diff --git a/k11_extension/source/svc/GetSystemInfo.c b/k11_extension/source/svc/GetSystemInfo.c
index cd86bcb..ef178dd 100644
--- a/k11_extension/source/svc/GetSystemInfo.c
+++ b/k11_extension/source/svc/GetSystemInfo.c
@@ -74,7 +74,7 @@ Result GetSystemInfoHook(s64 *out, s32 type, s32 param)
                 case 0x201: // isN3DS
                     *out = (cfwInfo.flags >> 4) & 1;
                     break;
-                case 0x202: // isSafeMode
+                case 0x202: // needToInitSd
                     *out = (cfwInfo.flags >> 5) & 1;
                     break;
                 case 0x203: // isSdMode
diff --git a/source/config.c b/source/config.c
index 14aba08..0477d29 100644
--- a/source/config.c
+++ b/source/config.c
@@ -31,6 +31,7 @@
 #include "utils.h"
 #include "screen.h"
 #include "draw.h"
+#include "emunand.h"
 #include "buttons.h"
 #include "pin.h"
 
@@ -196,13 +197,20 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
                                                  "GitHub repository!"
                                                };
 
+    FirmwareSource nandType = FIRMWARE_SYSNAND;
+    if(isSdMode)
+    {
+        nandType = FIRMWARE_EMUNAND;
+        locateEmuNand(&nandType);
+    }
+
     struct multiOption {
         u32 posXs[4];
         u32 posY;
         u32 enabled;
         bool visible;
     } multiOptions[] = {
-        { .visible = isSdMode },
+        { .visible = nandType == FIRMWARE_EMUNAND },
         { .visible = true },
         { .visible = true  },
         { .visible = true },
@@ -215,8 +223,8 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
         bool enabled;
         bool visible;
     } singleOptions[] = {
-        { .visible = isSdMode },
-        { .visible = isSdMode },
+        { .visible = nandType == FIRMWARE_EMUNAND },
+        { .visible = nandType == FIRMWARE_EMUNAND },
         { .visible = true },
         { .visible = true },
         { .visible = true },
diff --git a/source/firm.c b/source/firm.c
index c6d73dd..259cca7 100755
--- a/source/firm.c
+++ b/source/firm.c
@@ -344,7 +344,7 @@ static inline void mergeSection0(FirmwareType firmType, u32 firmVersion, bool lo
     }
 }
 
-u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStorage, bool isFirmProtEnabled, bool isSafeMode, bool doUnitinfoPatch)
+u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStorage, bool isFirmProtEnabled, bool needToInitSd, bool doUnitinfoPatch)
 {
     u8 *arm9Section = (u8 *)firm + firm->section[2].offset,
        *arm11Section1 = (u8 *)firm + firm->section[1].offset;
@@ -374,7 +374,7 @@ u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStora
     //Skip on FIRMs < 4.0
     if(ISN3DS || firmVersion >= 0x1D)
     {
-        ret += installK11Extension(arm11Section1, firm->section[1].size, isSafeMode, baseK11VA, arm11ExceptionsPage, &freeK11Space);
+        ret += installK11Extension(arm11Section1, firm->section[1].size, needToInitSd, baseK11VA, arm11ExceptionsPage, &freeK11Space);
         ret += patchKernel11(arm11Section1, firm->section[1].size, baseK11VA, arm11SvcTable, arm11ExceptionsPage);
     }
 
@@ -400,6 +400,9 @@ u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStora
     //Apply anti-anti-DG patches on 11.0+
     if(firmVersion >= (ISN3DS ? 0x21 : 0x52)) ret += patchTitleInstallMinVersionChecks(process9Offset, process9Size, firmVersion);
 
+    //patch P9 AM ticket wrapper on 11.8+ to use 0 Key and IV, only on UNITINFO patch to prevent NIM from actually send any
+    if(doUnitinfoPatch && firmVersion >= (ISN3DS ? 0x35 : 0x64)) ret += patchP9AMTicketWrapperZeroKeyIV(process9Offset, process9Size);
+
     //Apply UNITINFO patches
     if(doUnitinfoPatch)
     {
diff --git a/source/firm.h b/source/firm.h
index f1a6e98..5299a42 100644
--- a/source/firm.h
+++ b/source/firm.h
@@ -31,7 +31,7 @@
 
