Downgrading to Older Kernels/Dashboards with Xbox 360 Bad Update

BadUpdateDowngrading.md

NOTES: I AM NOT RESPONSIBLE FOR ANY DAMAGE DONE TO YOUR CONSOLE! PLEASE MAKE A NAND BACKUP AND HAVE AN EXTERNAL PROGRAMMER IN THE EVENT OF A BRICKED CONSOLE

PLEASE DO NOT SELL DOWNGRADED CONSOLES!

Please do not use this guide for any malicious or scammy behavior. I only want this guide to be used for personal projects/nostalgia.

THIS WILL NOT RE-ENABLE ANY PATCHED EXPLOITS LIKE THE JTAG EXPLOIT. THERE IS NO WAY TO DOWNGRADE CB TO RE-ENABLE THESE.

Thanks to everyone that made this possible:

grimdoomer: For the Bad Update exploit

InvoxiPlayGames: For the FreeMyXe project

MrMario2011: For the Bad Update tutorial

Octal450: For J-Runner with Extras

Jordan_1_Evo in the Xbox 360 Hub Discord server: For making me aware that this is possible

This guide assumes you have an Xbox 360 console running the latest dashboard version (2.0.17559.0) that can run homebrew applications with BadUpdate. If you do not know how to exploit with BadUpdate, here are some resources to get you started:

How to Run the Xbox 360 Hypervisor Exploit with a Free Demo - Bad Update Setup! from MrMario2011

grimdoomer/Xbox360BadUpdate

This guide was tested with a Xenon console downgraded to 2.0.6717 with CB 1928 as well as a Trinity downgraded to 2.0.9199.0 with CB 9231. The Xenon booted, the Trinity didn't. Your results may vary.

Step 1: Making a NAND Backup

Make a NAND backup! Not only will it benefit you in the case of a brick, but it will also help you in the process of building a new, downgraded NAND.

Follow the MrMario2011 Bad Update guide linked here. He explains everything better than me :P

Step 2: Modifying a NAND backup

Connect the USB device you used for Bad Update into your computer. Locate the folder containing Simple 360 NAND flasher and copy flashdmp.bin and cpukey.txt somewhere safe.

Download the latest version of J-Runner with Extras and extract it. Open JRunner.exe. Once it has loaded, find the Load button and locate your NAND backup. Your CPU key and console information should automatically show up. (If your CPU key does not automatically show up, open the cpukey.txt file that you copied earlier and paste the CPU key from that into J-Runner.)

On the right side of J-Runner, you should see the tab Bootloaders and SMC. Look for Console and CB_A and take note of the entire number that shows up. This is important. Make sure you have the correct number, otherwise you could brick your system. Now, close J-Runner.

In the J-Runner with Extras folder, navigate to xeBuild\17559 and open _retail.ini. Notepad will work fine for this. Using the Console and CB_A from earlier, use Ctrl+F and search for the CB_A you wrote down earlier. In my case, this was 1928. Go through all of the matching strings until you get to one that matches your console. In my case, this was Xenon

Copy the first 5 lines starting from [<your_console>bl_<your CB_A>]. Do not copy the cf_17559.bin or lower lines.

In the same file explorer window, go back to the xeBuild folder and go to the kernel you would like to downgrade to. 6717 is Blades. 9199 is NXE. 13604 is Kinect NXE.

For this example, I will be using 6717. Open the folder for the kernel you would like and open _retail.ini. Paste the 5 lines copied from earlier into the file after the version strings. Right below where you pasted the other lines, find the cf_6717 and cg_6717 strings (or whatever kernel version you have) and copy those. Paste them below the ce_1888.bin line and then save the ini file.

Open J-Runner and load your NAND backup again. In the XeBuild box (top right corner) select the kernel version you want to downgrade to, then select Retail. In the CB box, the CB version you added earlier should appear. If it doesn't, ensure the changes you made earlier are correct.

After selecting everything, press the Create XeBuild button. Once XeBuild completes, press Show Working Folder under the Bootloaders and SMC box. You should now see a file explorer window containing important console information, including your updflash.bin file.

Step 3: Restoring a NAND backup

Using the USB drive from earlier, copy the updflash.bin file to the folder containg Simple 360 NAND Flasher. If you turned off or rebooted your console during this process, run Bad Update again. Open Simple 360 NAND Flasher and it should detect the NAND backup that is ready to flash. To ensure you have a functional NAND backup after flashing, press B to dump your NAND and write the new NAND.

