Modder uses a $4 Raspberry Pi Pico to finish nine-year Xbox 360 voltage-glitch hack

A cheap tool replaces specialised hardware

The 2011 exploit needed dedicated equipment alongside a voltage-glitching chip. According to the report, the same technique can now be carried out with a Raspberry Pi Pico, a small microcontroller on a stick whose price starts at about $4, or roughly 5€ or £5.

Tom's Hardware reports that the modder first connected the Pi Pico to the console's NAND interface header in order to dump the NAND flash firmware, a task the report says is easily done with some wiring and the PicoFlasher utility.

How the glitch works

The exploit sends a very brief signal directly into the CPU's reset pin. The report says the CPU then executes the current instruction incorrectly rather than resetting as the label would suggest. Someone has previously found a way to use this faulty execution to run arbitrary code on the processor, bypassing the console's cryptographic protections.

Making the signal work requires timing with a resolution down to nanoseconds, and glitch chips may need several attempts before the processor latches the fault.

Background to the years of attempts

The Xbox 360 has been opened several times since its release. The report says the modding history began with modded DVD firmware in 2006, followed by a hypervisor hack in 2007 and a wiring method exposing JTAG debugging ports in 2009. Microsoft's updates usually closed the gaps that hackers found.

The 2011 CPU reset exploit lasted longer than these earlier methods. Scottish hacker Joshua Kennedy bought a Matrix Coolrunner Rev D modchip board in 2017 to try the glitch, but the setup required soldering, NAND work, programmers and patience. He later tried building his own programmer from an old PC's parallel port but never finished the project.

Open questions

• Will Microsoft issue an update that closes the reset-pin weakness?
• How many attempts does the glitch typically need before it succeeds on a Pico setup?