[Trinity, Corona] S-RGH Tutorial, start to

finish (Slim only) [16MB]

*****credit goes to JoinTheResistance at se7ensins for the original Write up of this tutorial*****

Warning:
Soldering skills are required to perform this mod, needless to say you can damage your console
while performing this mod.
Health warning:
Soldering, especially when using flux, generates toxic fumes, which you should not breathe in!
Therefore, it's recommended to either work in a well ventilated area or use a fume extractor. No
solder joint is worth cancer!

Supported consoles
All Trinity and Corona slims
Unsupported consoles
All Phats
Winchester slims

Identifying your console

Trinity or a corona

Identifying the corona version.

If you have a Trinity you can skip this step
If you have a Corona disassemble your console and follow the picture from below to identify the sub
model
After you know your exact motherboard version, proceed to the next step

Software
J-runner /S-RGH timing files

Hardware needed
Depending on your motherboard revision, you might need some console specific things, but let's
start with the standard stuff first.
Soldering iron

Solder (preferably lead free)

Wires (AWG 26 and AWG 30 work very well)

Flux

J-R Programmer or Nand-X (Both will work well)

A glitch board/chip
(Optional) some pin headers, if you're going to use an ACE or DGX/RGX that doesn't have them and
don't want to solder the programming cable directly

Supported glitch boards/chips (Glitchers)

X360 ACE

This is the easiest to find chip, it is also the best one for the task.
DGX/RGX

This one is a bit harder to find and might even cost you a bit more. It works, but I still recommend
getting the ACE.

Console specific
Corona V3/V5
A postfix adapter

Now that you have everything ready, let's start!

The first thing to do is install the JR-programmer/matrix nand flasher drivers.
First connect the device to your computer and wait until windows tells you that it can't find the
drivers. After that go into device manager and locate the JR programmer/Nand-X, it should show up
as JR programmer, unknown device or memory access. Next right click on it, "Update Driver
software", "Browse my computer for driver software" and point it to the jrunner folder.

Step 1: Reading the nand

After we have all the required software and hardware ready, we need to read the nand of the
console. Simply put, the nand is the chip where the console's operating system is stored and we
need to make a copy of it (nand dump), so that we can modify it. This process is going to vary by
motherboard type.

First, connect your JR programmer or nand-x by following the diagrams from bellow.
Note: You'll need to cut the coloured plugs off of the end of the nand cable on the JR
programmer/Nand-x
Trinity

Corona V1/V3/V5

After you have the cables soldered to the motherboard, plug the power cable in the Xbox, but do
NOT power it on! Connect the usb cable to your programmer and your PC and launch jrunner.
You should see either the nand-x or JR programmer logo next to the "CPU key database" button, if
it's not there your drivers probably aren't installed properly. If you see the logo you should be able
to proceed.

JR PROGRAMMER
NAND-X

You need to get two matching nand dumps so make sure that under reads you have at least 2. To
begin reading the nand click on "Read Nand". After its done doing all of the nand reads jrunner is
going to compare them and tell you if they are the same. If you get "Nands are the same" then you
are ready to continue. If you get any bad blocks, don't worry about them, jrunner will remap them
automatically, just make sure that the nand dumps match. If your nand dumps don't match or you
get a "Wrong version 0x0000000" error, then check your soldering and try again. Do NOT continue
until you have at least 2 matching nand dumps.

Step 2 - Creating and flashing the ECC

After getting the matching nand dumps, select "glitch2" on the right hand side of jrunner and click
on "create ECC". Once it says "ECC created", click on "Write ECC" and wait until jrunner writes the
ECC back to your console.

Step 3 - Programming the glitch chip

First unplug the nand read/write cable from your JR programmer and connect the xsvf programming
cable in the top plug. If you're using an ace (or an RGX without headers), you have probably seen
that there is nowhere to plug the other end of the cable in, well this is where those headers from
before come in. Here is what your chip will look like after soldering the headers.
Of course you can just solder the wires directly.
On the JRP cable you will have a few labels, when you are plugging the cable in the glitch board
make sure that you match them with the labels on the board that you are using. The ace chip
doesn't have labels so use this picture instead.

