J-Runner (basic guide) v3 build 1

J-Runner is a GUI that uses Xebuild, Xell-reloaded (full credit to their authors). Python has been replaced with
code within the GUI. It Enables JTAG, Glitch & Retail images to be created. Nandpro is NOT required nor used.

J-Runner has been designed to be used with Nand-X / JR-Programmer and T-X CoolRunner (if doing glitch
hack).

J-Runner relies on the fact you have already soldered in your CoolRunner or JTAG wiring – there are plenty of
diagrams available online and within J-Runner to achieve this correctly. In addition you should already have
installed your drivers for Nand-X / JR-Programmer and have it connected to both your motherboard and
CoolRunner(if doing Glitch Hack).

Upon the first run of J-Runner it will automatically check that it is the latest version and ensure all the required
files are correct (and download if required if File Downloads are enabled in settings).

J-Runner is designed to be simple and intuitive:

The process runs from left to right (Glitch Selected)

And the same for JTAG (Obviously Flashing CoolRunner is not used)
1. Read Nand:
The default is set to 2 dumps – this will automatically dump the nand 2 times then compare the dumps to
ensure they are the same! (number of dumps is selectable in number box)

2. Create ECC: / Create Xell-Reloaded:

This uses the nanddump1.bin that is loaded in source box! It creates the file you need to flash to your nand –
this contains Xell-Reloaded and the glitch info(or Xell-Reloaded file with your keyvault) to allow you to boot
your console to Xell-Reloaded and obtain your key. It then loads that file into Source box ready for writing.

3. Write ECC: / Write Xell-Reloaded:

Does what it says on the tin – writes the ECC/Xell-Reloaded file you created to your nand. Once written,
remove power cable then re-plug and boot your console (fingers crossed) it will boot into xell-reloaded. This
allows you to obtain your CPU Key (I suggest you open notepad and type it into that then save it as cpukey.txt
– if you are not using network cable to grab your key.)

4. Program CoolRunner: (not required for JTAG, R-JTAG, CR3 Pro)

This is a simple as it sounds, it flashes your coolrunner with the required file. (CR3 Pro and R-JTAG are pre-
programmed and should not be written to) although no longer directly in the line of operations – Its not a
nand function so was moved below the line of buttons. In addition more and more hacks are not requiring an
XSVF to be programmed by the user. So it has been moved on the GUI. However for Coolrunners that do
require programming – it’s required before attempting to boot your console to Xell to obtain console details.

5. Create Image:
This requires your nanddump1.bin to be reloaded into the source box. As well as the cpukey pasted/loaded
into the CPU Key Box. If you have the correct key then the information should be displayed on the right hand
boxes.

6. Write Image:
This writes the bin file you have loaded into the source box to your nand.

Image selections
During creation of your final images You select what type of image you are trying to create JTAG (with option
for R-JTAG), Glitch or Retail. Also which dashboard you wish to flash. Changing these buttons alters the option
available to you!

Aud_Clamp selection is also available for JTAG images

Glitch2M is a new option in XeBuild for Trinity / Corona on 16203+ dashes only
Xebuild Options
All the available options in Xebuild can be set here, this is for advanced users! Don’t change things you don’t
know what it does!

NOTE: Shouldn’t be used when Using Update Mode or Client Mode in Xebuild
Menu’s explained (updated for v3 build 1)

Tools:

Restart: Restarts the app (it’s nice to start things from fresh)

Extract Files: Extract a load of files – required for different things including CB’s, KV.bin, SMC_config, SMC
etc (these extract into working folder in a folder of their own based on serial or given name)

SMC Config Editor: allows you to edit the config of SMC of any nand loaded into source.

XValue: yep the old XVal program – opens a window to input console serial and the X-value from console
system settings. (proven to be unreliable as a means of checking if your console is banned – but interesting
none the less)

Check Secdata: checks your nands’ secdata and reports a full breakdown of the values listed.

