N
N3Star
Enthusiast
UPDATED GUIDE FOR XENON RGH WITH EXT_CLK
A lot has changed since last thread, so I decided to make an updated guide.
I will be using Matrix V3 glitcher, but compatible are also Coolrunners and soon ACE V3 glitchers.
This guide will be focused on EXT_CLK instead of PLL point, since on 90nm CPUs these are known to be unstable.
In the past we had some reports that GPU revision might affect boot times, so be advised beforehand, X02056 glitches the fastest, reengineered Y1 from Korea (X817791) worse and GPU Elpis (X819195) the worst. Nowadays such errors seem to be corrected. Revisions of each GPU, such as X02056-010 or X819195-002 don't matter. At the time of writing this point Octal450 said that GPU X819195 will not glitch.
1. PREREQUISITIES
⦁ Soldering iron with precision tip
⦁ Solder
⦁ Good quality flux
⦁ A method of reading NAND and programming the glitch chip - for example ancient and slow LPT, NAND-X, or what I use - JR-Programmer V2
⦁ Glitcher - Matrix, Coolrunner or ACE V3
⦁ Xenon or Zephyr Xbox 360 - this guide will be focused solely on Xenons, but Zephyrs are also compatible with this glitch method, I will use Xenon with GPU Y1 marked as X817791-001
⦁ Wires for RGH, I like AWG28/AWG30 kynar wire
⦁ JRunner - [Click here to view this link]
⦁ !NOT! needed anymore, timings are included into J-Runner since version 3.2.1): Timing files - [Click here to view this link]"
⦁ !!! EXPERIENCE IN SOLDERING !!!
⦁ Free evening
2. NAND
OK, now that we have everything ready let's start with basics: reading the NAND.
We usually need 2 dumps in order to confirm that everything was dumped properly.
If you can't get 2 dumps same you most likely have bad solder point somewhere.
Remember: use flux, take your time and you will succeed. Some people (like me) like to solder on the bottom side of motherboard since access to these points is easier.
For this step I like to click once the question mark on the XeBuild tab to see if the console is recognized properly, if it isn't then you probably forgot about plugging your console to the PSU (DON'T TURN IT ON!) or have a bad solder point. If it is then click "Read Nand" and wait.
Now that we have dumped our NAND images time for the .ecc.
Make sure that "Glitch2" option is selected, then click "Create Xell" and after that "Write Xell"
After that you can disconnect the programmer, but it will be needed later.
3. PROGRAMMING THE GLITCH CHIP
Now we have to program the glitch chip.
Go to "Program Timing File" and "EXT_CLK and Misc" tab.
I will start with 192MHz version of "59.4 0.9". After You chose Your desired timing hit "Program" button.
I'm not soldering cables from JR-Programmer to the glitcher, and, as You can see, once programming of that chip has failed.
In that case You firstly should check if You connected everything in the right way, and if yes then fiddle around with connections.
We will come back to this point later when we will try to improve boot times.
4. WIRING
Now is the hardest part - soldering the actual wires.
We have to remove the SMD capacitor on C7R112 point; don't worry it is not necessary to the console, so even if you later wish to go back to retail the console will work without it.
Wire routing is important here, thankfully we can use similar routing as in RGH 1.2 as the points are same or very close to it's replacement.
Also, watch out for STBY_CLK point when using Matrix/Coolrunners, it is especially small and easy to break, it is good practice to keep it far from EXT_CLK wire.
Points for glitchers:
Matrix:
A - RST
B - POST
C - STBY_CLK (remove oscillator if equipped)
F - EXT_CLK
Remember to short the upper FAT jumper and remove 0 Ohm resistor on C point or remove oscillator for best results.
If you need to use an crystal, use a 48 MHz only!
Coolrunner:
A - EXT_CLK
B - STBY_CLK (remove oscillator if equipped)
C - POST
D - RST
X360ACE (V1/V2/V3), DGX:
C - POST
D - RST
F - EXT_CLK (22K ohm resistor required)
!!! X360ACE uses 5V and 1.8V instead of 3.3V, so be careful about that, remember to desolder the diode.
My wiring:
EXT_CLK(GRAY) RESET(BLACK)
POST
STBY_CLK
TOP SIDE
BOTTOM SIDE
5. XELL
You did it? Great!
