Recent site activity

Site owners

  • Robert Ward
Tutorials/Guides‎ > ‎

Xbox 360 Jtag Tutorial

How to JTAG Hack your Xbox 360 Console, allowing you to run homebrew applications and backup games on your Xbox 360 Console. Complete step by step procedure with pictures to guide you along the way.

JTAQ PRE-REQUISITES

  • PC with a parallel printer port required to dump/write the NAND image
  • You will need an Xbox 360 Console with a Dashboard Kernel Version of 2.0.7371.0 or lower. If you have an updated kernel, STOP RIGHT HERE and don't waste your time, your console is not JTAG-able. Even if your console has the right kernel version, we cannot confirm if it is exploitable until you dump an image of your NAND, but there is a very high chance that it is :)

To check your Xbox 360 Dashboard Version:

1) Turn on your Xbox 360 Console and go to Console Settings:

2) Scroll to System Info, the current dashboard is on your top right (note in the image below i have kernel 2.0.8955.0 which is not JTAG-able)

OK - If your Dashboard shows version 2.0.7371.0 or lower, let's proceed to the next step, building the NAND DUMP CABLE (DB25 MALE PLUG)

BUILDING LPT/RJ45 CABLE FOR YOUR XBOX 360 CONSOLE

Now moving on.....we'll next need to create a simple DB-25 to RJ45 Cable to allow us to dump the NAND image from the Xbox 360 Console and write the new image back. Images below of what we will be building...

Contents Required to build this JTAG XBOX 360 cable (easily found at your local electrical outlet)

  • 1 x RJ45 Extender
  • 1 x CAT5 Patch Lead (make sure it's CAT5 not CAT6)
  • 1 x DB 25 25 WAY Male Plug (LPT Printer Cable) + Hood Cover
  • 5 x 100ohm Resistors (as per the image above)
  • 2 x Switching Diodes for later on: Part No: BAT41 or 1N4148 or 1N4153

Content Images Below:

We will prepare the DB25 Male Plug First....Study the image below.....

What we want to do here, is strip one end of the CAT5 Patch Lead, separate the wires and prepare them for soldering on the Xbox 360 Motherboard. The wire colors on the patch lead may not necessarily match the colors in the diagram below so be prepared to quickly draw up and make note of your own color configuration. Example: Orange on Diagram Above = Orange/White on Patch Lead....The idea is to have the wires soldered onto the board as per the diagram below, and the other end of the cable going into the RJ45 Joiner (NOTE: the joiner does not need to be glued to the Xbox 360 case as it is on the image below)....Here's a closer look once the wires are soldered to the Xbox 360. Take your time as you do not want to bridge any connections during this step!

Now we have completed this step, lets move onto the other end of the joiner. Basically we will yet again strip one end of the RJ45 Cable, prepare the wires for solder, and then solder to the DB25 Male Plug - Keeping in mind the color combination so we are routing them through the joiner correctly and matching the colors on the motherboard to the pins on the DB25 Plug as per the image below)

REMEMBER: There are 5 wires that need resistors soldered to the pins before them, the diagram below advises which ones they are, view the images of the Xbox 360 Mainboard below to get a better understanding of this step....

Pin Configuration on Xbox 360 JTAG DB25 Male Plug (take note of which is number 1)

Here's the completed and prepared Xbox 360 JTAG DB25 Male Plug with the Resistors in place....

Make sure none of the wires touch or are bridged....finally place the DB25 Cover on and you are ready to dump your NAND IMAGE using your Xbox 360 JTAG Cable :)

Once the Cable has been built, we can proceed to dumping the NAND image of your console

DUMPING YOUR XBOX 360 NAND IMAGE

  • Download Xbins, grab NANDPRO from their FTP Server....
  • make sure to install port95nt.exe from the NANDPRO folder, restart PC..
  • Plug in your Xbox 360 Console but do not power it on.
  • Plug in the DB25 Male plug into your PC's Parallel Port
  • Run Command Prompt and route to the NANDPRO folder
  • Run Command: nandpro lpt: -r16 orig.bin
  • Note: FlashConfig should state FlashConfig:01198010, which means it is talking to your Xbox 360 NAND
  • Wait Patiently, depending on your console revision, this could take a long time, most older Xenons are ~45Mins per nand dump, new jaspers with 256mb/512mb take much longer.
  • If there are no errors read the dump again with the following command: nandpro lpt: -r16 orig2.bin

VALIDATING YOUR XBOX 360 NAND IMAGE DUMP

Now we need to confirm the Xbox 360 Nand Dumps you have made are valid for safekeeping....

