diff --git a/patches/reboot.s b/patches/reboot.s
index 9cb779f..4c60db1 100644
--- a/patches/reboot.s
+++ b/patches/reboot.s
@@ -14,6 +14,9 @@ payload_maxsize equ 0x10000   ; Maximum size for the payload (maximum that CakeB
 
     mov r8, r1
 
+    cmp r7, #0
+    moveq r7, r10 ; for 2.x
+
     pxi_wait_recv:
         ldr r2, =0x44846
         ldr r0, =0x10008000
diff --git a/source/firm.c b/source/firm.c
index cbf6d17..569c4af 100755
--- a/source/firm.c
+++ b/source/firm.c
@@ -341,10 +341,17 @@ static inline void patchSafeFirm(void)
         //Decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader
         arm9Loader(arm9Section);
         firm->arm9Entry = (u8 *)0x801B01C;
-
-        patchFirmWrites(arm9Section, section[2].size);
     }
-    else patchFirmWriteSafe(arm9Section, section[2].size);
+
+    //Find the Process9 .code location, size and memory address
+    u32 process9Size,
+        process9MemAddr;
+    u8 *process9Offset = getProcess9(arm9Section + 0x15000, section[2].size - 0x15000, &process9Size, &process9MemAddr);
+
+    if(isN3DS) patchFirmWrites(process9Offset, process9Size);
+    else patchFirmWriteSafe(process9Offset, process9Size);
+
+    patchFirmlaunches(process9Offset, process9Size, process9MemAddr);
 }
 
 static inline void copySection0AndInjectSystemModules(void)