--- title: It took me nine years to hack my Xbox 360 | daily.dev description: A personal story about finally modchipping an Xbox 360 console using a Matrix CoolRunner glitcher chip and a Raspberry Pi Pico, nine years after first... canonical: https://daily.dev/posts/it-took-me-nine-years-to-hack-my-xbox-360-ze4vcjmts twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: It took me nine years to hack my Xbox 360 | daily.dev og:description: A personal story about finally modchipping an Xbox 360 console using a Matrix CoolRunner glitcher chip and a Raspberry Pi Pico, nine years after first... og:url: https://daily.dev/posts/it-took-me-nine-years-to-hack-my-xbox-360-ze4vcjmts og:image: https://api.daily.dev/og/posts/zE4VCjMts.png og:image:alt: It took me nine years to hack my Xbox 360 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # It took me nine years to hack my Xbox 360 **[Hacker News](https://daily.dev/sources/hn)** · 7 min read · 0 upvotes · 0 comments ## Summary A personal story about finally modchipping an Xbox 360 console using a Matrix CoolRunner glitcher chip and a Raspberry Pi Pico, nine years after first attempting the hack in 2017. The piece explains how Microsoft's secure boot chain on the Xbox 360 was defeated via fault injection - glitching the CPU_RESET signal to corrupt a signature-verification instruction - and reflects on how cheap microcontrollers like the Pico have made DIY fault injection attacks (used against the ESP32, AirTags, and Nintendo Switch) far more accessible than a decade ago. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does a glitching attack bypass Xbox 360 secure boot? It exploits fault injection by rapidly toggling the CPU_RESET signal at a precise moment during boot, which causes the CPU to execute the current instruction incorrectly instead of resetting. Specifically, researchers found the 'mr' (move register) instruction involved in signature verification could be glitched to move a 0 into its destination register instead of the real value, enabling arbitrary code execution despite Microsoft's otherwise secure boot chain. _Developers curious about console security internals can follow deep dives like this on daily.dev._ ### What tools do I need to modchip an Xbox 360 with a Matrix CoolRunner glitcher in 2026? A Raspberry Pi Pico can replace most of the expensive specialized hardware once required. Flashing PicoFlasher onto a Pico allows dumping the NAND in seconds, and flashing Pico-dirtyJTAG lets you program the CoolRunner's timing files via urjtag, eliminating the need for a separate NAND programmer and JTAG programmer that cost significant money and time back in 2017. _Hobbyists weighing cheap microcontroller-based tooling against legacy hardware can track projects like this on daily.dev._ ### Has fault injection been used to bypass secure boot on devices other than the Xbox 360? Yes, fault injection has bypassed secure boot and flash encryption on an ESP32 v3 in 2024, dumped Apple AirTag firmware in 2021 using a Raspberry Pi Pico, and the PicoFly modchip released in 2023 uses fault injection to defeat secure boot on the Nintendo Switch. These cases show fault injection becoming a more common and accessible attack vector as hardware security has hardened. _Security researchers comparing fault injection cases across devices can keep up with examples like these on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 32 comments across hackernews (as of 2026-10-15). **TL;DR:** Discussion centers less on the post itself and more on a coincidental software-only Xbox 360 exploit (Peer Pressure/BadUpdate/ABadAvatar) released the same week, with a lengthy technical sub-thread detailing how it compares to the hardware glitching approach, plus a tangential and testy argument about Xbox One security and name-calling. **Sentiment:** 20% positive · 55% mixed · 25% skeptical **The case for** - A newly released persistent software-only softmod (Peer Pressure) complements the hardware glitch approach and shows the Xbox 360 scene remains active. - The hardware glitch (RGH) still has an edge because it compromises the boot chain earlier than the pure software exploits. - Some found the deep dive into the boot chain and exploit history fascinating regardless of the exploit being superseded. **The pushback** - Several pointed out the post didn't need a modchip at all now that a software-only exploit exists, questioning the practical relevance of the hack. - One commenter claimed the article omitted mention of the software exploit, though others corrected this by quoting the article's closing paragraph. - The Xbox homebrew scene is described as somewhat sad in practice, dominated by paid 'stealth server' access despite free bypasses being available. **By community** - hackernews (mixed): Technical commenters focus on comparing the new software-only exploit to the glitching method and debate the state of the Xbox 360 homebrew scene, while a side argument about Microsoft and Xbox One security turns heated and off-topic. **Hottest debate:** Whether the