diff --git a/source/emunand.c b/source/emunand.c
index 7aa8ad1..25834d8 100644
--- a/source/emunand.c
+++ b/source/emunand.c
@@ -48,13 +48,13 @@ u32 getSDMMC(u8 *pos, u32 size)
     return *(u32 *)(off + 9) + *(u32 *)(off + 0xD);
 }
 
-void getEmuRW(u8 *pos, u32 size, u32 *readOffset, u32 *writeOffset)
+void getEmuRW(u8 *pos, u32 size, u16 **readOffset, u16 **writeOffset)
 {
     //Look for read/write code
     const u8 pattern[] = {0x1E, 0x00, 0xC8, 0x05};
 
-    *readOffset = (u32)memsearch(pos, pattern, size, 4) - 6;
-    *writeOffset = (u32)memsearch((u8 *)(*readOffset + 0xA), pattern, 0x100, 4) - 6;
+    *readOffset = (u16 *)memsearch(pos, pattern, size, 4) - 3;
+    *writeOffset = (u16 *)memsearch((u8 *)(*readOffset + 5), pattern, 0x100, 4) - 3;
 }
 
 u32 *getMPU(u8 *pos, u32 size)
diff --git a/source/emunand.h b/source/emunand.h
index f992269..abe8e4a 100644
--- a/source/emunand.h
+++ b/source/emunand.h
@@ -10,6 +10,6 @@
 
 void getEmunandSect(u32 *off, u32 *head, u32 *emuNAND);
 u32 getSDMMC(u8 *pos, u32 size);
-void getEmuRW(u8 *pos, u32 size, u32 *readOffset, u32 *writeOffset);
+void getEmuRW(u8 *pos, u32 size, u16 **readOffset, u16 **writeOffset);
 u32 *getMPU(u8 *pos, u32 size);
 void *getEmuCode(u8 *pos);
\ No newline at end of file
diff --git a/source/firm.c b/source/firm.c
index 77ce9d2..db9ee58 100755
--- a/source/firm.c
+++ b/source/firm.c
@@ -332,22 +332,22 @@ static inline void patchEmuNAND(u8 *arm9Section, u8 *process9Offset, u32 process
                        section[2].offset + (u32)section[2].address;
 
     //Add emuNAND hooks
-    u32 emuRead,
-        emuWrite;
+    u16 *emuRead,
+        *emuWrite;
 
     getEmuRW(process9Offset, process9Size, &emuRead, &emuWrite);
-    *(u16 *)emuRead = nandRedir[0];
-    *((u16 *)emuRead + 1) = nandRedir[1];
-    *((u32 *)emuRead + 1) = branchOffset;
-    *(u16 *)emuWrite = nandRedir[0];
-    *((u16 *)emuWrite + 1) = nandRedir[1];
-    *((u32 *)emuWrite + 1) = branchOffset;
+    *emuRead = nandRedir[0];
+    emuRead[1] = nandRedir[1];
+    ((u32 *)emuRead)[1] = branchOffset;
+    *emuWrite = nandRedir[0];
+    emuWrite[1] = nandRedir[1];
+    ((u32 *)emuWrite)[1] = branchOffset;
 
     //Set MPU for emu code region
     u32 *mpuOffset = getMPU(arm9Section, section[2].size);
     *mpuOffset = mpuPatch[0];
-    *(mpuOffset + 6) = mpuPatch[1];
-    *(mpuOffset + 9) = mpuPatch[2];
+    mpuOffset[6] = mpuPatch[1];
+    mpuOffset[9] = mpuPatch[2];
 }
 
 static inline void patchReboots(u8 *process9Offset, u32 process9Size, u32 process9MemAddr)
@@ -381,7 +381,7 @@ static inline void reimplementSvcBackdoor(void)
 
         memcpy(freeSpace, svcBackdoor, 40);
 
-        svcTable[0x7B] = 0xFFFF0000 + (u32)((u8 *)freeSpace - (u8 *)exceptionsPage);
+        svcTable[0x7B] = 0xFFFF0000 + ((u8 *)freeSpace - (u8 *)exceptionsPage);
     }
 }