Xbox 360:LPT Cable

This guide will walk you through obtaining NAND dumps, creating a XeLL file for a console, and writing it to the console's NAND using a LPT cable.

Equipment Needed

• A PC with a native 25 pin LPT/printer port. Generally, this port is purple colored. Converting an LPT cable to USB will not work.
• A PC running Windows Vista or later.
• A soldering iron, solder, flux, and Isopropyl alcohol with cotton swabs
  • Specific recommendatons can be found on this page
• 28AWG or 30AWG wire
• Five 100ohm 1/2W resistors
• A 1N914/4148 switching diode
• A 25-pin male D-sub connector. This can be taken from an old parallel printer cable, but it will likely need to be taken apart to be re-wired.
• (Recommended) A 25-pin D-sub connector hood. This will protect your cable from possible shorts and make the cable more permanent.
• (Recommended) 2.54mm/0.1" male pin headers and wires with a female pin header so you can attach/detach LPT cable

Preparing the LPT Cable

If not using a printer cable, cut 7 wires to about 6 inches in length. It's recommended to use wires with a female pin header on the end so that the cable can be easily attached/detached from the motherboard. Using the diagram below, solder a 100ohm 1/2W resistor on pins 1, 2, 14, 16, 17 on the backside of the D-Sub connector. The direction of the resistor does not matter. Solder the wires onto the end of the resistors and the two other colored pins in the diagram. Keep in the mind that the diagram is showing the PC connector side, meaning that the diagram is accurate if you are looking at the backside of the D-Sub connector. Each point should be solidly connected so that a tug on the wire won't disconnect the wire.

• If you have a full printer cable, you will need to cut off one end and check whether the pins on the male connector correspond to the wires inside. Some printer cables only have a few wires connected, so you may need to open it and move wires around via soldering onto the connector.

Once you've finished soldering, clean up any flux with isopropyl alcohol and cotton swabs.

Preparing the Motherboard

• If you attached female pin headers on the LPT cable, solder a male pin header to the 1N914/4148 diode. Ensure that the side of the diode with the black line is faced away from the male pin header. Solder the side of the diode with the black line to the orange point on the diagram below. Solder a male pin header to the rest of the points in the diagram. Each point should be solidly connected so that a tug on the wire won't disconnect the wire. You should now be able to plug your cable onto the motherboard and plug it into your powered off PC.

• If you did not attach female pin headers on the LPT cable, use the diagram below and solder the 1N914/4148 diode onto the wire on pin 11 (orange), ensuring that the side with the black line on it is faced away from the cable connector. Solder the side of the diode with the black line to the motherboard's orange point, and solder the rest of the cable's wires to the corresponding colors on the motherboard. Each point should be solidly connected so that a tug on the wire won't disconnect the wire. You should now be able to plug your cable onto the motherboard and plug it into your powered off PC.

Once you've finished soldering, clean up any flux with isopropyl alcohol and cotton swabs.

Reading the NAND

1. Download and extract NandPro 3.0a.
   • If you are using a 64-bit system, download InpOutBinaries and extract file "inpout32.dll" from folder "Win32" into the NandPro folder, then rename it to "DLPortIO.dll".
   • If you are using a 32-bit system, run port95.exe in the NandPro folder and install it.
2. With your PC powered off, plug the LPT cable into its parallel port. It should be connected to both your Xbox 360 and the PC. Plug your Xbox 360 power supply in, but do not turn the console on.
3. Press the Windows key + R and type "cmd" and press enter. In the Command Prompt, enter these commands. Replace the "16" with "64" if you have a 256MB or 512MB Jasper/Tonasket.
   • cd Desktop\Nandpro30
   • nandpro lpt: -r16 original_nand1.bin
4. Press Enter and it will start dumping the NAND. It will increment a hexadecimal counter, starting at address 0000 and ending at 03FF (or 1900 for a 256MB/512MB Jasper). If it says "Could not detect flash controller!" or anything about missing CB/CD files, see the troubleshooting steps at the bottom of this page. If you get messages about bad blocks, ignore them. This will create a file called original_nand1.bin in NandPro folder. This process will take approximately 35 minutes for regular consoles and ~150 minutes for 256MB/512MB Jaspers. When it is finished, type the command again, changing the name of the dump as follows, again replacing the "16" with "64" if you have a 256MB or 512MB Jasper/Tonasket.
   • nandpro lpt: -r16 original_nand2.bin
5. Download and extract J-Runner with Extras.
6. Launch J-Runner. Select ... next to the Load Source field and choose original_nand1.bin. Select ... next to the Additional File field and choose original_nand2.bin. Press the Compare button and it will tell you if the two dumps are an exact match while listing any bad blocks in the dump. If the dumps are the same, you can close J-Runner and proceed. If they aren't, take more dumps until you get matching ones.
7. Copy one of the dumps to a safe place such as cloud storage or send it to yourself in an email to keep it safe. They are located in the output folder in the J-Runner directory.