hardware glitching hack described in the post is still meaningful now that a software-only exploit for the Xbox 360 was released around the same time. **Open questions** - Will the persistent software softmod eventually be extended to work on all Xbox 360 hardware revisions? - Does the hardware glitch approach retain any practical advantage over the new software exploits beyond earlier boot-chain access? **Highlights** > The software exploit works for all console revisions, but the persistent softmod does not. There exist 3 main things in the software hack space for Xbox 360: 1. BadUpdate (Grimdoomer) which is the only software hypervisor exploit for the Xbox 360. It's intended to be launched from scenarios where someone could achieve code execution. The main method for launching BadUpdate was through Rock Band Blitz (created by ihateccompvir and InvoxiPlayGames). Pure software, works across all hardware revisions of the Xbox. 2. ABadAvatar (shutterbug2000) which uses a memory corruption vulnerability in the avatar loading code in the Xbox dashboard to gain code execution after the dashboard loads, then launches BadUpdate to exploit the console. Pure software, works across all hardware revisions of the Xbox. 3. Peer Pressure (Grimdoomer). First compromises the console through one of the above methods and modifies the SMC firmware to attack the southbridge. The SMC was abused in a similar manner for the JTAG hack, which likely led to Microsoft hardening it in later revisions of the hardware and mitigating the attack used here by Grimdoomer. More info on #3 here: https://youtu.be/ftEuor1asBM?t=96 At any rate, #1 and #2 do not provide early boot exploitation. #3 does. The hard drive security sector is involved and the kernel is responsible for loading that, so at this stage you've gone through 2BL, hypervisor, and kernel initialization. So you can't compromise the bootloaders, but you're early enough in the boot chain to do interesting things like replacing the boot animation with something custom. The JTAG hack does some weird stuff that, truthfully, I've never seen replicated on other hardware. tl;dr the console must be on a vulnerable software version which did not blow a downgrade fuse and using an additional hardware flash chip containing a different version of the OS which had a hypervisor bug, boots the console into that, triggers the exploit using SMC black magic, then reboots back into the upgraded version of the OS. The RGH hack described in this article would allow you to replace 2BL, so you've compromised the console earlier in the boot chain. > — [landr0id on hackernews](https://news.ycombinator.com/item?id=50100865) > This blogpost makes the point that the advent of the Raspberry Pi microcontroller made it easier to interface with a variety of hardware. And it is true, but the capability was already quite cheap in 2017 and before: fx2 chips can do quite a lot, for instance. I hope Bunnie's Baochip BIO approach will take off in microcontrollers, making that sort of feature more ubiquitous. You can do a lot of things with an ESP32 for instance, but the RP2040 still has an edge for I/O. Also missed the opportunity to mention that the RP2350 itself had its protection defeated by fault injection. Lastly, side channels and fault injection attacks are highly viable for mid-2010 and earlier hardware, but chip designs are hardening against them, for instance forcing a reboot when a glitch is detected. This makes current and next-generation chips harder to attack (see the laser fault injection on RP2350, though this is also being hardened against). It's probably a good thing to some extent (make it harder to duplicate my credit card), but I mourn the loss of control over my own HW. Incidentally, tinkering with the first gen Xbox (which is the security equivalent of a swiss cheese) taught me a lot about software, networking and electronics when I was younger. I hope that future generations will still get to tinker like that. > — [MayeulC on hackernews](https://news.ycombinator.com/item?id=50100308) > I was in the Xbox 360 scene back in the day before JTAG hacks existed -- modding savegames, getting a devkit, and building my own private homebrew. For the most part I left the scene around 2013. The softmod had me seeing what the status quo is and things are... not great. 