First off, confirm your images are identical using a hex editor to make sure they match 100%

Then downloaded an application call degraded from Xbins

Run Degraded, Click on Settings

Open up another browser and google "Degraded 1BL key"

Enter the key you found in the google search results into the Degraded Settings

Click the Valid and set file system start to 39

Now open your Orig.bin file you created earlier, Upon opening the file, you shouldn't receive any bad blocks

Here's an image of an image dump....

IMPORTANT STEP!!!

Now follow the guidelines below to confirm whether or not you can JTAG your Xbox 360 Console, even though you may have the correct dashboard on your Xbox 360 Console to JTAG, it doesn't mean you have an exploitable Xbox 360 CB, but there's a good chance it is.

Now in your Degraded Window, check which version CB you have got, and follow the chart below:

Exploitable Xbox 360 CB's which you can JTAG
1888, 1902, 1903, 1920,1921: exploitable xenon
4558: exploitable Zephyr
5761, 5766, 5770: exploitable falcon
6712, 6723: exploitable jasper

Non Exploitable Xbox 360 CB's which cannot be JTAG

Xenon: 1922, 1923, 1940
Zephyr: 4571, 4572, 4578, 4579
Falcon/Opus: 5771
Jasper: 6750

NOTE: The image above is non-exploitable so cannot run the Xbox 360 JTAG Hack

Now confirm your Xbox 360 Console has an EXPLOITABLE CB, if it doesn't i'm afraid you'll have to try finding another Xbox 360 to work on....

XBOX 360 JTAG - THE FINAL PROCEDURE

So you have an Exploitable CB and your Xbox 360 Dashboard version is 2.0.7371.0 or lower? Great you're in luck, now to the final part of the guide, installing the JTAG hack yourself. Depending on which Revision Xbox 360 you have the installation procedure for JTAG is a little different. Refer to my Xbox 360 Revisions link in the hot articles section of my website.

To Trigger the Xbox 360 JTAG hack, you need to bridge 3 points on the Xbox 360 Motherboard, i will advise which points they are depending on Xbox 360 Revision...

The Xbox 360 JTAG Hack requires switching diodes between some of the points being bridged....Pictures below state where the diodes should be and in which direction, pay close attention to the arrows...

Switching Diode Part Numbers: BAT41 or 1N4148 or 1N4153

XBOX 360 XENON REVISION

XBOX 360 FALCON, ZEPHYR, OPUS AND JASPER REVISIONS

.....OK please note that once the hack is installed, your Xbox 360 will not boot until a hacked imaged has been dumped. Also note that the JTAG hack above and the 3 wires we just installed will permanently need to stay where they are.

WRITING THE HACKED XBOX 360 XBR IMAGE ONTO YOUR XBOX 360 CONSOLE

  • Open up Xbins, and download the XBR Image for your board type, eg. XBR_8955.bin
  • Connect your DB25 Male Plug to your PC
  • Go to command prompt and route to the NANDPRO folder
  • Run: nandpro orig.bin: -r16 rawkv.bin 1 1
  • Run: nandpro orig.bin: -r16 rawconfig.bin 3de 2
  • These two commands extract the keyvault and config blocks from your original nand, and now all you need to do is inject these into the hacked XBR image
  • Rename the XBR image you downloaded from Xbins to just xbr.bin
  • Command Prompt, Route to NANDPRO folder
  • Run: nandpro xbr.bin: -w16 rawkv.bin 1 1
  • Run: nandpro xbr.bin: -w16 rawconfig.bin 3de 2
  • And then finally flash back the New Hacked NAND Image with your original keyvault and config blocks to your Xbox 360
  • Run: nandpro lpt: -w16 xbr.bin

And now you have a Jtagged 360 all we have to do now is install the software to be able to use its capabilities first we will install xexmenu and then freestyle dash use the following links....