 u32 loadNintendoFirm(FirmwareType *firmType, FirmwareSource nandType, bool loadFromStorage, bool isSafeMode);
 void loadHomebrewFirm(u32 pressed);
-u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStorage, bool isFirmProtEnabled, bool isSafeMode, bool doUnitinfoPatch);
+u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStorage, bool isFirmProtEnabled, bool needToInitSd, bool doUnitinfoPatch);
 u32 patchTwlFirm(u32 firmVersion, bool loadFromStorage, bool doUnitinfoPatch);
 u32 patchAgbFirm(bool loadFromStorage, bool doUnitinfoPatch);
 u32 patch1x2xNativeAndSafeFirm(void);
diff --git a/source/main.c b/source/main.c
index 120b8ae..15c0cc3 100644
--- a/source/main.c
+++ b/source/main.c
@@ -51,6 +51,7 @@ void main(int argc, char **argv, u32 magicWord)
 {
     bool isFirmProtEnabled,
          isSafeMode = false,
+         needToInitSd = false,
          isNoForceFlagSet = false,
          isNtrBoot;
     FirmwareType firmType;
@@ -192,9 +193,16 @@ void main(int argc, char **argv, u32 magicWord)
             goto boot;
         }
 
-        /* Else, force the last used boot options unless a button is pressed
+        //Account for DSiWare soft resets if exiting TWL_FIRM
+        if(CFG_BOOTENV == 3)
+        {
+            static const u8 TLNC[] = {0x54, 0x4C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4E, 0x43};
+            if(memcmp((void *)0x20000C00, TLNC, 10) == 0) needToInitSd = true;
+        }
+
+        /* Force the last used boot options if autobooting a TWL title, or unless a button is pressed
            or the no-forcing flag is set */
-        if(!pressed && !BOOTCFG_NOFORCEFLAG)
+        if(needToInitSd || memcmp((void *)0x20000300, "TLNC", 4) == 0 || (!pressed && !BOOTCFG_NOFORCEFLAG))
         {
             nandType = (FirmwareSource)BOOTCFG_NAND;
             firmSource = (FirmwareSource)BOOTCFG_FIRM;
@@ -223,6 +231,7 @@ void main(int argc, char **argv, u32 magicWord)
         firmSource = FIRMWARE_SYSNAND;
 
         isSafeMode = true;
+        needToInitSd = true;
 
         //If the PIN has been verified, wait to make it easier to press the SAFE_MODE combo
         if(pinExists && !shouldLoadConfigMenu)
@@ -328,7 +337,7 @@ boot:
     switch(firmType)
     {
         case NATIVE_FIRM:
-            res = patchNativeFirm(firmVersion, nandType, loadFromStorage, isFirmProtEnabled, isSafeMode, doUnitinfoPatch);
+            res = patchNativeFirm(firmVersion, nandType, loadFromStorage, isFirmProtEnabled, needToInitSd, doUnitinfoPatch);
             break;
         case TWL_FIRM:
             res = patchTwlFirm(firmVersion, loadFromStorage, doUnitinfoPatch);
diff --git a/source/patches.c b/source/patches.c
index 8b5f0bf..e6eec0d 100644
--- a/source/patches.c
+++ b/source/patches.c
@@ -100,7 +100,7 @@ static inline u32 *getKernel11HandlerVAPos(u8 *pos, u32 *arm11ExceptionsPage, u3
     return (u32 *)(pos + pointedInstructionVA - baseK11VA + 8);
 }
 
-u32 installK11Extension(u8 *pos, u32 size, bool isSafeMode, u32 baseK11VA, u32 *arm11ExceptionsPage, u8 **freeK11Space)
+u32 installK11Extension(u8 *pos, u32 size, bool needToInitSd, u32 baseK11VA, u32 *arm11ExceptionsPage, u8 **freeK11Space)
 {
     //The parameters to be passed on to the kernel ext
     //Please keep that in sync with the definition in k11_extension/source/main.c
@@ -203,7 +203,7 @@ u32 installK11Extension(u8 *pos, u32 size, bool isSafeMode, u32 baseK11VA, u32 *
 
     if(ISRELEASE) info->flags = 1;
     if(ISN3DS) info->flags |= 1 << 4;
-    if(isSafeMode) info->flags |= 1 << 5;
+    if(needToInitSd) info->flags |= 1 << 5;
     if(isSdMode) info->flags |= 1 << 6;
 
     return 0;
@@ -674,3 +674,25 @@ u32 patchAgbBootSplash(u8 *pos, u32 size)
 