Now we have to put it back together enough to be able to safely turn it on and see if we can boot Xell.
If it doesn't then you probably have a bad solder point or your console is very picky about timing file - you just have to try other, there is no magic formula for that, but see point 7, tune accordingly to debug light.
6. FREEBOOT
At this point we have to take the CPU Key and write it into Jrunner's "CPU Key:" gap.
You can do it manually, but I have ethernet cable ready, so I will use that.
Don't worry about mistakes when you type in your key, Jrunner will inform you if the CPU Key is correct.
Make sure, that your NAND dump is in the "Source" gap, or Jrunner won't decrypt it.
If you did that we have to create the Freeboot image.
Select your kernel version (any kernel should work, but old kernels have some 'problems' like not being able to play newer games..., so I will choose 17559)
Make sure you have Glitch2 selected and click "Create XeBuild Image".
Connect NAND reader to the PC (make sure your console is recognized), click "Write NAND" and wait.
After that finishes your console is done, you can disconnect the reader, put it back together and play some games.
BUT stick around if your console has poor boot times.
7. (optional) WHEN BOOT TIMES ARE POOR
There is a number of things to check when your Xenon misbehaves, so we will start with the easiest - glitch chip timings.
Unfortunately there is no rule, your box might like different timing than others, you just have to go one by one and test it.
Since in my testing both the metal cage and the DVD drive might affect the boot times I advise to tune with both in place.
Tuning Boot Times:
If the light stays on at the end of a cycle:
- This means that the checks were passed, but the console failed to start
- Probably the timing is too low, or the pulse length is too large
If the light goes off at the end of a cycle but doesn't boot:
- This means that the checks failed
- Probably the timing is too high, or the pulse length is too small
If that didn't help then there might be a problem with your wiring.
Make sure that no cable is close to the chokes, ! EXT_CLK and STBY_CLK are separated !, no wires are crushed by the Xclamps, try entirely different routing.
If you have any questions/suggestions/advice about this tutorial, please let me know. I myself am NOT done with this tutorial, when I learn something new, I'll add it here.
ALL CREDIT GOES TO OCTAL450 AND HIS TEAM
THANK YOU!
A lot has changed since last thread, so I decided to make an updated guide.
I will be using Matrix V3 glitcher, but compatible are also Coolrunners and soon ACE V3 glitchers.
This guide will be focused on EXT_CLK instead of PLL point, since on 90nm CPUs these are known to be unstable.
In the past we had some reports that GPU revision might affect boot times, so be advised beforehand, X02056 glitches the fastest, reengineered Y1 from Korea (X817791) worse and GPU Elpis (X819195) the worst. Nowadays such errors seem to be corrected. Revisions of each GPU, such as X02056-010 or X819195-002 don't matter. At the time of writing this point Octal450 said that GPU X819195 will not glitch.
1. PREREQUISITIES
⦁ Soldering iron with precision tip
⦁ Solder
⦁ Good quality flux
⦁ A method of reading NAND and programming the glitch chip - for example ancient and slow LPT, NAND-X, or what I use - JR-Programmer V2
⦁ Glitcher - Matrix, Coolrunner or ACE V3
⦁ Xenon or Zephyr Xbox 360 - this guide will be focused solely on Xenons, but Zephyrs are also compatible with this glitch method, I will use Xenon with GPU Y1 marked as X817791-001
⦁ Wires for RGH, I like AWG28/AWG30 kynar wire
⦁ JRunner - [Click here to view this link]
⦁ !NOT! needed anymore, timings are included into J-Runner since version 3.2.1): Timing files - [Click here to view this link]"
⦁ !!! EXPERIENCE IN SOLDERING !!!
⦁ Free evening
2. NAND
OK, now that we have everything ready let's start with basics: reading the NAND.
We usually need 2 dumps in order to confirm that everything was dumped properly.
If you can't get 2 dumps same you most likely have bad solder point somewhere.
Remember: use flux, take your time and you will succeed. Some people (like me) like to solder on the bottom side of motherboard since access to these points is easier.
For this step I like to click once the question mark on the XeBuild tab to see if the console is recognized properly, if it isn't then you probably forgot about plugging your console to the PSU (DON'T TURN IT ON!) or have a bad solder point. If it is then click "Read Nand" and wait.