17 years since the JTAG hack and just as of a couple days ago someone finally vibecoded a non-proprietary SDK. The scene by and large to the masses (or at least, the loudest group) mostly associates homebrew with "stealth" servers aka servers your console connects to which assist in bypassing Xbox LIVE challenges that detect modified consoles. The servers provide mod menus (trainers, basically) for various games and the ability to use older dashboards. The kicker is the custom servers are not required, code for bypassing challenges leaked ages ago, and people still pay for stealth server access! I can't even imagine who is still playing Xbox 360 titles on Xbox LIVE except people with modded consoles at this point. Hacking the console is complete. But the state of the scene is a bit sad. At least now we can vibecode the missing bits of the ecosystem (I say this as I'm literally reverse engineering and reimplementing the devkit debug monitor). > — [landr0id on hackernews · 1 comments](https://news.ycombinator.com/item?id=50100317) > They didn’t omit that information. This is literally the last paragraph of the article right before the references: > Funnily enough, a software-only exploit for the Xbox 360 dropped just last week , rendering my years of effort somewhat moot. Nevertheless, it was a fascinating deep dive into the inner workings of the console and the security mechanisms designed to protect it. > — [einsteinx2 on hackernews](https://news.ycombinator.com/item?id=50102253) > > Hacking the console is complete. No it's not. For starters the recently released softmod does not work on all Xbox 360 revisions. > — [ZenoArrow on hackernews · 2 comments](https://news.ycombinator.com/item?id=50100566) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50070661) · 107 points · 32 comments - [hackernews](https://news.ycombinator.com/item?id=50017365) · 4 points · 0 comments ## Similar posts on daily.dev - [Breaking The Parental Lock On An XBox 360 Is Very Much An Inconvenience](https://daily.dev/posts/breaking-the-parental-lock-on-an-xbox-360-is-very-much-an-inconvenience-7hipvnulu) · Hackaday · 0 upvotes · 0 comments - [For under $100, an Xbox 360 with homebrew beats almost every modern console I own](https://daily.dev/posts/for-under-100-an-xbox-360-with-homebrew-beats-almost-every-modern-console-i-own-muasgkxjt) · XDA Developers · 0 upvotes · 0 comments - [Hacking Hard Drive Firmware](https://daily.dev/posts/hacking-hard-drive-firmware-vcacuidwy) · Hackaday · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#hardware](https://daily.dev/tags/hardware), [#raspberry-pi](https://daily.dev/tags/raspberry-pi) [View this post on daily.dev](https://daily.dev/posts/it-took-me-nine-years-to-hack-my-xbox-360-ze4vcjmts) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"It took me nine years to hack my Xbox 360","url":"https://daily.dev/posts/it-took-me-nine-years-to-hack-my-xbox-360-ze4vcjmts","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/it-took-me-nine-years-to-hack-my-xbox-360-ze4vcjmts"},"datePublished":"2026-10-15T08:26:50.355Z","dateModified":"2026-10-15T12:42:50.811Z","description":"A personal story about finally modchipping an Xbox 360 console using a Matrix CoolRunner glitcher chip and a Raspberry Pi Pico, nine years after first...","image":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","thumbnailUrl":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/it-took-me-nine-years-to-hack-my-xbox-360-ze4vcjmts","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,hardware,raspberry-pi","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"It took me nine years to hack my Xbox 360"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/it-took-me-nine-years-to-hack-my-xbox-360-ze4vcjmts#faq","mainEntity":[{"@type":"Question","name":"How does a glitching attack bypass Xbox 360 secure boot?","acceptedAnswer":{"@type":"Answer","text":"It exploits fault injection by rapidly toggling the CPU_RESET signal at a precise moment during boot, which causes the CPU to execute the current instruction incorrectly instead of resetting. Specifically, researchers found the 'mr' (move register) instruction involved in signature verification could be glitched to move a 0 into its destination register instead of the real value, enabling arbitrary code execution despite Microsoft's otherwise secure boot chain. Developers curious about console security internals can follow deep dives like this on daily.dev."}},{"@type":"Question","name":"What tools do I need to modchip an Xbox 360 with a Matrix CoolRunner glitcher in 2026?","acceptedAnswer":{"@type":"Answer","text":"A Raspberry Pi Pico can replace most of the expensive specialized hardware once required. Flashing PicoFlasher onto a Pico allows dumping the NAND in seconds, and flashing Pico-dirtyJTAG lets you program the CoolRunner's timing files via urjtag, eliminating the need for a separate NAND programmer and JTAG programmer that cost significant money and time back in 2017. Hobbyists weighing cheap microcontroller-based tooling against legacy hardware can track projects like this on daily.dev."}},{"@type":"Question","name":"Has fault injection been used to bypass secure boot on devices other than the Xbox 360?","acceptedAnswer":{"@type":"Answer","text":"Yes, fault injection has bypassed secure boot and flash encryption on an ESP32 v3 in 2024, dumped Apple AirTag firmware in 2021 using a Raspberry Pi Pico, and the PicoFly modchip released in 2023 uses fault injection to defeat secure boot on the Nintendo Switch. These cases show fault injection becoming a more common and accessible attack vector as hardware security has hardened. Security researchers comparing fault injection cases across devices can keep up with examples like these on daily.dev."}}]} ```