Monitor POST: Does what it says on the tin (used for monitoring Power-On Self-Test - requires additional HW,
google it)
Update JR-P fw: If you need to reprogram the JR-P, select bootloader update switch, press this! While
its updating switch the update switch back to off

Hex Editor: allows you to view the loaded file as hex (editing ability using CTRL F2)

Images:

Here you have handy reference pictures for wiring your JTAG/RGH

Advanced Menu:
Custom Nand/CR Functions:

From here you can write/read/erase nand tailoring specific blocks to start and block length etc and flash
custom xsvf files

Custom XeBuild Command:

If you don’t know how to use XeBuild on its own – don’t touch this!

Corona 4GB Read/Write:

This gives you free reign to read, write and erase to your 4GB nand, Use with caution.

Demon/Fusion Write (remaps bad blocks): This function is only useful when you have a created an image
with noremap and want to write it to console, it will remap the bad blocks automatically. Disclaimer! It’s not
recommended whatsoever to use this function with an image that has already remapped blocks, if you don’t
know that, we suggest you don’t use it.
Change Lock Down Value: If you have to alter your LDV simply select this option the LDV boxes on nand info
tab become editable, alter one of them and return to this menu to confirm it.

Patch Nand: If I need to explain this – you shouldn’t be using it! A somewhat deprecated function. Its use is
mostly to change the contents of kv.bin like region, dvdkey, serial, osig and Console ID

Create an image without nanddump.bin: A rather nice feature. If you have carelessly ended up with ecc on
your console and no stock nand! –EEK!

You need a KV.bin(rename kv_en.bin after an extract from ecc file), SMC.bin(rename SMC_en.bin from an
extract), SMC_config.bin placed into Xebuild/data/ folder then enter your CPUKey into CPUKey box. Choose
your dash and image type then select this option from menu.

Get Latest SystemUpdate: It will download the latest system update from Microsoft, and extract it on the
xeBuild/[Version] folder, if that folder exists, for xebuild use. Before you use this ensure that you add the latest
dash to dash files first (this will create your “xeBuild/[Version] folder”).
Settings:
J-Runner now has some audible indication of things happening. It has some default embedded sounds for
nand write/read complete, nand compare success and a failure sound! If you are not a fan of these sounds –
you can set your own .wav files to play upon these 3 events from the settings menu on the toolbar.

Sonus360 Delay: if you experience lag whilst writing to the sonus try adding incrementing this Delay setting
by 1 at a time.

IP: The saved address to grab key from Xell.

IP Ranges: The “to and from” IP range to use Scan IP Range Button on main form

XeBuild Image Name: choose the output name of the image (in case you want to use xenon.elf etc)

Enable/Disable Filechecks: Checked is default to allow J-Runner to check all the files against its records and
downloads any required.

Auto Extract Files from nands: This setting will extract the files such as KV.bin, fcrt.bin, C-R.bin to a folder
within your output folder named according to console serial or if you have Unique Name setting as well
according to that. This should prevent any additional files becoming mixed up with other consoles if you have
been working on other consoles and left files in the output folder.

Only Move Nand/Files upon first CPU Key entry: If selected this will prevent J-Runner moving files you are
working on to their respective serial folders, everytime you load a nand whose key is already in the db.
(probably better with this selected – selected by default)

Use Unique name instead of Console Type in Db : This is for those who wish to use their own identifier instead
of console type in CPU Key Db. If this is selected – everytime you press read nand , you will be asked for a

unique name.

This in turn will be used in place of console type in the database and your Extracted files folder will use the
name also. E.g. Extracted-uniquename.
CPU Key Database
There is a Key database included in J-Runner this is automatically populated during the process and will store
your key against console serial number. Next time you load that nand into sourcebox the key will auto
populate from the database!

“Scan Folders”: press this and point to the folders you’d like to scan, it searches for keys and nands and add
them to your database (once checking they match of course)

Another new addition is the ability to use console type as a unique ID, you can manually right click on a row
and select edit or you can use Unique name setting in settings page and JR will ask for a name at the start of a
Read Nand and use that when adding to the database.

If you double click a row – your cpu key will be loaded into cpukey box on mainform – pressing load source
button after that should open the console serial folder that nand is kept in (providing you haven’t moved it in
relation to the application.exe)

Making finding previous nands simple.

Quick Key Functions

F1 - Restarts the application

F2 - Grabs the Config from the Nand (identify the nand)

F9 - check source file against cpukeydb

F12 - Forces a re-download of the application.

