Hacker Bypasses Xbox 360 Security With a Raspberry Pi Pico Microcontroller

Scottish hacker Joshua Kennedy has completed an Xbox 360 project he abandoned 9 years ago using an inexpensive Raspberry Pi Pico. The microcontroller’s starting price is 4 dollars (about 7 manats), while in some markets it costs 5 euros (10 manats) or 5 pounds (11 manats). Kennedy bypassed the console’s protection system and managed to run code of his choice on the processor. Previously, this required specialized equipment and a separate signal chip.

The hacker exploited a vulnerability discovered in 2011 involving a forced processor reset. A very weak electrical signal is sent to the processor’s reset input at a precise moment. As a result, the processor incorrectly executes the instruction it is processing at that time, bypassing Microsoft’s encryption-based protection. However, the signal must be timed with nanosecond precision. Several attempts are sometimes required for a successful result.

Kennedy purchased a signal chip called the Matrix Coolrunner Rev D in 2017. However, the project required soldering numerous wires, working with the console’s NAND memory, and using separate programming devices. He also tried to use an old computer’s parallel port as a programmer. The attempt was unsuccessful, so the project remained unfinished. This year, the Raspberry Pi Pico helped perform those tasks more simply.

For the new attempt, Kennedy connected the Raspberry Pi Pico to the console’s NAND memory connection point. He then used the PicoFlasher software to make a copy of the firmware. Next, he loaded the Octal450 Timing Files, which select the correct moment for intervention on different Xbox 360 versions, onto the Matrix Coolrunner chip. The appropriate timing window varies depending on the console’s hardware version. Thus, the project that failed 9 years ago was completed with a 4-dollar microcontroller.