[JTAG/RGH] How to build a hacked NAND image from scratch.

SouthParkModding · Apr 15, 2018

reply abcdefghijk

4229Brayden · Jun 3, 2018

nand image

elmaazoon · Aug 24, 2018

very good work

TheDarkDarkDarkness · Aug 27, 2018

Nice!!!!!!

bigkid72 · Oct 1, 2018

Thanks bud, hopefully i can get it to work for me

uuzt · Oct 14, 2018

thanks fotr the help!

Robbase · Nov 10, 2019

JeEnYuS said: ↑

This tutorial is only for those of you who; lost all of their original and hacked nand dumps + erased/corrupted the nand/flash the wrong image to the nand.

[SIZE=large]If you find yourself in this situation then this tutorial will walk you step by step to make your RGH/JTAG console boot again. This is a one size fit all solution.[/SIZE]

[SIZE=large]Take note that because you've lost all of your nand dumps, you won't be able to restore your console to retail ever again unless you have your original "kv.bin" and you will be unable to use your dvd drive until you extract it's key and patch the kv.[/SIZE]

[SIZE=x-large]Before getting started you will need the following;[/SIZE]

usb spi nand programmer(nand-x, jr-programmer, any will do(eMMC R/W kit for corona 4gb)
J-Runner the ultimate JTAG/RGH app DOWNLOAD
Extracted nand files that match you motherboard model (download below)

[SIZE=x-large]Step 1; Recovery of cpu key and LDV's[/SIZE]

[SIZE=medium]Download one of the clean extracted donor nand files according to your motherboard model and extract the containing folder to the location of your choice;[/SIZE]

Don't use these files to unban your console, first you don't have the original cpu key and second they are all coming from banned consoles. You have been warned!

Extracted Nand Files Download

***Hidden content cannot be quoted.***

[SIZE=medium]Next you need to solder/plug in your nand programmer wires onto the motherboard [/SIZE]
[SIZE=medium]Open J-Runner app an click on "show working folder" button located at the bottom right[/SIZE]

[SIZE=medium]Open the folder name "data" located inside /J-Runner/xeBuild/ folders[/SIZE]

[SIZE=medium]Open your extracted nand files folder and copy and paste KV.bin, SMC.bin, smc_config.bin and fcrt.bin(if required) to data folder. It should look like this.[/SIZE]

[SIZE=x-large][/SIZE]

In J-Runner, copy and paste this cpu key F37C0CD50B928F4E67614ACD548A4E49 in the cpu key section.

Choose dashboard version according your hack type (for JTAG choose 7371 - for phat rgh1 choose 14699 - for R-JTAG choose 15574 - for phat RGH2 choose 14719 - for slim choose anything above 14719)

Select your motherboard nand type.

Select retail as your image type.

It should look like this.

In J-Runner under the Advanced tab click on Create an image without nanddump.bin

Then you will be ask to enter LDV just enter any number between 1 and 80 and click ok.

At this point the dummy image should be successfully created and automatically loaded in the "Load Source" section.

Now with your nand programmer properly connected to both you pc and motherboard click on "Write Nand".

Wait until J-Runner is finish writing the nand and select your "hack type" then click on "Create ECC" for rgh machine or "Create Xell-Reloaded" for JTAG/R-JTAG machine.

Now click on "Write ECC" or "Write Xell-Reloaded" depending on your hack type[SIZE=11pt].[/SIZE]

You are now ready to boot xell and recover your cpu key.

Disconnect the nand wires from the nand programmer and Power ON your console and wait for xell to boot.
.
Once xell as booted write down your cpu key, fuseset 02 and fuseset 07/08.

Understanding and calculating LDV's

Calculating CF/CG ldv is fairly simple. Just count the number of "F" in fuseset 07 to fuseset 11. So in the example above we have a cf/cg lock down value of 2.

Calculating CB LDV can be a little bit more trickier. You have to take the right-most "F" and calculate how many character it is from the left. In the example above the right-most "F" is 5 characters from the left so we have a cb lock down value of 5.

[SIZE=11pt]Understanding CB LDV; Quote from Martin C @ TX [/SIZE]

The example above is from a Jasper with a cb ldv cseq of 5, remember that this value can be translated to a dashboard version. So by looking at the chart below we can determine that dashboard 7371 would be the highest compatible version for this particular console.

[SIZE=x-large]Step 2; Building the fake OG nand image[/SIZE]

Now back in J-Runner, enter your cpu key in the cpu key section.

Select your dashboard according to your CB LDV cseq

Select Retail as Image type.

Select Motherboard nand type.

Click on the "Advanced" tab and on "create an image without nanddump.bin"

You will be ask for LDV, this is the cf/cg LDV so you enter what you have in fuseset 07/08 and click "OK".

You have now created a fake original nand image. Even though you won't be able to boot your console with this image it would still be a good idea to keep it somewhere safe.

With your new image loaded in the "Load Source" section and your cpu key in the "Cpu Key" section click on the "kv info" tab. You will notice that the info in there are obviously not from your console. So now would be a good time, for those who can, to extract your dvd drive key and patch the key vault with the appropriate dvd key.

