A writer at kennedn.com bought a Matrix CoolRunner Rev D glitcher in 2017 to tackle an Xbox 360 and only finished the job in 2026. The Xbox 360 was built so that the first bootloader, 1BL, is baked into the CPU silicon and checks Microsoft’s signature on everything that follows. Software attacks mostly went nowhere.

The way in was fault injection. Pulsing the CPU_RESET line for about 100 nanoseconds makes the processor execute an instruction wrong. Researchers used that to turn the mr instruction during signature checking into a move of zero, which gave them code execution.

The 2017 attempt failed at the NAND dump, done over an LPT port on an old PC, a process that would have taken over 30 minutes. In 2026 the same step took seconds with PicoFlasher on a £5 Raspberry Pi Pico . A second Pico running Pico-dirtyJTAG programmed the CoolRunner timing files.…