Xbox 360:RGH/EXT CLK

EXT_CLK is a modern RGH method by Octal450 that uses the EXT_CLK_EN point instead of CPU_PLL_BYPASS to allow reliable glitching of Xbox 360 consoles with a 90nm Waternoose XCPU, such as Xenons and Zephyrs. While it can be used on Falcon or Jasper motherboards, RGH 1.2 is recommended for those motherboards due to its maturity.

Equipment Needed

• A glitch chip:
  • It is highly recommended to use STBY_CLK instead of a built in oscillator with EXT_CLK, but if you wish to install a crystal on a glitch chip it's best to use a 48 MHz one.
  • Coolrunner Rev A/B/C/D
  • Matrix Glitcher
  • X360ACE V1/V2/V3
• A PC running Windows Vista or later
• A soldering iron, solder, and flux (MG 835 recommended)
• Isopropyl alcohol (91% or higher recommended) and cotton swabs
• A NAND & Glitch Chip Programmer:
  • xFlasher 360
  • NAND-X
  • JR-Programmer
  • Matrix Flasher
• J-Runner with Extras (Includes EXT_CLK Matrix/Coolrunner Timings)
• EXT_CLK Timing Files (X360ACE chips only)

Motherboard Points

The points you need to solder to are similar to RGH 1.2, aside from using EXT_CLK instead of PLL.

• 3.3v
• 1.8V (Only if using an X360ACE)
  • Xenon Motherboard
  • HDMI or Opus Motherboard
• EXT_CLK
• STBY_CLK
  • Bottom (Only on Xenon)
  • Bottom (HDMI or Opus phats, recommended)
  • Topside (HDMI or Opus phats, either boxed point works)
• POST
  • Bottom
  • Top (requires scraping)
• CPU_RST
  • R8C2 (Performs better, recommended)
  • C7R112
    • This point on Xenons is covered by a resistor. The resistor will need to be removed, but luckily it's not required for booting.
  • J8C1: (Easier to solder)
• GND
  • Near 3.3v (clean installation)
  • AV Port (A bit easier to solder)

Glitch Chip Installation

Glitch Chip Pinouts

Matrix

• A - RST
• B - POST
• C - STBY_CLK (remove oscillator if equipped)
• F - EXT_CLK
  • If you have a Matrix that comes with an oscillator, it can be easily disabled if this resistor is removed instead of removing the entire oscillator.

Coolrunner

• A - EXT_CLK
• B - STBY_CLK (remove oscillator if equipped)
• C - POST
• D - RST

X360ACE (V1/V2/V3), DGX

• C - POST
• D - RST
• F - EXT_CLK (22K ohm resistor required)
• Remember to remove the diode and connect 1.8V

Programming the Glitch Chip

1. Plug the cable from your programmer into the chip programmer.
   • If you are using an xFlasher, ensure the switch is set to SPI.
   • CoolRunner: Slide switch to "PRG".
2. Open J-Runner with Extras. Click "Program Timing File" in the upper left and select your console’s tab and the relevant radio button for EXT_CLK.
   • You can use the timing assistant in the bottom left to auto select a safe timing for your motherboard revision.
3. Click "Program". When complete, unplug the cable from the glitch chip.
   • Coolrunner: Set the switch back to "NOR".

X360ACE V3+

• xFlasher or other Gowin compatible programmer required in order to program these chips
• Programming Instructions

Decrypting the NAND

1. Connect Ethernet and power on the console. The Coolrunner should blink once or more times, and then the console should start into XeLL RELOADED.
2. Once XeLL finishes, it will display your CPU key and some other info. There is also an IP address.
3. Enter the IP address into the box on the lower right of J-Runner and click "Get CPU Key". J-Runner will pull the info from the box, and decrypt the NANDs automatically.

Writing New NAND Image

1. Power down the console, and connect your programmer to the motherboard.
   • If you are using an xFlasher, ensure the switch is set to SPI.
2. In the upper right of J-Runner, ensure the Glitch2 radio button is selected.
3. Click "Create XeBuild Image". This will take a few moments.
4. Click "Write NAND".
5. Disconnect your programmer when the process completes.
6. Boot the console several times and ensure it boots consistently. If not, make sure your wiring is clean and neat and avoids noisy area. Run the wires near the X-Clamps for best results.
7. Tune glitch chip timings if necessary.
8. Return to the RGH main page and continue in the Cleaning Up section.

Tuning Boot Times (Optional)

If the light stays on at the end of a cycle: - This means that the checks were passed, but the console failed to start - Probably the timing is too low, or the pulse length is too large

If the light goes off at the end of a cycle but doesn't boot: - This means that the checks failed - Probably the timing is too high, or the pulse length is too small

Note that the debug light behavior may be slightly misleading due to using POST_OUT bit 0.