Click on the "XB Settings" tab, click on "Advanced XeBuild Options", paste your dvd key in the "dvdkey" section, click "OK" then click the "Use Edited Options" check box.

For DG16D5S and DLN10N owners; the easiest and cheapest way to make your dvd drive functional would be to install a TX LTU 2 pcb.

Final Part; Building/writing the hacked image

Back in J-Runner, with your new fake original nand image loaded in the "Load Source" section and cpu key in the "Cpu Key" section select hack image type(Jtag - rgh - rgh2 - r-jtag), select your desired dashboard(should be the latest which is 17150 at the moment), select motherboard nand type. You can also edit dashlaunch and xeBuild options at this point.

Click on create xeBuild image. You will see 3 or 4 warning messages poping up which will ask you if you want to delete kv.bin, smc.bin, fcrt.bin and smc_config.bin. Click yes on all of them.

With your nand programmer properly connected to both your console and pc click on "Write Nand"

Disconnect nand wires, Boot your console and have fun.

If this tutorial have helped you in any way or if you only downloaded the extracted nand files please click on the "Like This" button and drop a thanks.
Click to expand...

thanks

dynastybush · Jun 18, 2020

JeEnYuS said: ↑

This tutorial is only for those of you who; lost all of their original and hacked nand dumps + erased/corrupted the nand/flash the wrong image to the nand.

[SIZE=large]If you find yourself in this situation then this tutorial will walk you step by step to make your RGH/JTAG console boot again. This is a one size fit all solution.[/SIZE]

[SIZE=large]Take note that because you've lost all of your nand dumps, you won't be able to restore your console to retail ever again unless you have your original "kv.bin" and you will be unable to use your dvd drive until you extract it's key and patch the kv.[/SIZE]

[SIZE=x-large]Before getting started you will need the following;[/SIZE]

usb spi nand programmer(nand-x, jr-programmer, any will do(eMMC R/W kit for corona 4gb)
J-Runner the ultimate JTAG/RGH app DOWNLOAD
Extracted nand files that match you motherboard model (download below)

[SIZE=x-large]Step 1; Recovery of cpu key and LDV's[/SIZE]

thank you

[SIZE=medium]Download one of the clean extracted donor nand files according to your motherboard model and extract the containing folder to the location of your choice;[/SIZE]

Don't use these files to unban your console, first you don't have the original cpu key and second they are all coming from banned consoles. You have been warned!

Extracted Nand Files Download

***Hidden content cannot be quoted.***

[SIZE=medium]Next you need to solder/plug in your nand programmer wires onto the motherboard [/SIZE]
[SIZE=medium]Open J-Runner app an click on "show working folder" button located at the bottom right[/SIZE]

[SIZE=medium]Open the folder name "data" located inside /J-Runner/xeBuild/ folders[/SIZE]

[SIZE=medium]Open your extracted nand files folder and copy and paste KV.bin, SMC.bin, smc_config.bin and fcrt.bin(if required) to data folder. It should look like this.[/SIZE]

[SIZE=x-large][/SIZE]

In J-Runner, copy and paste this cpu key F37C0CD50B928F4E67614ACD548A4E49 in the cpu key section.

Choose dashboard version according your hack type (for JTAG choose 7371 - for phat rgh1 choose 14699 - for R-JTAG choose 15574 - for phat RGH2 choose 14719 - for slim choose anything above 14719)

Select your motherboard nand type.

Select retail as your image type.

It should look like this.

In J-Runner under the Advanced tab click on Create an image without nanddump.bin

Then you will be ask to enter LDV just enter any number between 1 and 80 and click ok.

At this point the dummy image should be successfully created and automatically loaded in the "Load Source" section.

Now with your nand programmer properly connected to both you pc and motherboard click on "Write Nand".

Wait until J-Runner is finish writing the nand and select your "hack type" then click on "Create ECC" for rgh machine or "Create Xell-Reloaded" for JTAG/R-JTAG machine.

Now click on "Write ECC" or "Write Xell-Reloaded" depending on your hack type[SIZE=11pt].[/SIZE]

You are now ready to boot xell and recover your cpu key.

Disconnect the nand wires from the nand programmer and Power ON your console and wait for xell to boot.
.
Once xell as booted write down your cpu key, fuseset 02 and fuseset 07/08.

Understanding and calculating LDV's

Calculating CF/CG ldv is fairly simple. Just count the number of "F" in fuseset 07 to fuseset 11. So in the example above we have a cf/cg lock down value of 2.

Calculating CB LDV can be a little bit more trickier. You have to take the right-most "F" and calculate how many character it is from the left. In the example above the right-most "F" is 5 characters from the left so we have a cb lock down value of 5.

[SIZE=11pt]Understanding CB LDV; Quote from Martin C @ TX [/SIZE]

The example above is from a Jasper with a cb ldv cseq of 5, remember that this value can be translated to a dashboard version. So by looking at the chart below we can determine that dashboard 7371 would be the highest compatible version for this particular console.

