Upped patch version

Added basic support for configuring the brightness level for the built-in screen init
Better commenting
2016-04-05 02:29:36 +02:00 · 2016-04-05 02:24:21 +02:00 · 2016-04-04 19:14:49 +02:00 · 2016-04-04 18:07:13 +02:00 · 2016-04-04 01:08:42 +02:00 · 2016-04-03 19:53:03 +02:00
55 changed files with 3182 additions and 714 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 out
 build
 loader/build
+injector/build
 *.bin
 *.3dsx
 *.smdh
--- a/24
+++ b/24
@@ -6,10 +6,13 @@ LD := arm-none-eabi-ld
 OC := arm-none-eabi-objcopy

 name := AuReiNand
+version := $(shell git describe --abbrev=0 --tags)

 dir_source := source
 dir_patches := patches
 dir_loader := loader
+dir_screeninit := screeninit
+dir_injector := injector
 dir_mset := CakeHax
 dir_ninjhax := CakeBrah
 dir_build := build
@@ -45,6 +48,8 @@ clean:
 	@$(MAKE) $(FLAGS) -C $(dir_ninjhax) clean
 	@rm -rf $(dir_out) $(dir_build)
 	@$(MAKE) -C $(dir_loader) clean
+	@$(MAKE) -C $(dir_screeninit) clean
+	@$(MAKE) -C $(dir_injector) clean

 $(dir_out):
 	@mkdir -p "$(dir_out)/aurei/payloads"
@@ -54,7 +59,7 @@ $(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)
 	@dd if=$(dir_build)/main.bin of=$@ bs=512 seek=144

 $(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)
-	@cp -av $(dir_build)/main.bin $@
+	@cp -a $(dir_build)/main.bin $@

 $(dir_out)/3ds/$(name): $(dir_out)
 	@mkdir -p "$(dir_out)/3ds/$(name)"
@@ -65,18 +70,24 @@ $(dir_out)/3ds/$(name): $(dir_out)
 $(dir_out)/$(name).zip: launcher a9lh ninjhax
 	@cd $(dir_out) && zip -9 -r $(name) *

-$(dir_build)/patches.h: $(dir_patches)/emunand.s $(dir_patches)/reboot.s
+$(dir_build)/patches.h: $(dir_patches)/emunand.s $(dir_patches)/reboot.s $(dir_injector)/Makefile
 	@mkdir -p "$(dir_build)"
 	@armips $<
 	@armips $(word 2,$^)
-	@mv emunand.bin reboot.bin $(dir_build)
-	@bin2c -o $@ -n emunand $(dir_build)/emunand.bin -n reboot $(dir_build)/reboot.bin
+	@$(MAKE) -C $(dir_injector)
+	@mv emunand.bin reboot.bin $(dir_injector)/injector.cxi $(dir_build)
+	@bin2c -o $@ -n emunand $(dir_build)/emunand.bin -n reboot $(dir_build)/reboot.bin -n injector $(dir_build)/injector.cxi

 $(dir_build)/loader.h: $(dir_loader)/Makefile
 	@$(MAKE) -C $(dir_loader)
 	@mv $(dir_loader)/loader.bin $(dir_build)
 	@bin2c -o $@ -n loader $(dir_build)/loader.bin

+$(dir_build)/screeninit.h: $(dir_screeninit)/Makefile
+	@$(MAKE) -C $(dir_screeninit)
+	@mv $(dir_screeninit)/screeninit.bin $(dir_build)
+	@bin2c -o $@ -n screeninit $(dir_build)/screeninit.bin
+
 $(dir_build)/main.bin: $(dir_build)/main.elf
 	$(OC) -S -O binary $< $@

@@ -84,7 +95,10 @@ $(dir_build)/main.elf: $(objects_cfw)
 	# FatFs requires libgcc for __aeabi_uidiv
 	$(CC) -nostartfiles $(LDFLAGS) -T linker.ld $(OUTPUT_OPTION) $^

-$(dir_build)/%.o: $(dir_source)/%.c $(dir_build)/patches.h $(dir_build)/loader.h
+$(dir_build)/memory.o : CFLAGS+=-O3
+$(dir_build)/utils.o : CFLAGS += -DCONFIG_TITLE="\"$(name) $(version) configuration\""
+
+$(dir_build)/%.o: $(dir_source)/%.c $(dir_build)/patches.h $(dir_build)/loader.h $(dir_build)/screeninit.h
 	@mkdir -p "$(@D)"
 	$(COMPILE.c) $(OUTPUT_OPTION) $<

--- a/README.md
+++ b/README.md
@@ -5,6 +5,8 @@

 You'll need armips and [bin2c](https://sourceforge.net/projects/bin2c/) added to your Path. [HERE](http://www91.zippyshare.com/v/ePGpjk9r/file.html) is a pre-compiled version of armips.

+You also need to have a recent build of makerom in your path for the injector to be built.
+
 Lastly, just run Make and everything should work!

 Copy everything in 'out' folder to SD root and run!
@@ -13,7 +15,7 @@ Copy everything in 'out' folder to SD root and run!

 See https://github.com/Reisyukaku/ReiNand and http://gbatemp.net/threads/reinand-mod-o3ds-n3ds-sysnand.411110

-The FIRMs you need are [HERE](http://www99.zippyshare.com/v/kEIiQl0x/file.html).
+The FIRMs you need are [HERE](http://www77.zippyshare.com/v/oXDn2Hes/file.html).

 **Credits:**
 
@@ -29,4 +31,6 @@ A skilled reverser gave me the new reboot patch.

 The screen init code is from dark_samus, bil1s, Normmatt, delebile and everyone who contributed.

