Friday, December 12, 2014

Cheap programmer to read/write Xbox 360 NAND

In order to mod the Xbox 360, the first step is being able to read/write the NAND on Xbox 360. Apparent somebody has figured out the JTAG signals on the Xbox 360 board, and there are plenty of JTAG/NAND programmers out there.

The most common ones at this time is J-R Programmer v2 by Team Xecuter (at around $27 on Internet, plus shipping). There are also v1 version, and also an older programmer called NAND-X. As I always are, I am trying to find the solution to the problem at the lowest cost. On eBay, I found the Matrix NAND Programmer for around $8 shipped. So that's what I got. (I could go cheaper to build a parallel port adaptor, but that is 30 minutes for each NAND reading. A bit too long.)

It is now not that straight forward to use it (otherwise where is the fun of it). Here is the tricks that I have figured out to get it working.

Wiring to Xbox

The Matrix Programmer is an older device that was developed for use around 2011 (that's why it is cheap). The wiring connection is marked as J1D2.1, etc. The "J1D2" part of the mark refers to the connection headers on the Xbox motherboard, and ".1" part refers to pin 1 of the header. Apparently, that is for an older version of the Xbox. I have a Slim and the "J1D2" is now "J2C1", and "J2B1" is now "J2C3". And here is how it looks like connected to my Xbox Slim (Trinity).


Device Driver

One software that is commonly used is called NandPro by Team Xecuter (currently at v3.0). It is a command line tool that comes with a driver folder. However, none of these drivers work. So I searched up and down, and finally I read a post saying that the Matrix Programmer might be compatible with older versions of NandPro, such as 2.0c. The download can be found at this link. With the driver in that package, the device install well. And it appears as a "XECUTER NAND-X USB"!


Reading NAND

The NAND can be read by the NandPro on commandline. The Trinity has 16M NAND. So the command should be
nandpro usb: -r16 nand1.bin
But Team Xecuter has a better tool called JRunner. It has a graphic interface and makes everything a lot easier. Better yet, because the Matrix Programmer appears to be imitating NAND-X (as shown below in the red rectangle), it can be used directly with JRunner to read NAND.


Creating New ECC

With JRunner, creating becomes a simple operation of a click. No more need to install Python and the crypto pack as before.

Writing NAND

Just when I thought everything is sailing through, writing NAND in JRunner did not work. The operating It maybe because NAND-X has changed the interface. With the ECC generated, I just fall back to the commandline NandPro, and it worked well as intended.
nandpro usb: +w16 image_00000000.ecc


Now all we needed is a chip that glitches the CPU.



12 comments:

Anonymous said...

Hi,

Great write up. I have also ordered one of these extremely cheap Matrix Programmers to read write the NAND on my xbox 360 Trinity. I am just waiting for it to be delivered from China.

However, I think I have spotted a small mistake. I think the command to write the ECC image should use +w16 and not +r16

ie. nandpro usb: +w16 image_00000000.ecc
instead of nandpro usb: +r16 image_00000000.ecc

PS. Which glitch chip did you go for? I've gone for one called x360run (again extremely cheap from China). I read about it here http://www.se7ensins.com/forums/threads/x360run-rgh-trinity-corona-tut.973125/

Thanks
Dave (uk)

Jake Hayes said...

Hello, I'm typeing this 2 because it delete ah but I know this is old but I have all that I need it think I bought My Rev C and Matrix nand reader but I read somewhere that you can program the chip with matrix like create the images so I'm a bit scared because if that's the case I'm stuck with a bunch of parts and if this is not true please help me how would I connect the Rec c and matrix to write my program it I belive that's what I need to do in new at this all I need do to is RGH my Trinity so if someone can tell me that or link me 2 a video sorry for no grammar but this is way to long for that lol THANKS!!!

Jake Hayes said...

OMG I read this and need to clear some things. I read that you can not Program the glitch chip (in my case rev c CR) with Matrix, witch is why I got it so I can do all the stuff I need for rgh my trinity. I belive I does not come with cable so how would I connect to the REV C or am I srewed. THANKS x9999

Adam Li said...

David,

I think I am using one of the CoolRunners. I forgot which version it is. Probably "Rev C"?

You are right on the typo. I have it fixed. Thanks.

Adam

Dávid Machil said...

Hello, i need driver for Matrix Nand FLasher SPI 1.0. I cant find it. And link you post does not work anymore. But when i connect matrix to usb to pc, i cant see new device in Devices. Where is the problem ? thanks

Adam Li said...

David, sorry the link is not working anymore. I just checked and I don't have a copy of it around anymore. It's has been a long time.

Anonymous said...

Drivers:
http://team-xecuter.com/nandpro_20d_drivers.rar
http://team-xecuter.com/forums/threads/54372-Official-NAND-X-Drivers

Anonymous said...

hi there mate quick question are you using a single core wire would it make a difference if not

ggaspar said...

does it work, with Xenon board??

Nuwan Lakmal said...
This comment has been removed by the author.
CodeAsm said...

@Nuwan Lakmal check his later post ;)
http://adamli.blogspot.nl/2014/12/xsvf-jtag-programmer.html

You need to program the glitcher to the correct file with the right timing (experiment even).
Im currently trying to do the same and wish I could find my Buspirate, else I have to either get my RaspberryPi or Xilinx programmer from the basement.

Nuwan Lakmal said...

When you write ecc file to NAND +r command is wrong. correct command is

nandpro usb: +w16 image_00000000.ec