Once it is complete, wait for the console to restart. You should now see the console booting into your new dashboard. You will be restricted to any hard drives, games, and accessories that are only supported on that kernel.

If you get 3 red lights, a red dot, or a green light without boot on your console, you might have done something wrong during the process or your CB does not support the kernel you were trying to go to. You will need to reflash your NAND using an external programmer.

Please comment any successful (or unsuccessful) downgrades with your console, kernel, and CB version :)

I have a Trinity Slim from April 2011, I assume that wouldn't work with 9199 NXE right? Asking before I try, I have no NAND programmers on hand.

I have a Trinity Slim from April 2011, I assume that wouldn't work with 9199 NXE right? Asking before I try, I have no NAND programmers on hand.

i tried with a trinity from June 2010 and it didn't work

I have a Trinity Slim from April 2011, I assume that wouldn't work with 9199 NXE right? Asking before I try, I have no NAND programmers on hand.

i tried with a trinity from June 2010 and it didn't work

Dang, thanks for telling me your result first though

Update 10/11/25 I've since done more research, and I believe I can definitively say which consoles can run what dashboards. 2.0.1888-2.0.2857: MOSTLY WORKS (on Y1 consoles), DOES NOT BOOT. I could be wrong about 2857 on Rheas, but all of these dashboards require a Y1 GPU, otherwise the console will throw an E78. From what I hear though, if you do have a Y1 unit, they should work, though 1888 will require some additional patches.

2.0.2858: MOSTLY WORKS. I don't think this will boot on anything newer than a Rhea, but reliable consoles with Rhea and Elpis GPUs are plentiful, and they will boot this dashboard. I believe this is also the first dashboard that will boot Gears of War, so it's the oldest dashboard that I'd seriously try to use. This dashboard requires you to reflash your DVD drive to a pre-XGD3 drive firmware if you're downgrading a console that has a newer drive firmware, so beware of that. I recommend iXtreme 1.1 if you don't want to use a stock firmware.

2.0.4532-2.0.4548: DOES NOT BOOT. I didn't bother testing these because it's known already that these two kernels specifically don't work. Microsoft patched the JTAG exploit by blacklisting these kernels in updated bootloaders, therefore you can't use them.

2.0.4552-2.0.6770: MOSTLY WORKS. Also yes, 2.0.6770 is a real version of the blades dashboard. As I noted previously, all of these kernels will throw an E66 error if you try to boot them on a console with a DVD drive firmware after XGD3's implementation, which happened with the 2.0.13146 update. The easiest solution is to remove the DVD drive, however you can also flash the DVD drive with a pre-XGD3 firmware, and it will actually read games (so long as you flash the correct DVD key, obviously).

2.0.7357-2.0.7371: MOSTLY WORKS. Out of these three dashboards, I only tried 7371, and it was able to boot with the same issues as the Blades kernels. The solution is also the same for these dashboards, I just noted them separately because this is where the NXE dashboards start.

2.0.8498: WORKS. I know, I was surprised too, but I didn't have any issues with booting this dashboard.

2.0.8955-2.0.9199: DOES NOT BOOT. I'll just repeat what I said last time: You can tell if you patched the correct CB or not by whether or not you get a general hardware failure with the secondary error code of 0022. 8498 was the system update that fixed the JTAG hack, but these kernels seem to have changed something that only allows you to boot them with patched but non-split CBs. Testing with consoles that have patched single CBs was pretty much inconclusive, but getting the CPU key on those consoles requires you to RGH the system anyway because nobody is brave enough to port badupdate to anything below 17559.

All Kinect Dashboards: DOES NOT BOOT. I tried every single version, none of them would even try to boot.

2.0.14699-2.0.15572: DOES NOT BOOT. 14699 was the last dashboard before phat consoles got split cbs (slims had them from day one). 14717-15572 had cbs that were unique to those dashboards, and I think they only boot on those cbs.

2.0.15574: WORKS. This dashboard was the first to use the current cb versions still present in 17559, and as a result, this dashboard under the hood is EXTREMELY similar to the current version. For most slim consoles, this is the lowest you can go, not sure what the case is with Winchester boards though if anyone is even considering downgrading those.

2.0.16197-2.0.16203: WORKS (probably). This is where Metro V2 dashboards start, I only tried 2.0.16203 though because it's the last old dashboard that's even slightly worth running, and it worked without any issues.