-The code for printing to the screen is from CakesFW.
+The code for printing to the screen, and the heavy revision to the reboot patch to allow for AGB/TWL loading are from CakesFW.
+
+ARM11 userland patching is only possible thanks to @yifanlu's 3ds_injector, which is bundled in the CFW.
--- a/injector/LICENSE
+++ b/injector/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Yifan Lu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
--- a/injector/Makefile
+++ b/injector/Makefile
@@ -0,0 +1,161 @@
+#---------------------------------------------------------------------------------
+.SUFFIXES:
+#---------------------------------------------------------------------------------
+
+ifeq ($(strip $(DEVKITARM)),)
+$(error "Please set DEVKITARM in your environment. export DEVKITARM=<path to>devkitARM")
+endif
+
+TOPDIR ?= $(CURDIR)
+MAKEROM ?= makerom
+include $(DEVKITARM)/3ds_rules
+
+#---------------------------------------------------------------------------------
+# TARGET is the name of the output
+# BUILD is the directory where object files & intermediate files will be placed
+# SOURCES is a list of directories containing source code
+# DATA is a list of directories containing data files
+# INCLUDES is a list of directories containing header files
+#---------------------------------------------------------------------------------
+TARGET		:=	$(notdir $(CURDIR))
+BUILD		:=	build
+SOURCES		:=	source
+DATA		:=	data
+INCLUDES	:=	include
+
+#---------------------------------------------------------------------------------
+# options for code generation
+#---------------------------------------------------------------------------------
+ARCH	:=	-march=armv6k -mtune=mpcore -mfloat-abi=hard -mtp=soft
+
+CFLAGS	:= -flto -Wall -O2 -mword-relocations \
+			-ffast-math -ffunction-sections -fdata-sections \
+			$(ARCH)
+
+CFLAGS	+=	$(INCLUDE) -DARM11 -D_3DS
+
+CXXFLAGS	:= $(CFLAGS) -fno-rtti -fno-exceptions -std=gnu99
+
+ASFLAGS	:=	$(ARCH)
+LDFLAGS	=	-flto -Xlinker --defsym="__start__=0x14000000" -specs=3dsx.specs $(ARCH) -Wl,-Map,$(notdir $*.map)
+
+LIBS	:= -lctru
+
+#---------------------------------------------------------------------------------
+# list of directories containing libraries, this must be the top level containing
+# include and lib
+#---------------------------------------------------------------------------------
+LIBDIRS	:= $(CTRULIB)
+
+
+#---------------------------------------------------------------------------------
+# no real need to edit anything past this point unless you need to add additional
+# rules for different file extensions
+#---------------------------------------------------------------------------------
+ifneq ($(BUILD),$(notdir $(CURDIR)))
+#---------------------------------------------------------------------------------
+
+export OUTPUT	:=	$(CURDIR)/$(TARGET)
+export TOPDIR	:=	$(CURDIR)
+
+export VPATH	:=	$(foreach dir,$(SOURCES),$(CURDIR)/$(dir)) \
+			$(foreach dir,$(DATA),$(CURDIR)/$(dir))
+
+export DEPSDIR	:=	$(CURDIR)/$(BUILD)
+
+CFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.c)))
+CPPFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.cpp)))
+SFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.s)))
+PICAFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.v.pica)))
+SHLISTFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.shlist)))
+BINFILES	:=	$(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.*)))
+
+#---------------------------------------------------------------------------------
+# use CXX for linking C++ projects, CC for standard C
+#---------------------------------------------------------------------------------
+ifeq ($(strip $(CPPFILES)),)
+#---------------------------------------------------------------------------------
+	export LD	:=	$(CC)
+#---------------------------------------------------------------------------------
+else
+#---------------------------------------------------------------------------------
+	export LD	:=	$(CXX)
+#---------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------
+
+export OFILES	:=	$(addsuffix .o,$(BINFILES)) \
+			$(PICAFILES:.v.pica=.shbin.o) $(SHLISTFILES:.shlist=.shbin.o) \
+			$(CPPFILES:.cpp=.o) $(CFILES:.c=.o) $(SFILES:.s=.o)
+
+export INCLUDE	:=	$(foreach dir,$(INCLUDES),-I$(CURDIR)/$(dir)) \
+			$(foreach dir,$(LIBDIRS),-I$(dir)/include) \
+			-I$(CURDIR)/$(BUILD)
+
+export LIBPATHS	:=	$(foreach dir,$(LIBDIRS),-L$(dir)/lib)
+
+.PHONY: $(BUILD) clean all
+
+#---------------------------------------------------------------------------------
+all: $(BUILD)
+
+$(BUILD):
+	@[ -d $@ ] || mkdir -p $@
+	@$(MAKE) --no-print-directory -C $(BUILD) -f $(CURDIR)/Makefile
+
+#---------------------------------------------------------------------------------
+clean:
+	@echo clean ...
+	@rm -fr $(BUILD) $(OUTPUT).cxi $(TARGET).elf
+
+
+#---------------------------------------------------------------------------------
+else
+
+DEPENDS	:=	$(OFILES:.o=.d)
+
+#---------------------------------------------------------------------------------
+# main targets
+#---------------------------------------------------------------------------------
+$(OUTPUT).cxi	: $(OUTPUT).elf
+	$(MAKEROM) -f ncch -rsf ../loader.rsf -nocodepadding -o $@ -elf $<
+
+$(OUTPUT).elf	:	$(OFILES)
+
+#---------------------------------------------------------------------------------
+# you need a rule like this for each extension you use as binary data
+#---------------------------------------------------------------------------------
+%.bin.o	:	%.bin
+#---------------------------------------------------------------------------------
+	@echo $(notdir $<)
+	@$(bin2o)
+
+#---------------------------------------------------------------------------------
+# rules for assembling GPU shaders
+#---------------------------------------------------------------------------------
+define shader-as
+	$(eval CURBIN := $(patsubst %.shbin.o,%.shbin,$(notdir $@)))
+	picasso -o $(CURBIN) $1
+	bin2s $(CURBIN) | $(AS) -o $@
+	echo "extern const u8" `(echo $(CURBIN) | sed -e 's/^\([0-9]\)/_\1/' | tr . _)`"_end[];" > `(echo $(CURBIN) | tr . _)`.h
+	echo "extern const u8" `(echo $(CURBIN) | sed -e 's/^\([0-9]\)/_\1/' | tr . _)`"[];" >> `(echo $(CURBIN) | tr . _)`.h
+	echo "extern const u32" `(echo $(CURBIN) | sed -e 's/^\([0-9]\)/_\1/' | tr . _)`_size";" >> `(echo $(CURBIN) | tr . _)`.h
+endef
+
+%.shbin.o : %.v.pica %.g.pica
+	@echo $(notdir $^)
+	@$(call shader-as,$^)
+
+%.shbin.o : %.v.pica
+	@echo $(notdir $<)
+	@$(call shader-as,$<)
+
+%.shbin.o : %.shlist
+	@echo $(notdir $<)
+	@$(call shader-as,$(foreach file,$(shell cat $<),$(dir $<)/$(file)))
+
+-include $(DEPENDS)
+
+#---------------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------------
--- a/injector/README.md
+++ b/injector/README.md
@@ -0,0 +1,30 @@
+3DS Loader Replacement
+======================
+
+This is an open source implementation of 3DS `loader` system module--with 
+additional features. The current aim of the project is to provide a nice 
+entry point for patching 3DS modules.
+
+## Roadmap
+Right now, this can serve as an open-source replacement for the built in loader. 
+There is additional support for patching any executable after it's loaded but 
+before it starts. For example, you can patch `menu` to skip region checks and 
+have region free game launching directly from the home menu. There is also 
+support for SDMC reading (not found in original loader implementation) which 
+means that patches can be loaded from the SD card. Ultimately, there would be 
+a patch system that supports easy loading of patches from the SD card.
+
+## Build
+You need a working 3DS build environment with a fairly recent copy of devkitARM, 
+ctrulib, and makerom. If you see any errors in the build process, it's likely 
+that you're using an older version.
+
+Currently, there is no support for FIRM building, so you need to do some steps 
+manually. First, you have to add padding to make sure the NCCH is of the right 
+size to drop in as a replacement. A hacky way is 
+[this patch](http://pastebin.com/nyKXLnNh) which adds junk data. Play around 
+with the size value to get the NCCH to be the exact same size as the one 
+found in your decrypted FIRM dump.
+
+Once you have a NCCH of the right size, just replace it in your decrypted FIRM 
+and find a way to launch it (for example with ReiNAND).
--- a/injector/loader.rsf
+++ b/injector/loader.rsf
@@ -0,0 +1,115 @@
+BasicInfo:
+  Title                   : loader
+  CompanyCode             : "00"
+  ProductCode             : 0828builder
+  ContentType             : Application
+  Logo                    : None
+
+TitleInfo:
+  UniqueId                : 0x13
+  Category                : Base
+  Version                 : 2
+
+Option:
+  UseOnSD                 : false
+  FreeProductCode         : true # Removes limitations on ProductCode
+  MediaFootPadding        : false # If true CCI files are created with padding
+  EnableCrypt             : false # Enables encryption for NCCH and CIA
+  EnableCompress          : true # Compresses exefs code
+
+AccessControlInfo:
+  IdealProcessor                : 1
+  AffinityMask                  : 3
+
+  Priority                      : 20
+
+  DisableDebug                  : true
+  EnableForceDebug              : false
+  CanWriteSharedPage            : false
+  CanUsePrivilegedPriority      : false
+  CanUseNonAlphabetAndNumber    : false
+  PermitMainFunctionArgument    : false
+  CanShareDeviceMemory          : false
+  RunnableOnSleep               : true
+  SpecialMemoryArrange          : true
+  ResourceLimitCategory         : Other
+
+  CoreVersion                   : 2
+  DescVersion                   : 2
+
+  MemoryType                    : Base # Application / System / Base
+  HandleTableSize: 0
+  SystemCallAccess:
+    AcceptSession: 74
+    ArbitrateAddress: 34
+    Break: 60
+    CancelTimer: 28
+    ClearEvent: 25
+    ClearTimer: 29
+    CloseHandle: 35
+    ConnectToPort: 45
+    ControlMemory: 1
+    CreateAddressArbiter: 33
+    CreateCodeSet: 115
+    CreateEvent: 23
+    CreateMemoryBlock: 30
+    CreateMutex: 19
+    CreatePort: 71
+    CreateProcess: 117
+    CreateSemaphore: 21
+    CreateSessionToPort: 72
+    CreateThread: 8
+    CreateTimer: 26
+    DuplicateHandle: 39
+    ExitProcess: 3
+    ExitThread: 9
+    GetCurrentProcessorNumber: 17
+    GetHandleInfo: 41
+    GetProcessId: 53
+    GetProcessIdealProcessor: 6
+    GetProcessIdOfThread: 54
+    GetProcessInfo: 43
+    GetResourceLimit: 56
+    GetResourceLimitCurrentValues: 58
+    GetResourceLimitLimitValues: 57
+    GetSystemInfo: 42
+    GetSystemTick: 40
+    GetThreadContext: 59
+    GetThreadId: 55
+    GetThreadIdealProcessor: 15
+    GetThreadInfo: 44
+    GetThreadPriority: 11
+    MapMemoryBlock: 31
+    OutputDebugString: 61
+    QueryMemory: 2
+    RandomStub: 116
+    ReleaseMutex: 20
+    ReleaseSemaphore: 22
+    ReplyAndReceive1: 75
+    ReplyAndReceive2: 76
+    ReplyAndReceive3: 77
+    ReplyAndReceive4: 78
+    ReplyAndReceive: 79
+    SendSyncRequest1: 46
+    SendSyncRequest2: 47
+    SendSyncRequest3: 48
+    SendSyncRequest4: 49
+    SendSyncRequest: 50
+    SetThreadPriority: 12
+    SetTimer: 27
+    SignalEvent: 24
+    SleepThread: 10
+    UnmapMemoryBlock: 32
+    WaitSynchronization1: 36
+    WaitSynchronizationN: 37
+  InterruptNumbers:
+  ServiceAccessControl:
+    - fs:LDR
+  FileSystemAccess:
+    - DirectSdmc
+    - CtrNandRw
+
+SystemControlInfo:
+  SaveDataSize: 0KB # It doesn't use any save data.
+  RemasterVersion: 0
+  StackSize: 0x1000
--- a/injector/source/exheader.h
+++ b/injector/source/exheader.h
@@ -0,0 +1,97 @@
+#pragma once
+
+#include <3ds/types.h>
+
+typedef struct
+{
+	u8 reserved[5];
+	u8 flag;
+	u8 remasterversion[2];
+} PACKED exheader_systeminfoflags;
+
+typedef struct
+{
+	u32 address;
+	u32 nummaxpages;
+	u32 codesize;
+} PACKED exheader_codesegmentinfo;
+
+typedef struct
+{
+	u8 name[8];
+	exheader_systeminfoflags flags;
+	exheader_codesegmentinfo text;
+	u8 stacksize[4];
+	exheader_codesegmentinfo ro;
+	u8 reserved[4];
+	exheader_codesegmentinfo data;
+	u32 bsssize;
+} PACKED exheader_codesetinfo;
+
+typedef struct
+{
+	u64 programid[0x30];
+} PACKED exheader_dependencylist;
+
+typedef struct
+{
+	u8 savedatasize[4];
+	u8 reserved[4];
+	u8 jumpid[8];
+	u8 reserved2[0x30];
+} PACKED exheader_systeminfo;
+
+typedef struct
+{
+	u8 extsavedataid[8];
+	u8 systemsavedataid[8];
+	u8 reserved[8];
+	u8 accessinfo[7];
+	u8 otherattributes;
+} PACKED exheader_storageinfo;
+
+typedef struct
+{
+	u64 programid;
+	u8 flags[8];
+	u16 resourcelimitdescriptor[0x10];
+	exheader_storageinfo storageinfo;
+	u64 serviceaccesscontrol[0x20];
+	u8 reserved[0x1f];
+	u8 resourcelimitcategory;
+} PACKED exheader_arm11systemlocalcaps;
+
+typedef struct
+{
+	u32 descriptors[28];
+	u8 reserved[0x10];
+} PACKED exheader_arm11kernelcapabilities;
+
+typedef struct
+{
+	u8 descriptors[15];
+	u8 descversion;
+} PACKED exheader_arm9accesscontrol;
+
+typedef struct
+{
+	// systemcontrol info {
+	//   coreinfo {
+	exheader_codesetinfo codesetinfo;
+	exheader_dependencylist deplist;
+	//   }
+	exheader_systeminfo systeminfo;
+	// }
+	// accesscontrolinfo {
+	exheader_arm11systemlocalcaps arm11systemlocalcaps;
+	exheader_arm11kernelcapabilities arm11kernelcaps;
+	exheader_arm9accesscontrol arm9accesscontrol;
+	// }
+	struct {
+		u8 signature[0x100];
+		u8 ncchpubkeymodulus[0x100];
+		exheader_arm11systemlocalcaps arm11systemlocalcaps;
+		exheader_arm11kernelcapabilities arm11kernelcaps;
+		exheader_arm9accesscontrol arm9accesscontrol;
+	} PACKED accessdesc;
+} PACKED exheader_header;
--- a/injector/source/fsldr.c
+++ b/injector/source/fsldr.c
@@ -0,0 +1,109 @@
+#include <3ds.h>
+#include "fsldr.h"
+#include "fsreg.h"
+#include "srvsys.h"
+
+#define SDK_VERSION 0x70200C8
+
+static Handle fsldrHandle;
+static int fsldrRefCount;
+
+// MAKE SURE fsreg has been init before calling this
+static Result fsldrPatchPermissions(void)
+{
+  u32 pid;
+  Result res;
+  FS_ProgramInfo info;
+  u32 storage[8] = {0};
+
+  storage[6] = 0x680; // SDMC access and NAND access flag
+  info.programId = 0x0004013000001302LL; // loader PID
+  info.mediaType = MEDIATYPE_NAND;
+  res = svcGetProcessId(&pid, 0xFFFF8001);
+  if (R_SUCCEEDED(res))
+  {
+    res = FSREG_Register(pid, 0xFFFF000000000000LL, &info, (u8 *)storage);
+  }
+  return res;
+}
+
+Result fsldrInit(void)
+{
+  Result ret = 0;
+
+  if (AtomicPostIncrement(&fsldrRefCount)) return 0;
+
+  ret = srvSysGetServiceHandle(&fsldrHandle, "fs:LDR");
+  if (R_SUCCEEDED(ret))
+  {
+    fsldrPatchPermissions();
+    ret = FSLDR_InitializeWithSdkVersion(fsldrHandle, SDK_VERSION);
+    ret = FSLDR_SetPriority(0);
+    if (R_FAILED(ret)) svcBreak(USERBREAK_ASSERT);
+  }
+  else
+  {
+    AtomicDecrement(&fsldrRefCount);
+  }
+
+  return ret;
+}
+
+void fsldrExit(void)
+{
+  if (AtomicDecrement(&fsldrRefCount)) return;
+  svcCloseHandle(fsldrHandle);
+}
+
+Result FSLDR_InitializeWithSdkVersion(Handle session, u32 version)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x861,1,2); // 0x8610042
+  cmdbuf[1] = version;
+  cmdbuf[2] = 32;
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(session))) return ret;
+
+  return cmdbuf[1];
+}
+
+Result FSLDR_SetPriority(u32 priority)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x862,1,0); // 0x8620040
+  cmdbuf[1] = priority;
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(fsldrHandle))) return ret;
+
+  return cmdbuf[1];
+}
+
+Result FSLDR_OpenFileDirectly(Handle* out, FS_Archive archive, FS_Path path, u32 openFlags, u32 attributes)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x803,8,4); // 0x8030204
+  cmdbuf[1] = 0;
+  cmdbuf[2] = archive.id;
+  cmdbuf[3] = archive.lowPath.type;
+  cmdbuf[4] = archive.lowPath.size;
+  cmdbuf[5] = path.type;
+  cmdbuf[6] = path.size;
+  cmdbuf[7] = openFlags;
+  cmdbuf[8] = attributes;
+  cmdbuf[9] = IPC_Desc_StaticBuffer(archive.lowPath.size, 2);
+  cmdbuf[10] = (u32) archive.lowPath.data;
+  cmdbuf[11] = IPC_Desc_StaticBuffer(path.size, 0);
+  cmdbuf[12] = (u32) path.data;
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(fsldrHandle))) return ret;
+
+  if(out) *out = cmdbuf[3];
+
+  return cmdbuf[1];
+}
--- a/injector/source/fsldr.h
+++ b/injector/source/fsldr.h
@@ -0,0 +1,9 @@
+#pragma once
+
+#include <3ds/types.h>
+
+Result fsldrInit(void);
+void fsldrExit(void);
+Result FSLDR_InitializeWithSdkVersion(Handle session, u32 version);
+Result FSLDR_SetPriority(u32 priority);
+Result FSLDR_OpenFileDirectly(Handle* out, FS_Archive archive, FS_Path path, u32 openFlags, u32 attributes);
--- a/injector/source/fsreg.c
+++ b/injector/source/fsreg.c
@@ -0,0 +1,116 @@
+#include <3ds.h>
+#include <string.h>
+#include "fsreg.h"
+#include "srvsys.h"
+
+static Handle fsregHandle;
+static int fsregRefCount;
+
+Result fsregInit(void)
+{
+  Result ret = 0;
+
+  if (AtomicPostIncrement(&fsregRefCount)) return 0;
+
+  ret = srvSysGetServiceHandle(&fsregHandle, "fs:REG");
+
+  if (R_FAILED(ret)) AtomicDecrement(&fsregRefCount);
+  return ret;
+}
+
+void fsregExit(void)
+{
+  if (AtomicDecrement(&fsregRefCount)) return;
+  svcCloseHandle(fsregHandle);
+}
+
+Result FSREG_CheckHostLoadId(u64 prog_handle)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x406,2,0); // 0x4060080
+  cmdbuf[1] = (u32) (prog_handle);
+  cmdbuf[2] = (u32) (prog_handle >> 32);
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(fsregHandle))) return ret;
+
+  return cmdbuf[1];
+}
+
+Result FSREG_LoadProgram(u64 *prog_handle, FS_ProgramInfo *title)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x404,4,0); // 0x4040100
+  memcpy(&cmdbuf[1], &title->programId, sizeof(u64));
+  *(u8 *)&cmdbuf[3] = title->mediaType;
+  memcpy(((u8 *)&cmdbuf[3])+1, &title->padding, 7);
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(fsregHandle))) return ret;
+  *prog_handle = *(u64 *)&cmdbuf[2];
+
+  return cmdbuf[1];
+}
+
+Result FSREG_GetProgramInfo(exheader_header *exheader, u32 entry_count, u64 prog_handle)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x403,3,0); // 0x40300C0
+  cmdbuf[1] = entry_count;
+  *(u64 *)&cmdbuf[2] = prog_handle;
+  cmdbuf[64] = ((entry_count << 10) << 14) | 2;
+  cmdbuf[65] = (u32) exheader;
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(fsregHandle))) return ret;
+
+  return cmdbuf[1];
+}
+
+Result FSREG_UnloadProgram(u64 prog_handle)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x405,2,0); // 0x4050080
+  cmdbuf[1] = (u32) (prog_handle);
+  cmdbuf[2] = (u32) (prog_handle >> 32);
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(fsregHandle))) return ret;
+
+  return cmdbuf[1];
+}
+
+Result FSREG_Unregister(u32 pid)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x402,1,0); // 0x4020040
+  cmdbuf[1] = pid;
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(fsregHandle))) return ret;
+
+  return cmdbuf[1];
+}
+
+Result FSREG_Register(u32 pid, u64 prog_handle, FS_ProgramInfo *info, void *storageinfo)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x401,0xf,0); // 0x40103C0
+  cmdbuf[1] = pid;
+  *(u64 *)&cmdbuf[2] = prog_handle;
+  memcpy(&cmdbuf[4], &info->programId, sizeof(u64));
+  *(u8 *)&cmdbuf[6] = info->mediaType;
+  memcpy(((u8 *)&cmdbuf[6])+1, &info->padding, 7);
+  memcpy((u8 *)&cmdbuf[8], storageinfo, 32);
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(fsregHandle))) return ret;
+
+  return cmdbuf[1];
+}
--- a/injector/source/fsreg.h
+++ b/injector/source/fsreg.h
@@ -0,0 +1,13 @@
+#pragma once
+
+#include <3ds/types.h>
+#include "exheader.h"
+
+Result fsregInit(void);
+void fsregExit(void);
+Result FSREG_CheckHostLoadId(u64 prog_handle);
+Result FSREG_LoadProgram(u64 *prog_handle, FS_ProgramInfo *title);
+Result FSREG_GetProgramInfo(exheader_header *exheader, u32 entry_count, u64 prog_handle);
+Result FSREG_UnloadProgram(u64 prog_handle);
+Result FSREG_Unregister(u32 pid);
+Result FSREG_Register(u32 pid, u64 prog_handle, FS_ProgramInfo *info, void *storageinfo);
--- a/injector/source/ifile.c
+++ b/injector/source/ifile.c
@@ -0,0 +1,105 @@
+#include <3ds.h>
+#include "ifile.h"
+#include "fsldr.h"
+
+Result IFile_Open(IFile *file, FS_Archive archive, FS_Path path, u32 flags)
+{
+  Result res;
+
+  res = FSLDR_OpenFileDirectly(&file->handle, archive, path, flags, 0);
+  file->pos = 0;
+  file->size = 0;
+  return res;
+}
+
+Result IFile_Close(IFile *file)
+{
+  return FSFILE_Close(file->handle);
+}
+
+Result IFile_GetSize(IFile *file, u64 *size)
+{
+  Result res;
+
+  res = FSFILE_GetSize(file->handle, size);
+  file->size = *size;
+  return res;
+}
+
+Result IFile_Read(IFile *file, u64 *total, void *buffer, u32 len)
+{
+  u32 read;
+  u32 left;
+  char *buf;
+  u64 cur;
+  Result res;
+
+  if (len == 0)
+  {
+    *total = 0;
+    return 0;
+  }
+
+  buf = (char *)buffer;
+  cur = 0;
+  left = len;
+  while (1)
+  {
+    res = FSFILE_Read(file->handle, &read, file->pos, buf, left);
+    if (R_FAILED(res))
+    {
+      break;
+    }
+
+    cur += read;
+    file->pos += read;
+    if (read == left)
+    {
+      break;
+    }
+    buf += read;
+    left -= read;
+  }
+
+  *total = cur;
+  return res;
+}
+
+Result IFile_Write(IFile *file, u64 *total, void *buffer, u32 len, u32 flags)
+{
+  u32 written;
+  u32 left;
+  char *buf;
+  u64 cur;
+  Result res;
+
+  if (len == 0)
+  {
+    *total = 0;
+    return 0;
+  }
+
+  buf = (char *)buffer;
+  cur = 0;
+  left = len;
+  while (1)
+  {
+    res = FSFILE_Write(file->handle, &written, file->pos, buf, left, flags);
+    if (R_FAILED(res))
+    {
+      break;
+    }
+
+    cur += written;
+    file->pos += written;
+    if (written == left)
+    {
+      break;
+    }
+    buf += written;
+    left -= written;
+  }
+
+  *total = cur;
+  return res;
+}
--- a/injector/source/ifile.h
+++ b/injector/source/ifile.h
@@ -0,0 +1,16 @@
+#pragma once
+
+#include <3ds/types.h>
+
+typedef struct
+{
+  Handle handle;
+  u64 pos;
+  u64 size;
+} IFile;
+
+Result IFile_Open(IFile *file, FS_Archive archive, FS_Path path, u32 flags);
+Result IFile_Close(IFile *file);
+Result IFile_GetSize(IFile *file, u64 *size);
+Result IFile_Read(IFile *file, u64 *total, void *buffer, u32 len);
+Result IFile_Write(IFile *file, u64 *total, void *buffer, u32 len, u32 flags);
--- a/injector/source/loader.c
+++ b/injector/source/loader.c
@@ -0,0 +1,593 @@
+#include <3ds.h>
+#include <string.h>
+#include <sys/iosupport.h>
+#include "patcher.h"
+#include "exheader.h"
+#include "ifile.h"
+#include "fsldr.h"
+#include "fsreg.h"
+#include "pxipm.h"
+#include "srvsys.h"
+
+#define MAX_SESSIONS 1
+
+const char CODE_PATH[] = {0x01, 0x00, 0x00, 0x00, 0x2E, 0x63, 0x6F, 0x64, 0x65, 0x00, 0x00, 0x00};
+
+typedef struct
+{
+  u32 text_addr;
+  u32 text_size;
+  u32 ro_addr;
+  u32 ro_size;
+  u32 data_addr;
+  u32 data_size;
+  u32 total_size;
+} prog_addrs_t;
+
+static Handle g_handles[MAX_SESSIONS+2];
+static int g_active_handles;
+static u64 g_cached_prog_handle;
+static exheader_header g_exheader;
+static char g_ret_buf[1024];
+
+static int lzss_decompress(u8 *end)
+{
+  unsigned int v1; // r1@2
+  u8 *v2; // r2@2
+  u8 *v3; // r3@2
+  u8 *v4; // r1@2
+  char v5; // r5@4
+  char v6; // t1@4
+  signed int v7; // r6@4
+  int v9; // t1@7
+  u8 *v11; // r3@8
+  int v12; // r12@8
+  int v13; // t1@8
+  int v14; // t1@8
+  unsigned int v15; // r7@8
+  int v16; // r12@8
+  int ret;
+
+  ret = 0;
+  if ( end )
+  {
+    v1 = *((u32 *)end - 2);
+    v2 = &end[*((u32 *)end - 1)];
+    v3 = &end[-(v1 >> 24)];
+    v4 = &end[-(v1 & 0xFFFFFF)];
+    while ( v3 > v4 )
+    {
+      v6 = *(v3-- - 1);
+      v5 = v6;
+      v7 = 8;
+      while ( 1 )
+      {
+        if ( (v7-- < 1) )
+          break;
+        if ( v5 & 0x80 )
+        {
+          v13 = *(v3 - 1);
+          v11 = v3 - 1;
+          v12 = v13;
+          v14 = *(v11 - 1);
+          v3 = v11 - 1;
+          v15 = ((v14 | (v12 << 8)) & 0xFFFF0FFF) + 2;
+          v16 = v12 + 32;
+          do
+          {
+            ret = v2[v15];
+            *(v2-- - 1) = ret;
+            v16 -= 16;
+          }
+          while ( !(v16 < 0) );
+        }
+        else
+        {
+          v9 = *(v3-- - 1);
+          ret = v9;
+          *(v2-- - 1) = v9;
+        }
+        v5 *= 2;
+        if ( v3 <= v4 )
+          return ret;
+      }
+    }
+  }
+  return ret;
+}
+
+static Result allocate_shared_mem(prog_addrs_t *shared, prog_addrs_t *vaddr, int flags)
+{
+  u32 dummy;
+
+  memcpy(shared, vaddr, sizeof(prog_addrs_t));
+  shared->text_addr = 0x10000000;
+  shared->ro_addr = shared->text_addr + (shared->text_size << 12);
+  shared->data_addr = shared->ro_addr + (shared->ro_size << 12);
+  return svcControlMemory(&dummy, shared->text_addr, 0, shared->total_size << 12, (flags & 0xF00) | MEMOP_ALLOC, MEMPERM_READ | MEMPERM_WRITE);
+}
+
+static Result load_code(u64 progid, prog_addrs_t *shared, u64 prog_handle, int is_compressed)
+{
+  IFile file;
+  FS_Archive archive;
+  FS_Path path;
+  Result res;
+  u64 size;
+  u64 total;
+
+  archive.id = ARCHIVE_SAVEDATA_AND_CONTENT2;
+  archive.lowPath.type = PATH_BINARY;
+  archive.lowPath.data = &prog_handle;
+  archive.lowPath.size = 8;
+  //archive.handle = prog_handle; // not needed
+  path.type = PATH_BINARY;
+  path.data = CODE_PATH;
+  path.size = sizeof(CODE_PATH);
+  if (R_FAILED(IFile_Open(&file, archive, path, FS_OPEN_READ)))
+  {
+    svcBreak(USERBREAK_ASSERT);
+  }
+
+  // get file size
+  if (R_FAILED(IFile_GetSize(&file, &size)))
+  {
+    IFile_Close(&file);
+    svcBreak(USERBREAK_ASSERT);
+  }
+
+  // check size
+  if (size > (u64)shared->total_size << 12)
+  {
+    IFile_Close(&file);
+    return 0xC900464F;
+  }
+
+  // read code
+  res = IFile_Read(&file, &total, (void *)shared->text_addr, size);
+  IFile_Close(&file); // done reading
+  if (R_FAILED(res))
+  {
+    svcBreak(USERBREAK_ASSERT);
+  }
+
+  // decompress
+  if (is_compressed)
+  {
+    lzss_decompress((u8 *)shared->text_addr + size);
+  }
+
+  // patch
+  patchCode(progid, (u8 *)shared->text_addr, shared->total_size << 12);
+
+  return 0;
+}
+
+static Result loader_GetProgramInfo(exheader_header *exheader, u64 prog_handle)
+{
+  Result res;
+
+  if (prog_handle >> 32 == 0xFFFF0000)
+  {
