NOTES: I AM NOT RESPONSIBLE FOR ANY DAMAGE DONE TO YOUR CONSOLE! PLEASE MAKE A NAND BACKUP AND HAVE AN EXTERNAL PROGRAMMER IN THE EVENT OF A BRICKED CONSOLE

PLEASE DO NOT SELL DOWNGRADED CONSOLES!

Please do not use this guide for any malicious or scammy behavior. I only want this guide to be used for personal projects/nostalgia.

THIS WILL NOT RE-ENABLE ANY PATCHED EXPLOITS LIKE THE JTAG EXPLOIT. THERE IS NO WAY TO DOWNGRADE CB TO RE-ENABLE THESE.

Thanks to everyone that made this possible:

grimdoomer: For the Bad Update exploit

InvoxiPlayGames: For the FreeMyXe project

MrMario2011: For the Bad Update tutorial

Octal450: For J-Runner with Extras

Jordan_1_Evo in the Xbox 360 Hub Discord server: For making me aware that this is possible

This guide assumes you have an Xbox 360 console running the latest dashboard version (2.0.17559.0) that can run homebrew applications with BadUpdate. If you do not know how to exploit with BadUpdate, here are some resources to get you started:

How to Run the Xbox 360 Hypervisor Exploit with a Free Demo - Bad Update Setup! from MrMario2011

grimdoomer/Xbox360BadUpdate

This guide was tested with a Xenon console downgraded to 2.0.6717 with CB 1928 as well as a Trinity downgraded to 2.0.9199.0 with CB 9231. The Xenon booted, the Trinity didn't. Your results may vary.

Step 1: Making a NAND Backup

Make a NAND backup! Not only will it benefit you in the case of a brick, but it will also help you in the process of building a new, downgraded NAND.

Follow the MrMario2011 Bad Update guide linked here. He explains everything better than me :P

Step 2: Modifying a NAND backup

Connect the USB device you used for Bad Update into your computer. Locate the folder containing Simple 360 NAND flasher and copy flashdmp.bin and cpukey.txt somewhere safe.

Download the latest version of J-Runner with Extras and extract it. Open JRunner.exe. Once it has loaded, find the Load button and locate your NAND backup. Your CPU key and console information should automatically show up. (If your CPU key does not automatically show up, open the cpukey.txt file that you copied earlier and paste the CPU key from that into J-Runner.)

On the right side of J-Runner, you should see the tab Bootloaders and SMC. Look for Console and CB_A and take note of the entire number that shows up. This is important. Make sure you have the correct number, otherwise you could brick your system. Now, close J-Runner.

In the J-Runner with Extras folder, navigate to xeBuild\17559 and open _retail.ini. Notepad will work fine for this. Using the Console and CB_A from earlier, use Ctrl+F and search for the CB_A you wrote down earlier. In my case, this was 1928. Go through all of the matching strings until you get to one that matches your console. In my case, this was Xenon

Copy the first 5 lines starting from [<your_console>bl_<your CB_A>]. Do not copy the cf_17559.bin or lower lines.

In the same file explorer window, go back to the xeBuild folder and go to the kernel you would like to downgrade to. 6717 is Blades. 9199 is NXE. 13604 is Kinect NXE.

For this example, I will be using 6717. Open the folder for the kernel you would like and open _retail.ini. Paste the 5 lines copied from earlier into the file after the version strings. Right below where you pasted the other lines, find the cf_6717 and cg_6717 strings (or whatever kernel version you have) and copy those. Paste them below the ce_1888.bin line and then save the ini file.

Open J-Runner and load your NAND backup again. In the XeBuild box (top right corner) select the kernel version you want to downgrade to, then select Retail. In the CB box, the CB version you added earlier should appear. If it doesn't, ensure the changes you made earlier are correct.

After selecting everything, press the Create XeBuild button. Once XeBuild completes, press Show Working Folder under the Bootloaders and SMC box. You should now see a file explorer window containing important console information, including your updflash.bin file.

Step 3: Restoring a NAND backup

Using the USB drive from earlier, copy the updflash.bin file to the folder containg Simple 360 NAND Flasher. If you turned off or rebooted your console during this process, run Bad Update again. Open Simple 360 NAND Flasher and it should detect the NAND backup that is ready to flash. To ensure you have a functional NAND backup after flashing, press B to dump your NAND and write the new NAND.

Once it is complete, wait for the console to restart. You should now see the console booting into your new dashboard. You will be restricted to any hard drives, games, and accessories that are only supported on that kernel.

If you get 3 red lights, a red dot, or a green light without boot on your console, you might have done something wrong during the process or your CB does not support the kernel you were trying to go to. You will need to reflash your NAND using an external programmer.

Please comment any successful (or unsuccessful) downgrades with your console, kernel, and CB version :)