Deemwar Monads & Abstractions

The Xbox 360 Reset Glitch

Source: It took me nine years to hack my Xbox 360, by Kennedn

The Xbox 360 checks a Microsoft signature before it boots. The reset glitch does not break the check; it makes the CPU run one instruction wrong at the right moment. Kennedn bought the chip for it in 2017 and finished the job in 2026.

~100 ns reset pulse
1 instruction glitched
9 years bought 2017, done 2026

The boot chain

Microsoft learned from the original Xbox. Software attacks that try to run unsigned code on the 360 mostly don’t work.

  1. 1

    1BL starts

    baked into the CPU silicon

    The first boot stage cannot be rewritten. It is the root of trust.

  2. 2

    Load CB

    from flash storage

    1BL reads the next bootloader stage, called CB.

  3. 3

    Verify the signature

    1BL checks CB

    CB must be signed by Microsoft. Without Microsoft’s keys there is no real way to take over the boot.

  4. unsigned → the console refuses to boot · each later stage turns on more security

The glitch

The lock is sound, so the attack goes after something more basic: a CPU behaves predictably only under stable energy conditions.

A reset pulse during the check turns “refuse” into “run”.

Pulse CPU_RESETabout 100 ns
No resetinstruction runs wrong
mr writes 0value ignored
Unsigned codeboots

Researchers toggled the CPU reset line very briefly. Instead of resetting, the CPU executed its current instruction incorrectly. Timed to the signature check, the mr (move register) instruction ignores the value it should move and writes a 0 into its destination register. That gives arbitrary code execution.

Kennedn’s build

Matrix CoolRunner Rev DThe glitcher modchip, bought in 2017.
2017 attemptA home-made printer-port NAND/JTAG programmer; it never worked and the project was shelved.
2026 NAND dumpPicoFlasher on a Raspberry Pi Pico: a handful of seconds.
2026 timing filesPico-dirtyJTAG on a second Pico programs the CoolRunner.

What it teaches

CaseLessonRule now
Xbox 360A correct signature check fell to a timed reset pulse.A secure-boot chain is only as strong as its power and timing.
ESP32 v3, 2024A single electromagnetic glitch bypassed Secure Boot and Flash Encryption on a chip with fault-injection countermeasures.Countermeasures need testing against real glitches; hardware flaws cannot be patched.
Raspberry Pi PicoPIO blocks at 133 MHz time to about 7.5 ns.Assume attackers own cheap, precise glitch tooling.

Guardrails for secure-boot builders

Read more

Kennedn: It took me nine years to hack my Xbox 360.

Hacker News discussion.

Free60: Xbox 360 boot process.

Rodrigo Copetti: Xbox 360 architecture, the glitcher.

Delvaux, Mune, Romero, Timmers: Breaking Espressif’s ESP32 V3 (USENIX WOOT 2024).

Sources: pulse length, the mr glitch, 1BL/CB, 2017 and 2026 dates, Pico timing from Kennedn’s post; ESP32 v3 from the USENIX WOOT 2024 paper page.