+    return FSREG_GetProgramInfo(exheader, 1, prog_handle);
+  }
+  else
+  {
+    res = FSREG_CheckHostLoadId(prog_handle);
+    //if ((res >= 0 && (unsigned)res >> 27) || (res < 0 && ((unsigned)res >> 27)-32))
+    //so use PXIPM if FSREG fails OR returns "info", is the second condition a bug?
+    if (R_FAILED(res) || (R_SUCCEEDED(res) && R_LEVEL(res) != RL_SUCCESS))
+    {
+      return PXIPM_GetProgramInfo(exheader, prog_handle);
+    }
+    else
+    {
+      return FSREG_GetProgramInfo(exheader, 1, prog_handle);
+    }
+  }
+}
+
+static Result loader_LoadProcess(Handle *process, u64 prog_handle)
+{
+  Result res;
+  int count;
+  u32 flags;
+  u32 desc;
+  u32 dummy;
+  prog_addrs_t shared_addr;
+  prog_addrs_t vaddr;
+  Handle codeset;
+  CodeSetInfo codesetinfo;
+  u32 data_mem_size;
+  u64 progid;
+
+  // make sure the cached info corrosponds to the current prog_handle
+  if (g_cached_prog_handle != prog_handle)
+  {
+    res = loader_GetProgramInfo(&g_exheader, prog_handle);
+    g_cached_prog_handle = prog_handle;
+    if (res < 0)
+    {
+      g_cached_prog_handle = 0;
+      return res;
+    }
+  }
+
+  // get kernel flags
+  flags = 0;
+  for (count = 0; count < 28; count++)
+  {
+    desc = g_exheader.arm11kernelcaps.descriptors[count];
+    if (0x1FE == desc >> 23)
+    {
+      flags = desc & 0xF00;
+    }
+  }
+  if (flags == 0)
+  {
+    return MAKERESULT(RL_PERMANENT, RS_INVALIDARG, 1, 2);
+  }
+
+  // allocate process memory
+  vaddr.text_addr = g_exheader.codesetinfo.text.address;
+  vaddr.text_size = (g_exheader.codesetinfo.text.codesize + 4095) >> 12;
+  vaddr.ro_addr = g_exheader.codesetinfo.ro.address;
+  vaddr.ro_size = (g_exheader.codesetinfo.ro.codesize + 4095) >> 12;
+  vaddr.data_addr = g_exheader.codesetinfo.data.address;
+  vaddr.data_size = (g_exheader.codesetinfo.data.codesize + 4095) >> 12;
+  data_mem_size = (g_exheader.codesetinfo.data.codesize + g_exheader.codesetinfo.bsssize + 4095) >> 12;
+  vaddr.total_size = vaddr.text_size + vaddr.ro_size + vaddr.data_size;
+  if ((res = allocate_shared_mem(&shared_addr, &vaddr, flags)) < 0)
+  {
+    return res;
+  }
+
+  // load code
+  progid = g_exheader.arm11systemlocalcaps.programid;
+  if ((res = load_code(progid, &shared_addr, prog_handle, g_exheader.codesetinfo.flags.flag & 1)) >= 0)
+  {
+    memcpy(&codesetinfo.name, g_exheader.codesetinfo.name, 8);
+    codesetinfo.program_id = progid;
+    codesetinfo.text_addr = vaddr.text_addr;
+    codesetinfo.text_size = vaddr.text_size;
+    codesetinfo.text_size_total = vaddr.text_size;
+    codesetinfo.ro_addr = vaddr.ro_addr;
+    codesetinfo.ro_size = vaddr.ro_size;
+    codesetinfo.ro_size_total = vaddr.ro_size;
+    codesetinfo.rw_addr = vaddr.data_addr;
+    codesetinfo.rw_size = vaddr.data_size;
+    codesetinfo.rw_size_total = data_mem_size;
+    res = svcCreateCodeSet(&codeset, &codesetinfo, (void *)shared_addr.text_addr, (void *)shared_addr.ro_addr, (void *)shared_addr.data_addr);
+    if (res >= 0)
+    {
+      res = svcCreateProcess(process, codeset, g_exheader.arm11kernelcaps.descriptors, count);
+      svcCloseHandle(codeset);
+      if (res >= 0)
+      {
+        return 0;
+      }
+    }
+  }
+
+  svcControlMemory(&dummy, shared_addr.text_addr, 0, shared_addr.total_size << 12, MEMOP_FREE, 0);
+  return res;
+}
+
+static Result loader_RegisterProgram(u64 *prog_handle, FS_ProgramInfo *title, FS_ProgramInfo *update)
+{
+  Result res;
+  u64 prog_id;
+
+  prog_id = title->programId;
+  if (prog_id >> 32 != 0xFFFF0000)
+  {
+    res = FSREG_CheckHostLoadId(prog_id);
+    //if ((res >= 0 && (unsigned)res >> 27) || (res < 0 && ((unsigned)res >> 27)-32))
+    if (R_FAILED(res) || (R_SUCCEEDED(res) && R_LEVEL(res) != RL_SUCCESS))
+    {
+      res = PXIPM_RegisterProgram(prog_handle, title, update);
+      if (res < 0)
+      {
+        return res;
+      }
+      if (*prog_handle >> 32 != 0xFFFF0000)
+      {
+        res = FSREG_CheckHostLoadId(*prog_handle);
+        //if ((res >= 0 && (unsigned)res >> 27) || (res < 0 && ((unsigned)res >> 27)-32))
+        if (R_FAILED(res) || (R_SUCCEEDED(res) && R_LEVEL(res) != RL_SUCCESS))
+        {
+          return 0;
+        }
+      }
+      svcBreak(USERBREAK_ASSERT);
+    }
+  }
+
+  if ((title->mediaType != update->mediaType) || (prog_id != update->programId))
+  {
+    svcBreak(USERBREAK_ASSERT);
+  }
+  res = FSREG_LoadProgram(prog_handle, title);
+  if (R_SUCCEEDED(res))
+  {
+    if (*prog_handle >> 32 == 0xFFFF0000)
+    {
+      return 0;
+    }
+    res = FSREG_CheckHostLoadId(*prog_handle);
+    //if ((res >= 0 && (unsigned)res >> 27) || (res < 0 && ((unsigned)res >> 27)-32))
+    if (R_FAILED(res) || (R_SUCCEEDED(res) && R_LEVEL(res) != RL_SUCCESS))
+    {
+      svcBreak(USERBREAK_ASSERT);
+    }
+  }
+  return res;
+}
+
+static Result loader_UnregisterProgram(u64 prog_handle)
+{
+  Result res;
+
+  if (prog_handle >> 32 == 0xFFFF0000)
+  {
+    return FSREG_UnloadProgram(prog_handle);
+  }
+  else
+  {
+    res = FSREG_CheckHostLoadId(prog_handle);
+    //if ((res >= 0 && (unsigned)res >> 27) || (res < 0 && ((unsigned)res >> 27)-32))
+    if (R_FAILED(res) || (R_SUCCEEDED(res) && R_LEVEL(res) != RL_SUCCESS))
+    {
+      return PXIPM_UnregisterProgram(prog_handle);
+    }
+    else
+    {
+      return FSREG_UnloadProgram(prog_handle);
+    }
+  }
+}
+
+static void handle_commands(void)
+{
+  FS_ProgramInfo title;
+  FS_ProgramInfo update;
+  u32* cmdbuf;
+  u16 cmdid;
+  int res;
+  Handle handle;
+  u64 prog_handle;
+
+  cmdbuf = getThreadCommandBuffer();
+  cmdid = cmdbuf[0] >> 16;
+  res = 0;
+  switch (cmdid)
+  {
+    case 1: // LoadProcess
+    {
+      res = loader_LoadProcess(&handle, *(u64 *)&cmdbuf[1]);
+      cmdbuf[0] = 0x10042;
+      cmdbuf[1] = res;
+      cmdbuf[2] = 16;
+      cmdbuf[3] = handle;
+      break;
+    }
+    case 2: // RegisterProgram
+    {
+      memcpy(&title, &cmdbuf[1], sizeof(FS_ProgramInfo));
+      memcpy(&update, &cmdbuf[5], sizeof(FS_ProgramInfo));
+      res = loader_RegisterProgram(&prog_handle, &title, &update);
+      cmdbuf[0] = 0x200C0;
+      cmdbuf[1] = res;
+      *(u64 *)&cmdbuf[2] = prog_handle;
+      break;
+    }
+    case 3: // UnregisterProgram
+    {
+      if (g_cached_prog_handle == prog_handle)
+      {
+        g_cached_prog_handle = 0;
+      }
+      cmdbuf[0] = 0x30040;
+      cmdbuf[1] = loader_UnregisterProgram(*(u64 *)&cmdbuf[1]);
+      break;
+    }
+    case 4: // GetProgramInfo
+    {
+      prog_handle = *(u64 *)&cmdbuf[1];
+      if (prog_handle != g_cached_prog_handle)
+      {
+        res = loader_GetProgramInfo(&g_exheader, prog_handle);
+        if (res >= 0)
+        {
+          g_cached_prog_handle = prog_handle;
+        }
+        else
+        {
+          g_cached_prog_handle = 0;
+        }
+      }
+      memcpy(&g_ret_buf, &g_exheader, 1024);
+      cmdbuf[0] = 0x40042;
+      cmdbuf[1] = res;
+      cmdbuf[2] = 0x1000002;
+      cmdbuf[3] = (u32) &g_ret_buf;
+      break;
+    }
+    default: // error
+    {
+      cmdbuf[0] = 0x40;
+      cmdbuf[1] = 0xD900182F;
+      break;
+    }
+  }
+}
+
+static Result should_terminate(int *term_request)
+{
+  u32 notid;
+  Result ret;
+
+  ret = srvSysReceiveNotification(&notid);
+  if (R_FAILED(ret))
+  {
+    return ret;
+  }
+  if (notid == 0x100) // term request
+  {
+    *term_request = 1;
+  }
+  return 0;
+}
+
+// this is called before main
+void __appInit()
+{
+  srvSysInit();
+  fsregInit();
+  fsldrInit();
+  pxipmInit();
+}
+
+// this is called after main exits
+void __appExit()
+{
+  pxipmExit();
+  fsldrExit();
+  fsregExit();
+  srvSysExit();
+}
+
+// stubs for non-needed pre-main functions
+void __sync_init();
+void __sync_fini();
+void __system_initSyscalls();
+ 
+void __ctru_exit(int rc)
+{
+  __appExit();
+  __sync_fini();
+  svcExitProcess();
+}
+ 
+void initSystem(void (*retAddr)(void))
+{
+  __sync_init();
+  __system_initSyscalls();
+  __appInit();
+}
+
+int main()
+{
+  Result ret;
+  Handle handle;
+  Handle reply_target;
+  Handle *srv_handle;
+  Handle *notification_handle;
+  s32 index;
+  int i;
+  int term_request;
+  u32* cmdbuf;
+
+  ret = 0;
+
+  srv_handle = &g_handles[1];
+  notification_handle = &g_handles[0];
+
+  if (R_FAILED(srvSysRegisterService(srv_handle, "Loader", MAX_SESSIONS)))
+  {
+    svcBreak(USERBREAK_ASSERT);
+  }
+
+  if (R_FAILED(srvSysEnableNotification(notification_handle)))
+  {
+    svcBreak(USERBREAK_ASSERT);
+  }
+
+  g_active_handles = 2;
+  g_cached_prog_handle = 0;
+  index = 1;
+
+  reply_target = 0;
+  term_request = 0;
+  do
+  {
+    if (reply_target == 0)
+    {
+      cmdbuf = getThreadCommandBuffer();
+      cmdbuf[0] = 0xFFFF0000;
+    }
+    ret = svcReplyAndReceive(&index, g_handles, g_active_handles, reply_target);
+
+    if (R_FAILED(ret))
+    {
+      // check if any handle has been closed
+      if (ret == 0xC920181A)
+      {
+        if (index == -1)
+        {
+          for (i = 2; i < MAX_SESSIONS+2; i++)
+          {
+            if (g_handles[i] == reply_target)
+            {
+              index = i;
+              break;
+            }
+          }
+        }
+        svcCloseHandle(g_handles[index]);
+        g_handles[index] = g_handles[g_active_handles-1];
+        g_active_handles--;
+        reply_target = 0;
+      }
+      else 
+      {
+        svcBreak(USERBREAK_ASSERT);
+      }
+    }
+    else
+    {
+      // process responses
+      reply_target = 0;
+      switch (index)
+      {
+        case 0: // notification
+        {
+          if (R_FAILED(should_terminate(&term_request)))
+          {
+            svcBreak(USERBREAK_ASSERT);
+          }
+          break;
+        }
+        case 1: // new session
+        {
+          if (R_FAILED(svcAcceptSession(&handle, *srv_handle)))
+          {
+            svcBreak(USERBREAK_ASSERT);
+          }
+          if (g_active_handles < MAX_SESSIONS+2)
+          {
+            g_handles[g_active_handles] = handle;
+            g_active_handles++;
+          }
+          else
+          {
+            svcCloseHandle(handle);
+          }
+          break;
+        }
+        default: // session
+        {
+          handle_commands();
+          reply_target = g_handles[index];
+          break;
+        }
+      }
+    }
+  } while (!term_request || g_active_handles != 2);
+
+  srvSysUnregisterService("Loader");
+  svcCloseHandle(*srv_handle);
+  svcCloseHandle(*notification_handle);
+
+  return 0;
+}
--- a/injector/source/patcher.c
+++ b/injector/source/patcher.c
@@ -0,0 +1,264 @@
+#include <3ds.h>
+#include <string.h>
+#include "patcher.h"
+#include "ifile.h"
+
+#ifndef PATH_MAX
+#define PATH_MAX 255
+#endif
+
+static u32 config = 0;
+static u8 secureinfo[0x111] = {0};
+
+//Quick Search algorithm, adapted from http://igm.univ-mlv.fr/~lecroq/string/node19.html#SECTION00190
+static u8 *memsearch(u8 *startPos, const void *pattern, u32 size, u32 patternSize)
+{
+    const u8 *patternc = (const u8 *)pattern;
+
+    //Preprocessing
+    u32 table[256];
+
+    for(u32 i = 0; i < 256; ++i)
+        table[i] = patternSize + 1;
+    for(u32 i = 0; i < patternSize; ++i)
+        table[patternc[i]] = patternSize - i;
+
+    //Searching
+    u32 j = 0;
+
+    while(j <= size - patternSize)
+    {
+        if(memcmp(patternc, startPos + j, patternSize) == 0)
+            return startPos + j;
+        j += table[startPos[j + patternSize]];
+    }
+
+    return NULL;
+}
+
+static u32 patchMemory(u8 *start, u32 size, const void *pattern, u32 patSize, int offset, const void *replace, u32 repSize, u32 count)
+{
+    u32 i;
+
+    for(i = 0; i < count; i++)
+    {
+        u8 *found = memsearch(start, pattern, size, patSize);
+
+        if(found == NULL)
+            break;
+
+        memcpy(found + offset, replace, repSize);
+
+        u32 at = (u32)(found - start);
+
+        if(at + patSize > size) size = 0;
+        else size = size - (at + patSize);
+
+        start = found + patSize;
+    }
+
+    return i;
+}
+
+static int fileOpen(IFile *file, FS_ArchiveID id, const char *path, int flags)
+{
+    FS_Archive archive;
+    FS_Path ppath;
+
+    size_t len = strnlen(path, PATH_MAX);
+    archive.id = id;
+    archive.lowPath.type = PATH_EMPTY;
+    archive.lowPath.size = 1;
+    archive.lowPath.data = (u8 *)"";
+    ppath.type = PATH_ASCII;
+    ppath.data = path;
+    ppath.size = len+1;
+
+    return IFile_Open(file, archive, ppath, flags);
+}
+
+static int loadSecureinfo()
+{
+    IFile file;
+    Result ret;
+    u64 total;
+
+    if(secureinfo[0] == 0xFF)
+        return 0;
+
+    ret = fileOpen(&file, ARCHIVE_NAND_RW, "/sys/SecureInfo_C", FS_OPEN_READ);
+    if(R_SUCCEEDED(ret))
+    {
+        ret = IFile_Read(&file, &total, secureinfo, sizeof(secureinfo));
+        IFile_Close(&file);
+        if(R_SUCCEEDED(ret) && total == sizeof(secureinfo))
+            secureinfo[0] = 0xFF;
+    }
+
+    return ret;
+}
+
+static int loadConfig()
+{
+    IFile file;
+    Result ret;
+    u64 total;
+
+    if(config)
+        return 0;
+
+    ret = fileOpen(&file, ARCHIVE_SDMC, "/aurei/config.bin", FS_OPEN_READ);
+    if(R_SUCCEEDED(ret))
+    {
+        ret = IFile_Read(&file, &total, &config, 3);
+        IFile_Close(&file);
+    }
+
+    return ret;
+}
+
+void patchCode(u64 progId, u8 *code, u32 size)
+{
+    switch(progId)
+    {
+        case 0x0004003000008F02LL: // USA Menu
+        case 0x0004003000008202LL: // EUR Menu
+        case 0x0004003000009802LL: // JPN Menu
+        case 0x000400300000A102LL: // CHN Menu
+        case 0x000400300000A902LL: // KOR Menu
+        case 0x000400300000B102LL: // TWN Menu
+        {
+            static const u8 regionFreePattern[] = {
+                0x00, 0x00, 0x55, 0xE3, 0x01, 0x10, 0xA0, 0xE3
+            };
+            static const u8 regionFreePatch[] = {
+                0x01, 0x00, 0xA0, 0xE3, 0x1E, 0xFF, 0x2F, 0xE1
+            };
+
+            //Patch SMDH region checks
+            patchMemory(code, size, 
+                regionFreePattern, 
+                sizeof(regionFreePattern), -16, 
+                regionFreePatch, 
+                sizeof(regionFreePatch), 1
+            );
+
+            break;
+        }
+
+        case 0x0004013000002C02LL: // NIM
+        {
+            static const u8 blockAutoUpdatesPattern[] = {
+                0x25, 0x79, 0x0B, 0x99
+            };
+            static const u8 blockAutoUpdatesPatch[] = {
+                0xE3, 0xA0
+            };
+            static const u8 skipEshopUpdateCheckPattern[] = {
+                0x30, 0xB5, 0xF1, 0xB0
+            };
+            static const u8 skipEshopUpdateCheckPatch[] = {
+                0x00, 0x20, 0x08, 0x60, 0x70, 0x47
+            };
+
+            //Block silent auto-updates
+            patchMemory(code, size, 
+                blockAutoUpdatesPattern, 
+                sizeof(blockAutoUpdatesPattern), 0, 
+                blockAutoUpdatesPatch, 
+                sizeof(blockAutoUpdatesPatch), 1
+            );
+
+            //Skip update checks to access the EShop
+            patchMemory(code, size, 
+                skipEshopUpdateCheckPattern, 
+                sizeof(skipEshopUpdateCheckPattern), 0, 
+                skipEshopUpdateCheckPatch, 
+                sizeof(skipEshopUpdateCheckPatch), 1
+            );
+
+            break;
+        }
+
+        case 0x0004001000021000LL: // USA MSET
+        case 0x0004001000020000LL: // JPN MSET
+        case 0x0004001000022000LL: // EUR MSET
+        case 0x0004001000026000LL: // CHN MSET
+        case 0x0004001000027000LL: // KOR MSET
+        case 0x0004001000028000LL: // TWN MSET
+        {
+            if(R_SUCCEEDED(loadConfig()) && ((config >> 5) & 1))
+            {
+                static const u16 verPattern[] = u"Ver.";
+                const u32 currentFirm = ((config >> 12) & 1);
+                const u32 currentNand = ((config >> 13) & 3);
+
+                //Patch Ver. string
+                patchMemory(code, size,
+                    verPattern,
+                    sizeof(verPattern) - sizeof(u16), 0,
+                    currentNand ? ((currentNand == 1) ? ((currentFirm == 1) ? u" Emu" : u"Emu9") : u"Emu2") :
+                                  ((currentFirm == 1) ? u" Sys" : u"Sys9"),
+                    sizeof(verPattern) - sizeof(u16), 1
+                );
+            }
+
+            break;
+        }
+
+        case 0x0004013000008002LL: // NS
+        {
+            static const u8 stopCartUpdatesPattern[] = {
+                0x0C, 0x18, 0xE1, 0xD8
+            };
+            static const u8 stopCartUpdatesPatch[] = {
+                0x0B, 0x18, 0x21, 0xC8
+            };
+
+            //Disable updates from foreign carts (makes carts region-free)
+            patchMemory(code, size, 
+                stopCartUpdatesPattern, 
+                sizeof(stopCartUpdatesPattern), 0, 
+                stopCartUpdatesPatch,
+                sizeof(stopCartUpdatesPatch), 2
+            );
+
+            break;
+        }
+
+        case 0x0004013000001702LL: // CFG
+        {
+            static const u8 secureinfoSigCheckPattern[] = {
+                0x06, 0x46, 0x10, 0x48, 0xFC
+            };
+            static const u8 secureinfoSigCheckPatch[] = {
+                0x00, 0x26
+            };
+
+            //Disable SecureInfo signature check
+            patchMemory(code, size, 
+                secureinfoSigCheckPattern, 
+                sizeof(secureinfoSigCheckPattern), 0, 
+                secureinfoSigCheckPatch, 
+                sizeof(secureinfoSigCheckPatch), 1
+            );
+
+            if(R_SUCCEEDED(loadSecureinfo()))
+            {
+                static const u16 secureinfoFilenamePattern[] = u"SecureInfo_";
+                static const u16 secureinfoFilenamePatch[] = u"C";
+
+                //Use SecureInfo_C
+                patchMemory(code, size, 
+                    secureinfoFilenamePattern, 
+                    sizeof(secureinfoFilenamePattern) - sizeof(u16),
+                    sizeof(secureinfoFilenamePattern) - sizeof(u16), 
+                    secureinfoFilenamePatch, 
+                    sizeof(secureinfoFilenamePatch) - sizeof(u16), 2
+                );
+            }
+
+            break;
+        }
+    }
+}
--- a/injector/source/patcher.h
+++ b/injector/source/patcher.h
@@ -0,0 +1,5 @@
+#pragma once
+
+#include <3ds/types.h>
+
+void patchCode(u64 progId, u8 *code, u32 size);
--- a/injector/source/pxipm.c
+++ b/injector/source/pxipm.c
@@ -0,0 +1,74 @@
+#include <3ds.h>
+#include <string.h>
+#include "pxipm.h"
+#include "srvsys.h"
+
+static Handle pxipmHandle;
+static int pxipmRefCount;
+
+Result pxipmInit(void)
+{
+  Result ret = 0;
+
+  if (AtomicPostIncrement(&pxipmRefCount)) return 0;
+
+  ret = srvSysGetServiceHandle(&pxipmHandle, "PxiPM");
+
+  if (R_FAILED(ret)) AtomicDecrement(&pxipmRefCount);
+  return ret;
+}
+
+void pxipmExit(void)
+{
+  if (AtomicDecrement(&pxipmRefCount)) return;
+  svcCloseHandle(pxipmHandle);
+}
+
+Result PXIPM_RegisterProgram(u64 *prog_handle, FS_ProgramInfo *title, FS_ProgramInfo *update)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x2,8,0); // 0x20200
+  memcpy(&cmdbuf[1], &title->programId, sizeof(u64));
+  *(u8 *)&cmdbuf[3] = title->mediaType;
+  memcpy(((u8 *)&cmdbuf[3])+1, &title->padding, 7);
+  memcpy(&cmdbuf[5], &update->programId, sizeof(u64));
+  *(u8 *)&cmdbuf[7] = update->mediaType;
+  memcpy(((u8 *)&cmdbuf[7])+1, &update->padding, 7);
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(pxipmHandle))) return ret;
+  *prog_handle = *(u64*)&cmdbuf[2];
+
+  return cmdbuf[1];
+}
+
+Result PXIPM_GetProgramInfo(exheader_header *exheader, u64 prog_handle)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x1,2,2); // 0x10082
+  cmdbuf[1] = (u32) (prog_handle);
+  cmdbuf[2] = (u32) (prog_handle >> 32);
+  cmdbuf[3] = (0x400 << 8) | 0x4;
+  cmdbuf[4] = (u32) exheader;
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(pxipmHandle))) return ret;
+
+  return cmdbuf[1];
+}
+
+Result PXIPM_UnregisterProgram(u64 prog_handle)
+{
+  u32 *cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x3,2,0); // 0x30080
+  cmdbuf[1] = (u32) (prog_handle);
+  cmdbuf[2] = (u32) (prog_handle >> 32);
+
+  Result ret = 0;
+  if(R_FAILED(ret = svcSendSyncRequest(pxipmHandle))) return ret;
+
+  return cmdbuf[1];
+}
--- a/injector/source/pxipm.h
+++ b/injector/source/pxipm.h
@@ -0,0 +1,10 @@
+#pragma once
+
+#include <3ds/types.h>
+#include "exheader.h"
+
+Result pxipmInit(void);
+void pxipmExit(void);
+Result PXIPM_RegisterProgram(u64 *prog_handle, FS_ProgramInfo *title, FS_ProgramInfo *update);
+Result PXIPM_GetProgramInfo(exheader_header *exheader, u64 prog_handle);
+Result PXIPM_UnregisterProgram(u64 prog_handle);
--- a/injector/source/srvsys.c
+++ b/injector/source/srvsys.c
@@ -0,0 +1,154 @@
+#include <3ds.h>
+#include <string.h>
+#include "srvsys.h"
+
+static Handle srvHandle;
+static int srvRefCount;
+static RecursiveLock initLock;
+static int initLockinit = 0;
+
+Result srvSysInit()
+{
+  Result rc = 0;
+
+  if (!initLockinit)
+  {
+    RecursiveLock_Init(&initLock);
+  }
+
+  RecursiveLock_Lock(&initLock);
+
+  if (srvRefCount > 0)
+  {
+    RecursiveLock_Unlock(&initLock);
+    return MAKERESULT(RL_INFO, RS_NOP, 25, RD_ALREADY_INITIALIZED);
+  }
+
+  while (1)
+  {
+    rc = svcConnectToPort(&srvHandle, "srv:");
+    if (R_LEVEL(rc) != RL_PERMANENT || 
+        R_SUMMARY(rc) != RS_NOTFOUND || 
+        R_DESCRIPTION(rc) != RD_NOT_FOUND
+       ) break;
+    svcSleepThread(500000);
+  }
+  if (R_SUCCEEDED(rc))
+  {
+    rc = srvSysRegisterClient();
+    srvRefCount++;
+  }
+
+  RecursiveLock_Unlock(&initLock);
+  return rc;
+}
+
+Result srvSysRegisterClient(void)
+{
+  Result rc = 0;
+  u32* cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x1,0,2); // 0x10002
+  cmdbuf[1] = IPC_Desc_CurProcessHandle();
+
+  if(R_FAILED(rc = svcSendSyncRequest(srvHandle)))return rc;
+
+  return cmdbuf[1];
+}
+
+Result srvSysExit()
+{
+  Result rc;
+  RecursiveLock_Lock(&initLock);
+
+  if (srvRefCount > 1)
+  {
+    srvRefCount--;
+    RecursiveLock_Unlock(&initLock);
+    return MAKERESULT(RL_INFO, RS_NOP, 25, RD_BUSY);
+  }
+
+  if (srvHandle != 0) svcCloseHandle(srvHandle);
+  else svcBreak(USERBREAK_ASSERT);
+  rc = (Result)srvHandle; // yeah, I think this is a benign bug
+  srvHandle = 0;
+  srvRefCount--;
+  RecursiveLock_Unlock(&initLock);
+  return rc;
+}
+
+Result srvSysGetServiceHandle(Handle* out, const char* name)
+{
+  Result rc = 0;
+  u32* cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x5,4,0); // 0x50100
+  strncpy((char*) &cmdbuf[1], name,8);
+  cmdbuf[3] = strlen(name);
+  cmdbuf[4] = 0x0;
+
+  if(R_FAILED(rc = svcSendSyncRequest(srvHandle)))return rc;
+
+  if(out) *out = cmdbuf[3];
+
+  return cmdbuf[1];
+}
+
+Result srvSysEnableNotification(Handle* semaphoreOut)
+{
+  Result rc = 0;
+  u32* cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x2,0,0);
+
+  if(R_FAILED(rc = svcSendSyncRequest(srvHandle)))return rc;
+
+  if(semaphoreOut) *semaphoreOut = cmdbuf[3];
+
+  return cmdbuf[1];
+}
+
+Result srvSysReceiveNotification(u32* notificationIdOut)
+{
+  Result rc = 0;
+  u32* cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0xB,0,0); // 0xB0000
+
+  if(R_FAILED(rc = svcSendSyncRequest(srvHandle)))return rc;
+
+  if(notificationIdOut) *notificationIdOut = cmdbuf[2];
+
+  return cmdbuf[1];
+}
+
+Result srvSysRegisterService(Handle* out, const char* name, int maxSessions)
+{
+  Result rc = 0;
+  u32* cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x3,4,0); // 0x30100
+  strncpy((char*) &cmdbuf[1], name,8);
+  cmdbuf[3] = strlen(name);
+  cmdbuf[4] = maxSessions;
+
+  if(R_FAILED(rc = svcSendSyncRequest(srvHandle)))return rc;
+
+  if(out) *out = cmdbuf[3];
+
+  return cmdbuf[1];
+}
+
+Result srvSysUnregisterService(const char* name)
+{
+  Result rc = 0;
+  u32* cmdbuf = getThreadCommandBuffer();
+
+  cmdbuf[0] = IPC_MakeHeader(0x4,3,0); // 0x400C0
+  strncpy((char*) &cmdbuf[1], name,8);
+  cmdbuf[3] = strlen(name);
+
+  if(R_FAILED(rc = svcSendSyncRequest(srvHandle)))return rc;
+
+  return cmdbuf[1];
+}
--- a/injector/source/srvsys.h
+++ b/injector/source/srvsys.h
@@ -0,0 +1,47 @@
+/**
+ * @file srv.h
+ * @brief Service API.
+ */
+#pragma once
+
+/// Initializes the service API.
+Result srvSysInit(void);
+
+/// Exits the service API.
+Result srvSysExit(void);
+
+/**
+ * @brief Retrieves a service handle, retrieving from the environment handle list if possible.
+ * @param out Pointer to write the handle to.
+ * @param name Name of the service.
+ */
+Result srvSysGetServiceHandle(Handle* out, const char* name);
+
+/// Registers the current process as a client to the service API.
+Result srvSysRegisterClient(void);
+
+/**
+ * @brief Enables service notificatios, returning a notification semaphore.
+ * @param semaphoreOut Pointer to output the notification semaphore to.
+ */
+Result srvSysEnableNotification(Handle* semaphoreOut);
+
+/**
+ * @brief Receives a notification.
+ * @param notificationIdOut Pointer to output the ID of the received notification to.
+ */
+Result srvSysReceiveNotification(u32* notificationIdOut);
+
+/**
+ * @brief Registers the current process as a service.
+ * @param out Pointer to write the service handle to.
+ * @param name Name of the service.
+ * @param maxSessions Maximum number of sessions the service can handle.
+ */
+Result srvSysRegisterService(Handle* out, const char* name, int maxSessions);
+
+/**
+ * @brief Unregisters the current process as a service.
+ * @param name Name of the service.
+ */
+Result srvSysUnregisterService(const char* name);
--- a/loader/Makefile
+++ b/loader/Makefile
@@ -16,11 +16,9 @@ include $(DEVKITARM)/3ds_rules
 # INCLUDES is a list of directories containing header files
 # SPECS is the directory containing the important build and link files
 #---------------------------------------------------------------------------------
-export TARGET		:=	$(shell basename $(CURDIR))
+export TARGET	:=	$(shell basename $(CURDIR))
 BUILD		:=	build
-SOURCES		:=	source source/fatfs  source/fatfs/sdmmc
-DATA		:=	data
-INCLUDES	:=	include source/fatfs  source/fatfs/sdmmc
+SOURCES		:=	source source/fatfs source/fatfs/sdmmc

