Out of the three seventh generation consoles that I have modded, I found the Xbox 360 to be the hardest to hack, mostly because of how hard it was to find current tutorials. Forums are filled with outdated information, and there are just so many different modchips, console revisions, and methods of hacking. I wanted to know how I could mod my Trinity console into a Trinity RGH console.
This post covers the process of doing an RGH2 mod on my Xbox 360 S Trinity console as cheaply as possible. Most guides mention buying expensive NAND programmers, glitch chips, QSB's, and other specialized parts. I'll be using a cheap $7 modchip, along with several dollars worth of electronics that you might already own.
What you'll need
Here's a short list of items that you'll need in order to RGH your console. You can find out which model your Xbox 360 console is by looking at this chart. Having a second male LPT connector would be useful if you plan on hacking multiple consoles since you won't have to resolder when switching between NAND flashing and glitch chip flashing.
You, or someone you know, probably has an old computer with an LPT port. Just look for something with an old purple printer port on the back, ideally running Windows XP. You'll probably be able to find one for free.
- Trinity Xbox 360 S console
- Soldering iron and solder
- X360Ace V3 glitch chip
- Male LPT connector
- 5x 100 ohm resistors
- 1x 3.3k ohm resistor
- A ~3.3V power source (2x AA batteries in series works)
- An old computer with an LPT port
Additionally you'll need some software, I've uploaded a zip file with all of the software needed for the guide below.
Step 1 - Preparing the Xbox 360 for a NAND dump
The first thing you'll need to do is dump the NAND on your console. This is done by connecting the LPT port of a computer to seven points on the Xbox motherboard's JTAG headers.
Above is a color coded image showing the back of an LPT connector, this is the side you are soldering to. Attach an 100 ohm resistor to pink, light blue, yellow, blue, and red. Then attach a short length of wire to each resistor, and to the remaining two colors on the port (green and orange). It should look something like the image below.
Now you need to solder the wires coming out of the LPT connector to the Xbox 360's motherboard. Below is an image showing the same seven colors on the JTAG headers. Solder the LPT wires to the matching colored JTAG port holes. It should look something like the image above when done.
You might have noticed that my wires are very short. Short wires are very important. I had tried this with a Corona v5 console and a longer length of wire and wasn't able to read the NAND chip at all. My working wires are about 6cm long. I don't know the maximum length of wire that will work, but if you are having issues and your soldering is good, you might want to try shortening the wires. I used wires out of a CAT5e Ethernet cable.
Step 2 - Dumping the Xbox 360 NAND
Now that you have an LPT connector soldered to your Xbox 360's motherboard, you can dump the NAND. To do this connect the LPT connector to the LPT port on the back of your old computer. Then connect the power supply to the Xbox, but don't turn on the console. Above is an image showing my board connected to a computer.
To read the NAND you'll need to use a program called NANDPro30. For a Windows XP system you'll need to install the port95nt.exe file for the LPT port to work. Once installed you can open a command prompt window, and browse to the location of the extracted NANDPro folder.
To read the NAND type in the following into the command prompt:
nandpro lpt: -r16 nand1.bin
It should say something about the NAND being read. It'll take a while, so let it run. If you get an error check your solder connections, wire length, and LPT port settings in the BIOS (I was able to use default settings, but you might need to make some changes).
Once the reading has finished, run the same command a second time, but change nand1.bin to nand2.bin. It's important that you read the NAND twice, so that you can compare them to know if you got a valid dump or not.
Step 3 - Generating and writing an ECC file to the NAND
Now you'll need to prepare the NAND chip for the glitch chip. To do this you will need to generate an ECC file using another program called J-Runner. You might need to install a version of .NET Framework onto your computer to get J-Runner to work with Windows XP.
Begin by selecting the two NAND dumps you made with the load source, and load extra buttons. Then click NAND compare. If you don't get a message saying NANDs are the same, you'll need to go back to the second step until you can get at least two good NAND dumps. Good NAND dumps are really important.
Now make some selections in the XeBuild section. Select your dash version, Glitch2, and check CR4. Now you can click on the create ECC button in the top left. You should see an ECC created message in the message log. Above is an image of the J-Runner program after doing all of the things listed above.