After you have the headers soldered and all of the cables plugged in, switch the switch near the xsvf
port on the JRP to the side closer to the port itself.
To flash the timing file, open jrunner and go to advanced, then custom nand/cr functions, select Xsvf
and click the "..." on the right. Next, use the window that just popped up to navigate to where you
have the S-RGH files extracted, go in the "Trinity" or "Corona" folder (depending on what console
you have) and you will find 3 sub folders 150MHz, 200MHz and 300MHz. These folders hold the
timing files that we will be programming onto the glitch chip. The folder names represent the
working frequency of the chip when flashed with one of those files. Because every console is
different, there is no way to determine which file is going to work best for you. Once you open one
of the folders you will see more folders labelled "timing_XX.X". The numbers represent the timing at
which the glitch/reset pulse will be sent. Lower means earlier, higher means later. In these folders
you will find the actual files. They will the labelled "TR_L_X.X_T_XX.X" for trinity files and
"CO_L_X.X_T_XX.X" for corona files. The number after the "L" is the length of the reset/glitch pulse.
The lower the number, the lower the pulse length, the higher the number the loner the pulse. Of
course we can't be sure what is going to work best, so we will start by choosing the 300MHz,
"TR_L_0.5_T_60.6" file for trinity consoles and the 300MHz "CO_L_0.5_T_66.2" file for coronas.
After the file is selected, click open and then "RUN". Wait until jrunner flashes the file onto the chip,
after it's done disconnect the chip and proceed to the next step.

Step 4 - Soldering the glitch chip

After the ECC has been written and the glitch chip programmed, it's time to connect it to the
motherboard. Follow the diagrams from below!

DGX/RGX
Trinity/Corona V1/V2
Corona V3/V4/V5/V6

X360 ACE
Trinity/Corona V1/V2
Corona V3/V4/V5/V6

You will also need to bridge a few points if you have one of these motherboard revisions.

Even though it says V3 and V4 only, this is also necessary on V5 and V6 boards. To bridge the points
you can use 0 Ohm resistors/fuses, a small wire or just solder on its own. As the picture suggests,
only make the bridges if the resistors are missing!
Step 5: Getting the CPU key

After you have soldered the chip onto the board it's time to get the CPU key. First, you need to
disconnect the JR programmer/Nand-X from the motherboard. Simply unplug the cable from the
JRP/Nand-X itself, no need to desolder it.
Once you have your nand reader disconnected from the motherboard, plug the power and HDMI/AV
cables in and turn your console on. Now the glitch chip will attempt to glitch your console. If your
console doesn't boot within a minute, program the chip with a different timing file. Note: Make sure
that the console is both off and unplugged while programming the glitch chip.

Once your console boots you will see the Xell Reloaded screen.

Wait a bit and it will scroll down to your CPU and DVD key. The one we need now is the CPU key, so
take a picture if it or write it down.

Once you have your CPU key turn your console off and continue to the next step.

Step 6: Building and flashing the hacked image

First you will need to add the dashboard files. To do this in jrunner open the drop down menu under
Dash version, click on add dash, check the box next to the dashboard version you wish to create,
select the latest one if unsure, which is 17349 at the time of writing this tutorial, and click on Add
dashes

So, since jrunner no longer updates, you will either need to use 17511 for the initial XeBuild (even if
your console was on a higher dash prior to RGHing it), or update it yourself like this.
Don't worry about that now, you can later update to the latest dashboard.
Make sure that you have 17511 selected under dash version.

Load one of your nand dumps into "source" in jrunner and enter your CPU key in the CPU key box.
Don't worry about mistyping your CPU key, jrunner will tell you "CPU key is correct" if you have
entered it correctly.
Once you have entered your CPU key correctly and downloaded the latest dashboard, select
"glitch2" from the right and click on "Create Xebuild image". Note: If you aren't getting instant boot
times you can check the "CR4" box next to glitch2 to reduce the time between glitch attempts.
Once it's done creating your image connect your JR programmer/matrix nand flasher to your console
and PC, then plug the Xbox 360 power cable in the console, but do NOT turn the console on! Next
click on "Write Nand" and wait for it to write the image onto the console.
After it's done writing the image unplug everything and wait 30s, after that plug the Xbox 360 power
and HDMI/AV cables in (make sure that your nand programmer is NOT connected to the console)
and turn your Xbox on. Your console should now boot into the default dashboard. And that's pretty
much it, now all you have to do is desolder the nand cables, clean the flux and put your console back
together.

*****credit goes to JoinTheResistance at se7ensins for the original Write up of this tutorial*****

*****Tutorial Pdf Version 1.0 produced by ScottD1503 at se7ensins*****