 #---------------------------------------------------------------------------------
 # Setup some defines
@@ -43,14 +41,6 @@ CXXFLAGS	:= $(CFLAGS) -fno-rtti -fno-exceptions
 ASFLAGS	:=	-g $(ARCH)
 LDFLAGS	=	-nostartfiles -g --specs=../stub.specs $(ARCH) -Wl,-Map,$(TARGET).map

-LIBS	:= 
-
-#---------------------------------------------------------------------------------
-# list of directories containing libraries, this must be the top level containing
-# include and lib
-#---------------------------------------------------------------------------------
-LIBDIRS	:=
-  
 #---------------------------------------------------------------------------------
 # no real need to edit anything past this point unless you need to add additional
 # rules for different file extensions
@@ -60,15 +50,13 @@ ifneq ($(BUILD),$(notdir $(CURDIR)))
 
 export OUTPUT	:=	$(CURDIR)/$(TARGET)

-export VPATH	:=	$(foreach dir,$(SOURCES),$(CURDIR)/$(dir)) \
-			$(foreach dir,$(DATA),$(CURDIR)/$(dir))
+export VPATH	:=	$(foreach dir,$(SOURCES),$(CURDIR)/$(dir))

 export DEPSDIR	:=	$(CURDIR)/$(BUILD)

 CFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.c)))
 CPPFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.cpp)))
 SFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.s)))
-BINFILES	:=	$(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.*)))

 #---------------------------------------------------------------------------------
 # use CXX for linking C++ projects, CC for standard C
@@ -84,14 +72,7 @@ else
 endif
 #---------------------------------------------------------------------------------

-export OFILES	:= $(addsuffix .o,$(BINFILES)) \
-			$(CPPFILES:.cpp=.o) $(CFILES:.c=.o) $(SFILES:.s=.o)
-
-export INCLUDE	:=	$(foreach dir,$(INCLUDES),-I$(CURDIR)/$(dir)) \
-			$(foreach dir,$(LIBDIRS),-I$(dir)/include) \
-			-I$(CURDIR)/$(BUILD)
-
-export LIBPATHS	:=	$(foreach dir,$(LIBDIRS),-L$(dir)/lib)
+export OFILES	:= $(CPPFILES:.cpp=.o) $(CFILES:.c=.o) $(SFILES:.s=.o)

 .PHONY: $(BUILD) clean all
 
--- a/loader/source/buttons.h
+++ b/loader/source/buttons.h
@@ -2,12 +2,11 @@

 #include "types.h"

-#define HID_PAD       (*(vu16 *)0x10146000 ^ 0xFFF)
-#define BUTTON_B      (1 << 1)
+#define HID_PAD       (*(vu32 *)0x10146000 ^ 0xFFF)
 #define BUTTON_X      (1 << 10)
 #define BUTTON_Y      (1 << 11)
+#define BUTTON_R1     (1 << 8)
 #define BUTTON_SELECT (1 << 2)
-#define BUTTON_START  (1 << 3)
 #define BUTTON_RIGHT  (1 << 4)
 #define BUTTON_LEFT   (1 << 5)
 #define BUTTON_UP     (1 << 6)
--- a/loader/source/fatfs/ffconf.h
+++ b/loader/source/fatfs/ffconf.h
@@ -8,7 +8,7 @@
 / Functions and Buffer Configurations
 /---------------------------------------------------------------------------*/

-#define	_FS_TINY		1
+#define	_FS_TINY		0
 /* This option switches tiny buffer configuration. (0:Normal or 1:Tiny)
 /  At the tiny configuration, size of the file object (FIL) is reduced _MAX_SS
 /  bytes. Instead of private sector buffer eliminated from the file object,
--- a/loader/source/main.c
+++ b/loader/source/main.c
@@ -4,9 +4,11 @@

 #define PAYLOAD_ADDRESS	0x23F00000

-static u32 loadPayload(const char *path){
+static u32 loadPayload(const char *path)
+{
    FIL payload;
    unsigned int br;
+
    if(f_open(&payload, path, FA_READ) == FR_OK)
    {
        f_read(&payload, (void *)PAYLOAD_ADDRESS, f_size(&payload), &br);
@@ -18,22 +20,23 @@ static u32 loadPayload(const char *path){
    return 0;
 }

-void main(void){
+void main(void)
+{
    FATFS fs;
+
    f_mount(&fs, "0:", 1);

    //Get pressed buttons
-    u16 pressed = HID_PAD;
+    u32 pressed = HID_PAD;

-    if(((pressed & BUTTON_B) && loadPayload("/aurei/payloads/b.bin")) ||
-       ((pressed & BUTTON_X) && loadPayload("/aurei/payloads/x.bin")) ||
-       ((pressed & BUTTON_Y) && loadPayload("/aurei/payloads/y.bin")) ||
-       ((pressed & BUTTON_SELECT) && loadPayload("/aurei/payloads/select.bin")) ||
-       ((pressed & BUTTON_START) && loadPayload("/aurei/payloads/start.bin")) ||
-       ((pressed & BUTTON_RIGHT) && loadPayload("/aurei/payloads/right.bin")) ||
+    if(((pressed & BUTTON_RIGHT) && loadPayload("/aurei/payloads/right.bin")) ||
       ((pressed & BUTTON_LEFT) && loadPayload("/aurei/payloads/left.bin")) ||
       ((pressed & BUTTON_UP) && loadPayload("/aurei/payloads/up.bin")) ||
       ((pressed & BUTTON_DOWN) && loadPayload("/aurei/payloads/down.bin")) ||
+       ((pressed & BUTTON_X) && loadPayload("/aurei/payloads/x.bin")) ||
+       ((pressed & BUTTON_Y) && loadPayload("/aurei/payloads/y.bin")) ||
+       ((pressed & BUTTON_SELECT) && loadPayload("/aurei/payloads/select.bin")) ||
+       ((pressed & BUTTON_R1) && loadPayload("/aurei/payloads/r.bin")) ||
       loadPayload("/aurei/payloads/default.bin"))
        ((void (*)())PAYLOAD_ADDRESS)();
 }
--- a/loader/source/start.s
+++ b/loader/source/start.s
@@ -12,7 +12,4 @@ _start:
    mcr p15, 0, r0, c7, c6, 0  @ flush D-cache
    mcr p15, 0, r0, c7, c10, 4 @ drain write buffer

-    bl main
-
-.die:
-    b .die
+    b main
--- a/patches/reboot.s
+++ b/patches/reboot.s
@@ -1,221 +1,232 @@
 .arm.little

-byteswritten equ 0x2000E000
-kernelCode equ 0x080F0000
-buffer equ 0x24000000
-fileOpen equ 0x4E45504F ;dummy
+firm_addr equ 0x24000000  ; Temporary location where we'll load the FIRM to
+firm_maxsize equ 0x200000  ; Random value that's bigger than any of the currently known firm's sizes.
+kernel_code equ 0x080F0000 ; Offset to copy the Kernel9 code to

 .create "reboot.bin", 0
 .arm
-//Code jumps here right after the sprintf call
-process9Reboot:
-	doPxi:
-        ldr r4, =0x44846
-		ldr r0, =0x10008000
-		readPxiLoop1:
-			ldrh r1, [r0,#4]
-			.word 0xE1B01B81	//lsls r1, r1, #0x17
-			bmi readPxiLoop1
-			ldr r0, [r0,#0xC]		
-        cmp r0, r4
-        bne doPxi
-	
-	GetFirmPath:
-		add r0, sp, #0x3A8-0x70+0x24
-		ldr r1, [r0], #4
-		ldr r2, =0x00300030
-		cmp r1, r2
-		ldreq r1, [r0], #4
-		ldreq r2, =0x002F0032
-		cmpeq r1, r2
-		
-	OpenFirm:
-		ldreq r1, =(FileName - OpenFirm - 12)
-		addeq r1, pc
-		addne r1, sp, #0x3A8-0x70
-		moveq r2, #1
-		movne r2, #0
-		str r2, [externalFirm]
-		mov r2, #1
-		add r0, r7, #8
-		ldr r6, =fileOpen
-		blx r6
-	
-    SeekFirm:
-		ldr r0, [externalFirm]
-		cmp r0, #1
-		moveq r0, r7
-        ldreq r1, =byteswritten
-        ldreq r2, =buffer
-        ldreq r3, =0x0
-		ldreq r6, [sp,#0x3A8-0x198]
-		ldreq r6, [r6,#0x28]	//fread function stored here
-		blxeq r6
-		
-	ReadFirm:
+    ; Interesting registers and locations to keep in mind, set before this code is ran:
+    ; - sp + 0x3A8 - 0x70: FIRM path in exefs.
+    ; - r7 (which is sp + 0x3A8 - 0x198): Reserved space for file handle
+    ; - *(sp + 0x3A8 - 0x198) + 0x28: fread function.
+
+    pxi_wait_recv:
+        ldr r2, =0x44846
+        ldr r0, =0x10008000
+        readPxiLoop1:
+            ldrh r1, [r0, #4]
+            lsls r1, #0x17
+            bmi readPxiLoop1
+            ldr r0, [r0, #0xC]
+        cmp r0, r2
+        bne pxi_wait_recv
+
+    ; Convert 2 bytes of the path string
+    ; This will be the method of getting the lower 2 bytes of the title ID
+    ;   until someone bothers figuring out where the value is derived from.
+    mov r0, #0  ; Result
+    add r1, sp, #0x3A8 - 0x70
+    add r1, #0x22  ; The significant bytes
+    mov r2, #4  ; Maximum loops (amount of bytes * 2)
+
+    hex_string_to_int_loop:
+        ldr r3, [r1], #2  ; 2 because it's a utf-16 string.
+        and r3, #0xFF
+
+        ; Check if it"s a number
+        cmp r3, #'0'
+        blo hex_string_to_int_end
+        sub r3, #'0'
+        cmp r3, #9
+        bls hex_string_to_int_calc
+
+        ; Check if it"s a capital letter
+        cmp r3, #'A' - '0'
+        blo hex_string_to_int_end
+        sub r3, #'A' - '0' - 0xA  ; Make the correct value: 0xF >= al >= 0xA
+        cmp r3, #0xF
+        bls hex_string_to_int_calc
+
+        ; Incorrect value: x > "A"
+        bhi hex_string_to_int_end
+
+        hex_string_to_int_calc:
+            orr r0, r3, r0, lsl #4
+            subs r2, #1
+            bne hex_string_to_int_loop
+    hex_string_to_int_end:
+
+    ; Get the FIRM path
+    cmp r0, #0x0002  ; NATIVE_FIRM
+    adreq r1, firm_fname
+    beq load_firm
+    ldr r5, =0x0102  ; TWL_FIRM
+    cmp r0, r5
+    adreq r1, twlfirm_fname
+    beq load_firm
+    ldr r5, =0x0202  ; AGB_FIRM
+    cmp r0, r5
+    adreq r1, agbfirm_fname
+    beq load_firm
+    bne fallback  ; TODO: Stubbed
+
+    fallback:
+        ; Fallback: Load specified FIRM from exefs
+        add r1, sp, #0x3A8-0x70  ; Location of exefs string.
+        b load_firm
+
+    load_firm:
+        ; Open file
+        add r0, r7, #8
+        mov r2, #1
+        ldr r6, [fopen]
+        orr r6, 1
+        blx r6
+
+        cmp r0, #0  ; Check if we were able to load the FIRM
+        bne fallback  ; Otherwise, try again with the FIRM from exefs.
+        ; This will loop indefinitely if the exefs FIRM fails to load, but whatever.
+
+        ; Read file
 		mov r0, r7
-        ldr r1, =byteswritten
-        ldr r2, =buffer
-        ldr r3, =0x200000
-		ldr r6, [sp,#0x3A8-0x198]
-		ldr r6, [r6,#0x28]	//fread function stored here
+        adr r1, bytes_read
+        mov r2, firm_addr
+        mov r3, firm_maxsize
+		ldr r6, [sp, #0x3A8-0x198]
+		ldr r6, [r6, #0x28]
 		blx r6