[SIZE=x-large]Step 2; Building the fake OG nand image[/SIZE]

Now back in J-Runner, enter your cpu key in the cpu key section.

Select your dashboard according to your CB LDV cseq

Select Retail as Image type.

Select Motherboard nand type.

Click on the "Advanced" tab and on "create an image without nanddump.bin"

You will be ask for LDV, this is the cf/cg LDV so you enter what you have in fuseset 07/08 and click "OK".

You have now created a fake original nand image. Even though you won't be able to boot your console with this image it would still be a good idea to keep it somewhere safe.

With your new image loaded in the "Load Source" section and your cpu key in the "Cpu Key" section click on the "kv info" tab. You will notice that the info in there are obviously not from your console. So now would be a good time, for those who can, to extract your dvd drive key and patch the key vault with the appropriate dvd key.

Click on the "XB Settings" tab, click on "Advanced XeBuild Options", paste your dvd key in the "dvdkey" section, click "OK" then click the "Use Edited Options" check box.

For DG16D5S and DLN10N owners; the easiest and cheapest way to make your dvd drive functional would be to install a TX LTU 2 pcb.

Final Part; Building/writing the hacked image

Back in J-Runner, with your new fake original nand image loaded in the "Load Source" section and cpu key in the "Cpu Key" section select hack image type(Jtag - rgh - rgh2 - r-jtag), select your desired dashboard(should be the latest which is 17150 at the moment), select motherboard nand type. You can also edit dashlaunch and xeBuild options at this point.

Click on create xeBuild image. You will see 3 or 4 warning messages poping up which will ask you if you want to delete kv.bin, smc.bin, fcrt.bin and smc_config.bin. Click yes on all of them.

With your nand programmer properly connected to both your console and pc click on "Write Nand"

Disconnect nand wires, Boot your console and have fun.

If this tutorial have helped you in any way or if you only downloaded the extracted nand files please click on the "Like This" button and drop a thanks.
Click to expand...

ardopermana · Nov 15, 2020

thanks for the link

LeeNP · Jun 2, 2021

try

JeEnYuS said: ↑

This tutorial is only for those of you who; lost all of their original and hacked nand dumps + erased/corrupted the nand/flash the wrong image to the nand.

[SIZE=large]If you find yourself in this situation then this tutorial will walk you step by step to make your RGH/JTAG console boot again. This is a one size fit all solution.[/SIZE]

[SIZE=large]Take note that because you've lost all of your nand dumps, you won't be able to restore your console to retail ever again unless you have your original "kv.bin" and you will be unable to use your dvd drive until you extract it's key and patch the kv.[/SIZE]

[SIZE=x-large]Before getting started you will need the following;[/SIZE]

usb spi nand programmer(nand-x, jr-programmer, any will do(eMMC R/W kit for corona 4gb)
J-Runner the ultimate JTAG/RGH app DOWNLOAD
Extracted nand files that match you motherboard model (download below)

[SIZE=x-large]Step 1; Recovery of cpu key and LDV's[/SIZE]

[SIZE=medium]Download one of the clean extracted donor nand files according to your motherboard model and extract the containing folder to the location of your choice;[/SIZE]

Don't use these files to unban your console, first you don't have the original cpu key and second they are all coming from banned consoles. You have been warned!

Extracted Nand Files Download

***Hidden content cannot be quoted.***

[SIZE=medium]Next you need to solder/plug in your nand programmer wires onto the motherboard [/SIZE]
[SIZE=medium]Open J-Runner app an click on "show working folder" button located at the bottom right[/SIZE]

[SIZE=medium]Open the folder name "data" located inside /J-Runner/xeBuild/ folders[/SIZE]

[SIZE=medium]Open your extracted nand files folder and copy and paste KV.bin, SMC.bin, smc_config.bin and fcrt.bin(if required) to data folder. It should look like this.[/SIZE]

[SIZE=x-large][/SIZE]

In J-Runner, copy and paste this cpu key F37C0CD50B928F4E67614ACD548A4E49 in the cpu key section.

Choose dashboard version according your hack type (for JTAG choose 7371 - for phat rgh1 choose 14699 - for R-JTAG choose 15574 - for phat RGH2 choose 14719 - for slim choose anything above 14719)

Select your motherboard nand type.

Select retail as your image type.

It should look like this.

In J-Runner under the Advanced tab click on Create an image without nanddump.bin

Then you will be ask to enter LDV just enter any number between 1 and 80 and click ok.

At this point the dummy image should be successfully created and automatically loaded in the "Load Source" section.

Now with your nand programmer properly connected to both you pc and motherboard click on "Write Nand".

Wait until J-Runner is finish writing the nand and select your "hack type" then click on "Create ECC" for rgh machine or "Create Xell-Reloaded" for JTAG/R-JTAG machine.

Now click on "Write ECC" or "Write Xell-Reloaded" depending on your hack type[SIZE=11pt].[/SIZE]

You are now ready to boot xell and recover your cpu key.

Disconnect the nand wires from the nand programmer and Power ON your console and wait for xell to boot.
.
Once xell as booted write down your cpu key, fuseset 02 and fuseset 07/08.

Understanding and calculating LDV's

Calculating CF/CG ldv is fairly simple. Just count the number of "F" in fuseset 07 to fuseset 11. So in the example above we have a cf/cg lock down value of 2.

Calculating CB LDV can be a little bit more trickier. You have to take the right-most "F" and calculate how many character it is from the left. In the example above the right-most "F" is 5 characters from the left so we have a cb lock down value of 5.

[SIZE=11pt]Understanding CB LDV; Quote from Martin C @ TX [/SIZE]

The example above is from a Jasper with a cb ldv cseq of 5, remember that this value can be translated to a dashboard version. So by looking at the chart below we can determine that dashboard 7371 would be the highest compatible version for this particular console.

[SIZE=x-large]Step 2; Building the fake OG nand image[/SIZE]

Now back in J-Runner, enter your cpu key in the cpu key section.

Select your dashboard according to your CB LDV cseq

Select Retail as Image type.

Select Motherboard nand type.

Click on the "Advanced" tab and on "create an image without nanddump.bin"

You will be ask for LDV, this is the cf/cg LDV so you enter what you have in fuseset 07/08 and click "OK".

You have now created a fake original nand image. Even though you won't be able to boot your console with this image it would still be a good idea to keep it somewhere safe.

With your new image loaded in the "Load Source" section and your cpu key in the "Cpu Key" section click on the "kv info" tab. You will notice that the info in there are obviously not from your console. So now would be a good time, for those who can, to extract your dvd drive key and patch the key vault with the appropriate dvd key.

Click on the "XB Settings" tab, click on "Advanced XeBuild Options", paste your dvd key in the "dvdkey" section, click "OK" then click the "Use Edited Options" check box.

For DG16D5S and DLN10N owners; the easiest and cheapest way to make your dvd drive functional would be to install a TX LTU 2 pcb.

Final Part; Building/writing the hacked image

Back in J-Runner, with your new fake original nand image loaded in the "Load Source" section and cpu key in the "Cpu Key" section select hack image type(Jtag - rgh - rgh2 - r-jtag), select your desired dashboard(should be the latest which is 17150 at the moment), select motherboard nand type. You can also edit dashlaunch and xeBuild options at this point.

Click on create xeBuild image. You will see 3 or 4 warning messages poping up which will ask you if you want to delete kv.bin, smc.bin, fcrt.bin and smc_config.bin. Click yes on all of them.

With your nand programmer properly connected to both your console and pc click on "Write Nand"

Disconnect nand wires, Boot your console and have fun.

If this tutorial have helped you in any way or if you only downloaded the extracted nand files please click on the "Like This" button and drop a thanks.
Click to expand...

mr420 rgh · Oct 18, 2021

Thanks got my nand infected

darviral · Jun 20, 2022

JeEnYuS said: ↑

This tutorial is only for those of you who; lost all of their original and hacked nand dumps + erased/corrupted the nand/flash the wrong image to the nand.

[SIZE=large]If you find yourself in this situation then this tutorial will walk you step by step to make your RGH/JTAG console boot again. This is a one size fit all solution.[/SIZE]

[SIZE=large]Take note that because you've lost all of your nand dumps, you won't be able to restore your console to retail ever again unless you have your original "kv.bin" and you will be unable to use your dvd drive until you extract it's key and patch the kv.[/SIZE]

[SIZE=x-large]Before getting started you will need the following;[/SIZE]

usb spi nand programmer(nand-x, jr-programmer, any will do(eMMC R/W kit for corona 4gb)
J-Runner the ultimate JTAG/RGH app DOWNLOAD
Extracted nand files that match you motherboard model (download below)

[SIZE=x-large]Step 1; Recovery of cpu key and LDV's[/SIZE]

[SIZE=medium]Download one of the clean extracted donor nand files according to your motherboard model and extract the containing folder to the location of your choice;[/SIZE]

Don't use these files to unban your console, first you don't have the original cpu key and second they are all coming from banned consoles. You have been warned!

Extracted Nand Files Download

***Hidden content cannot be quoted.***

[SIZE=medium]Next you need to solder/plug in your nand programmer wires onto the motherboard [/SIZE]
[SIZE=medium]Open J-Runner app an click on "show working folder" button located at the bottom right[/SIZE]

[SIZE=medium]Open the folder name "data" located inside /J-Runner/xeBuild/ folders[/SIZE]

[SIZE=medium]Open your extracted nand files folder and copy and paste KV.bin, SMC.bin, smc_config.bin and fcrt.bin(if required) to data folder. It should look like this.[/SIZE]

[SIZE=x-large][/SIZE]

In J-Runner, copy and paste this cpu key F37C0CD50B928F4E67614ACD548A4E49 in the cpu key section.

Choose dashboard version according your hack type (for JTAG choose 7371 - for phat rgh1 choose 14699 - for R-JTAG choose 15574 - for phat RGH2 choose 14719 - for slim choose anything above 14719)

Select your motherboard nand type.

Select retail as your image type.

It should look like this.

In J-Runner under the Advanced tab click on Create an image without nanddump.bin

Then you will be ask to enter LDV just enter any number between 1 and 80 and click ok.

