial, and click on Add dashes
Don't worry about that now, you can later update to the latest dashboard.
Make sure that you have 17511 selected under dash version.
Load one of your nand dumps into "source" in jrunner and enter your CPU key in the CPU key box.
Don't worry about mistyping your cpu key, jrunner will tell you "CPU key is correct" if you have entered it correctly.
Once you have entered your CPU key correctly and downloaded the latest dashboard, select "glitch2" from the right and click on "Create Xebuild image". Note: If you aren't getting instant boot times you can check the "CR4" box next to glitch2 to reduce the time between glitch attempts.
Once it's done creating your image connect your JR programmer/matrix nand flasher to your console and PC, then plug the xbox 360 power cable in the console, but do NOT turn the console on! Next click on "Write Nand" and wait for it to write the image onto the console.
After it's done writing the image unplug everything and wait 30s, after that plug the xbox 360 power and HDMI/AV cables in (make sure that your nand programmer is NOT connected to the console) and turn your xbox on. Your console should now boot into the default dashboard. And that's pretty much it, now all you have to do is desolder the nand cables, clean the flux and put your console back together.
If you can't get your console to glitch there are many things to try, too many for me to mention them all in this thread. I suggest that you head over to teamx360.co.uk and doing some reading in the S-RGH section. If you can't find a solution there, then open a thread in the "Xbox 360 support" section here on se7ensins or over at teamx360.co.uk and we'll try to help you as best as we can.
Last edited by a moderator: