What a stealth server is actually doing
On a retail 360, the console speaks to Xbox Live as itself. On RGH3 or JTAG, the machine runs unsigned code, patched dashes, and plugins. On Bad Update 1.3 + XeUnshackle, it does that only until power-off. Live still expects a retail-shaped conversation. A stealth stack sits in the middle and tries to make that conversation look ordinary. People still search XBLStealth, “360 stealth,” proto, and a rotating list of plugin filenames. The architecture is older than the brand names.
That is the entire trick. It is not a hardware cloaking device. It does not rewrite Winchester into Trinity. It does not make a banned KeyVault clean. If your identity is already flagged, the proxy is translating a guilty passport — whether you paid for RGH3 or only ran Rock Band Blitz.
Three layers people flatten into one word
Hardware: RGH3, RGH1.2/Ace/Coolrunner, JTAG, or a non-persistent hypervisor exploit. Identity: KeyVault and CPU key pairing. Session: Dashlaunch 3.21 flags plus the stealth xex (or XeUnshackle USB launch.ini) that handles Live traffic.
When someone says “stealth is down,” they might mean the service, their plugin, DNS, dashboard 17559 mismatch, or a KV that was already shared. Those are different tickets. Treating them as one ticket is how you “fix” a banned vault by reinstalling Aurora covers.
I am not going to rank stealth providers. They change names. The useful skill is knowing which layer failed before you pay anyone for a new anything — including people who were only here for GOD backups and then plugged in Ethernet “just to see.”