Xbox 360:RGH/RGH1.2

RGH1.2 combines RGH1-like PLL slowdown with Glitch2 images to allow reliable glitching of Falcon/Jasper consoles with split CB (post 14699 kernel). RGH1.2 V2 ports this hack to Trinity/Corona consoles as well as fixing a few issues on Jaspers.

Equipment Needed

 * A glitch chip:
 * Coolrunner Rev A/B/C/D
 * CR3 Lite
 * Matrix Glitcher
 * Squirt BGA/Reloaded
 * X360ACE V1/V2/V3
 * X360ACE V4/V5/V3+ (Trinity/Corona only)
 * DGX
 * A PC running Windows Vista or later
 * A soldering iron, solder, and flux (MG 835 recommended)
 * Isopropyl alcohol (91% or higher recommended) and cotton swabs
 * xFlasher 360, NAND-X, JR-Programmer, or Matrix Flasher
 * J-Runner with Extras (Includes RGH1.2 V2 Matrix/Coolrunner Timings)
 * RGH1.2 V2 Timing Files (X360ACE/Squirt chips only)

Motherboard points on Falcon & Jasper

 * 3.3v
 * Topside near AV
 * PLL
 * Bottom
 * Top (under CPU heatsink, requires scraping)
 * STBY_CLK
 * Bottom (recommended and easier to solder)
 * Topside (There are 2 points boxed, either can be used.)
 * POST
 * Bottom
 * Top (requires scraping)
 * CPU_RST
 * R8C2 (Performs better, recommended)
 * Near PLL
 * J8C1: (Easier to solder)
 * GND
 * Near 3.3v (clean installation)
 * AV Port (A bit easier to solder)

Coolrunner Rev A/B/C/D

 * A - PLL
 * B - STBY_CLK (only if not using oscillator)
 * C - POST
 * D - RST

CR3 Lite

 * A - PLL
 * B - STBY_CLK (only if not using oscillator)
 * C - POST
 * D - RST

Matrix Glitcher

 * A - RST
 * B - POST
 * C - STBY_CLK (only if not using oscillator)
 * F - PLL

Squirt

 * Squirt BGA 1.2: Disable the onboard 670pf and/or 480pf caps by removing R7 and R8
 * Squirt Reloaded 2.X: remove R2 and connect STBY_CLK
 * Pinout follows written labels
 * Don't use POST or RST tuners

X360ACE (V1/V2/V3), DGX

 * C - POST
 * D - RST
 * E - STBY_CLK (only if not using oscillator version)
 * F - PLL (22K ohm resistor required)
 * Remember to remove the diode and connect 1.8V

Motherboard points on Trinity & Corona

 * PLL
 * No alternative point!
 * POST & RST
 * If POST on the bottom is disabled (like in Waitsburg & Stingray boards) or damaged, a postfix adapter is required. The adapter can also be used on Trinity in case it's damaged. Postfix installation and identification visible here.
 * FT4R2 (Only on Trinity)
 * R4P4 (Only on Corona)
 * STBY_CLK (Trinity only)
 * C3B10 (Top)
 * FT3N2 (Bottom)
 * GND & 3.3V

Coolrunner Rev A/B/C/D

 * B - STBY_CLK (only if not using oscillator)
 * C - POST
 * D - RST
 * E - PLL (10K ohm resistor recommended)

CR3 Lite

 * B - STBY_CLK (only if not using oscillator)
 * C - POST
 * D - RST
 * E - PLL (10K ohm resistor recommended)

Matrix Glitcher (Corona)

 * A - RST
 * B - POST
 * E - PLL (10K ohm resistor recommended)

Matrix Glitcher (Trinity)

 * A - RST
 * B - POST
 * C - STBY_CLK (only if not using oscillator)
 * E - PLL (10K ohm resistor recommended)

X360ACE (V1/V2/V3/V3+), DGX

 * C - POST
 * D - RST
 * F - PLL (10K ohm resistor recommended)

X360ACE V4/V5

 * A - RST
 * B - POST
 * C1 - CPU_CLK_DP
 * C2 - CPU_CLK_DN
 * D - PLL (10K ohm resistor required)

Squirt

 * Squirt Reloaded 2.X: remove R2 and connect STBY_CLK or remove 100 MHz and add 48 MHz oscillator
 * Use SCL pad for PLL
 * Pinout follows written labels
 * Don't use POST or RST tuners

Programming the Glitch Chip

 * 1) Plug the cable from your programmer into the chip programmer.
 * 2) * If you are using an xFlasher, ensure the switch is set to.
 * 3) * CoolRunner: Slide switch to "PRG".
 * 4) Open J-Runner with Extras. Click "Program Timing File" in the upper left and select your console’s tab and the relevant radio button for RGH 1.2.
 * 5) Click "Program". When complete, unplug the cable from the glitch chip.
 * 6) * Coolrunner: Set the switch back to "NOR".

X360ACE V4/V5/V3+

 * xFlasher or other Gowin compatible programmer required in order to program these chips
 * Programming Instructions

Decrypting the NAND

 * 1) Connect Ethernet and power on the console. The Coolrunner should blink once or more times, and then the console should start into XeLL RELOADED.
 * 2) Once XeLL finishes, it will display your CPU key and some other info. There is also an IP address.
 * 3) Enter the IP address into the box on the lower right of J-Runner and click "Get CPU Key". J-Runner will pull the info from the box, and decrypt the NANDs automatically.

Writing New NAND Image

 * 1) Power down the console, and connect your programmer to the motherboard.
 * 2) * If you are using an xFlasher, ensure the switch is set to.
 * 3) In the upper right of J-Runner, ensure the   radio button is selected.
 * 4) * Make sure  is enabled for better boot times.
 * 5) Click "Create XeBuild Image". This will take a few moments.
 * 6) Click "Write NAND".
 * 7) Disconnect your programmer when the process completes.
 * 8) Boot the console several times and ensure it boots consistently. If not, make sure your wiring is clean and neat and avoids noisy area. Run the wires near the X-Clamps for best results.
 * 9) Return to the RGH main page and continue in the Cleaning Up section.