(Phat Only) Checking your CB if it's JTAGable

This section is only if you have a phat Xbox 360 that has a dashboard/kernel version of 2.0.7371.0 or lower.

Open J-Runner and select ... next to the Load Source field and choose the original_nand1.bin or original_nand2.bin file. On the right-hand side, note the value next to the 2BL [CB] label. If your CB is on the list below, your console is JTAGable. Any newer CB which is not on the list will be patched.

Model	Exploitable CB Versions
Xenon	1888, 1897, 1902, 1903, 1920, 1921, 8192
Xenon (Elpis)	none*
Zephyr	4540, 4558, 4570, 4580
Falcon/Opus	5760, 5761, 5766, 5770
Jasper	6712 & 6723
Tonasket	none

*Elpis Xenons come with a 7xxx CB, which are always patched against the JTAG hack.

Creating XeLL

1. In J-Runner, select "…" next to the Load Source field and choose your nanddump1.bin or nanddump2.bin.
2. Select the appropriate radio button in the top right of the window:
   • JTAG - For JTAG, R-JTAG, or R-JTOP.
   • Glitch - For RGH1.
   • Glitch2 - For RGH1.2, RGH2, RGH3, EXT_CLK, Muffin/Mufas, or S-RGH.
   • Glitch2m - Same as Glitch2 but only used if your eFuses are in a non-bootable state.
3. Put a check in the appropriate check box (if applicable) in the top right of the window:
   • If you are using JTAG, select JTAG and leave the R-JTAG checkbox unchecked.
     • If you are using R-JTAG or R-JTOP, the R-JTAG checkbox would be enabled.
     • If you are not on a Xenon console, select Aud_Clamp for either of these three modifications.
   • If you are using RGH 1.2 or S-RGH, select SMC+
   • If you are on a non-Xenon console with EXT_CLK, select SMC+
   • If you are using Project Mufas, select SMC+
   • If you are using RGH2 with an X360ACE, select SMC+
   • If you are using RGH2 or RGH2+ with a CR3/CR4, select CR4
   • If you are using RGH3, select RGH3
   • If you have an Xbox 360 E motherboard with Windbond W641GG2KB RAM, select WB 2K
4. Select the Create XeLL button and wait for it to finish.

Flashing the Dump

1. Copy the generated xxxxx.bin or xxxxx.ecc (for example, xenon.bin) file into your Nandpro30 folder. Press the Windows key + R and type "cmd" and press enter. In the Command Prompt, enter these commands, replacing xxxxx with your file's name and replacing the "16" with a "64" if you are using a 256MB or 512MB Jasper:
   • cd Desktop\Nandpro30
   • nandpro lpt: -w16 xxxxx.bin or nandpro lpt: -w16 xxxxx.ecc
2. Press Enter, and it will start writing XeLL to the first 50 blocks of your motherboard's NAND. It will increment a hexadecimal counter, starting at address 0000 and ending at 004F. If it says "Could not detect flash controller!", see the troubleshooting steps at the bottom of this page. This process will take approximately 3.5 minutes (~14 minutes for a 256MB / 512MB Jasper).
3. Once it has successfully written to the motherboard, unplug the power cable from your Xbox 360 and unplug the LPT cable from the computer.
4. Go back the page you were originally on for wiring instructions.
   • JTAG
   • RGH
     • RGH1
     • RGH1.2
     • RGH2
     • S-RGH
     • Project Mufas
     • EXT_CLK
     • RGH3
   • R-JTAG
   • R-JTOP

Troubleshooting

• "Could not detect flash controller!" while dumping
  • Check that your power brick is plugged in, with an amber colored LED, and that it is plugged into your console completely (console turned off).
  • Check your motherboard soldering to make sure that you have wires, resistors, and the diode in the correct places. Each point should be solidly connected so that a tug on the wire won't disconnect the wire.
  • Check that the wiring on your LPT connector matches the diagram. The diagram shows *the PC's port*, which is the same as the *back* of the connector.
  • Check that you've cleaned up any flux you had used. Depending on the type, it may be conductive and cause issues.

• What should I do if I ripped off a soldering pad?
  • Look online for an alternate point to solder onto. Practice more on junk electronics before attempting to continue.