Read Nand:
The default is 2 reads (this is to allow comparison to ensure you have a good dump)

Ensure you have Nand-X or JR-Programmer all connected with drivers installed. Board plugged in but not
powered on, then press the Read Nand button,

J-Runner will check the nand type upon starting read it will select the correct nand for you. The choice you
make here will be displayed in the text box on app and remain until you manually alter it by clicking on textbox
itself or restart the app or manually load a file into source.

Nand read is initialized and begins the first dump.

NOTE: For Big Block Jaspers you have 3 options (selected board only = 64mb Dumps, 2mb Dumps(only if advanced
selected) or Full Dumps)

NOTE: For 4GB Corona Consoles – an additional panel will temporarily replace nand info until you select
close (on its panel)

Once complete the second dump begins automatically.

Upon both dumps being auto loaded into GUI for automatic comparison.

Look in the log for the comparison result

With “Glitch” - Selected
Flash CoolRunner
At this point you should Flash the CoolRunner with relevant file

Press the Program Coolrunner button

You can also use LPT cable Programmer to program your CoolRunner
Create ECC
At this point press the create ECC button you should see a whole load of text appear in the log file.

Look at the log and ensure there are no error messages

NOTE: If you have bad blocks in the first 50 blocks, J-Runner will remap these for you and create a fixed file
from which to create the ECC file.

The created image is now loaded into the source box ready for writing

At this point there have still been no changes made to your nand
Write ECC
You now have to write the Xell-reloaded image with ECC data for your nand.

Press write ECC

You will then see this (or similar)

Once finished

Unplug power cord, wait 10 seconds or so, replug it and boot the console

With any luck you should see Xell-reloaded on your screen

Once fully loaded

Open notepad on your PC and type in the cpu key (at bottom of screen) then save the file as cpukey.txt (or you
can use Http

Then copy your key and paste into the CPU Key box in J-Runner.

If you network the Xbox to your router and connect to the address shown at the bottom of the screen – you
can then use the grab CPU Key function just enter the digits shown on the screen for the IP address.

For Corona motherboards Xell prior to 0.92 will not display video so you can use either “Scan IP Range” (This
will scan the range you set in the Settings page and grab the CPUKey if it finds your Xbox running Xell) or
“Monitor COM” (monitor com – explained HERE)

J-Runner will then reload your nanddump1.bin into source box again in preparation of key validation and
image creation

Now you should have all the info in KV tab on the right hand box and you will get a CPU Key verified message
in the log!

The log will also show your current LDV value of console!
At this point you now have all the info you need to create a Freeboot image.

Shutdown the Xbox and proceed

With “JTAG” Selected

Flash CoolRunner
This Button is NOT USED as part of JTAG HACK – AS SUCH IS DISABLED - IGNORE IT

IF DOING R-JTAG ENSURE YOU HAVE THE OPTION BOX TICKED

Create Xell-Reloaded
At this point press the Create Xell-Reloaded button

You should see a text appear in the log file.

Look at this and ensure there are no error messages

The created image is now loaded into the source box ready for writing

At this point there have still been no changes made to your nand

Write Xell-Reloaded
You now have to write the Xell-Reloaded image with your data to your nand.

Press write Xell-Reloaded

You will then see this

Once finished

Unplug power cord, wait 10 seconds or so, replug it and boot the console

With any luck you should see Xell-Reloaded on your screen

Once fully loaded

Open notepad on your PC and type in the cpu key (at bottom of screen) then save the file as cpukey.txt

Then copy your key and paste into the CPUKey box in J-Runner.

(If you have your Xbox connected with network cable – use Grab CPU Key function or you can use either “Scan
IP Range” (This will scan the range you set in the Settings page and grab the CPUKey if it finds your Xbox
running Xell) or “Monitor COM” (monitor com – explained HERE))

Then J-Runner will reload your original nanddump1.bin into source box again
Now you should have all the info in kv tab on right hand box ( if CPU key is correct) and you will get a “CPU Key
verified” message in the log!

The log will also show your current LDV value of console!

At this point you now have all the info you need to create a Freeboot image.

Shutdown the Xbox and proceed

Create Image:
You have to reloaded you original nand dump back into source box and have pasted in your cpu key.