-    KernelSetState:
-        mov r2, #0
-        mov r3, r2
-        mov r1, r2
-        mov r0, r2
-        .word 0xEF00007C    //SVC 0x7C
+    ; Set kernel state
+    mov r0, #0
+    mov r1, #0
+    mov r2, #0
+    mov r3, #0
+    swi 0x7C

-    GoToReboot:
-        ldr r0, =(KernelCodeStart - GoToReboot - 12)
-		add r0, pc
-		ldr r1, =kernelCode
-		ldr r2, =0x300
-		bl Memcpy
-		
-		ldr r0, =kernelCode
-        .word 0xEF00007B    //SVC 0x7B
+    goto_reboot:
+        ; Jump to reboot code
+        ldr r0, =(kernelcode_start - goto_reboot - 12)
+        add r0, pc
+        ldr r1, =kernel_code
+        ldr r2, =0x300
+        bl memcpy32
+        ldr r0, =kernel_code
+        swi 0x7B

-    InfiniteLoop:
-        b InfiniteLoop
+    die:
+        b die

-Memcpy:
-	MOV     R12, LR
-	STMFD   SP!, {R0-R4}
-	ADD     R2, R2, R0
-
-	memcpyLoop:
-		LDR     R3, [R0],#4
-		STR     R3, [R1],#4
-		CMP     R0, R2
-		BLT     memcpyLoop
-		LDMFD   SP!, {R0-R4}
-		MOV     LR, R12
-		BX      LR
-
-FileName:
-	.dcw "sdmc:/aurei/patched_firmware_sys.bin"
-	.word 0x0
-
-externalFirm:
-	.word 0x2000A000
+memcpy32:  ; memcpy32(void *src, void *dst, unsigned int size)
+    add r2, r0
+    memcpy32_loop:
+        ldmia r0!, {r3}
+        stmia r1!, {r3}
+        cmp r0, r2
+        blo memcpy32_loop
+    bx lr

+bytes_read: .word 0
+fopen: .ascii "OPEN"
 .pool
+firm_fname:    .dcw "sdmc:/aurei/patched_firmware_sys.bin"
+	       .word 0x0
+.pool
+twlfirm_fname: .dcw "sdmc:/aurei/patched_firmware_twl.bin"
+	       .word 0x0
+.pool
+agbfirm_fname: .dcw "sdmc:/aurei/patched_firmware_agb.bin"
+	       .word 0x0

-// Kernel Code
 .align 4
-KernelCodeStart:
-	memorySetting:
-		MRC     p15, 0, R0,c2,c0, 0
-        MRC     p15, 0, R12,c2,c0, 1
-        MRC     p15, 0, R1,c3,c0, 0
-        MRC     p15, 0, R2,c5,c0, 2
-        MRC     p15, 0, R3,c5,c0, 3
-        LDR     R4, =0x18000035
-        BIC     R2, R2, #0xF0000
-        BIC     R3, R3, #0xF0000
-        ORR     R0, R0, #0x10
-        ORR     R2, R2, #0x30000
-        ORR     R3, R3, #0x30000
-        ORR     R12, R12, #0x10
-        ORR     R1, R1, #0x10
-        MCR     p15, 0, R0,c2,c0, 0
-        MCR     p15, 0, R12,c2,c0, 1
-        MCR     p15, 0, R1,c3,c0, 0
-        MCR     p15, 0, R2,c5,c0, 2
-        MCR     p15, 0, R3,c5,c0, 3
-        MCR     p15, 0, R4,c6,c4, 0
-        MRC     p15, 0, R0,c2,c0, 0
-        MRC     p15, 0, R1,c2,c0, 1
-        MRC     p15, 0, R2,c3,c0, 0
-        ORR     R0, R0, #0x20
-        ORR     R1, R1, #0x20
-        ORR     R2, R2, #0x20
-        MCR     p15, 0, R0,c2,c0, 0
-        MCR     p15, 0, R1,c2,c0, 1
-        MCR     p15, 0, R2,c3,c0, 0
+    kernelcode_start:
+        ; Set MPU settings
+        mrc p15, 0, r0, c2, c0, 0  ; dcacheable
+        mrc p15, 0, r12, c2, c0, 1  ; icacheable
+        mrc p15, 0, r1, c3, c0, 0  ; write bufferable
+        mrc p15, 0, r2, c5, c0, 2  ; daccess
+        mrc p15, 0, r3, c5, c0, 3  ; iaccess
+        ldr r4, =0x18000035  ; 0x18000000 128M
+        bic r2, r2, #0xF0000  ; unprotect region 4
+        bic r3, r3, #0xF0000  ; unprotect region 4
+        orr r0, r0, #0x10  ; dcacheable region 4
+        orr r2, r2, #0x30000  ; region 4 r/w
+        orr r3, r3, #0x30000  ; region 4 r/w
+        orr r12, r12, #0x10  ; icacheable region 4
+        orr r1, r1, #0x10  ; write bufferable region 4
+        mcr p15, 0, r0, c2, c0, 0
+        mcr p15, 0, r12, c2, c0, 1
+        mcr p15, 0, r1, c3, c0, 0  ; write bufferable
+        mcr p15, 0, r2, c5, c0, 2  ; daccess
+        mcr p15, 0, r3, c5, c0, 3  ; iaccess
+        mcr p15, 0, r4, c6, c4, 0  ; region 4 (hmmm)

-    copyFirmPartitions:
-        LDR     R4, =buffer
-        ADD     R3, R4, #0x40
-        LDR     R0, [R3]
-        ADD     R0, R0, R4
-        LDR     R1, [R3,#4]
-        LDR     R2, [R3,#8] 
-		bl KernelMemcpy
-		
-        ADD     R3, R4, #0x70
-        LDR     R0, [R3]
-        ADD     R0, R0, R4
-        LDR     R1, [R3,#4]
-        LDR     R2, [R3,#8]
-        bl KernelMemcpy
-			
-        ADD     R3, R4, #0xA0
-        LDR     R0, [R3]
-        ADD     R0, R0, R4
-        LDR     R1, [R3,#4]
-        LDR     R2, [R3,#8]
-        bl KernelMemcpy
-			
-		ADD     R3, R4, #0xD0
-        LDR     R0, [R3]
-		CMP		R0, #0
-		BEQ		invalidateDataCache
-        ADD     R0, R0, R4
-        LDR     R1, [R3,#4]
-        LDR     R2, [R3,#8]
-        bl KernelMemcpy
-		
-    invalidateDataCache:
-        MOV     R2, #0
-        MOV     R1, R2
-        loc_809460C:
-        MOV     R0, #0
-        MOV     R3, R2,LSL#30
-        loc_8094614:
-        ORR     R12, R3, R0,LSL#5
-        MCR     p15, 0, R1,c7,c10, 4
-        MCR     p15, 0, R12,c7,c14, 2
-        ADD     R0, R0, #1
-        CMP     R0, #0x20
-        BCC     loc_8094614
-        ADD     R2, R2, #1
-        CMP     R2, #4
-        BCC     loc_809460C
+        mrc p15, 0, r0, c2, c0, 0  ; dcacheable
+        mrc p15, 0, r1, c2, c0, 1  ; icacheable
+        mrc p15, 0, r2, c3, c0, 0  ; write bufferable
+        orr r0, r0, #0x20  ; dcacheable region 5
+        orr r1, r1, #0x20  ; icacheable region 5
+        orr r2, r2, #0x20  ; write bufferable region 5
+        mcr p15, 0, r0, c2, c0, 0  ; dcacheable
+        mcr p15, 0, r1, c2, c0, 1  ; icacheable
+        mcr p15, 0, r2, c3, c0, 0  ; write bufferable

-    jumpToEntrypoint:
-        MCR     p15, 0, R1,c7,c10, 4
-        LDR     R0, =0x42078
-        MCR     p15, 0, R0,c1,c0, 0
-        MCR     p15, 0, R1,c7,c5, 0
-        MCR     p15, 0, R1,c7,c6, 0
-        MCR     p15, 0, R1,c7,c10, 4
-		LDR     R4, =buffer
-        MOV     R1, #0x1FFFFFFC
-		LDR     R2, [R4,#8]
-		STR     R2, [R1]
-		LDR     R0, [R4,#0xC]
-		BX      R0
+        ; Copy the firmware
+        mov r4, firm_addr
+        add r5, r4, #0x40  ; Start of loop
+        add r6, r5, #0x30 * 3  ; End of loop (scan 4 entries)
+
+    copy_firm_loop:
+        ldr r0, [r5]
+        cmp r0, #0
+        addne r0, r4  ; src
+        ldrne r1, [r5, #4]  ; dest
+        ldrne r2, [r5, #8]  ; size
+        blne kernelmemcpy32
+
+        cmp r5, r6
+        addlo r5, #0x30
+        blo copy_firm_loop
+
+    ; Flush cache
+    mov r2, #0
+    mov r1, r2
+    flush_cache:
+        mov r0, #0
+        mov r3, r2, lsl #30
+        flush_cache_inner_loop:
+            orr r12, r3, r0, lsl#5
+            mcr p15, 0, r1, c7, c10, 4  ; drain write buffer
+            mcr p15, 0, r12, c7, c14, 2  ; clean and flush dcache entry (index and segment)
+            add r0, #1
+            cmp r0, #0x20
+            bcc flush_cache_inner_loop
+        add r2, #1
+        cmp r2, #4
+        bcc flush_cache
+
+    ; Enable MPU
+    ldr r0, =0x42078  ; alt vector select, enable itcm
+    mcr p15, 0, r0, c1, c0, 0
+    mcr p15, 0, r1, c7, c5, 0  ; flush dcache
+    mcr p15, 0, r1, c7, c6, 0  ; flush icache
+    mcr p15, 0, r1, c7, c10, 4  ; drain write buffer
+    mov r0, firm_addr
+
+    ; Boot FIRM
+    mov r1, #0x1FFFFFFC
+    ldr r2, [r0, #8]  ; arm11 entry
+    str r2, [r1]
+    ldr r0, [r0, #0xC]  ; arm9 entry
+    bx r0
 .pool

-KernelMemcpy:
-	MOV     R12, LR
-	STMFD   SP!, {R0-R4}
-	ADD     R2, R2, R0
-
-	kmemcpyLoop:
-		LDR     R3, [R0],#4
-		STR     R3, [R1],#4
-		CMP     R0, R2
-		BLT     kmemcpyLoop
-		LDMFD   SP!, {R0-R4}
-		MOV     LR, R12
-		BX      LR
-.pool
-
-KernelCodeEnd:
-
+kernelmemcpy32:  ; memcpy32(void *src, void *dst, unsigned int size)
+    add r2, r0
+    kmemcpy32_loop:
+        ldmia r0!, {r3}
+        stmia r1!, {r3}
+        cmp r0, r2
+        blo kmemcpy32_loop
+    bx lr
 .close
--- a/screeninit/Makefile
+++ b/screeninit/Makefile
@@ -0,0 +1,115 @@
+#---------------------------------------------------------------------------------
+.SUFFIXES:
+#---------------------------------------------------------------------------------
+
+ifeq ($(strip $(DEVKITARM)),)
+$(error "Please set DEVKITARM in your environment. export DEVKITARM=<path to>devkitARM")
+endif
+
+include $(DEVKITARM)/3ds_rules
+
+#---------------------------------------------------------------------------------
+# TARGET is the name of the output
+# BUILD is the directory where object files & intermediate files will be placed
+# SOURCES is a list of directories containing source code
+# DATA is a list of directories containing data files
+# INCLUDES is a list of directories containing header files
+# SPECS is the directory containing the important build and link files
+#---------------------------------------------------------------------------------
+export TARGET	:=	$(shell basename $(CURDIR))
+BUILD		:=	build
+SOURCES		:=	source
+
+#---------------------------------------------------------------------------------
+# Setup some defines
+#---------------------------------------------------------------------------------
+
+#---------------------------------------------------------------------------------
+# options for code generation
+#---------------------------------------------------------------------------------
+ARCH	:=	-mthumb -mthumb-interwork
+
+CFLAGS	:=	-g -Wall -O2\
+			-mcpu=mpcore -mlittle-endian\
+			-ffast-math -Wno-main -std=c99\
+			$(ARCH)
+
+CFLAGS	+=	$(INCLUDE) -DARM11
+
+CXXFLAGS	:= $(CFLAGS) -fno-rtti -fno-exceptions
+
+ASFLAGS	:=	-g $(ARCH)
+LDFLAGS	=	-nostartfiles -g --specs=../stub.specs $(ARCH) -Wl,-Map,$(TARGET).map
+
+#---------------------------------------------------------------------------------
+# no real need to edit anything past this point unless you need to add additional
+# rules for different file extensions
+#---------------------------------------------------------------------------------
+ifneq ($(BUILD),$(notdir $(CURDIR)))
+#---------------------------------------------------------------------------------
+ 
+export OUTPUT	:=	$(CURDIR)/$(TARGET)
+
+export VPATH	:=	$(foreach dir,$(SOURCES),$(CURDIR)/$(dir))
+
+export DEPSDIR	:=	$(CURDIR)/$(BUILD)
+
+CFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.c)))
+CPPFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.cpp)))
+SFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.s)))
+
+#---------------------------------------------------------------------------------
+# use CXX for linking C++ projects, CC for standard C
+#---------------------------------------------------------------------------------
+ifeq ($(strip $(CPPFILES)),)
+#---------------------------------------------------------------------------------
+	export LD	:=	$(CC)
+#---------------------------------------------------------------------------------
+else
+#---------------------------------------------------------------------------------
+	export LD	:=	$(CXX)
+#---------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------
+
+export OFILES	:= $(CPPFILES:.cpp=.o) $(CFILES:.c=.o) $(SFILES:.s=.o)
+
+.PHONY: $(BUILD) clean all
+ 
+#---------------------------------------------------------------------------------
+all: $(BUILD)
+
+$(BUILD):
+	@[ -d $@ ] || mkdir -p $@
+	@make --no-print-directory -C $(BUILD) -f $(CURDIR)/Makefile
+ 
+#---------------------------------------------------------------------------------
+clean:
+	@echo clean ...
+	@rm -fr $(BUILD) $(OUTPUT).elf
+ 
+ 
+#---------------------------------------------------------------------------------
+else
+ 
+DEPENDS	:=	$(OFILES:.o=.d)
+ 
+#---------------------------------------------------------------------------------
+# main targets
+#---------------------------------------------------------------------------------
+$(OUTPUT).bin	:	$(OUTPUT).elf
+$(OUTPUT).elf	:	$(OFILES)
+
+
+#---------------------------------------------------------------------------------
+%.bin: %.elf
+	@$(OBJCOPY) -O binary $< $@
+	@echo built ... $(notdir $@)
+ 
+
+-include $(DEPENDS)
+
+ 
+#---------------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------------
--- a/screeninit/source/main.c
+++ b/screeninit/source/main.c
@@ -0,0 +1,105 @@
+#include "types.h"
+
+void main(void)
+{
+   const u32 brightness[4] = {0x5F, 0x4C, 0x39, 0x26};
+   u32 brightnessLevel = *(vu32 *)0x24F04000;
+   vu32 *const arm11 = (u32 *)0x1FFFFFF8;
+
+   *(vu32 *)0x10141200 = 0x1007F;
+   *(vu32 *)0x10202014 = 0x00000001;
+   *(vu32 *)0x1020200C &= 0xFFFEFFFE;
+   *(vu32 *)0x10202240 = brightness[brightnessLevel];
+   *(vu32 *)0x10202A40 = brightness[brightnessLevel];
+   *(vu32 *)0x10202244 = 0x1023E;
+   *(vu32 *)0x10202A44 = 0x1023E;
+
+   // Top screen
+   *(vu32 *)0x10400400 = 0x000001c2;
+   *(vu32 *)0x10400404 = 0x000000d1;
+   *(vu32 *)0x10400408 = 0x000001c1;
+   *(vu32 *)0x1040040c = 0x000001c1;
+   *(vu32 *)0x10400410 = 0x00000000;
+   *(vu32 *)0x10400414 = 0x000000cf;
+   *(vu32 *)0x10400418 = 0x000000d1;
+   *(vu32 *)0x1040041c = 0x01c501c1;
+   *(vu32 *)0x10400420 = 0x00010000;
+   *(vu32 *)0x10400424 = 0x0000019d;
+   *(vu32 *)0x10400428 = 0x00000002;
+   *(vu32 *)0x1040042c = 0x00000192;
+   *(vu32 *)0x10400430 = 0x00000192;
+   *(vu32 *)0x10400434 = 0x00000192;
+   *(vu32 *)0x10400438 = 0x00000001;
+   *(vu32 *)0x1040043c = 0x00000002;
+   *(vu32 *)0x10400440 = 0x01960192;
+   *(vu32 *)0x10400444 = 0x00000000;
+   *(vu32 *)0x10400448 = 0x00000000;
+   *(vu32 *)0x1040045C = 0x00f00190;
+   *(vu32 *)0x10400460 = 0x01c100d1;
+   *(vu32 *)0x10400464 = 0x01920002;
+   *(vu32 *)0x10400468 = 0x18300000;
+   *(vu32 *)0x10400470 = 0x80341;
+   *(vu32 *)0x10400474 = 0x00010501;
+   *(vu32 *)0x10400478 = 0;
+   *(vu32 *)0x10400490 = 0x000002D0;
+   *(vu32 *)0x1040049C = 0x00000000;
+
+   // Disco register
+   for(u32 i = 0; i < 256; i++)
+       *(vu32 *)0x10400484 = 0x10101 * i;
+
+   // Bottom screen
+   *(vu32 *)0x10400500 = 0x000001c2;
+   *(vu32 *)0x10400504 = 0x000000d1;
+   *(vu32 *)0x10400508 = 0x000001c1;
+   *(vu32 *)0x1040050c = 0x000001c1;
+   *(vu32 *)0x10400510 = 0x000000cd;
+   *(vu32 *)0x10400514 = 0x000000cf;
+   *(vu32 *)0x10400518 = 0x000000d1;
+   *(vu32 *)0x1040051c = 0x01c501c1;
+   *(vu32 *)0x10400520 = 0x00010000;
+   *(vu32 *)0x10400524 = 0x0000019d;
+   *(vu32 *)0x10400528 = 0x00000052;
+   *(vu32 *)0x1040052c = 0x00000192;
+   *(vu32 *)0x10400530 = 0x00000192;
+   *(vu32 *)0x10400534 = 0x0000004f;
+   *(vu32 *)0x10400538 = 0x00000050;
+   *(vu32 *)0x1040053c = 0x00000052;
+   *(vu32 *)0x10400540 = 0x01980194;
+   *(vu32 *)0x10400544 = 0x00000000;
+   *(vu32 *)0x10400548 = 0x00000011;
+   *(vu32 *)0x1040055C = 0x00f00140;
+   *(vu32 *)0x10400560 = 0x01c100d1;
+   *(vu32 *)0x10400564 = 0x01920052;
+   *(vu32 *)0x10400568 = 0x18300000 + 0x46500;
+   *(vu32 *)0x10400570 = 0x80301;
+   *(vu32 *)0x10400574 = 0x00010501;
+   *(vu32 *)0x10400578 = 0;
+   *(vu32 *)0x10400590 = 0x000002D0;
+   *(vu32 *)0x1040059C = 0x00000000;
+
+   // Disco register
+   for(u32 i = 0; i < 256; i++)
+       *(vu32 *)0x10400584 = 0x10101 * i;
+
+   *(vu32 *)0x10400468 = 0x18300000;
+   *(vu32 *)0x1040046c = 0x18300000;
+   *(vu32 *)0x10400494 = 0x18300000;
+   *(vu32 *)0x10400498 = 0x18300000;
+   *(vu32 *)0x10400568 = 0x18346500;
+   *(vu32 *)0x1040056c = 0x18346500;
+
+   //Set CakeBrah framebuffers
+   *((vu32 *)0x23FFFE00) = 0x18300000;
+   *((vu32 *)0x23FFFE04) = 0x18300000;
+   *((vu32 *)0x23FFFE08) = 0x18346500;
+
+   //Clear ARM11 entry offset
+   *arm11 = 0;
+
+   //Wait for the entry to be set
+   while(!*arm11);
+
+   //Jump to it
+   ((void (*)())*arm11)();
+}
--- a/screeninit/source/start.s
+++ b/screeninit/source/start.s
@@ -0,0 +1,8 @@
+.section .text.start
+.align 4
+.global _start
+_start:
+    @ Disable interrupts
+    CPSID aif
+
+    b main
--- a/screeninit/source/types.h
+++ b/screeninit/source/types.h
@@ -0,0 +1,19 @@
+/*
+*   types.h
+*       by Reisyukaku
+*   Copyright (c) 2015 All Rights Reserved
+*/
+
+#pragma once
+
+#include <stdint.h>
+
+//Common data types
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+typedef uint64_t u64;
+typedef volatile u8 vu8;
+typedef volatile u16 vu16;
+typedef volatile u32 vu32;
+typedef volatile u64 vu64;
--- a/screeninit/stub.ld
+++ b/screeninit/stub.ld
@@ -0,0 +1,12 @@
+ENTRY(_start)
+SECTIONS
+{
+    . = 0x24F03000;
+    .text.start : { *(.text.start) }
+    .text : { *(.text) }
+    .data : { *(.data) }
+    .bss : { *(.bss COMMON) }
+    .rodata : { *(.rodata) }
+    . = ALIGN(4);
+}
+
--- a/screeninit/stub.specs
+++ b/screeninit/stub.specs
@@ -0,0 +1,5 @@
+%rename link                old_link
+
+*link:
+%(old_link) -T ../stub.ld%s
+
--- a/source/buttons.h
+++ b/source/buttons.h
@@ -8,14 +8,22 @@

