Downgrading to Older Kernels/Dashboards with Xbox 360 Bad Update

BadUpdateDowngrading.md

NOTES: I AM NOT RESPONSIBLE FOR ANY DAMAGE DONE TO YOUR CONSOLE! PLEASE MAKE A NAND BACKUP AND HAVE AN EXTERNAL PROGRAMMER IN THE EVENT OF A BRICKED CONSOLE

PLEASE DO NOT SELL DOWNGRADED CONSOLES!

Please do not use this guide for any malicious or scammy behavior. I only want this guide to be used for personal projects/nostalgia.

THIS WILL NOT RE-ENABLE ANY PATCHED EXPLOITS LIKE THE JTAG EXPLOIT. THERE IS NO WAY TO DOWNGRADE CB TO RE-ENABLE THESE.

Thanks to everyone that made this possible:

grimdoomer: For the Bad Update exploit

InvoxiPlayGames: For the FreeMyXe project

MrMario2011: For the Bad Update tutorial

Octal450: For J-Runner with Extras

Jordan_1_Evo in the Xbox 360 Hub Discord server: For making me aware that this is possible

This guide assumes you have an Xbox 360 console running the latest dashboard version (2.0.17559.0) that can run homebrew applications with BadUpdate. If you do not know how to exploit with BadUpdate, here are some resources to get you started:

How to Run the Xbox 360 Hypervisor Exploit with a Free Demo - Bad Update Setup! from MrMario2011

grimdoomer/Xbox360BadUpdate

This guide was tested with a Xenon console downgraded to 2.0.6717 with CB 1928 as well as a Trinity downgraded to 2.0.9199.0 with CB 9231. The Xenon booted, the Trinity didn't. Your results may vary.

Step 1: Making a NAND Backup

Make a NAND backup! Not only will it benefit you in the case of a brick, but it will also help you in the process of building a new, downgraded NAND.

Follow the MrMario2011 Bad Update guide linked here. He explains everything better than me :P

Step 2: Modifying a NAND backup

Connect the USB device you used for Bad Update into your computer. Locate the folder containing Simple 360 NAND flasher and copy flashdmp.bin and cpukey.txt somewhere safe.

Download the latest version of J-Runner with Extras and extract it. Open JRunner.exe. Once it has loaded, find the Load button and locate your NAND backup. Your CPU key and console information should automatically show up. (If your CPU key does not automatically show up, open the cpukey.txt file that you copied earlier and paste the CPU key from that into J-Runner.)

On the right side of J-Runner, you should see the tab Bootloaders and SMC. Look for Console and CB_A and take note of the entire number that shows up. This is important. Make sure you have the correct number, otherwise you could brick your system. Now, close J-Runner.

In the J-Runner with Extras folder, navigate to xeBuild\17559 and open _retail.ini. Notepad will work fine for this. Using the Console and CB_A from earlier, use Ctrl+F and search for the CB_A you wrote down earlier. In my case, this was 1928. Go through all of the matching strings until you get to one that matches your console. In my case, this was Xenon

Copy the first 5 lines starting from [<your_console>bl_<your CB_A>]. Do not copy the cf_17559.bin or lower lines.

In the same file explorer window, go back to the xeBuild folder and go to the kernel you would like to downgrade to. 6717 is Blades. 9199 is NXE. 13604 is Kinect NXE.

For this example, I will be using 6717. Open the folder for the kernel you would like and open _retail.ini. Paste the 5 lines copied from earlier into the file after the version strings. Right below where you pasted the other lines, find the cf_6717 and cg_6717 strings (or whatever kernel version you have) and copy those. Paste them below the ce_1888.bin line and then save the ini file.

Open J-Runner and load your NAND backup again. In the XeBuild box (top right corner) select the kernel version you want to downgrade to, then select Retail. In the CB box, the CB version you added earlier should appear. If it doesn't, ensure the changes you made earlier are correct.

After selecting everything, press the Create XeBuild button. Once XeBuild completes, press Show Working Folder under the Bootloaders and SMC box. You should now see a file explorer window containing important console information, including your updflash.bin file.

Step 3: Restoring a NAND backup

Using the USB drive from earlier, copy the updflash.bin file to the folder containg Simple 360 NAND Flasher. If you turned off or rebooted your console during this process, run Bad Update again. Open Simple 360 NAND Flasher and it should detect the NAND backup that is ready to flash. To ensure you have a functional NAND backup after flashing, press B to dump your NAND and write the new NAND.

Once it is complete, wait for the console to restart. You should now see the console booting into your new dashboard. You will be restricted to any hard drives, games, and accessories that are only supported on that kernel.

If you get 3 red lights, a red dot, or a green light without boot on your console, you might have done something wrong during the process or your CB does not support the kernel you were trying to go to. You will need to reflash your NAND using an external programmer.

Please comment any successful (or unsuccessful) downgrades with your console, kernel, and CB version :)

Also E66 after Flash on Zephyr 4569 on dashboard 6717.

Okay, after spending an entire day downgrading and nearly bricking my consoles dozens of times, here are my conclusions:

Console 1:
Xbox 360 Arcade from late 2009 (downgraded to 6717 and 7371 I didn't want to risk updating to 8498 or 8507)
Jasper Tonasket 512MB
CB: 6754

Console 2:
bolt modded and reflowed motherboard from an unfixed Falcon from 2007 (he was the guinea pig for all these tests)
CB: 5774

console 3:
4gb 2012 slim (downgraded to 15574)
CB: 13181

NO slim console will work with a dashboard below 15574 using this method

2.0.1888 - 2.0.4548 Does not work!
I believe it doesn't work because it uses a different hypervisor than the one currently in use.

2.0.4552.0 - 2.0.6690.0 It doesn't work, but it works? NOT RECOMENDED
These panels work on consoles prior to Jasper, but I believe they don't work on Jasper due to some incompatibility with the black southbridge. (PSB).

2.0.6717.0 - 2.0.6770.0 Works!
Works perfectly on all FAT consoles with less than 256MB of memory. On consoles with 512MB of RAM, it only recognizes 256MB.

2.0.7357.0 - 2.0.7371.0 Works!
Works perfectly on all fat consoles without any issues.

2.0.8498.0 - 2.0.8507.0 It doesn't work, but it works? NOT RECOMENDED
Okay, I found some very strange inconsistencies here. Updating my console from 7371 to 8498 and 8507 works perfectly, but flashing the NAND with these kernels does not work. There are no secondary errors, it just does not boot.

2.0.8498.0 - 2.0.14719.0 Does NOT work!
The console does not boot. Starting with 8498, Microsoft fixed the JTAG exploit and made the console work with split CBs.
downgraded consoles use an newer update of the split CBs, which is not compatible with the non-updated CBs, and the console does not boot.

2.0.15574.0 - 2.0.17559.0 Works!
Starting with 15574, the split CBs were updated and this new version of the CBS remained until the latest version of the console.
So these panels work normally.

Errors found on Older working Dashboards:

• Blades: On consoles with 512MB of internal memory, the system will only recognize 256MB of RAM instead of 512MB
• Blades/NXE: On consoles with the latest DVD firmware with the AP2.5 security update and XGD3 game support, an RROD Drive related error will occur when turning on.

@Halo2Disc There isn't a listing for a 16mb falcon 5774 in my _retail.ini for version 17559. what should I do to downgrade to 6717?

Replace the line of code in your retail.ini with this one:

[falconbl]
cba_5774.bin,53e96a15
cbb_5774.bin,0d13b810
cd_5774.bin,c677e4d4
ce_1888.bin,ff9b60df
cf_6717.bin,796c7a1f
cg_6717.bin,3180015f