At this point you need to decide if you want dashlaunch installed

There is a dashlaunch configurator included in J-Runner, if you want to include Dashlaunch remember to tick
DL Patches

Click the launch.ini Options Button

Configure each option as you wish. I have selected the default boot of Freestyle Dash from a USB stick (naming
the freestyle folder as FSD)

You can save the settings for future use (becomes the default ini). But click create to save your file for this
image.

Exit the window.

Patching Xebuild:
There are several patches available to use and can be found on the XeBuild Settings Tab

Advanced options are also available within this tab. (for experienced users)

Now click Create XeBuild Image Button

You should now be faced with something in log like this

all your files from this hack are saved in a folder (console serial number)

You now have 2 options to flash this image to your Nand

You can either press Write Nand

Or you can copy the updflash.bin to a USB stick – put into xbox and boot it!
Write Nand
Is as simple as it sounds

Press the button and Nand write will start

Once finished flashing

Unplug power for a few seconds

At this point I plugged in my USB with Freestyle Dash folder (\FSD)

Then replug and boot it.

Using Xebuild to update your Console:
New XeBuild has some exciting new features – J-runner has been changed to reflect these.

Dashlaunch updsver is required to be running on your xbox to make use of these. A standalone version of this
has been released also (throw its default.xex on a FAT32 USB stick and boot your console)

You can update your current RGH/JTAG over LAN

Its incredibly quick and easy to do.

Please ensure you added current dash to dash files, downloaded system update from advanced menu before
using this updater

The patches in settings tab are included in settings for this.

The updater grabs your data from console, creates new nand and writes it and avatar and Kinect data to your
console.

Client Mode has a lot more selectable options

For more detailed info regarding these functions read the release notes for XeBuild

http://www.xbins.org/nfo.php?file=xboxnfo2323.nfo

These functions should be used with caution.

DemoN Usage
J-Runner has now integrated DemoN commands to enable full control of the Team Xecuter DemoN from
within J-Runner.

With Demon attached using USB (and driver installed) the DemoN icon will appear and the demon details will
appear at bottom right of screen.

(Screenshot from earlier version – operation is the same)

Mode: shows up as bootloader if the DemoN has no firmware installed.

FW: Displays Current firmware/bootloader version (will not show up if in bootloader mode)

Flash: This displays the nand that is selected at time of DemoN detection or Toggle-Nand function is used.

NOTE: If you swap nands manually using switch on console whilst J-Runner is running this display will not change – J-Runner will
warn you if you select a nand function and the nand has been switched manually!

DemoN Menu
When DemoN is detected a new menu will appear that relates purely to DemoN functions.
Toggle NAND: To switch nand between the one on DemoN and the one on the Xbox360 use Toggle NAND
menu selection. Upon toggling the currently selected nand will be displayed on bottom bar and in the log
window.

The Power On and Power Off function : only works if you have the optional wire connected for
remote power. This enables you to power the xbox on and off!

Update DemoN: this allows you to update the firmware on the DemoN. Just select this and select the
firmware file.

All Read, Write and flash CoolRunner functions operate as normal within J-Runner using DemoN instead of
Nand-X or J-R Programmer when DemoN is connected using USB. (so expect nand functions to occur a lot
faster!)
Monitor COM
This feature allows you to see what’s displayed on screen during booting of Xell.

To use the COM Port you must have additional wiring and Hardware to use this feature. Use an old DVD Drive
power connector and utilize the wiring as shown below. Then just connect a CK3i or X360USBPro V2 or even a
CK3 Pro RevD with the additional wire (same set up for upgrading Nand-x to ARM 3). Slim points shown below

For CK3i/X360USBPRO V2/CK3 Ver D (with wire)

To use simply open port and boot Xell-Reloaded! Xell output will be displayed in window!
Nand-X USB Update Cable

Credit for
Picture “xslvry” (TX Forums)
HOW-TO Create a Nand from CPUkey and files

Create an image without nanddump.bin

What you’ll need:

 your cpukey – that’s crucial and unique

 kv.bin – encrypted or not
 smc.bin – encrypted or not
 smc_config.bin
 read your nand (even though it contains ECC in first 50 blocks) (if you don’t have the files above)