At this point the dummy image should be successfully created and automatically loaded in the "Load Source" section.

Now with your nand programmer properly connected to both you pc and motherboard click on "Write Nand".

Wait until J-Runner is finish writing the nand and select your "hack type" then click on "Create ECC" for rgh machine or "Create Xell-Reloaded" for JTAG/R-JTAG machine.

Now click on "Write ECC" or "Write Xell-Reloaded" depending on your hack type[SIZE=11pt].[/SIZE]

You are now ready to boot xell and recover your cpu key.

Disconnect the nand wires from the nand programmer and Power ON your console and wait for xell to boot.
.
Once xell as booted write down your cpu key, fuseset 02 and fuseset 07/08.

Understanding and calculating LDV's

Calculating CF/CG ldv is fairly simple. Just count the number of "F" in fuseset 07 to fuseset 11. So in the example above we have a cf/cg lock down value of 2.

Calculating CB LDV can be a little bit more trickier. You have to take the right-most "F" and calculate how many character it is from the left. In the example above the right-most "F" is 5 characters from the left so we have a cb lock down value of 5.

[SIZE=11pt]Understanding CB LDV; Quote from Martin C @ TX [/SIZE]

The example above is from a Jasper with a cb ldv cseq of 5, remember that this value can be translated to a dashboard version. So by looking at the chart below we can determine that dashboard 7371 would be the highest compatible version for this particular console.

[SIZE=x-large]Step 2; Building the fake OG nand image[/SIZE]

Now back in J-Runner, enter your cpu key in the cpu key section.

Select your dashboard according to your CB LDV cseq

Select Retail as Image type.

Select Motherboard nand type.

Click on the "Advanced" tab and on "create an image without nanddump.bin"

You will be ask for LDV, this is the cf/cg LDV so you enter what you have in fuseset 07/08 and click "OK".

You have now created a fake original nand image. Even though you won't be able to boot your console with this image it would still be a good idea to keep it somewhere safe.

With your new image loaded in the "Load Source" section and your cpu key in the "Cpu Key" section click on the "kv info" tab. You will notice that the info in there are obviously not from your console. So now would be a good time, for those who can, to extract your dvd drive key and patch the key vault with the appropriate dvd key.

Click on the "XB Settings" tab, click on "Advanced XeBuild Options", paste your dvd key in the "dvdkey" section, click "OK" then click the "Use Edited Options" check box.

For DG16D5S and DLN10N owners; the easiest and cheapest way to make your dvd drive functional would be to install a TX LTU 2 pcb.

Final Part; Building/writing the hacked image

Back in J-Runner, with your new fake original nand image loaded in the "Load Source" section and cpu key in the "Cpu Key" section select hack image type(Jtag - rgh - rgh2 - r-jtag), select your desired dashboard(should be the latest which is 17150 at the moment), select motherboard nand type. You can also edit dashlaunch and xeBuild options at this point.

Click on create xeBuild image. You will see 3 or 4 warning messages poping up which will ask you if you want to delete kv.bin, smc.bin, fcrt.bin and smc_config.bin. Click yes on all of them.

With your nand programmer properly connected to both your console and pc click on "Write Nand"

Disconnect nand wires, Boot your console and have fun.

If this tutorial have helped you in any way or if you only downloaded the extracted nand files please click on the "Like This" button and drop a thanks.
Click to expand...

thanks

Nothingizcooler · Apr 12, 2025

JeEnYuS said: ↑

You must've done something wrong.

What's your console and hack type???
Click to expand...

JeEnYuS said: ↑

This tutorial is only for those of you who; lost all of their original and hacked nand dumps + erased/corrupted the nand/flash the wrong image to the nand.

[SIZE=large]If you find yourself in this situation then this tutorial will walk you step by step to make your RGH/JTAG console boot again. This is a one size fit all solution.[/SIZE]

[SIZE=large]Take note that because you've lost all of your nand dumps, you won't be able to restore your console to retail ever again unless you have your original "kv.bin" and you will be unable to use your dvd drive until you extract it's key and patch the kv.[/SIZE]

[SIZE=x-large]Before getting started you will need the following;[/SIZE]

usb spi nand programmer(nand-x, jr-programmer, any will do(eMMC R/W kit for corona 4gb)
J-Runner the ultimate JTAG/RGH app DOWNLOAD
Extracted nand files that match you motherboard model (download below)

[SIZE=x-large]Step 1; Recovery of cpu key and LDV's[/SIZE]

[SIZE=medium]Download one of the clean extracted donor nand files according to your motherboard model and extract the containing folder to the location of your choice;[/SIZE]

Don't use these files to unban your console, first you don't have the original cpu key and second they are all coming from banned consoles. You have been warned!