 #include "types.h"

-#define HID_PAD         (*(vu16 *)0x10146000 ^ 0xFFF)
-#define BUTTON_R1       (1 << 8)
-#define BUTTON_L1       (1 << 9)
-#define BUTTON_A        1
-#define BUTTON_B        (1 << 1)
-#define BUTTON_UP       (1 << 6)
-#define BUTTON_DOWN     (1 << 7)
-#define BUTTON_START    (1 << 3)
-#define BUTTON_SELECT   (1 << 2)
-#define SAFE_MODE       (BUTTON_R1 | BUTTON_L1 | BUTTON_A | BUTTON_UP)
-#define PAYLOAD_BUTTONS ((BUTTON_L1 | BUTTON_A) ^ 0xFFF)
+#define HID_PAD                (*(vu32 *)0x10146000 ^ 0xFFF)
+#define BUTTON_R1              (1 << 8)
+#define BUTTON_L1              (1 << 9)
+#define BUTTON_A               1
+#define BUTTON_B               (1 << 1)
+#define BUTTON_X               (1 << 10)
+#define BUTTON_Y               (1 << 11)
+#define BUTTON_SELECT          (1 << 2)
+#define BUTTON_START           (1 << 3)
+#define BUTTON_RIGHT           (1 << 4)
+#define BUTTON_LEFT            (1 << 5)
+#define BUTTON_UP              (1 << 6)
+#define BUTTON_DOWN            (1 << 7)
+#define BUTTON_L1R1            (BUTTON_R1 | BUTTON_L1)
+#define SAFE_MODE              (BUTTON_L1R1 | BUTTON_A | BUTTON_UP)
+#define OVERRIDE_BUTTONS       (BUTTON_B ^ 0xFFF)
+#define SINGLE_PAYLOAD_BUTTONS (BUTTON_LEFT | BUTTON_RIGHT | BUTTON_UP | BUTTON_DOWN | BUTTON_START | BUTTON_X | BUTTON_Y)
+#define L_PAYLOAD_BUTTONS      (BUTTON_R1 | BUTTON_SELECT)
+#define MENU_BUTTONS           (BUTTON_LEFT | BUTTON_RIGHT | BUTTON_UP | BUTTON_DOWN | BUTTON_A | BUTTON_START)
--- a/source/crypto.c
+++ b/source/crypto.c
@@ -239,14 +239,16 @@ static const u8 key2[0x10] = {
 };

 //Get Nand CTR key
-static void getNandCTR(u8 *buf, u32 console){
+static void getNandCTR(u8 *buf, u32 console)
+{
    u8 *addr = (console ? (u8 *)0x080D8BBC : (u8 *)0x080D797C) + 0x0F;
    for(u8 keyLen = 0x10; keyLen; keyLen--)
        *(buf++) = *(addr--);
 }

 //Read firm0 from NAND and write to buffer
-void nandFirm0(u8 *outbuf, u32 size, u32 console){
+void nandFirm0(u8 *outbuf, u32 size, u32 console)
+{
    u8 CTR[0x10];
    getNandCTR(CTR, console);

@@ -258,28 +260,31 @@ void nandFirm0(u8 *outbuf, u32 size, u32 console){
 }

 //Decrypts the N3DS arm9bin
-void decryptArm9Bin(u8 *arm9Section, u32 mode){
-
+void decryptArm9Bin(u8 *arm9Section, u32 mode)
+{
    //Firm keys
    u8 keyY[0x10];
    u8 CTR[0x10];
    u8 slot = mode ? 0x16 : 0x15;

    //Setup keys needed for arm9bin decryption
-    memcpy(keyY, arm9Section+0x10, 0x10);
-    memcpy(CTR, arm9Section+0x20, 0x10);
+    memcpy(keyY, arm9Section + 0x10, 0x10);
+    memcpy(CTR, arm9Section + 0x20, 0x10);
+
+    //Calculate the size of the ARM9 binary
    u32 size = 0;
    //http://stackoverflow.com/questions/12791077/atoi-implementation-in-c
-    for(u8 *tmp = arm9Section+0x30; *tmp; tmp++)
-        size = (size<<3)+(size<<1)+(*tmp)-'0';
+    for(u8 *tmp = arm9Section + 0x30; *tmp; tmp++)
+        size = (size << 3) + (size << 1) + (*tmp) - '0';

-    if(mode){
+    if(mode)
+    {
        u8 keyX[0x10];

        //Set 0x11 to key2 for the arm9bin and misc keys
        aes_setkey(0x11, key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
        aes_use_keyslot(0x11);
-        aes(keyX, arm9Section+0x60, 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+        aes(keyX, arm9Section + 0x60, 1, NULL, AES_ECB_DECRYPT_MODE, 0);
        aes_setkey(slot, keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
    }

@@ -288,21 +293,22 @@ void decryptArm9Bin(u8 *arm9Section, u32 mode){
    aes_use_keyslot(slot);

    //Decrypt arm9bin
-    aes(arm9Section+0x800, arm9Section+0x800, size/AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes(arm9Section + 0x800, arm9Section + 0x800, size/AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
 }

 //Sets the N3DS 9.6 KeyXs
-void setKeyXs(u8 *arm9Section){
-
-    u8 *keyData = arm9Section+0x89814;
-    u8 *decKey = keyData+0x10;
+void setKeyXs(u8 *arm9Section)
+{
+    u8 *keyData = arm9Section + 0x89814;
+    u8 *decKey = keyData + 0x10;

    //Set keys 0x19..0x1F keyXs
    aes_setkey(0x11, key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
    aes_use_keyslot(0x11);
-    for(u8 slot = 0x19; slot < 0x20; slot++){
+    for(u8 slot = 0x19; slot < 0x20; slot++)
+    {
        aes(decKey, keyData, 1, NULL, AES_ECB_DECRYPT_MODE, 0);
        aes_setkey(slot, decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
-        *(keyData+0xF) += 1;
+        *(keyData + 0xF) += 1;
    }
 }
--- a/source/draw.c
+++ b/source/draw.c
@@ -20,63 +20,77 @@ static const struct fb {
    u8 *bottom;
 } *const fb = (struct fb *)0x23FFFE00;

-static int strlen(const char *string){
+static inline int strlen(const char *string)
+{
    char *stringEnd = (char *)string;
    while(*stringEnd) stringEnd++;
    return stringEnd - string;
 }

-void clearScreens(void){
+void clearScreens(void)
+{
    memset32(fb->top_left, 0, 0x46500);
    memset32(fb->top_right, 0, 0x46500);
    memset32(fb->bottom, 0, 0x38400);
 }

-void loadSplash(void){
+void loadSplash(void)
+{
    clearScreens();

    //Don't delay boot if no splash image is on the SD
    if(fileRead(fb->top_left, "/aurei/splash.bin", 0x46500) +
-       fileRead(fb->bottom, "/aurei/splashbottom.bin", 0x38400)){
-        u64 i = 0x1300000; while(--i) __asm("mov r0, r0"); //Less Ghetto sleep func
+       fileRead(fb->bottom, "/aurei/splashbottom.bin", 0x38400))
+    {
+        u64 i = 0x1300000;
+        while(--i) __asm("mov r0, r0"); //Less Ghetto sleep func
    }
 }

-void drawCharacter(char character, int pos_x, int pos_y, u32 color){
+void drawCharacter(char character, int posX, int posY, u32 color)
+{
    u8 *const select = fb->top_left;

-    for(int y = 0; y < 8; y++){
-        unsigned char char_pos = font[character * 8 + y];
+    for(int y = 0; y < 8; y++)
+    {
+        char charPos = font[character * 8 + y];

-        for(int x = 7; x >= 0; x--){
-            int screen_pos = (pos_x * SCREEN_TOP_HEIGHT * 3 + (SCREEN_TOP_HEIGHT - y - pos_y - 1) * 3) + (7 - x) * 3 * SCREEN_TOP_HEIGHT;
+        for(int x = 7; x >= 0; x--)
+        {
+            int screenPos = (posX * SCREEN_TOP_HEIGHT * 3 + (SCREEN_TOP_HEIGHT - y - posY - 1) * 3) + (7 - x) * 3 * SCREEN_TOP_HEIGHT;

-            if ((char_pos >> x) & 1) {
-                select[screen_pos] = color >> 16;
-                select[screen_pos + 1] = color >> 8;
-                select[screen_pos + 2] = color;
+            if ((charPos >> x) & 1)
+            {
+                select[screenPos] = color >> 16;
+                select[screenPos + 1] = color >> 8;
+                select[screenPos + 2] = color;
            }
        }
    }
 }

-int drawString(const char *string, int pos_x, int pos_y, u32 color){
+int drawString(const char *string, int posX, int posY, u32 color)
+{
    int length = strlen(string);

-    for(int i = 0, line_i = 0; i < length; i++, line_i++){
-        if(string[i] == '\n'){
-            pos_y += SPACING_VERT;
+    for(int i = 0, line_i = 0; i < length; i++, line_i++)
+    {
+        if(string[i] == '\n')
+        {
+            posY += SPACING_Y;
            line_i = 0;
            i++;
-        } else if(line_i >= (SCREEN_TOP_WIDTH - pos_x) / SPACING_HORIZ){
+        }
+        else if(line_i >= (SCREEN_TOP_WIDTH - posX) / SPACING_X)
+        {
            // Make sure we never get out of the screen.
-            pos_y += SPACING_VERT;
+            posY += SPACING_Y;
            line_i = 2;  // Little offset so we know the same string continues.
            if(string[i] == ' ') i++;  // Spaces at the start look weird
        }

-        drawCharacter(string[i], pos_x + line_i * SPACING_HORIZ, pos_y, color);
+        drawCharacter(string[i], posX + line_i * SPACING_X, posY, color);
    }

-    return pos_y;
+    return posY;
 }
--- a/source/draw.h
+++ b/source/draw.h
@@ -10,10 +10,10 @@

 #include "types.h"

-#define SPACING_VERT 10
-#define SPACING_HORIZ 8
+#define SPACING_Y 10
+#define SPACING_X 8

 void loadSplash(void);
 void clearScreens(void);
-void drawCharacter(char character, int pos_x, int pos_y, u32 color);
-int drawString(const char *string, int pos_x, int pos_y, u32 color);
+void drawCharacter(char character, int posX, int posY, u32 color);
+int drawString(const char *string, int posX, int posY, u32 color);
--- a/source/emunand.c
+++ b/source/emunand.c
@@ -8,53 +8,77 @@
 #include "memory.h"
 #include "fatfs/sdmmc/sdmmc.h"

-void getEmunandSect(u32 *off, u32 *head, u32 emuNAND){
+u32 getEmunandSect(u32 *off, u32 *head, u32 *emuNAND)
+{
    u8 *const temp = (u8 *)0x24300000;

-    u32 nandSize = getMMCDevice(0)->total_size;
-    u32 nandOffset = emuNAND == 1 ? 0 :
+    const u32 nandSize = getMMCDevice(0)->total_size;
+    u32 nandOffset = *emuNAND == 1 ? 0 :
                                  (nandSize > 0x200000 ? 0x400000 : 0x200000);

-    if(sdmmc_sdcard_readsectors(nandOffset + nandSize, 1, temp) == 0){
-        if(*(u32 *)(temp + 0x100) == NCSD_MAGIC){
-            *off = nandOffset;
-            *head = nandOffset + nandSize;
+    //Check for RedNAND
+    if(sdmmc_sdcard_readsectors(nandOffset + 1, 1, temp) == 0)
+    {
+        if(*(u32 *)(temp + 0x100) == NCSD_MAGIC)
+        {
+            *off = nandOffset + 1;
+            *head = nandOffset + 1;
+        }
+
+        //Check for Gateway emuNAND
+        else if(sdmmc_sdcard_readsectors(nandOffset + nandSize, 1, temp) == 0)
+        {
+            if(*(u32 *)(temp + 0x100) == NCSD_MAGIC)
+            {
+                *off = nandOffset;
+                *head = nandOffset + nandSize;
+            }
+
+            /* Fallback to the first emuNAND if there's no second one,
+               or to SysNAND if there isn't any */
+            else
+            {
+                (*emuNAND)--;
+                if(*emuNAND) getEmunandSect(off, head, emuNAND);
+
+                return 0;
+            }
        }
-        //Fallback to the first emuNAND if there's no second one
-        else if(emuNAND == 2) getEmunandSect(off, head, 1);
-        //Check if a RedNAND is present
-        else if(sdmmc_sdcard_readsectors(1, 1, temp) == 0)
-            if(*(u32 *)(temp + 0x100) != NCSD_MAGIC)
-                *head = 0;
    }
+
+    return 1;
 }

-u32 getSDMMC(void *pos, u32 size){
+u32 getSDMMC(u8 *pos, u32 size)
+{
    //Look for struct code
-    const unsigned char pattern[] = {0x21, 0x20, 0x18, 0x20};
-    const u8 *off = (u8 *)memsearch(pos, pattern, size, 4) - 1;
+    const u8 pattern[] = {0x21, 0x20, 0x18, 0x20};
+    const u8 *off = memsearch(pos, pattern, size, 4) - 1;

-    return *(u32 *)(off+0x0A) + *(u32 *)(off+0x0E);
+    return *(u32 *)(off + 0x0A) + *(u32 *)(off + 0x0E);
 }

-void getEmuRW(void *pos, u32 size, u32 *readOff, u32 *writeOff){
+void getEmuRW(u8 *pos, u32 size, u32 *readOff, u32 *writeOff)
+{
    //Look for read/write code
-    const unsigned char pattern[] = {0x1E, 0x00, 0xC8, 0x05};
+    const u8 pattern[] = {0x1E, 0x00, 0xC8, 0x05};

-    *writeOff = (u32)memsearch(pos, pattern, size, 4) - 6;
-    *readOff = (u32)memsearch((void *)(*writeOff - 0x1000), pattern, 0x1000, 4) - 6;
+    *readOff = (u32)memsearch(pos, pattern, size, 4) - 6;
+    *writeOff = (u32)memsearch((u8 *)(*readOff + 0xA), pattern, 0x100, 4) - 6;
 }

-void *getMPU(void *pos, u32 size){
+u32 *getMPU(u8 *pos, u32 size)
+{
    //Look for MPU pattern
-    const unsigned char pattern[] = {0x03, 0x00, 0x24, 0x00};
+    const u8 pattern[] = {0x03, 0x00, 0x24, 0x00};

-    return memsearch(pos, pattern, size, 4);
+    return (u32 *)memsearch(pos, pattern, size, 4);
 }

-void *getEmuCode(void *pos, u32 size, u8 *proc9Offset){
-    const unsigned char pattern[] = {0x00, 0xFF, 0xFF, 0xFF};
- 
+void *getEmuCode(u8 *proc9Offset)
+{
+    const u8 pattern[] = {0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x00};
+
    //Looking for the last free space before Process9
-    return (u8 *)memsearch(pos, pattern, size - (size - (u32)(proc9Offset - (u8 *)pos)), 4) + 0xD;
+    return memsearch(proc9Offset - 0x3000, pattern, 0x3000, 6) + 0x455;
 }
--- a/source/emunand.h
+++ b/source/emunand.h
@@ -10,8 +10,8 @@