You can get those files using the Extract Files option

load as source then select Extract from the tools menu

Look in Output/Extracted-serial or Extracted-Uniquename folder

First, copy those on files on the xebuild/data folder, if you haven’t copied them, J-Runner will open the folder
for you to copy them.
Copy the cpukey in the cpukey section Select the Dash Version you want

Select the type of hack you want – rgh, jtag or retail

Press Advanced -> Create image without nanddump.bin

You need to select mobo type

You will be asked for LDV, you can find the current one by booting to xell

Your nand will be created and saved into folder

HOW-TO Change Lock down value

Load Nand and cpu key

Choose a dash version, nand type, and type of image you want (retail, glitch, jtag)

On advanced menu click Change Lock Down Value

Now enter the new lockdown value you wish

Programmer’s note: When you get the cpu key via Ethernet, current ldv will be mentioned in log

and simply create an image as usual (New LDV will be used during build)
HOW-TO deal with BadBlocks

In simple terms –

J-Runner is fully automated in dealing with badblocks!

So use J-Runner as normal – don’t mess with the files or the process – it’s all taken care of!

To help you understand;

J-Runner remaps bad blocks only when:

1. Comparing the nands
2. It initializes the nand
3. Creates ECC

those 3 DO NOT have any effect at all on the nand files or the console!

The actual bad block handling is happening when JR is writing ECC, where the blocks are remapped on console!

Remember bad blocks are not always bad, they're normal and common when hardware is involved. They are
just areas of memory where the console has had issues writing to in the past.
Also remapped blocks don’t always exist. So don’t panic

In short if there is bad blocks – J-Runner will deal with them whilst writing the ECC to the console. If you then
use the same dump (the dump is never altered by J-Runner) then xebuild handles the bad blocks when
creating an image. J-Runner then mearly writes that image as normal.

So Bad-Blocks (proper ones, not bad soldering and getting badblocks reported on every block) how do you deal
with them?

You don’t! J-Runner and XeBuild do!

Be aware of them but continue as normal!

What is Building a New Bootloader Chain?

Essentially this is building an ECC file for RGH2 whilst using a RGH1 Nand with the CPUKey!

It’s that simple!

So if you have a RGH1 Nand and the CPUKey and you want to experiment and try RGH2 without updating your
console to Stock Nand beyond RGH1 ability. This is the way to do it.!

I hope this clears things up.

HOW-TO Create Custom Sounds with SonuS
SonuS requires sound files to be .wav in a certain format to be able to create .bins from them then combines
those .bin to make a final .bin ready for writing to the console.

So to get your wav file in the correct format, you need to do a little editing.

Your final bin file size is also limited to 44k so you can’t use a full music score as wav file and expect it to work.
Dependant on your selection you end up with 2 or 3 sounds within your allowable 44k, so keep your files as
small as possible to start with.

To edit your sound file – it’s suggested you use “Audacity” it’s a free sound editor that produces the sound to
the correct format

So open your sound file with Audacity

Then set your project rate to 8000

Then you can maximise your volume level using “Effect>Amplify”

Don’t amplify too much as will start to clip the peak points
4 seconds is quite long so you can play around and clip the length of the sound

Once you finished editing length and volume (smaller size is better)

You then “Export” the file

You now have a wav file in the correct format ready to be used !

Do the same for the next sound/s you wish to use.

Then in SonuS Editor load your files into the appropriate boxes (Start/Eject/Glitch)
Then press Convert .wav button.

This converts your wavs to .bin ready for creating final bin file

You can see the new .bin files have been loaded ready to create final files

Upon pressing Create .bin if the combined filesize is too big you will see something like this

You then need to edit your wavs even further to make the file sizes smaller or choose alternate
sounds/combinations

Reload them and press Convert .wav again then Create .bin
Wav’s converted now press Create .bin

Now you can write it and test it out!

NOTE: If wishing to use the Glitch Sound option you are required to wire a single wire from sonus(Shown
below) to ROL point on CR (JR-Programmer must also be disconnected from SonuS to allow the glitch sound to
play)

Also a very short sound file is suggested to be used for Glitch noise.

For Glitch Sound - a single wire goes from point shown to ROL point on CR3