Extracted Nand Files Download

***Hidden content cannot be quoted.***

[SIZE=medium]Next you need to solder/plug in your nand programmer wires onto the motherboard [/SIZE]
[SIZE=medium]Open J-Runner app an click on "show working folder" button located at the bottom right[/SIZE]

[SIZE=medium]Open the folder name "data" located inside /J-Runner/xeBuild/ folders[/SIZE]

[SIZE=medium]Open your extracted nand files folder and copy and paste KV.bin, SMC.bin, smc_config.bin and fcrt.bin(if required) to data folder. It should look like this.[/SIZE]

[SIZE=x-large][/SIZE]

In J-Runner, copy and paste this cpu key F37C0CD50B928F4E67614ACD548A4E49 in the cpu key section.

Choose dashboard version according your hack type (for JTAG choose 7371 - for phat rgh1 choose 14699 - for R-JTAG choose 15574 - for phat RGH2 choose 14719 - for slim choose anything above 14719)

Select your motherboard nand type.

Select retail as your image type.

It should look like this.

In J-Runner under the Advanced tab click on Create an image without nanddump.bin

Then you will be ask to enter LDV just enter any number between 1 and 80 and click ok.

At this point the dummy image should be successfully created and automatically loaded in the "Load Source" section.

Now with your nand programmer properly connected to both you pc and motherboard click on "Write Nand".

Wait until J-Runner is finish writing the nand and select your "hack type" then click on "Create ECC" for rgh machine or "Create Xell-Reloaded" for JTAG/R-JTAG machine.

Now click on "Write ECC" or "Write Xell-Reloaded" depending on your hack type[SIZE=11pt].[/SIZE]

You are now ready to boot xell and recover your cpu key.

Disconnect the nand wires from the nand programmer and Power ON your console and wait for xell to boot.
.
Once xell as booted write down your cpu key, fuseset 02 and fuseset 07/08.

Understanding and calculating LDV's

Calculating CF/CG ldv is fairly simple. Just count the number of "F" in fuseset 07 to fuseset 11. So in the example above we have a cf/cg lock down value of 2.

Calculating CB LDV can be a little bit more trickier. You have to take the right-most "F" and calculate how many character it is from the left. In the example above the right-most "F" is 5 characters from the left so we have a cb lock down value of 5.

[SIZE=11pt]Understanding CB LDV; Quote from Martin C @ TX [/SIZE]

The example above is from a Jasper with a cb ldv cseq of 5, remember that this value can be translated to a dashboard version. So by looking at the chart below we can determine that dashboard 7371 would be the highest compatible version for this particular console.

[SIZE=x-large]Step 2; Building the fake OG nand image[/SIZE]

Now back in J-Runner, enter your cpu key in the cpu key section.

Select your dashboard according to your CB LDV cseq

Select Retail as Image type.

Select Motherboard nand type.

Click on the "Advanced" tab and on "create an image without nanddump.bin"

You will be ask for LDV, this is the cf/cg LDV so you enter what you have in fuseset 07/08 and click "OK".

You have now created a fake original nand image. Even though you won't be able to boot your console with this image it would still be a good idea to keep it somewhere safe.

With your new image loaded in the "Load Source" section and your cpu key in the "Cpu Key" section click on the "kv info" tab. You will notice that the info in there are obviously not from your console. So now would be a good time, for those who can, to extract your dvd drive key and patch the key vault with the appropriate dvd key.

Click on the "XB Settings" tab, click on "Advanced XeBuild Options", paste your dvd key in the "dvdkey" section, click "OK" then click the "Use Edited Options" check box.

For DG16D5S and DLN10N owners; the easiest and cheapest way to make your dvd drive functional would be to install a TX LTU 2 pcb.

Final Part; Building/writing the hacked image

Back in J-Runner, with your new fake original nand image loaded in the "Load Source" section and cpu key in the "Cpu Key" section select hack image type(Jtag - rgh - rgh2 - r-jtag), select your desired dashboard(should be the latest which is 17150 at the moment), select motherboard nand type. You can also edit dashlaunch and xeBuild options at this point.

Click on create xeBuild image. You will see 3 or 4 warning messages poping up which will ask you if you want to delete kv.bin, smc.bin, fcrt.bin and smc_config.bin. Click yes on all of them.

With your nand programmer properly connected to both your console and pc click on "Write Nand"

Disconnect nand wires, Boot your console and have fun.

If this tutorial have helped you in any way or if you only downloaded the extracted nand files please click on the "Like This" button and drop a thanks.
Click to expand...

Great!

veli koç · Apr 16, 2026

Merhaba. İki haftadır konsolumu yeniden çalıştırmaya çalışıyorum. Xbox 360 Phat-Jasper 16MB'ım yanlış yazılım yüklediğim için açılmıyor. Kapanmadan önce CPU anahtarı, DVD anahtarı ve fuseset'in ekran görüntülerini aldım. CPU anahtarı, DVD anahtarı ve LVD değerine sahibim. Ne yapmalıyım? Bana yardımcı olabilir misiniz? (Yazılım yükleme çipi: Coolrunner Corona Rev: D)

veli koç · Apr 16, 2026

Hello. I've been trying to get my console working again for two weeks. My Xbox 360 Phat-Jasper 16MB won't turn on because I installed the wrong software. I took screenshots of the CPU key, DVD key, and fuseset before it shut down. I have the CPU key, DVD key, and LVD values. What should I do? Can you help me? (Software installation chip: Coolrunner Corona Rev: D)

Sockrat · Apr 19, 2026

JeEnYuS said: ↑

Это руководство предназначено только для тех, кто потерял все свои оригинальные и взломанные дампы NAND, а также стёр/повредил NAND/прошил неправильный образ в NAND.

