Coldforest could bring a new hardware exploit to Xbox One

The original Xbox One has never been an easy machine to crack at hardware level. Microsoft built the console around a tightly controlled boot process, and for years that kept serious low-level modifications out of reach. Coldforest is trying a different route. Rather than relying on a conventional software exploit, the project uses voltage glitching to interfere with the Xbox One during the earliest stages of boot. The idea is simple on paper, but difficult in practice: hit the processor with a carefully timed electrical fault, interrupt a security check, then use that opening to gain deeper control of the system. Coldforest packages that approach into dedicated hardware. It isn’t a finished retail modchip, and there’s still no public demonstration showing the complete process working reliably from start to finish. Even so, the design gives a pretty clear picture of where the project is heading.

Coldforest is more than a glitch board

Coldforest targets the original Xbox One model 1540, mainly the early hardware revisions released around 2013 and 2014. The board uses two separate microcontrollers. That’s one of the more interesting parts of the design.

The main controller handles jobs where timing really matters. That includes triggering glitches against the Xbox One SoC, accessing the eMMC storage, programming memory, injecting code and communicating directly through GPIO connections.

A second controller handles the less time-sensitive management work. That means firmware updates, remote control, system monitoring and the user interface can run independently from the glitch hardware itself.

It’s a sensible split. Instead of making one chip responsible for everything, Coldforest separates the precise hardware work from the management layer. The result looks less like a simple modchip and more like a small development platform attached directly to the Xbox One motherboard.

Bliss provides the foundation

Coldforest builds on a voltage-glitch technique known as Bliss. The basic idea is to disturb the processor at exactly the right moment during boot. The Xbox One normally follows a strict chain of trust, with each stage checking that the next stage is legitimate before allowing it to run.

Voltage glitching tries to break that sequence. Instead of defeating the cryptography itself, the hardware briefly pushes the processor outside normal operating conditions. If the timing lands correctly, the CPU may skip, corrupt or incorrectly process a security-sensitive operation.

That’s the opening the attack needs. Of course, getting that timing right isn’t trivial. A glitch that’s too early does nothing. Too late, same result. Push the voltage too far and the console may simply crash. So repeatability matters just as much as the exploit concept itself.

RP2354A and ESP32 handle different jobs

Coldforest uses an RP2354A as its main controller. This chip handles the work that needs accurate timing, including glitch routines and direct communication with the Xbox One hardware. Its programmable I/O features make it a natural fit for that kind of task.

An ESP32-WROOM-32E-N16 sits alongside it. The ESP32 takes care of Wi-Fi, remote access and the broader management interface. Coldforest’s planned control system can operate through USB, a browser-based Wi-Fi interface and an optional 2.8-inch touchscreen.

From there, the hardware can expose tools for firmware loading, memory dumping, storage programming, status monitoring and individual subsystem control. That’s a much wider feature set than simply pressing a button and hoping a voltage glitch works.

XOCore could handle the next stage

The hardware is only part of the project. Coldforest also includes XOCore, a custom boot environment based on coreboot and adapted for the Xbox One’s system-on-chip.

The goal is to initialise key processor and memory functions once low-level execution becomes available. From there, XOCore could eventually provide a base for custom firmware or alternative operating systems. Linux is one obvious possibility.

Several pieces of the puzzle are already being worked on, including eFuse reading, eMMC and SDIO communication, POST-code detection, GPIO monitoring, SoC power detection and independent glitch control. But the hardest part is still the most important one.

Coldforest needs to turn those individual capabilities into a reliable exploit chain that consistently reaches arbitrary code execution. That hasn’t been publicly demonstrated yet.

Still a prototype, not a finished product

Coldforest is currently closer to a development project than something you’d order, install and forget about. Estimated production costs sit at roughly $40 for a Lite version and around $60 for the fuller configuration, based on small production runs. The hardware and software are also expected to be released openly, so compatible boards could be produced independently.

That doesn’t make Coldforest a finished Xbox One modification solution. Not yet. What it does show is that voltage glitching on Microsoft’s first Xbox One hardware is moving from isolated proof-of-concept work toward something more integrated. Coldforest combines glitch hardware, storage access, remote management and a custom boot environment into one platform.

Whether it can make the final jump to reliable low-level control will depend on the remaining engineering work. For now, the project is best viewed as a serious prototype with a clear technical direction, rather than a completed modchip ready for everyday use.