Why the Xbox 360 was so hard to crack
Kennedn's account starts with the console's boot chain. Microsoft had learned from the original Xbox and built the 360's security around a signed chain of trust. The first bootloader, 1BL, is baked into the CPU silicon. Its job is to load the next stage, called CB, from flash and check that Microsoft signed it. Further protections switch on as the console moves up the chain.
Kennedn quotes early community commentary that software-only attempts to run unsigned code mostly didn't work. "Essentially unhackable by conventional approaches" is his framing of the software route, not a timeless verdict. As the closing section shows, software exploits did eventually arrive.
How reset glitching gets around the lock
If the lock is sound, attack the hardware's assumptions. Computation depends on stable electrical conditions. Researchers found that briefly toggling the CPU's reset line (CPU_RESET) does something unexpected. The CPU doesn't reset. It executes the current instruction incorrectly.
The glitcher's pulse lasts roughly 100 nanoseconds. That was enough to corrupt the mr (move register) instruction in the signature-verification path. The faulted instruction moves a zero into its destination register instead of the intended value. Kennedn's summary is that once you know when to flick the lights, you get arbitrary code execution.
Credit for finding this belongs to earlier researchers. Kennedn's references point to the Reset Glitch Hack write-up by GliGli and Tiros. Tom's Hardware describes the CPU force-reset exploit as the longest-lasting physical hack, dating to 2011.
The 2017 attempt versus the 2026 attempt
In 2017 a Reset Glitch Hack needed several things:
- A glitching chip
- Solder and a soldering iron
- A NAND programmer
- A JTAG programmer
To save money, Kennedn tried to build his own NAND/JTAG programmer on the LPT (printer) port of an old PC. He says a NAND dump that way would have taken over 30 minutes. He doesn't remember why it failed, but it did, and the project was shelved.
In 2026 he split the work between two Picos:
- NAND dump. He flashed PicoFlasher onto a Pico and soldered it to the correct pads on the console. The dump then took "a handful of seconds." He gives no exact time or NAND size.
- Glitcher programming. He flashed Pico-dirtyJTAG onto a second Pico. He used it to program the CoolRunner's timing files, using Octal450's timing files and urJTAG built from source.
The two steps are different jobs. The first reads the console's flash. The second loads timing data into the modchip.
Why the Pico suits this job
Kennedn highlights the RP2040's programmable I/O (PIO) blocks. They can implement many standard protocols and offer very precise timing. At 133 MHz, one clock period is about 7.52 ns, which is where his "roughly 7.5 nanoseconds" figure comes from. That is a clock-period calculation. It isn't a guarantee that every end-to-end glitch lands with that accuracy.
He also notes the price. The Pico launched in 2021 at £5. Tom's Hardware, in its own coverage, put the cost at about $4, or roughly 5€ or £5.
Beyond the console
Kennedn argues that fault injection is getting more attractive because defenses have hardened. He ties this to the wider industry. Microsoft began requiring hardware-backed secure boot (via TPM) for Windows 11 in 2021. He also lists other fault-injection results:
- A 2024 bypass of ESP32 v3 secure boot and flash encryption
- A 2021 Apple AirTag firmware dump using a Pico
- The 2023 PicoFly modchip for the Nintendo Switch
That list matters to Windows readers because the same trust-chain idea now sits in PCs and servers. Hardware-rooted boot raises the bar. It also moves the weak point from software bugs to physical and electrical behavior. Kennedn's view is that cheap microcontrollers make those attacks more accessible. This is his opinion and an industry-level observation. It isn't a measured trend.
The software exploit that arrived the same week
Kennedn ends on a wry note. A software-only exploit for the 360 "dropped just last week," which made his effort somewhat moot. It is called Peer Pressure, and it is a different method from his hardware mod.
- Release. Peer Pressure, by developer Grimdoomer, was publicly released as v1.0.477 on GitHub. The release page shows it as the initial public release, dated 07 Oct.
- How it works. It modifies the console's NAND image and HDD security sectors to trigger DMA attacks during startup. These exploit a race condition when the security sectors are read from the hard drive, and the result is unsigned code execution.
- Supported hardware. Xenon, Zephyr, Falcon, Jasper and Trinity boards work. Corona and Winchester are unsupported because they have a hardware-level fix for the exploit. A later-model slim or an E console is out of luck.
- Requirements. The project's installation wiki says you need a mechanical HDD, a FAT32 USB stick, the Rock Band Blitz demo and the latest installer package. It tells users to create a system backup first. That backup holds the NAND image, CPU key and fuses, and HDD security sectors, and the wiki calls it essential for recovery.
- A caveat from the community. A Se7enSins post says installing it force-links the HDD to the console. If the drive dies or is wiped, the system can be bricked and the NAND must be rebuilt. That is a forum user's description, not project documentation, so treat it as a warning to back up and read the wiki.
Peer Pressure needs no soldering. It also doesn't cover every board. The Pico-assisted hardware route still needs soldering and the right tooling and timing files. Neither is universally better. Which one fits depends on the motherboard revision and how much hardware work you're willing to do.
What to take from it
- Cheap tools lower the bar. A task that stalled in 2017 took Kennedn seconds in 2026. That's his personal comparison, not a controlled benchmark.
- Soldering is still involved. The Pico was soldered to console pads, so this remains a hardware modification.
- Silicon-rooted trust has limits. Even a hardwired first bootloader depends on electrical behavior. That's a lesson for any secure-boot design.
- Different mods fit different consoles. Check your board revision before choosing a method.
The post doesn't provide a wiring diagram, a motherboard revision, or a target-specific timing recipe. It is an account of a finished personal project, not an installation guide. Anyone modding a console should work from the projects' own documentation and back up the NAND and CPU key before touching anything.