[SIZE=large]Если вы оказались в подобной ситуации, то это пошаговое руководство поможет вам снова запустить консоль RGH/JTAG. Это универсальное решение.[/SIZE]

[SIZE=large]Обратите внимание, что, поскольку вы потеряли все дампы NAND, вы никогда больше не сможете восстановить консоль до заводских настроек, если у вас нет оригинального файла "kv.bin", и вы не сможете использовать DVD-привод, пока не извлечете его ключ и не пропатчите файл kv.[/SIZE]

[SIZE=x-large]Перед началом работы вам понадобится следующее;[/SIZE]

USB SPI NAND программатор (NAND-X, JR-программатор, любой подойдет (комплект eMMC для чтения/записи Corona 4 ГБ))
J-Runner — лучшее приложение JTAG/RGH. СКАЧАТЬ.
Извлеченные файлы NAND, соответствующие вашей модели материнской платы (скачать ниже).

[SIZE=x-large] Шаг 1; Восстановление ключа ЦП и LDV [/SIZE]

[SIZE=medium]Загрузите один из чистых извлеченных файлов донорской NAND-памяти в соответствии с моделью вашей материнской платы и распакуйте содержащуюся в нем папку в выбранное вами место;[/SIZE]

Не используйте эти файлы для разблокировки вашей консоли. Во-первых, у вас нет оригинального ключа активации, а во-вторых, все они получены с заблокированных консолей. Предупреждение!

Скачать извлеченные файлы NAND

***Скрытый контент нельзя цитировать.***

[SIZE=medium]Далее вам нужно припаять/подключить провода программатора NAND к материнской плате[/SIZE]
[SIZE=medium]Откройте приложение J-Runner и нажмите кнопку «Показать рабочую папку», расположенную в правом нижнем углу[/SIZE]

[SIZE=medium]Откройте папку с именем "data", расположенную внутри папки /J-Runner/xeBuild/[/SIZE]

[SIZE=medium]Откройте папку с извлеченными файлами NANDи скопируйте и вставьте KV.bin, SMC.bin, smc_config.bin и fcrt.bin (при необходимости) в папку data. Должно получиться вот так.[/SIZE]

[SIZE=x-large] [/SIZE]

В программе J-Runner скопируйте и вставьте следующий ключ ЦП: F37C0CD50B928F4E67614ACD548A4E49 в раздел ключей ЦП.

Выберите версию панели управления в соответствии с типом вашего взлома (для JTAG выберите 7371, для phat RGH1 — 14699, для R-JTAG — 15574, для phat RGH2 — 14719, для slim — любое значение выше 14719).

Выберите тип NAND вашей материнской платы.

Выберите тип изображения «розничная торговля».

Это должно выглядеть вот так.

В J-Runner на вкладке «Дополнительно» нажмите «Создать образ без nanddump.bin».

Затем вас попросят ввести LDV; просто введите любое число от 1 до 80 и нажмите «ОК».

На этом этапе фиктивное изображение должно быть успешно создано и автоматически загружено в раздел "Загрузить источник".

Теперь, когда программатор NAND правильно подключен к вашему компьютеру и материнской плате, нажмите кнопку "Записать NAND".

Дождитесь, пока J-Runner завершит запись в NAND, выберите тип взлома, затем нажмите «Создать ECC» для машины RGH или «Создать Xell-Reloaded» для машины JTAG/R-JTAG.

Теперь нажмите «Записать ECC» или «Записать Xell-Reloaded» в зависимости от типа вашего взлома[SIZE=11pt].[/SIZE]

Теперь вы готовы загрузить Xell и восстановить ключ процессора.

Отсоедините провода NAND от программатора NAND, включите консоль и дождитесь загрузки Xell.
После
загрузки Xell запишите ключ процессора, коды предохранителей 02 и 07/08.

Понимание и расчет LDV

Расчет значения блокировки CF/CG довольно прост. Достаточно посчитать количество символов "F" в блоке предохранителей от 07 до 11. Таким образом, в приведенном выше примере значение блокировки CF/CG равно 2.

Расчет CB LDV может быть немного сложнее. Необходимо взять крайнюю правую букву «F» и вычислить, на сколько символов она находится слева. В приведенном выше примере крайняя правая буква «F» находится на расстоянии 5 символов слева, поэтому значение блокировки CB равно 5.

[SIZE=11pt]Понимание CB LDV; Цитата от Мартина С. @ TX[/SIZE]

Приведенный выше пример взят из Jasper с параметром cb ldv cseq равным 5. Помните, что это значение можно перевести в версию панели управления. Таким образом, взглянув на приведенную ниже диаграмму, мы можем определить, что панель управления 7371 будет самой совместимой версией для этой конкретной консоли.