 #define NCSD_MAGIC (0x4453434E)

-void getEmunandSect(u32 *off, u32 *head, u32 emuNAND);
-u32 getSDMMC(void *pos, u32 size);
-void getEmuRW(void *pos, u32 size, u32 *readOff, u32 *writeOff);
-void *getMPU(void *pos, u32 size);
-void *getEmuCode(void *pos, u32 size, u8 *proc9Offset);
+u32 getEmunandSect(u32 *off, u32 *head, u32 *emuNAND);
+u32 getSDMMC(u8 *pos, u32 size);
+void getEmuRW(u8 *pos, u32 size, u32 *readOff, u32 *writeOff);
+u32 *getMPU(u8 *pos, u32 size);
+void *getEmuCode(u8 *proc9Offset);
--- a/source/firm.c
+++ b/source/firm.c
@@ -18,166 +18,296 @@
 #include "../build/patches.h"

 //FIRM patches version
-#define PATCH_VER 1
+#define PATCH_VER 4

-static firmHeader *const firmLocation = (firmHeader *)0x24000000;
+static firmHeader *const firm = (firmHeader *)0x24000000;
 static const firmSectionHeader *section;
 static u8 *arm9Section;
 static const char *patchedFirms[] = { "/aurei/patched_firmware_sys.bin",
                                     "/aurei/patched_firmware_emu.bin",
                                     "/aurei/patched_firmware_em2.bin",
-                                     "/aurei/patched_firmware90.bin" };
+                                     "/aurei/patched_firmware90.bin",
+                                     "/aurei/patched_firmware_twl.bin",
+                                     "/aurei/patched_firmware_agb.bin" };
+
 static u32 firmSize,
-           mode = 1,
-           console = 1,
-           emuNAND = 0,
-           a9lhSetup = 0,
-           usePatchedFirm = 0,
-           selectedFirm = 0;
-
-void setupCFW(void){
+           console,
+           mode,
+           emuNAND,
+           a9lhSetup,
+           selectedFirm,
+           usePatchedFirm,
+           emuOffset,
+           emuHeader;
+u32        config;

+void setupCFW(void)
+{
    //Determine if booting with A9LH
-    u32 a9lhBoot = (PDN_SPI_CNT == 0x0) ? 1 : 0;
+    u32 a9lhBoot = !PDN_SPI_CNT ? 1 : 0;
+
    //Retrieve the last booted FIRM
-    u8 previousFirm = CFG_BOOTENV;
+    u32 previousFirm = CFG_BOOTENV;
+
    //Detect the console being used
-    if(PDN_MPCORE_CFG == 1) console = 0;
+    console = (PDN_MPCORE_CFG == 1) ? 0 : 1;
+
    //Get pressed buttons
-    u16 pressed = HID_PAD;
-    u32 updatedSys = 0;
+    u32 pressed = HID_PAD;

    //Attempt to read the configuration file
-    const char configPath[] = "aurei/config.bin";
-    u16 config = 0;
-    u32 needConfig = fileRead((u8 *)&config, configPath, 2) ? 1 : 2;
-
-    //Determine if A9LH is installed
-    if(a9lhBoot || (config >> 2) & 0x1){
-        a9lhSetup = 1;
-        //Check setting for > 9.2 sysNAND
-        updatedSys = config & 0x1;
+    const char configPath[] = "/aurei/config.bin";
+    u32 needConfig;
+    if(fileRead(&config, configPath, 3)) needConfig = 1;
+    else
+    {
+        config = 0;
+        needConfig = 2;
    }

+    //Determine if A9LH is installed and the user has an updated sysNAND
+    u32 updatedSys;
+
+    if(a9lhBoot || (config >> 2) & 1)
+    {
+        if(pressed == SAFE_MODE)
+            error("Using Safe Mode would brick you, or remove A9LH!");
+
+        a9lhSetup = 1;
+
+        //Check setting for > 9.2 sysNAND
+        updatedSys = config & 1;
+    }
+    else
+    {
+        a9lhSetup = 0;
+        updatedSys = 0;
+    }
+
+    u32 tempConfig = (PATCH_VER << 17) | (a9lhSetup << 16);
+
    /* If booting with A9LH, it's a MCU reboot and a previous configuration exists,
       try to force boot options */
-    if(a9lhBoot && previousFirm && needConfig == 1){
+    if(a9lhBoot && previousFirm && needConfig == 1)
+    {
        //Always force a sysNAND boot when quitting AGB_FIRM
-        if(previousFirm == 0x7){
-            if(!updatedSys) mode = (config >> 8) & 0x1;
+        if(previousFirm == 7)
+        {
+            mode = updatedSys ? 1 : (config >> 12) & 1;
+            emuNAND = 0;
            needConfig = 0;
-        //Else, force the last used boot options unless A is pressed
-        } else if(!(pressed & BUTTON_A)){
-            mode = (config >> 8) & 0x1;
-            emuNAND = (config >> 9) & 0x1;
+
+            //Flag to prevent multiple boot options-forcing
+            tempConfig |= 1 << 15;
+        }
+        /* Else, force the last used boot options unless a payload button or A/L/R are pressed
+           or the no-forcing flag is set */
+        else if(!(pressed & OVERRIDE_BUTTONS) && !((config >> 15) & 1))
+        {
+            mode = (config >> 12) & 1;
+            emuNAND = (config >> 13) & 3;
            needConfig = 0;
        }
    }

-    if(needConfig){
-
-        /* If L and one of the payload buttons are pressed, and if not using A9LH
+    //Boot options aren't being forced
+    if(needConfig)
+    {
+        /* If L and R/Select or one of the single payload buttons are pressed and, if not using A9LH,
           the Safe Mode combo is not pressed, chainload an external payload */
-        if((pressed & BUTTON_L1) && (pressed & PAYLOAD_BUTTONS) &&
-           pressed != SAFE_MODE) loadPayload();
-
-        if(a9lhSetup && pressed == SAFE_MODE)
-            error("Using Safe Mode would brick you, or remove A9LH!");
+        if(((pressed & SINGLE_PAYLOAD_BUTTONS) || ((pressed & BUTTON_L1) && (pressed & L_PAYLOAD_BUTTONS)))
+           && pressed != SAFE_MODE)
+            loadPayload();

        //If no configuration file exists or SELECT is held, load configuration menu
        if(needConfig == 2 || (pressed & BUTTON_SELECT))
-            configureCFW(configPath);
+            configureCFW(configPath, patchedFirms);

        //If screens are inited, load splash screen
-        if(PDN_GPU_CNT != 0x1) loadSplash();
+        if(PDN_GPU_CNT != 1) loadSplash();

-        /* If L is pressed, boot 9.0 FIRM */
-        if(pressed == BUTTON_L1) mode = 0;
+        /* If L is pressed, or L or R are not pressed when it is the default FIRM,
+           boot 9.0 FIRM */
+        mode = ((config >> 3) & 1) ? ((!(pressed & BUTTON_L1R1)) ? 0 : 1) :
+                                     ((pressed & BUTTON_L1) ? 0 : 1);

        /* If L or R aren't pressed on a 9.0/9.2 sysNAND, or the 9.0 FIRM is selected
           or R is pressed on a > 9.2 sysNAND, boot emuNAND */
-        if((updatedSys && (!mode || (pressed & BUTTON_R1))) ||
-           (!updatedSys && mode && !(pressed & BUTTON_R1))){
-            //If not 9.0 FIRM and B is pressed, attempt booting the second emuNAND
-            if(mode && (pressed & BUTTON_B)) emuNAND = 2;
-            else emuNAND = 1;
+        if((updatedSys && (!mode || (pressed & BUTTON_R1))) || (!updatedSys && mode && !(pressed & BUTTON_R1)))
+        {
+            /* If not 9.0 FIRM and the second emuNAND is set as default and B isn't pressed, or vice-versa,
+               attempt to boot it */ 
+            emuNAND = (mode && ((!(pressed & BUTTON_B)) == ((config >> 4) & 1))) ? 2 : 1;
        }
+        else emuNAND = 0;

        /* If tha FIRM patches version is different or user switched to/from A9LH,
-           and "Use pre-patched FIRMs" is set, delete all patched FIRMs */
-        u16 bootConfig = (PATCH_VER << 11) | (a9lhSetup << 10);
-        if ((config >> 1) & 0x1 && bootConfig != (config & 0xFC00))
+           delete all patched FIRMs */
+        if((tempConfig & 0xFF0000) != (config & 0xFF0000))
            deleteFirms(patchedFirms, sizeof(patchedFirms) / sizeof(char *));
-
-        //We also need to remember the used boot mode on A9LH
-        if(a9lhBoot) bootConfig |= (mode << 8) | (emuNAND << 9);
-
-        //If the boot configuration is different from previously, overwrite it
-        if(bootConfig != (config & 0xFF00)){
-            //Preserve user settings (first byte)
-            u16 tempConfig = ((config & 0xFF) | bootConfig);
-            fileWrite((u8 *)&tempConfig, configPath, 2);
-        }
    }

-    if(mode) selectedFirm = emuNAND ? (emuNAND == 1 ? 2 : 3) : 1;
+    u32 usePatchedFirmSet = ((config >> 1) & 1);

-    //Skip decrypting and patching FIRM
-    if((config >> 1) & 0x1){
-        //Only needed with this setting
-        if(!mode) selectedFirm = 4;
-        if(fileExists(patchedFirms[selectedFirm - 1])) usePatchedFirm = 1;
+    while(1)
+    {
+        /* Determine which patched FIRM we need to write or attempt to use (if any).
+           Patched 9.0 FIRM is only needed if "Use pre-patched FIRMs" is set */
+        selectedFirm = mode ? (emuNAND ? (emuNAND == 1 ? 2 : 3) : 1) :
+                              (usePatchedFirmSet ? 4 : 0);
+
+        //If "Use pre-patched FIRMs" is set and the appropriate FIRM exists, use it
+        if(usePatchedFirmSet && fileExists(patchedFirms[selectedFirm - 1]))
+            usePatchedFirm = 1;
+
+        /* If the user is booting EmuNAND but the chosen one is not found,
+           force 9.6/10.x FIRM and re-detect the patched FIRMs */
+        else if(emuNAND && !getEmunandSect(&emuOffset, &emuHeader, &emuNAND))
+        {
+            mode = 1;
+            continue;
+        }
+
+        break;
+    }
+
+    tempConfig |= (emuNAND << 13) | (mode << 12);
+
+    //If the boot configuration is different from previously, overwrite it
+    if(tempConfig != (config & 0xFFF000))
+    {
+        //Preserve user settings (first 12 bits)
+        tempConfig |= config & 0xFFF;
+
+        fileWrite(&tempConfig, configPath, 3);
    }
 }

 //Load FIRM into FCRAM
-void loadFirm(void){
-
+void loadFirm(void)
+{
    //If not using an A9LH setup or the patched FIRM, load 9.0 FIRM from NAND
-    if(!usePatchedFirm && !a9lhSetup && !mode){
+    if(!usePatchedFirm && !a9lhSetup && !mode)
+    {
        //Read FIRM from NAND and write to FCRAM
        firmSize = console ? 0xF2000 : 0xE9000;
-        nandFirm0((u8 *)firmLocation, firmSize, console);
+        nandFirm0((u8 *)firm, firmSize, console);
+
        //Check for correct decryption
-        if(memcmp(firmLocation, "FIRM", 4) != 0)
+        if(memcmp(firm, "FIRM", 4) != 0)
            error("Couldn't decrypt NAND FIRM0 (O3DS not on 9.x?)");
    }
+
    //Load FIRM from SD
-    else{
+    else
+    {
        const char *path = usePatchedFirm ? patchedFirms[selectedFirm - 1] :
-                                (mode ? "/aurei/firmware.bin" : "/aurei/firmware90.bin");
+                                            (mode ? "/aurei/firmware.bin" : "/aurei/firmware90.bin");
        firmSize = fileSize(path);
-        if(!firmSize) error("aurei/firmware(90).bin doesn't exist");
-        fileRead((u8 *)firmLocation, path, firmSize);
+        if(!firmSize) error(mode ? "aurei/firmware.bin doesn't exist" :
+                                   "aurei/firmware90.bin doesn't exist");
+        fileRead(firm, path, firmSize);
    }

-    section = firmLocation->section;
+    section = firm->section;

    //Check that the loaded FIRM matches the console
    if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68))
-        error("aurei/firmware(90).bin doesn't match this\nconsole, or it's encrypted");
+        error(mode ? "aurei/firmware.bin doesn't match this console,\nor it's encrypted" :
+                     "aurei/firmware90.bin doesn't match this console,\nor it's encrypted");

-    arm9Section = (u8 *)firmLocation + section[2].offset;
+    arm9Section = (u8 *)firm + section[2].offset;

-    if(console && !usePatchedFirm) decryptArm9Bin(arm9Section, mode);
+    //On N3DS, decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader
+    if(console && !usePatchedFirm)
+    {
+        decryptArm9Bin(arm9Section, mode);
+        firm->arm9Entry = (u8 *)0x801B01C;
+    }
+}
+
+static inline void patchTwlAgb(u32 whichFirm)
+{
+    static firmHeader *const twlAgbFirm = (firmHeader *)0x25000000;
+
+    const char *path = whichFirm ? "/aurei/firmware_agb.bin" : "/aurei/firmware_twl.bin";
+    u32 size = fileSize(path);
+
+    //Skip patching if the file doesn't exist
+    if(!size) return;
+
+    fileRead(twlAgbFirm, path, size);
+
+    static const firmSectionHeader *twlAgbSection = twlAgbFirm->section;
+
+    //Check that the loaded FIRM matches the console
+    if((((u32)twlAgbSection[3].address >> 8) & 0xFF) != (console ? 0x60 : 0x68))
+        error(whichFirm ? "aurei/firmware_agb.bin doesn't match this\nconsole, or it's encrypted" :
+                          "aurei/firmware_twl.bin doesn't match this\nconsole, or it's encrypted");
+
+    //On N3DS, decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader
+    if(console)
+    {
+        decryptArm9Bin((u8 *)twlAgbFirm + twlAgbSection[3].offset, 0);
+        twlAgbFirm->arm9Entry = (u8 *)0x801301C;
+    }
+
+    struct patchData {
+        u32 offset[2];
+        union {
+            u8 type0[8];
+            u16 type1;
+        } patch;
+        u32 type;
+    };
+
+    static const struct patchData twlPatches[] = {
+        {{0x1650C0, 0x165D64}, {{ 6, 0x00, 0x20, 0x4E, 0xB0, 0x70, 0xBD }}, 0},
+        {{0x173A0E, 0x17474A}, { .type1 = 0x2001 }, 1},
+        {{0x174802, 0x17553E}, { .type1 = 0x2000 }, 2},
+        {{0x174964, 0x1756A0}, { .type1 = 0x2000 }, 2},
+        {{0x174D52, 0x175A8E}, { .type1 = 0x2001 }, 2},
+        {{0x174D5E, 0x175A9A}, { .type1 = 0x2001 }, 2},
+        {{0x174D6A, 0x175AA6}, { .type1 = 0x2001 }, 2},
+        {{0x174E56, 0x175B92}, { .type1 = 0x2001 }, 1},
+        {{0x174E58, 0x175B94}, { .type1 = 0x4770 }, 1}
+    };
+
+    static const struct patchData agbPatches[] = {
+        {{0x9D2A8, 0x9DF64}, {{ 6, 0x00, 0x20, 0x4E, 0xB0, 0x70, 0xBD }}, 0},
+        {{0xD7A12, 0xD8B8A}, { .type1 = 0xEF26 }, 1}
+    };
+
+    /* Calculate the amount of patches to apply. Only count the boot screen patch for AGB_FIRM
+       if the matching option was enabled (keep it as last) */
+    u32 numPatches = whichFirm ? (sizeof(agbPatches) / sizeof(struct patchData)) - !((config >> 6) & 1) :
+                                 (sizeof(twlPatches) / sizeof(struct patchData));
+    const struct patchData *patches = whichFirm ? agbPatches : twlPatches;
+
+    //Patch
+    for(u32 i = 0; i < numPatches; i++)
+    {
+        switch(patches[i].type)
+        {
+            case 0:
+                memcpy((u8 *)twlAgbFirm + patches[i].offset[console], patches[i].patch.type0 + 1, patches[i].patch.type0[0]);
+                break;
+            case 2:
+                *(u16 *)((u8 *)twlAgbFirm + patches[i].offset[console] + 2) = 0;
+            case 1:
+                *(u16 *)((u8 *)twlAgbFirm + patches[i].offset[console]) = patches[i].patch.type1;
+                break;
+        }
+    }
+
+    fileWrite(twlAgbFirm, whichFirm ? patchedFirms[5] : patchedFirms[4], size);
 }

 //NAND redirection
-static void loadEmu(u8 *proc9Offset){
-
-    u32 emuOffset = 1,
-        emuHeader = 1,
-        emuRead,
-        emuWrite;
-
-    //Look for emuNAND
-    getEmunandSect(&emuOffset, &emuHeader, emuNAND);
-
-    //No emuNAND detected
-    if(!emuHeader) error("No emuNAND has been detected");
-
-    //Copy the emuNAND patch
-    void *emuCodeOffset = getEmuCode(arm9Section, section[2].size, proc9Offset);
+static inline void patchEmuNAND(u8 *proc9Offset)
+{
+    //Copy emuNAND code
+    void *emuCodeOffset = getEmuCode(proc9Offset);
    memcpy(emuCodeOffset, emunand, emunand_size);

    //Add the data of the found emuNAND
@@ -191,89 +321,136 @@ static void loadEmu(u8 *proc9Offset){
    *pos_sdmmc = getSDMMC(arm9Section, section[2].size);

    //Calculate offset for the hooks
-    *(u32 *)(nandRedir + 4) = (u32)emuCodeOffset - (u32)firmLocation -
-                              section[2].offset + (u32)section[2].address;
+    u32 branchOffset = (u32)emuCodeOffset - (u32)firm -
+                       section[2].offset + (u32)section[2].address;

    //Add emunand hooks
+    u32 emuRead,
+        emuWrite;
+
    getEmuRW(arm9Section, section[2].size, &emuRead, &emuWrite);
-    memcpy((void *)emuRead, nandRedir, sizeof(nandRedir));
-    memcpy((void *)emuWrite, nandRedir, sizeof(nandRedir));
+    *(u16 *)emuRead = nandRedir[0];
+    *((u16 *)emuRead + 1) = nandRedir[1];
+    *((u32 *)emuRead + 1) = branchOffset;
+    *(u16 *)emuWrite = nandRedir[0];
+    *((u16 *)emuWrite + 1) = nandRedir[1];
+    *((u32 *)emuWrite + 1) = branchOffset;

