Ok, for the sake of this question we will focus on the Jasper/Zephyr side of the new reset glitch hack...

1BL runs a zero-paired CB. CB initializes DRAM, |Reset Glitch|, then loads modified CD. If CD fails to load, SMC reboots it until it loads. The CD then proceeds to boot Unsigned Code (Xellous).

under normal circumstances instead of unsigned code, CD would load the base kernel/HV "CE" from NAND, then Start CF. CF loads, decrypts, and decompresses HV and Kernel patches. From there it loads the Patched HV and Kernel, and boots to the Dashboard.

So here we come to the question: What does it actually take to boot a modified dashboard? It appears to me that we need post-CD RSA/SHA1 checks removed, and some HV/Kernel patches. Is that all?

I am confused on 1 other detail... CB in its standard form is RSA signed. It also is in charge of initializing the processor security engine to hash check DRAM on the fly. What checks the signature of the CB?

It also seems like negating efuse checks would be beneficial too....

Any Answers are greatly appreciated. Its not something I've been able to just look up, and its bugging me.