whatever image you use, xell, xbr, etc, it must have the appropriate smc code for the wiring method you're using. you may be able to find xell binaries that have tms on audclamp, i've never done it.
my method:
1) dump nand.
2) make sure it's good. (i always do 3 reads and let nandcompare produce my "original" [tho i've never had nandcompare say it couldn't find a match for all blocks across 3 dumps]).
3) read kv out of nand (or your dump).
4) write the appropriate xbr_jasperXX_8955_3.bin to the nand. note the word appropriate. the usual places has images that have tms on ARGON_DATA and tdi on DB1F1. you'll need to make your own if you change where those signals are located. this is accomplished with sbtool (extract smc from either your dump or xbr_jasperXX_8955_3.bin) and then run it through blackaddr's smc_io tool. this thread is not about how to do that (and as i type this i realize that, call the police, the thread is getting jacked!), so you can read up on that.
5) write your kv back to the nand.
5) wire your method up.
6) boot into xellous by using eject. there's your cpu key quick get a camera ah crap you need to reboot cuz you weren't ready. seriously, use your camera.
7) build a freeboot image with your cpu key and your original nand. custom build it and use that same patched smc you created in step 4 (unless you use the standard tms=ARGON_DATA, tdi=DB1F1 wiring).

boot up the box, start xexmenu, launch flash360, write the freeboot image you renamed to updflash.bin and put in the same folder as flash360.
9) go to bed cuz you're up WAY TOO LATE. oh my god you have to be up in 3 hours to take the kids to school and then head into work. omg. but wait. i should just put the system back in the case; ah shit, first i need to flash the drive. dammit.
10) drink caffeine in the morning.
11) repeat #10.
note, tho, that i only work with jaspers and YMMV.