you aren't going to find out how it works but all it does it glitch the nand to boot the hacked dash

There is a really technical article explaining how the RGH hack works.

Basically, the while the 360 is trying to boot, all of the CPU's functions are based on a clock. The Coolrunner will pulse a signal to the CPU to slow down this clock that controls the CPU to where it can be exploited. The reason why the Reset Glitch can take a while to boot is due to the fact that it is based on a glitch and there are two main factors:

One function of the CPU that gets exploited also contains values needed to boot, if these are missed, the system will crash needing another glitch attempt.

On Slims, the CPU's clock speed would fluctuate at times, and when the pulse is sent to reset, the necessary function to reset the CPU would be missed, needing another glitch attempt.

The Coolrunner is basically the processor that handles all of this information and sends the pulses to the CPU based on its own clock.

iTwerks wrote There is a really technical article explaining how the RGH hack works.

Basically, the while the 360 is trying to boot, all of the CPU's functions are based on a clock. The Coolrunner will pulse a signal to the CPU to slow down this clock that controls the CPU to where it can be exploited. The reason why the Reset Glitch can take a while to boot is due to the fact that it is based on a glitch and there are two main factors:

One function of the CPU that gets exploited also contains values needed to boot, if these are missed, the system will crash needing another glitch attempt.

On Slims, the CPU's clock speed would fluctuate at times, and when the pulse is sent to reset, the necessary function to reset the CPU would be missed, needing another glitch attempt.

The Coolrunner is basically the processor that handles all of this information and sends the pulses to the CPU based on its own clock.

Also, to add to this, a CR3 Lite is basically just a Rev C with all of the added bells and whistles.

iTwerks wrote
The Coolrunner is basically the processor that handles all of this information and sends the pulses to the CPU based on its own clock.

This is where the CR3 Lite is a kinda cool chip, it has an onboard 48mhz oscillator which when enabled is used for the clock signal - this is necessary for Corona consoles.

On phats and trinities the STBY_CLK is able to be picked up from the console (this is pad B on TX stuff) so the onboard 48mhz oscillator is disabled on a CR3 Lite for those installs.

So depending on the board and install you could be using the CLK signal from the CR3 Lite (coronas) or the CLK signal from the board (all phats and trinities).


You can read really in depth about the exact methodology of the glitch for both RGH1 and RGH2 over at libxenon dot org.