Nine Years to Hack an Xbox 360: How a £5 Pico Made the Impossible Trivial

The author bought a glitcher — a Matrix CoolRunner Rev D modchip — back in 2017. Its only job is to deliver a roughly 100-nanosecond pulse of energy to an Xbox 360's CPU. Why would anyone want that? The answer explains why the console was long considered essentially unhackable.

Microsoft did its homework

After the security failures of the original Xbox, the company built a solid chain of trust into the 360. The first bootloader stage, 1BL, is physically baked into the CPU silicon: it loads the next stage from flash and verifies Microsoft's signature. Without the signing keys there was no real way to hijack the boot process, and each later stage enabled more protections. Software-based ways of running unsigned code, as tmbinc admitted, mostly didn't work.

Striking the weakest link

If the lock is sound and the guards check IDs at the door, a key is useless. It's easier to tell the guard his shoelaces are untied and hit him over the head with a club. That's the spirit of fault injection. Researchers found that rapidly toggling the CPU_RESET signal didn't reset the processor — it made it execute the current instruction incorrectly. The mr instruction, part of signature verification, could be glitched into writing a 0 into its destination instead of the intended value. By knowing the moment and flicking the "lights" on and off, attackers gained arbitrary code execution.

The future is glitching

Such trust chains are now everywhere. Microsoft mandated hardware-backed secure boot for its operating systems in 2021. In 2024 ESP32 v3's protections were bypassed by fault injection; Apple AirTag firmware was dumped in 2021 with a Raspberry Pi Pico; the PicoFly modchip for the Nintendo Switch (2023) uses fault injection too. The harder defences get, the more attractive this channel becomes — and the cheaper, accurate microcontrollers make it ever more accessible.

A love letter to the Pico

Released in 2021 for £5, the Raspberry Pi Pico shines thanks to its PIO blocks, which offer roughly 7.5-nanosecond timing resolution at 133 MHz. In 2017 the author tried to build a NAND/JTAG programmer on an old PC's LPT port — a dump would have taken over half an hour, and the project stalled. In 2026 he flashed PicoFlasher onto a Pico and read the NAND in seconds, then used Pico-dirtyJTAG to program the CoolRunner's timing files.

The punchline: a software-only Xbox 360 exploit dropped just a week earlier, rendering years of effort somewhat moot. Still, the author has no regrets — it was a fascinating deep dive into the console's innards and its defences. The takeaway: a task that defeated him in 2017 was handled in 2026 by a five-pound microcontroller.

Source: Lobsters