Hello all,

i will explain you in this tutorial how to RGH you xbox fat with a kernel > at 14699

You will need :
- A coolrunner or Squirt 1.2
- A CPLD programmer : nand-x, squirt programmer, LPT cable…
- A nand dumper flasher
- Soldering materials
- An Xbox 360 Fat with Kernel >14699

I : Programming the CPLD

   A : Squirt

You will need the 360 squirt programmer and UrJTAG application. Place the files you want to flash your cpld with next to the executable.

Squirt team recommand to use rgh2-cle-squirtbga150212.svf , but if you don’t have good result with it, you can try another one.

Then use the following commands :
cable ft2232
detect
svf yourfile.svf

    B : Coolrunner

Use your nand-x and nandpro 3.0, place de xsvf file you want to flash next to nandpro 3.0 and use the following command : nandpro xsvf: yourfile.xsvf
Use the xsvf file according to the mother board :
Falcon/Opus: Program either TX_RGH2_B.xsvf, or TX_RGH2_C.xsvf
Jasper: Program either TX_RGH2_A.xsvf, or TX_RGH2_D.xsvf
Zephyr: Program either TX_RGH2_D.xsvf, or TX_RGH2_C.xsvf

II : Making the hacked image

- Dump your console’s nand twice with your nand-x or usb spi as usual (nandpro usb: r16 (or 64): nand1.bin): nand1.bin) and make sure they match (fc /b nand1.bin nand2.bin)

- Use Xecuter Team RGH 2.0 build.py or Squirt360′s one.
Place your nand in the RGH folder, like this (create the « output » folder if there is none).

and use the following command depending on the build.py you choose :

imgbuild\build_new.py nand1.bin for Squirt360

and you will get the ecc files in the output folder

build.py nand.bin for xecuter

you should find the ecc in the output folder

- now flash the ecc image with nandpro and the +w16 command (nandpro usb: +w16 image.ecc)

III : Soldering the hardware

Xecuter Diagram
Squirt Diagram

IV : let’s glitching

Connect your 360 to your TV, plug the power supply, turn it on and enjoy =)
With RGH2.0 the console can take a little time to glitch, so don’t be too hurry and give it time =)
If you don’t have boot at all, play with the CPU_RST length.

Full credit goes to
- Tiros & GliGli for their original RGH work
- cOz for his universal SMC patcher
- Xecuter Team
- Squirt360 Team