After nine years, a hobbyist glitch-hacks the Xbox 360 with a £5 Raspberry Pi Pico

A nine-year personal project to run unsigned code on an Xbox 360 finally succeeded this year, according to a detailed write-up on kennedn.com that has since reached Hacker News's front page. The author's route in was not a clever software exploit but a hardware attack technique called fault injection — and the project was completed, ironically, only days before a software-only exploit for the console was published.

A boot chain built to shut out software attacks

Microsoft learned from the original Xbox's weaknesses and hardened its successor considerably, the author explains. The first bootloader, known as 1BL, is physically embedded in the Xbox 360's CPU silicon. Its job is to load the next bootloader stage, CB, from flash storage and verify that Microsoft signed it. Without the company's signing keys there was no realistic way to seize control during boot, and each successive boot phase turns on additional protections that would each need to be defeated. The well-known hacker tmbinc concluded that software-based approaches to running unsigned code on the console largely do not work.

Fault injection breaks a deeper assumption

If the lock is strong and the entry procedures sound, the weakest link becomes something more fundamental: computation depends on stable electrical conditions in order to behave predictably. Fault injection subverts exactly that assumption. Researchers found that toggling the CPU_RESET line on the Xbox 360 very quickly does not reset the processor — instead, it makes the CPU execute the current instruction incorrectly. Crucially, an mr (move register) instruction involved in the signature verification process could be glitched into writing a zero into its destination register, handing researchers arbitrary code execution. The Matrix CoolRunner Rev D the author bought in 2017 is purpose-built for this job: it delivers a roughly 100-nanosecond pulse of energy to the console.

What changed between 2017 and 2026

The first attempt stalled. In 2017, modding an Xbox 360 required a glitching chip, a soldering iron, a NAND programmer and a JTAG programmer — a costly toolkit. The author tried to save money by building a NAND and JTAG programmer from a very old PC's parallel port, which would have needed over 30 minutes for a single NAND dump. It never worked, and the project was shelved.

The 2026 retry was straightforward by comparison. A Raspberry Pi Pico — released in 2021 for £5 — running PicoFlasher dumped the console's NAND in a handful of seconds. A second Pico flashed with Pico-dirtyJTAG programmed the CoolRunner's timing files, used together with Octal450's timing files and the urjtag project built from source. The Pico's PIO blocks, driven by a 133 MHz clock, give an effective timing resolution of roughly 7.5 nanoseconds, which the author credits with making this kind of precise work cheap and accessible.

A pattern, not a one-off

The post argues fault injection is becoming both more attractive and more accessible. Hardware-backed secure boot, unusual a decade ago, is now widespread — Microsoft has enforced it on its operating systems since 2021. The author points to recent examples: the ESP32 v3's secure boot and flash encryption were bypassed with a fault injection attack in 2024, the Apple AirTag's firmware was dumped in 2021 by stacksmashing using a Pi Pico, and the PicoFly modchip for the Nintendo Switch arrived in 2023. As the software attack surface hardens, subverting the electrical behaviour of a chip becomes the practical way in, and cheap microcontrollers have lowered the barrier to trying.

Why it matters

Trust chains like the Xbox 360's are now standard across computing hardware, and they push attackers past code and toward physics. That means designers of secure systems have to treat fault injection as a realistic, low-cost threat rather than a laboratory curiosity, because a £5 microcontroller can now do work that once demanded expensive, specialised equipment and rare skills. The story also ends with a lesson in humility: as the author notes, a software-only exploit for the Xbox 360 dropped just last week, rendering nine years of hardware effort largely unnecessary — though, they add, the deep dive into the console's inner workings and security mechanisms was its own reward.