     return 0;
 }
+
+u32 patchP9AMTicketWrapperZeroKeyIV(u8* pos, u32 size)
+{
+    static const u8 __rt_memclr_pattern[] = {0x00, 0x20, 0xA0, 0xE3, 0x04, 0x00, 0x51, 0xE3, 0x07, 0x00, 0x00, 0x3A};
+    static const u8 pattern[] = {0x20, 0x21, 0xA6, 0xA8};
+
+    u32 function = (u32)memsearch(pos, __rt_memclr_pattern, size, sizeof(__rt_memclr_pattern));
+    u32 *off = (u32*)memsearch(pos, pattern, size, sizeof(pattern));
+
+    if(function == 0 || off == NULL) return 1;
+
+    s32 opjumpdistance = (s32)(function - ((u32)&off[2])) / 2;
+
+    //beyond limit
+    if(opjumpdistance < -0x1fffff || opjumpdistance > 0x1fffff) return 1;
+
+    //r0 and r1 for old call are already correctly for this one 
+    //BLX __rt_memclr
+    off[1] = 0xE800F000U | (((u32)opjumpdistance & 0x7FF) << 16) | (((u32)opjumpdistance >> 11) & 0x3FF) | (((u32)opjumpdistance >> 21) & 0x400);
+
+    return 0;
+}
\ No newline at end of file
diff --git a/source/patches.h b/source/patches.h
index 1382125..0b62a09 100644
--- a/source/patches.h
+++ b/source/patches.h
@@ -39,7 +39,7 @@
 
 u8 *getProcess9Info(u8 *pos, u32 size, u32 *process9Size, u32 *process9MemAddr);
 u32 *getKernel11Info(u8 *pos, u32 size, u32 *baseK11VA, u8 **freeK11Space, u32 **arm11SvcHandler, u32 **arm11ExceptionsPage);
-u32 installK11Extension(u8 *pos, u32 size, bool isSafeMode, u32 baseK11VA, u32 *arm11ExceptionsPage, u8 **freeK11Space);
+u32 installK11Extension(u8 *pos, u32 size, bool needToInitSd, u32 baseK11VA, u32 *arm11ExceptionsPage, u8 **freeK11Space);
 u32 patchKernel11(u8 *pos, u32 size, u32 baseK11VA, u32 *arm11SvcTable, u32 *arm11ExceptionsPage);
 u32 patchSignatureChecks(u8 *pos, u32 size);
 u32 patchOldSignatureChecks(u8 *pos, u32 size);
@@ -64,3 +64,4 @@ u32 patchTwlFlashcartChecks(u8 *pos, u32 size, u32 firmVersion);
 u32 patchOldTwlFlashcartChecks(u8 *pos, u32 size);
 u32 patchTwlShaHashChecks(u8 *pos, u32 size);
 u32 patchAgbBootSplash(u8 *pos, u32 size);
+u32 patchP9AMTicketWrapperZeroKeyIV(u8* pos, u32 size);
diff --git a/sysmodules/loader/source/loader.c b/sysmodules/loader/source/loader.c
index 01cc71a..e38daf1 100644
--- a/sysmodules/loader/source/loader.c
+++ b/sysmodules/loader/source/loader.c
@@ -12,7 +12,7 @@
 #define HBLDR_3DSX_TID  (*(vu64 *)0x1FF81100)
 
 u32 config, multiConfig, bootConfig;
-bool isN3DS, isSafeMode, isSdMode;
+bool isN3DS, needToInitSd, isSdMode;
 
 const char CODE_PATH[] = {0x01, 0x00, 0x00, 0x00, 0x2E, 0x63, 0x6F, 0x64, 0x65, 0x00, 0x00, 0x00};
 
@@ -47,12 +47,12 @@ static inline void loadCFWInfo(void)
     if(R_FAILED(svcGetSystemInfo(&out, 0x10000, 0x201))) svcBreak(USERBREAK_ASSERT);
     isN3DS = (bool)out;
     if(R_FAILED(svcGetSystemInfo(&out, 0x10000, 0x202))) svcBreak(USERBREAK_ASSERT);
-    isSafeMode = (bool)out;
+    needToInitSd = (bool)out;
     if(R_FAILED(svcGetSystemInfo(&out, 0x10000, 0x203))) svcBreak(USERBREAK_ASSERT);
     isSdMode = (bool)out;
 
