MuthaFknRAMBO wrote from what I remember seeing about this method after viewing the reversed code, is that you do download two files, the hv and xam. These files are downloaded and then used to patch your current ones on your jtag/rsg. That way you have the xbl bypass. Now these files are probably deleted after you disconnect from xbl or turn off your jtag. There is a way to capture the files after you have patched your jtag, but I won't tell you. cause it's so easy you should know.

NITRAMMODZ wrote

If he has wrote a function to read the CPU key from the fuse line's, he will have defined this address into a var somewhere "0x20000020000ULL", then added in the offset to get fuse lines 3 and 4, or 5 and 6 to get the CPU key, or he might of defined it with the fuse line offset already added. But either way he would have the result of that in a var somewhere in memory. So you could use that address to find his function then edit in a jump to your function and edit his vars or edit his function in the XEX to point to a different place in memory were you have your spoofed Efuse data.

Edit,

I find it funny people trying to protect a bypass on security, since for the same reasons they are able to hack Xbox live security there security is pointless. We have the ability to read and write memory at anytime, run our own code at any time, edit pretty much any function and finally intercept any function and calls at run time.

The only thing we can't edit on the Xbox 360 is the Efuses and the 1BL code in the CPU's ROM. If we could edit the 1BL there would of been no timing attack hack, SMC Hack or RGH. Heck if we could just edit the Efuses there would of been no need for the timing attack or RGH. But that doesn't matter the main point is you could bypass his CPU key check.