Hobbyist Reproduces Xbox One 'Bliss' Hack After 1.3 Million Glitch Attempts
Five months after Markus "Doom" Gaasedelen ended the Xbox One's twelve-year run as the console nobody could crack, someone else has finally done it too.
On August 21, the developer known as leor (@LeoRim) posted a short message that the Xbox modding scene had been waiting on since spring: "I recreated the bliss hack!" He credited Gaasedelen for the underlying exploit, thanked the people who had helped him along the way, and promised a write-up building on the original research. His own summary of the effort was blunt, it was, he said, incredibly difficult.
That difficulty is the actual story here.
The numbers
Asked how many glitch cycles it took before the attack landed, leor published his campaign statistics:
| Metric | Count |
|---|---|
| Glitch attempts | 1,039,495 |
| Boots | 419,825 |
| B1155 markers before the successful night (ROP) | ~11 |
| Clean MPU skips at the final cell | ~214 |
| Code execution | 1 |
Counting the runs that never made it into the logged databases, he estimates the true figure comfortably exceeds 1.3 million attempts.
The shape of that funnel is worth sitting with. Over a million tries produced roughly two hundred instances where the first stage of the attack behaved as intended — and exactly one of those cascaded into full code execution. This is not an exploit you run; it is an exploit you farm.
The hardware paid for it. In late July, leor reported killing his first eMMC chip and replacing it with an industrial-grade part, with something on the order of 150,000 reboots logged in the databases for that console alone. Half a million power cycles is not a workload consumer flash was designed to survive.
Getting there
The public trail runs back to July 20, when leor announced he had landed a ROP chain on the Xbox One but had no shell code yet — a meaningful milestone, since it meant the fault injection was reliably steering execution, even if the payload stage remained out of reach. He credited the payload itself to researcher retr0id, explicitly taking no credit for it, and noted that many others had helped.
A month later, the final piece fell into place.
What Bliss is
The exploit leor reproduced was unveiled by Gaasedelen on March 7, 2026, at the RE//verse conference in a talk titled Hacking the Xbox One. It was the first boot ROM–level compromise of the platform since its November 2013 launch — a gap that made the Xbox One a genuine outlier. The Xbox 360 fell to the Reset Glitch Hack; the PlayStation 4 was jailbroken by 2016. The Xbox One, with its Platform Security Processor acting as hardware root of trust, its fused keys, its dual RSA/ECC signature enforcement and multi-stage secure boot, simply held.
Bliss does not attack that architecture on its own terms. It attacks the physics underneath it.
The technique is crowbar voltage glitching: momentarily collapsing the North Bridge core rail during startup so the processor skips or misreads an instruction. Bliss is a double glitch. The first fault interrupts the loop that configures the ARM Cortex memory protection unit, stripping away memory isolation. The second lands during a memcpy operation while a header is being read, redirecting execution into attacker-controlled data.
Because the flawed code is etched into silicon rather than stored in updatable firmware, Microsoft cannot patch it. The exploit is limited to the original 2013 "fat" Xbox One — later revisions ship hardened boot ROMs with voltage glitch detection — but on that hardware it is permanent, and it yields the whole stack: boot ROM, security processor, hypervisor, OS.
Gaasedelen also faced the absence of any debug interface. He rebuilt visibility into the boot process indirectly, using power traces, flash access patterns and GPIO behaviour as timing anchors precise enough to aim a glitch at a specific instruction.
Why reproduction matters
Gaasedelen released full details specifically so others could reproduce the work and, eventually, build modchips. Reproduction is the step that turns a conference demo into a platform.
leor is not the only one trying. The independent hardware researcher Torus has published technical write-ups on partially reproducing Bliss, focused on re-enabling the security processor's POST codes that Microsoft disabled via fuses. Separately, GFL_Tech is developing an open-source modchip intended to automate the glitch sequence, with schematics and firmware published as the project progresses.
Every successful independent replication tightens the timing profile that a future modchip will need. A one-in-a-million success rate is unusable as a consumer product; it is extremely useful as a dataset.
Caveats
As of publication, leor's result rests on his own reporting on X and has not been independently verified. The promised technical write-up has not yet appeared. For a hardware attack of this complexity, that documentation — timing windows, trigger methodology, the specific conditions at the final cell — is where the real value to the scene lies.
The practical stakes are modest for Microsoft. The Xbox One is a legacy platform, and Developer Mode has offered a sanctioned homebrew path since 2016. The stakes for preservation are not modest at all. Full access to firmware, boot stages and encrypted content is what allows a console to be documented, emulated and repaired long after the servers go dark.
For now, the headline is simpler. Bliss works, it works for more than one person, and it cost a million attempts and at least one dead flash chip to prove it.