Hopefully this is a good reference for anyone looking to downgrade a burner system or something. I've tried to be somewhat all inclusive based on what I know, even if 6717 is the only dashboard anyone cares about, and I know that works on all phats. Please don't use this info to scam people.

I got a October 05 console on metro from 2015 it's got a 05 gdr in it can I downgrade to 1888
I sorta know what I'm doing I downgraded another xenon to 6717 without needing to flash the DVD

Successful on Falcon.

I should have looked into this more before hand but how can this be undone? I would like to get it back to the latest update.

Can I do this with a USB

yes

Don't work on version 2.0.17XXX shows boot animation but shows error 66 Edit:I took out the dvd drive and it booted just fine thanks!

Motherboard: Falcon
Manufacturers date: 10-30-2007
CB: 5774
Kernel: 15574
Sucessful downgrade! Also my hard drive retained all of its data without the need to reformat!
Edit: Only thing that does not work is the avatar editor, but otherwise works flawlessly!

@CooLtool4610 how did you get your falcon to downgrade to a kinect nxe dashboard? I tried to downgrade to kinect nxe on my falcon and it doesn't boot anymore.

@CooLtool4610 how did you get your falcon to downgrade to a kinect nxe dashboard? I tried to downgrade to kinect nxe on my falcon and it doesn't boot anymore.

I downgraded to 2.0.15574.0, which is metro V1. Downgrading to Kinect NXE results in a bricked console unfortunatley

I have a falcon xbox 360 with an mfg date of 10-30-2007 and dashboard 2.0.17559.0, can I downgrade my console to 7357 via this method without having to flash my dvd drive?

No, but you can downgrade to 8498 or 8507 (someone else tested that and it worked on their Xbox) and the newer drive firmware will work

How do you get 8498 kernel? It is not packaged with JRunner :(

Download the dashboard from digiex and you'll have to manually create an XeBuild for it.

can someone help me? I got 0022 always, tried with 6717 and 9199 with xenon 7378 and it doesnt work :(

Sounds like you're using the wrong CB, you have to use the same cb as your original nand dump, which is probably the post 15574 split cb. Check if you added the cb to your XeBuild and pick that one, you can copy most of it from 17559. Do be aware that 9199 still won't boot, but if you want NXE you can go up to 8507

would you happen to share those dashboards im having a tough time trying to find any. specifically 8498

@CooLtool4610 if I used a picoflasher to write my consoles original nand back would it work again?

glad i decided to be Ultra Sure i backed up my nand tried to NXE 9199 and it keeps going to an E 73. not that im upset iuts atm bricked, was one i picked up for 15$ just to yoink the DVD Drive (and it's Key /KV) but looks like i got some learning to do on sodering a Picoflasher. (Trinity Mfg date 01/25/2011) i'll take out the HDD for now and just use as USB for my RGH'd 4GB Trinity. ( i should really remove that 4GB Daughter card before it upends it.)

@CooLtool4610 if I used a picoflasher to write my consoles original nand back would it work again?

I would have no idea since I downgraded my console without installing a nand flasher.

@CooLtool4610 I bought a picoflasher today and its arriving tomorrow, ill let you know how it goes

Successful on Falcon.

I should have looked into this more before hand but how can this be undone? I would like to get it back to the latest update.

If you downgraded to 15574, you can update back to 17559 via xbox live, which is what I did.

I have a falcon xbox 360 with an mfg date of 10-30-2007 and dashboard 2.0.17559.0, can I downgrade my console to 7357 via this method without having to flash my dvd drive?

No, but you can downgrade to 8498 or 8507 (someone else tested that and it worked on their Xbox) and the newer drive firmware will work

How do you get 8498 kernel? It is not packaged with JRunner :(

Download the dashboard from digiex and you'll have to manually create an XeBuild for it.

can someone help me? I got 0022 always, tried with 6717 and 9199 with xenon 7378 and it doesnt work :(

Sounds like you're using the wrong CB, you have to use the same cb as your original nand dump, which is probably the post 15574 split cb. Check if you added the cb to your XeBuild and pick that one, you can copy most of it from 17559. Do be aware that 9199 still won't boot, but if you want NXE you can go up to 8507

would you happen to share those dashboards im having a tough time trying to find any. specifically 8498

Me too, can you please share the files for 8498 nxe with us?

Question, can I get avatars to work with nxe 8498? Or are avatars not working like 15574?