Now copy the image_00000000.ecc file from the output folder inside of the J-Runner program folder to the folder where you have NANDPro30 installed. With your Xbox 360 still connected to your computer, run the following in the same command prompt you used to dump your NAND.
nandpro lpt: -w16 image_00000000.ecc
This command writes the ECC image to the NAND chip. It's much quicker than the NAND dumping because it only has to write to the first 50 blocks of the NAND. Below is the output of that command.
After writing the ECC file to the NAND your console will no longer be able to boot without a glitch chip installed, so you'll need to finish this guide in order to use your console.
Step 4 - Flashing XSVF Trinity timing files to the X360Ace V3
The X360Ace V3 comes preprogrammed for Corona consoles, so you'll need to flash updated XSVF timings to the chip for Trinity boards. I was able to do this using my LPT connector.
Above is a hand drawn schematic of how you need to connect the LPT connector to the X360Ace chip. The LPT connector is being viewed from the side you solder to, and the X360Ace text on the image is where the text is printed on the actual chip. The image has two 1.5V AAAA battery cells shown to get the 3V output. You can use any 3V or 3.3V source, something like a couple of AA batteries works. Below is an image of how I wired everything together.
To program the X360Ace chip plug in the LPT connector into the LPT port on your old computer, and open up J-Runner. Make sure you have selected LPT, and entered the port number, into the CoolRunner programming section, and then click on advanced, and then custom NAND/CR functions.
A windows should pop up, and look like the one displayed above. Select the XSVF command, and select the trinity-acev3.xsvf file for the filename. You can then click the run button.The J-Runner output window should have a success message printed on it. My X360Ace chip also had a green light that turned on. Below is an image of the J-Runner output window box.
Step 5 - Soldering the X360Ace V3 to your Trinity board
Once your X360Ace chip has been flashed with the updated timing file for Trinity boards, you can solder the X360Ace chip to your motherboard. This involves soldering the six included wires from the chip to various parts of the board.
I have some general soldering tips on this page. For the X360Ace make sure your wires are as short and direct as possible, and that there is as little exposed wire on the ends that touch the board as possible.
I started by wiring the ground wire from the ground pin, to the metal shielding around the video output ports. Then I wired the 5V line from the chip to the point on the JTAG header pictured above.
Next I wired the E and F points on the chip to the two corresponding points on the JTAG header pictured above. The F point is the one positioned closer to the X360Ace chip, and the E point is positioned farther away from the X360Ace chip.
Next I wired point C to one of the pads on the back of the Xbox 360 motherboard. Route it through the back through the hole, and connect it to the small point pictured above. The point is the second point on the second row, when counting from left to right, and from bottom to top.
Finally wire the last point, point D. This point is the toughest to install, you may need to remove the heatsink if you can't reach the resistor with it on.The image above shows the wiring to the resistor, but it's really hard to see. There are two resistors right next to each other underneath the heatsink fins. Wire point D to the left resistor, on the side of the resistor that is closer to the processor.
Step 6 - Creating and flashing your XeBuild NAND image
You can now fully assemble your console for this step. Once assembled turn on your console when it's connected to a TV. You should see a blue screen with XeLL Reloaded displayed on it, just like the image above. Once it has finished booting you should see some text with the words "your cpu key:". Type this string into the CPU Key field in J-Runner.
Make sure you still have your NAND dump from the second step selected, and that your dash version, Glitch2, and CR4 are all still selected. Then with the CPU key entered, click the Re-Init button. A message with the text of "Nand Initialization Finished" should appear in the message box. You can then click the Create XeBuild Image button. The image above shows the screen after pressing that button.
A numbered folder should appear in your J-Runner program folder, and it should have a file called updflash.bin inside. Copy this file to the root of a FAT32 formatted flash drive. Then shut off your console, put in the flash drive, and turn it back on.
Once booted your console should have text saying it found the updflash.bin file, and that it is writing it to the flash. When finished it will say "image written, shut down now". You can then restart your console. The output is in the image above.
If you followed all of the steps above correctly you should now have a Trinity RGH console. You can now run homebrew, emulators, game backups, and more. This post doesn't cover the installation of software like XEXmenu, the Aurora dashboard, and DashLaunch. Here are some links that may help you get those pieces of software installed:
This guide may also be useful, it describes the modding process of all of the Xbox 360 models.
I found the Xbox 360 RGH process to be more difficult to the process of hacking other seventh generation consoles like the Wii, and the PS3, mostly because of the huge variety of hacking methods, and my desire to do it as cheaply as possible (it ended up being around $10). Doing another 360 now that I've done my first should be a lot easier.