Now that we have dumped our NAND images time for the .ecc.
Make sure that "Glitch2" option is selected, then click "Create Xell" and after that "Write Xell"
After that you can disconnect the programmer, but it will be needed later.
3. PROGRAMMING THE GLITCH CHIP
Now we have to program the glitch chip.
Go to "Program Timing File" and "EXT_CLK and Misc" tab.
I will start with 192MHz version of "59.4 0.9". After You chose Your desired timing hit "Program" button.
I'm not soldering cables from JR-Programmer to the glitcher, and, as You can see, once programming of that chip has failed.
In that case You firstly should check if You connected everything in the right way, and if yes then fiddle around with connections.
We will come back to this point later when we will try to improve boot times.
4. WIRING
Now is the hardest part - soldering the actual wires.
We have to remove the SMD capacitor on C7R112 point; don't worry it is not necessary to the console, so even if you later wish to go back to retail the console will work without it.
Wire routing is important here, thankfully we can use similar routing as in RGH 1.2 as the points are same or very close to it's replacement.
Also, watch out for STBY_CLK point when using Matrix/Coolrunners, it is especially small and easy to break, it is good practice to keep it far from EXT_CLK wire.
Points for glitchers:
Matrix:
A - RST
B - POST
C - STBY_CLK (remove oscillator if equipped)
F - EXT_CLK
Remember to short the upper FAT jumper and remove 0 Ohm resistor on C point or remove oscillator for best results.
If you need to use an crystal, use a 48 MHz only!
Coolrunner:
A - EXT_CLK
B - STBY_CLK (remove oscillator if equipped)
C - POST
D - RST
X360ACE (V1/V2/V3), DGX:
C - POST
D - RST
F - EXT_CLK (22K ohm resistor required)
!!! X360ACE uses 5V and 1.8V instead of 3.3V, so be careful about that, remember to desolder the diode.
My wiring:
EXT_CLK(GRAY) RESET(BLACK)
POST
STBY_CLK
TOP SIDE
BOTTOM SIDE
5. XELL
You did it? Great!
Now we have to put it back together enough to be able to safely turn it on and see if we can boot Xell.
If it doesn't then you probably have a bad solder point or your console is very picky about timing file - you just have to try other, there is no magic formula for that, but see point 7, tune accordingly to debug light.
6. FREEBOOT
At this point we have to take the CPU Key and write it into Jrunner's "CPU Key:" gap.
You can do it manually, but I have ethernet cable ready, so I will use that.
Don't worry about mistakes when you type in your key, Jrunner will inform you if the CPU Key is correct.
Make sure, that your NAND dump is in the "Source" gap, or Jrunner won't decrypt it.
If you did that we have to create the Freeboot image.
Select your kernel version (any kernel should work, but old kernels have some 'problems' like not being able to play newer games..., so I will choose 17559)
Make sure you have Glitch2 selected and click "Create XeBuild Image".
Connect NAND reader to the PC (make sure your console is recognized), click "Write NAND" and wait.
After that finishes your console is done, you can disconnect the reader, put it back together and play some games.
BUT stick around if your console has poor boot times.
7. (optional) WHEN BOOT TIMES ARE POOR
There is a number of things to check when your Xenon misbehaves, so we will start with the easiest - glitch chip timings.
Unfortunately there is no rule, your box might like different timing than others, you just have to go one by one and test it.
Since in my testing both the metal cage and the DVD drive might affect the boot times I advise to tune with both in place.
Tuning Boot Times:
If the light stays on at the end of a cycle:
- This means that the checks were passed, but the console failed to start
- Probably the timing is too low, or the pulse length is too large
If the light goes off at the end of a cycle but doesn't boot:
- This means that the checks failed
- Probably the timing is too high, or the pulse length is too small
If that didn't help then there might be a problem with your wiring.
Make sure that no cable is close to the chokes, ! EXT_CLK and STBY_CLK are separated !, no wires are crushed by the Xclamps, try entirely different routing.
If you have any questions/suggestions/advice about this tutorial, please let me know. I myself am NOT done with this tutorial, when I learn something new, I'll add it here.
ALL CREDIT GOES TO OCTAL450 AND HIS TEAM
THANK YOU!
Last edited by a moderator: