Thanks, are they attached to pins on the CPU or the mobo? Paranoid I could pull something when removing the HS.

 

Going slightly off topic and being a pedant I do have to note you can reach out and touch pins on a BGA -- some hackers doing such things used little hooks inside sheaths (think sprung hook probes for a scope)and snaked them through the gaps until they get where there need to be and then unfurl them. Can even be done for semi permanent installation rather than just sniffing data one time.

 

the rf board (ring of light) has three screws iirc.

 

the rf board should come out very easily. I assume you haven't unscrewed the third screw, since you mentioned only two. it's been a long time since I've opened up a 360, and then it was only phat ones (never owned a slim), so I'm basing this on memory.

 

For anything going wide I have only seen it for edge balls (I was not paying attention so much to what it as much as "that is cool" so I think it might have been a TV/cable hacking thing), and that was mostly a one time sniffing or basic injection. Hooks and whatnot is more of a group of hackers feeling out a system. As for probing a BGA then breakout/MITM board is probably the easier method but first things first you check to make sure there are no debug points or some kind of boundary scan type debug technique (somewhat amusingly in a conversation like this then JTAG being the main one) -- for the debug points then with the noise issues of modern high frequency boards then they often leave them in lest they have to redo RF or solve a new crop of noise issues.

If you want to get crazy lab style then you can also do things like https://www.networkworld.com/articl...-used-to-secure-xbox-360--other-products.html