     IFile file;
-    if(isSafeMode) fileOpen(&file, ARCHIVE_SDMC, "/", FS_OPEN_READ); //Init SD card if SAFE_MODE is being booted
+    if(needToInitSd) fileOpen(&file, ARCHIVE_SDMC, "/", FS_OPEN_READ); //Init SD card if SAFE_MODE is being booted
 }
 
 static int lzss_decompress(u8 *end)
diff --git a/sysmodules/loader/source/patcher.h b/sysmodules/loader/source/patcher.h
index e2eebd7..3fceb0d 100644
--- a/sysmodules/loader/source/patcher.h
+++ b/sysmodules/loader/source/patcher.h
@@ -39,7 +39,7 @@ enum singleOptions
 };
 
 extern u32 config, multiConfig, bootConfig;
-extern bool isN3DS, isSafeMode, isSdMode;
+extern bool isN3DS, needToInitSd, isSdMode;
 
 void patchCode(u64 progId, u16 progVer, u8 *code, u32 size, u32 textSize, u32 roSize, u32 dataSize, u32 roAddress, u32 dataAddress);
 Result fileOpen(IFile *file, FS_ArchiveID archiveId, const char *path, int flags);
diff --git a/sysmodules/rosalina/include/menus/cheats.h b/sysmodules/rosalina/include/menus/cheats.h
index cd66c6c..b95e36c 100644
--- a/sysmodules/rosalina/include/menus/cheats.h
+++ b/sysmodules/rosalina/include/menus/cheats.h
@@ -33,4 +33,4 @@
 #define CHEATS_PER_MENU_PAGE 18
 
 void RosalinaMenu_Cheats(void);
-void Cheat_ApplyKeyCheats();
+void Cheat_ApplyCheats();
diff --git a/sysmodules/rosalina/source/menu.c b/sysmodules/rosalina/source/menu.c
index 87a2ed3..c040c5c 100644
--- a/sysmodules/rosalina/source/menu.c
+++ b/sysmodules/rosalina/source/menu.c
@@ -175,9 +175,7 @@ void    menuThreadMain(void)
         }
         else
         {
-        	if (HID_PAD & 0xFFF) {
-        		Cheat_ApplyKeyCheats();
-        	}
+            Cheat_ApplyCheats();
         }
 
         // Check for home button on O3DS Mode3 with plugin loaded
diff --git a/sysmodules/rosalina/source/menus/cheats.c b/sysmodules/rosalina/source/menus/cheats.c
index 64351bb..ed8cad9 100644
--- a/sysmodules/rosalina/source/menus/cheats.c
+++ b/sysmodules/rosalina/source/menus/cheats.c
@@ -465,10 +465,12 @@ static u32 Cheat_ApplyCheat(const Handle processHandle, const CheatDescription*
             case 0xB:
                 // B Type
                 // Format: BXXXXXXX 00000000
-                // Description: Loads offset register.
+                // Description: Loads offset register with value at given XXXXXXX
                 if (!skipExecution)
                 {
-                    cheat_state.offset = (arg0 & 0x0FFFFFFF);
+                    u32 value;
+                    if (!Cheat_Read32(processHandle, arg0 & 0x0FFFFFFF, &value)) return 0;
+                    cheat_state.offset = value;
                 }
                 break;
             case 0xC:
@@ -1118,16 +1120,12 @@ static u32 Cheat_GetCurrentPID(u64* titleId)
     }
 }
 
-void Cheat_ApplyKeyCheats(void)
+void Cheat_ApplyCheats(void)
 {
     if (!cheatCount)
     {
         return;
     }
-    if (!hasKeyActivated)
-    {
-        return;
-    }
 
     u64 titleId = 0;
     u32 pid = Cheat_GetCurrentPID(&titleId);
@@ -1149,9 +1147,13 @@ void Cheat_ApplyKeyCheats(void)
     u32 keys = HID_PAD & 0xFFF;
     for (int i = 0; i < cheatCount; i++)
     {
-        if (cheats[i]->active && cheats[i]->keyActivated && (cheats[i]->keyCombo & keys) == keys)
+        if (cheats[i]->active && !(cheats[i]->keyActivated))
         {
             Cheat_MapMemoryAndApplyCheat(pid, cheats[i]);
+        } 
+        else if (cheats[i]->active && cheats[i]->keyActivated && (cheats[i]->keyCombo & keys) == keys)
+        {
+            Cheat_MapMemoryAndApplyCheat(pid, cheats[i]);    
         }
     }
 }