[SIZE=x-large]Шаг 2; Создание поддельного образа NAND OG[/SIZE]

Теперь вернитесь в J-Runner и введите ключ процессора в соответствующем поле.

Выберите панель управления в соответствии с вашей материнской платой LDV cseq.

Выберите Retail в качестве типа образа.

Выберите тип NAND материнской платы.

Перейдите на вкладку «Дополнительно» и выберите «Создать образ без nanddump.bin».

Вам будет предложено ввести LDV, это LDV типа cf/cg, поэтому введите то, что у вас есть в блоке предохранителей 07/08, и нажмите «ОК».

Вы создали поддельный оригинальный образ NAND. Хотя вы не сможете загрузить консоль с этим образом, всё же рекомендуется хранить его в безопасном месте.

После загрузки нового образа в разделе «Загрузить источник» и ввода ключа ЦП в разделе «Ключ ЦП», перейдите на вкладку «Информация о kv». Вы заметите, что информация там явно не с вашей консоли. Поэтому сейчас самое время, если есть возможность, извлечь ключ с DVD-привода и пропатчить хранилище ключей соответствующим ключом DVD.

Перейдите на вкладку «Настройки XB», затем нажмите «Расширенные параметры XeBuild», вставьте свой ключ DVD в поле «dvdkey», нажмите «ОК», а затем установите флажок «Использовать отредактированные параметры».

Для владельцев DG16D5S и DLN10N самый простой и дешевый способ заставить ваш DVD-привод работать — это установить плату TX LTU 2.

Заключительная часть; Создание/запись взломанного образа.

Вернувшись в J-Runner, загрузите новый поддельный оригинальный образ NAND в разделе "Load Source" и ключ CPU в разделе "CPU Key", выберите тип образа взлома (Jtag - rgh - rgh2 - r-jtag), выберите желаемую панель управления (она должна быть последней, на данный момент это 17150), выберите тип NAND материнской платы. На этом этапе вы также можете редактировать параметры dashlaunch и xeBuild.

Нажмите «Создать образ xeBuild». Вы увидите 3 или 4 предупреждающих сообщения с вопросом, хотите ли вы удалить файлы kv.bin, smc.bin, fcrt.bin и smc_config.bin. Нажмите «Да» для всех из них.

Правильно подключив программатор NAND к консоли и компьютеру, нажмите кнопку "Записать NAND".

Отсоедините провода NAND, загрузите консоль и наслаждайтесь.

Если это руководство вам чем-то помогло, или если вы просто скачали извлеченные файлы NAND, пожалуйста, нажмите кнопку «Нравится» и поставьте «Спасибо».
Click to expand...

Sockrat · Apr 19, 2026

очень интересно

Log in or Sign up

[JTAG/RGH] How to build a hacked NAND image from scratch.

SouthParkModding Rookie

5/47

4229Brayden Newbie

5/47

elmaazoon Newbie

5/47

TheDarkDarkDarkness Newbie

5/47

bigkid72 Newbie

5/47

uuzt Newbie

5/47

Robbase Rookie

15/47

dynastybush Newbie

5/47

ardopermana Newbie

5/47

LeeNP Newbie

5/47

mr420 rgh Newbie

5/47

darviral Rookie

10/47

Nothingizcooler Newbie

5/47

veli koç Newbie

5/47

Attached Files:

MVIMG_20260401_095936.jpg

veli koç Newbie

5/47

Attached Files:

MVIMG_20260401_095936.jpg

MVIMG_20260401_102639.jpg

Sockrat Newbie

5/47

Sockrat Newbie

5/47

Share This Page

Forums

Log in or Sign up

[JTAG/RGH] How to build a hacked NAND image from scratch.

SouthParkModding Rookie 5/47

4229Brayden Newbie 5/47

elmaazoon Newbie 5/47

TheDarkDarkDarkness Newbie 5/47

bigkid72 Newbie 5/47

uuzt Newbie 5/47

Robbase Rookie 15/47

dynastybush Newbie 5/47

ardopermana Newbie 5/47

LeeNP Newbie 5/47

mr420 rgh Newbie 5/47

darviral Rookie 10/47

Nothingizcooler Newbie 5/47

veli koç Newbie 5/47

Attached Files:

MVIMG_20260401_095936.jpg

veli koç Newbie 5/47

Attached Files:

MVIMG_20260401_095936.jpg

MVIMG_20260401_102639.jpg

Sockrat Newbie 5/47

Sockrat Newbie 5/47

Share This Page

Useful Searches

SouthParkModding Rookie

5/47

4229Brayden Newbie

5/47

elmaazoon Newbie

5/47

TheDarkDarkDarkness Newbie

5/47

bigkid72 Newbie

5/47

uuzt Newbie

5/47

Robbase Rookie

15/47

dynastybush Newbie

5/47

ardopermana Newbie

5/47

LeeNP Newbie

5/47

mr420 rgh Newbie

5/47

darviral Rookie

10/47

Nothingizcooler Newbie

5/47

veli koç Newbie

5/47

veli koç Newbie

5/47

Sockrat Newbie

5/47

Sockrat Newbie

5/47