    //Set MPU for emu code region
-    void *mpuOffset = getMPU(arm9Section, section[2].size);
-    memcpy(mpuOffset, mpu, sizeof(mpu));
+    u32 *mpuOffset = getMPU(arm9Section, section[2].size);
+    *mpuOffset = mpuPatch[0];
+    *(mpuOffset + 6) = mpuPatch[1];
+    *(mpuOffset + 9) = mpuPatch[2];
+}
+
+static inline void patchReboots(u8 *proc9Offset)
+{
+    //Calculate offset for the firmlaunch code
+    void *rebootOffset = getReboot(arm9Section, section[2].size);
+
+    //Calculate offset for the fOpen function
+    u32 fOpenOffset = getfOpen(proc9Offset, rebootOffset);
+
+    //Copy firmlaunch code
+    memcpy(rebootOffset, reboot, reboot_size);
+
+    //Put the fOpen offset in the right location
+    u32 *pos_fopen = (u32 *)memsearch(rebootOffset, "OPEN", reboot_size, 4);
+    *pos_fopen = fOpenOffset;
+
+    //Patch path for emuNAND-patched FIRM
+    if(emuNAND)
+    {
+        void *pos_path = memsearch(rebootOffset, L"sy", reboot_size, 4);
+        memcpy(pos_path, emuNAND == 1 ? L"emu" : L"em2", 5);
+    }
+}
+
+static inline void injectLoader(void)
+{
+    u32 loaderOffset,
+        loaderSize;
+
+    getLoader((u8 *)firm + section[0].offset, section[0].size, &loaderOffset, &loaderSize);
+
+    //Check that the injector CXI isn't larger than the original
+    if(injector_size <= (int)loaderSize)
+    {
+        memset((void *)loaderOffset, 0, loaderSize);
+        memcpy((void *)loaderOffset, injector, injector_size);
+
+        //Patch content size and ExeFS size to match the repaced loader's ones
+        *((u32 *)loaderOffset + 0x41) = loaderSize / 0x200;
+        *((u32 *)loaderOffset + 0x69) = loaderSize / 0x200 - 5;
+    }
 }

 //Patches
-void patchFirm(void){
+void patchFirm(void)
+{
+    if(mode)
+    {
+        //Only patch AGB_FIRM/TWL_FIRM if the patched ones don't already exist
+        if(!fileExists(patchedFirms[4])) patchTwlAgb(0);
+        if(!fileExists(patchedFirms[5])) patchTwlAgb(1);
+    }

    //Skip patching
    if(usePatchedFirm) return;

-    if(mode || emuNAND){
+    if(mode || emuNAND)
+    {
        //Find the Process9 NCCH location
        u8 *proc9Offset = getProc9(arm9Section, section[2].size);

        //Apply emuNAND patches
-        if(emuNAND) loadEmu(proc9Offset);
+        if(emuNAND) patchEmuNAND(proc9Offset);

-        //Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
-        if(mode){
-            //Read reboot code from SD
-            void *rebootOffset = getReboot(arm9Section, section[2].size);
-            memcpy(rebootOffset, reboot, reboot_size);
-
-            //Calculate the fOpen offset and put it in the right location
-            u32 *pos_fopen = (u32 *)memsearch(rebootOffset, "OPEN", reboot_size, 4);
-            *pos_fopen = getfOpen(arm9Section, section[2].size, proc9Offset);
-
-            //Patch path for emuNAND-patched FIRM
-            if(emuNAND){
-                void *pos_path = memsearch(rebootOffset, L"sy", reboot_size, 4);
-                memcpy(pos_path, emuNAND == 1 ? L"emu" : L"em2", 5);
-            }
-        }
+        //Apply FIRM reboot patches, not on 9.0 FIRM as it breaks firmlaunchhax
+        if(mode) patchReboots(proc9Offset);
    }

-    if(a9lhSetup && !emuNAND){
-        //Patch FIRM partitions writes on sysNAND to protect A9LH
-        void *writeOffset = getFirmWrite(arm9Section, section[2].size);
-        memcpy(writeOffset, writeBlock, sizeof(writeBlock));
+    //Apply FIRM0/1 writes patches on sysNAND to protect A9LH
+    if(a9lhSetup && !emuNAND)
+    {
+        u16 *writeOffset = getFirmWrite(arm9Section, section[2].size);
+        *writeOffset = writeBlock[0];
+        *(writeOffset + 1) = writeBlock[1];
    }

-    //Disable signature checks
+    //Apply signature checks patches
    u32 sigOffset,
        sigOffset2;

-    getSignatures(firmLocation, firmSize, &sigOffset, &sigOffset2);
-    memcpy((void *)sigOffset, sigPat1, sizeof(sigPat1));
-    memcpy((void *)sigOffset2, sigPat2, sizeof(sigPat2));
+    getSigChecks(arm9Section, section[2].size, &sigOffset, &sigOffset2);
+    *(u16 *)sigOffset = sigPatch[0];
+    *(u16 *)sigOffset2 = sigPatch[0];
+    *((u16 *)sigOffset2 + 1) = sigPatch[1];

-    //Patch ARM9 entrypoint on N3DS to skip arm9loader
-    if(console)
-        firmLocation->arm9Entry = (u8 *)0x801B01C;
+    //Replace the FIRM loader with the injector
+    injectLoader();

    //Write patched FIRM to SD if needed
    if(selectedFirm)
-        if(!fileWrite((u8 *)firmLocation, patchedFirms[selectedFirm - 1], firmSize))
+        if(!fileWrite(firm, patchedFirms[selectedFirm - 1], firmSize))
            error("Couldn't write the patched FIRM (no free space?)");
 }

-void launchFirm(void){
-
+void launchFirm(void)
+{
    if(console && mode) setKeyXs(arm9Section);

    //Copy firm partitions to respective memory locations
-    memcpy(section[0].address, (u8 *)firmLocation + section[0].offset, section[0].size);
-    memcpy(section[1].address, (u8 *)firmLocation + section[1].offset, section[1].size);
+    memcpy(section[0].address, (u8 *)firm + section[0].offset, section[0].size);
+    memcpy(section[1].address, (u8 *)firm + section[1].offset, section[1].size);
    memcpy(section[2].address, arm9Section, section[2].size);

    //Fixes N3DS 3D
    deinitScreens();

    //Set ARM11 kernel entrypoint
-    *(vu32 *)0x1FFFFFF8 = (u32)firmLocation->arm11Entry;
+    *(vu32 *)0x1FFFFFF8 = (u32)firm->arm11Entry;

    //Final jump to arm9 kernel
-    ((void (*)())firmLocation->arm9Entry)();
+    ((void (*)())firm->arm9Entry)();
 }
--- a/source/firm.h
+++ b/source/firm.h
@@ -8,9 +8,8 @@

 #include "types.h"

-#define PDN_MPCORE_CFG (*(vu8 *)0x10140FFC)
-#define PDN_SPI_CNT    (*(vu8 *)0x101401C0)
-#define CFG_BOOTENV    (*(vu8 *)0x10010000)
+#define PDN_MPCORE_CFG (*(vu32 *)0x10140FFC)
+#define PDN_SPI_CNT    (*(vu32 *)0x101401C0)

 //FIRM Header layout
 typedef struct firmSectionHeader {
--- a/source/fs.c
+++ b/source/fs.c
@@ -9,18 +9,21 @@

 static FATFS fs;

-u32 mountSD(void){
+u32 mountSD(void)
+{
    if(f_mount(&fs, "0:", 1) != FR_OK) return 0;
    return 1;
 }

-u32 fileRead(u8 *dest, const char *path, u32 size){
+u32 fileRead(void *dest, const char *path, u32 size)
+{
    FRESULT fr;
    FIL fp;
    unsigned int br = 0;

    fr = f_open(&fp, path, FA_READ);
-    if(fr == FR_OK){
+    if(fr == FR_OK)
+    {
        if(!size) size = f_size(&fp);
        fr = f_read(&fp, dest, size, &br);
    }
@@ -29,7 +32,8 @@ u32 fileRead(u8 *dest, const char *path, u32 size){
    return fr ? 0 : 1;
 }

-u32 fileWrite(const u8 *buffer, const char *path, u32 size){
+u32 fileWrite(const void *buffer, const char *path, u32 size)
+{
    FRESULT fr;
    FIL fp;
    unsigned int br = 0;
@@ -41,7 +45,8 @@ u32 fileWrite(const u8 *buffer, const char *path, u32 size){
    return fr ? 0 : 1;
 }

-u32 fileSize(const char *path){
+u32 fileSize(const char *path)
+{
    FIL fp;
    u32 size = 0;

@@ -52,7 +57,8 @@ u32 fileSize(const char *path){
    return size;
 }

-u32 fileExists(const char *path){
+u32 fileExists(const char *path)
+{
    FIL fp;
    u32 exists = 0;

@@ -62,6 +68,7 @@ u32 fileExists(const char *path){
    return exists;
 }

-void fileDelete(const char *path){
+void fileDelete(const char *path)
+{
    f_unlink(path);
 }
--- a/source/fs.h
+++ b/source/fs.h
@@ -9,8 +9,8 @@
 #include "types.h"

 u32 mountSD(void);
-u32 fileRead(u8 *dest, const char *path, u32 size);
-u32 fileWrite(const u8 *buffer, const char *path, u32 size);
+u32 fileRead(void *dest, const char *path, u32 size);
+u32 fileWrite(const void *buffer, const char *path, u32 size);
 u32 fileSize(const char *path);
 u32 fileExists(const char *path);
 void fileDelete(const char *path);
--- a/source/i2c.c
+++ b/source/i2c.c
@@ -10,11 +10,13 @@ static const struct { u8 bus_id, reg_addr; } dev_data[] = {
    {2, 0xA4}, {2, 0x9A}, {2, 0xA0},
 };

-static inline u8 i2cGetDeviceBusId(u8 device_id) {
+static inline u8 i2cGetDeviceBusId(u8 device_id)
+{
    return dev_data[device_id].bus_id;
 }

-static inline u8 i2cGetDeviceRegAddr(u8 device_id) {
+static inline u8 i2cGetDeviceRegAddr(u8 device_id)
+{
    return dev_data[device_id].reg_addr;
 }

@@ -26,7 +28,8 @@ static vu8* reg_data_addrs[] = {
    (vu8*)(I2C3_REG_OFF + I2C_REG_DATA),
 };

-static inline vu8* i2cGetDataReg(u8 bus_id) {
+static inline vu8* i2cGetDataReg(u8 bus_id)
+{
    return reg_data_addrs[bus_id];
 }

@@ -38,22 +41,27 @@ static vu8* reg_cnt_addrs[] = {
    (vu8*)(I2C3_REG_OFF + I2C_REG_CNT),
 };

-static inline vu8* i2cGetCntReg(u8 bus_id) {
+static inline vu8* i2cGetCntReg(u8 bus_id)
+{
    return reg_cnt_addrs[bus_id];
 }

 //-----------------------------------------------------------------------------

-static inline void i2cWaitBusy(u8 bus_id) {
+static inline void i2cWaitBusy(u8 bus_id)
+{
    while (*i2cGetCntReg(bus_id) & 0x80);
 }

-static inline u32 i2cGetResult(u8 bus_id) {
+static inline u32 i2cGetResult(u8 bus_id)
+{
    i2cWaitBusy(bus_id);
+
    return (*i2cGetCntReg(bus_id) >> 4) & 1;
 }

-static void i2cStop(u8 bus_id, u8 arg0) {
+static void i2cStop(u8 bus_id, u8 arg0)
+{
    *i2cGetCntReg(bus_id) = (arg0 << 5) | 0xC0;
    i2cWaitBusy(bus_id);
    *i2cGetCntReg(bus_id) = 0xC5;
@@ -61,32 +69,40 @@ static void i2cStop(u8 bus_id, u8 arg0) {

 //-----------------------------------------------------------------------------

-static u32 i2cSelectDevice(u8 bus_id, u8 dev_reg) {
+static u32 i2cSelectDevice(u8 bus_id, u8 dev_reg)
+{
    i2cWaitBusy(bus_id);
    *i2cGetDataReg(bus_id) = dev_reg;
    *i2cGetCntReg(bus_id) = 0xC2;
+
    return i2cGetResult(bus_id);
 }

-static u32 i2cSelectRegister(u8 bus_id, u8 reg) {
+static u32 i2cSelectRegister(u8 bus_id, u8 reg)
+{
    i2cWaitBusy(bus_id);
    *i2cGetDataReg(bus_id) = reg;
    *i2cGetCntReg(bus_id) = 0xC0;
+
    return i2cGetResult(bus_id);
 }

 //-----------------------------------------------------------------------------

-u32 i2cWriteRegister(u8 dev_id, u8 reg, u8 data) {
+u32 i2cWriteRegister(u8 dev_id, u8 reg, u8 data)
+{
    u8 bus_id = i2cGetDeviceBusId(dev_id);
    u8 dev_addr = i2cGetDeviceRegAddr(dev_id);

-    for (int i = 0; i < 8; i++) {
-        if (i2cSelectDevice(bus_id, dev_addr) && i2cSelectRegister(bus_id, reg)) {
+    for (u32 i = 0; i < 8; i++)
+    {
+        if (i2cSelectDevice(bus_id, dev_addr) && i2cSelectRegister(bus_id, reg))
+        {
            i2cWaitBusy(bus_id);
            *i2cGetDataReg(bus_id) = data;
            *i2cGetCntReg(bus_id) = 0xC1;
            i2cStop(bus_id, 0);
+
            if (i2cGetResult(bus_id))
                return 1;
        }
@@ -95,4 +111,4 @@ u32 i2cWriteRegister(u8 dev_id, u8 reg, u8 data) {
    }

    return 0;
-}
+}
--- a/source/loader.c
+++ b/source/loader.c
@@ -12,8 +12,10 @@

 #define PAYLOAD_ADDRESS	0x24F00000

-void loadPayload(void){
-    if(fileExists("aurei/payloads/default.bin")){
+void loadPayload(void)
+{
+    if(fileExists("aurei/payloads/default.bin"))
+    {
        initScreens();
        memcpy((void *)PAYLOAD_ADDRESS, loader, loader_size);
        ((void (*)())PAYLOAD_ADDRESS)();
--- a/source/main.c
+++ b/source/main.c
@@ -9,7 +9,8 @@
 #include "fs.h"
 #include "firm.h"

-void main(void){
+void main(void)
+{
    mountSD();
    setupCFW();
    loadFirm();
--- a/source/memory.c
+++ b/source/memory.c
@@ -2,42 +2,72 @@
 *   memory.c
 *       by Reisyukaku / Aurora Wright
 *   Copyright (c) 2016 All Rights Reserved
+*
+*   Quick Search algorithm adapted from http://igm.univ-mlv.fr/~lecroq/string/node19.html#SECTION00190
 */

 #include "memory.h"

-void memcpy(void *dest, const void *src, u32 size){
+void memcpy(void *dest, const void *src, u32 size)
+{
    u8 *destc = (u8 *)dest;
    const u8 *srcc = (const u8 *)src;
+
    for(u32 i = 0; i < size; i++)
        destc[i] = srcc[i];
 }

-void memset(void *dest, int filler, u32 size){
+void memset(void *dest, int filler, u32 size)
+{
    u8 *destc = (u8 *)dest;
+
    for(u32 i = 0; i < size; i++)
        destc[i] = (u8)filler;
 }

-void memset32(void *dest, u32 filler, u32 size){
+void memset32(void *dest, u32 filler, u32 size)
+{
    u32 *dest32 = (u32 *)dest;
+
    for (u32 i = 0; i < size / 4; i++)
        dest32[i] = filler;
 }

-int memcmp(const void *buf1, const void *buf2, u32 size){
+int memcmp(const void *buf1, const void *buf2, u32 size)
+{
    const u8 *buf1c = (const u8 *)buf1;
    const u8 *buf2c = (const u8 *)buf2;
-    for(u32 i = 0; i < size; i++){
+
+    for(u32 i = 0; i < size; i++)
+    {
        int cmp = buf1c[i] - buf2c[i];
        if(cmp) return cmp;
    }
+
    return 0;
 }

-void *memsearch(void *start_pos, const void *search, u32 size, u32 size_search){
-    for(void *pos = start_pos + size - size_search; pos >= start_pos; pos--){
-        if(memcmp(pos, search, size_search) == 0) return pos;
+u8 *memsearch(u8 *startPos, const void *pattern, u32 size, u32 patternSize)
+{
+    const u8 *patternc = (const u8 *)pattern;
+
+    //Preprocessing
+    u32 table[256];
+
+    for(u32 i = 0; i < 256; ++i)
+        table[i] = patternSize + 1;
+    for(u32 i = 0; i < patternSize; ++i)
+        table[patternc[i]] = patternSize - i;
+
+    //Searching
+    u32 j = 0;
+
+    while(j <= size - patternSize)
+    {
+        if(memcmp(patternc, startPos + j, patternSize) == 0)
+            return startPos + j;
+        j += table[startPos[j + patternSize]];
    }
+
    return NULL;
 }
--- a/source/memory.h
+++ b/source/memory.h
@@ -2,6 +2,8 @@
 *   memory.h
 *       by Reisyukaku / Aurora Wright
 *   Copyright (c) 2016 All Rights Reserved
+*
+*   Quick Search algorithm adapted from http://igm.univ-mlv.fr/~lecroq/string/node19.html#SECTION00190
 */

 #pragma once
@@ -12,4 +14,4 @@ void memcpy(void *dest, const void *src, u32 size);
 void memset(void *dest, int filler, u32 size);
 void memset32(void *dest, u32 filler, u32 size);
 int memcmp(const void *buf1, const void *buf2, u32 size);
-void *memsearch(void *start_pos, const void *search, u32 size, u32 size_search);
+u8 *memsearch(u8 *startPos, const void *pattern, u32 size, u32 patternSize);
--- a/source/patches.c
+++ b/source/patches.c
@@ -11,60 +11,66 @@
 *                   Patches
 **************************************************/

-const u8 mpu[0x2C] = {
-    0x03, 0x00, 0x36, 0x00, 0x00, 0x00, 0x10, 0x10, 0x01, 0x00, 0x00, 0x01, 0x03, 0x00, 0x36, 0x00, 
-    0x00, 0x00, 0x00, 0x20, 0x01, 0x01, 0x01, 0x01, 0x03, 0x06, 0x20, 0x00, 0x00, 0x00, 0x00, 0x08, 
-    0x01, 0x01, 0x01, 0x01, 0x03, 0x06, 0x1C, 0x00, 0x00, 0x00, 0x02, 0x08
-};
+const u32 mpuPatch[3] = {0x00360003, 0x00200603, 0x001C0603};

-//Branch to emunand function. To be filled in
-u8 nandRedir[0x08] = {0x00, 0x4C, 0xA0, 0x47, 0x00, 0x00, 0x00, 0x00};
+const u16 nandRedir[2] = {0x4C00, 0x47A0};

-const u8 sigPat1[2] = {0x00, 0x20};
-const u8 sigPat2[4] = {0x00, 0x20, 0x70, 0x47};
+const u16 sigPatch[2] = {0x2000, 0x4770};

-const u8 writeBlock[4] = {0x00, 0x20, 0xC0, 0x46};
+const u16 writeBlock[2] = {0x2000, 0x46C0};

 /**************************************************
 *                   Functions
 **************************************************/

-u8 *getProc9(void *pos, u32 size){
-    return (u8 *)memsearch(pos, "ess9", size, 4);
+u8 *getProc9(u8 *pos, u32 size)
+{
+    return memsearch(pos, "ess9", size, 4);
 }

-void getSignatures(void *pos, u32 size, u32 *off, u32 *off2){
+void getSigChecks(u8 *pos, u32 size, u32 *off, u32 *off2)
+{
    //Look for signature checks
-    const unsigned char pattern[] = {0xC0, 0x1C, 0x76, 0xE7};
-    const unsigned char pattern2[] = {0xB5, 0x22, 0x4D, 0x0C};
+    const u8 pattern[] = {0xC0, 0x1C, 0x76, 0xE7},
+             pattern2[] = {0xB5, 0x22, 0x4D, 0x0C};

    *off = (u32)memsearch(pos, pattern, size, 4);
    *off2 = (u32)memsearch(pos, pattern2, size, 4) - 1;
 }

-void *getReboot(void *pos, u32 size){
+void *getReboot(u8 *pos, u32 size)
+{
    //Look for FIRM reboot code
-    const unsigned char pattern[] = {0xDE, 0x1F, 0x8D, 0xE2};
+    const u8 pattern[] = {0xDE, 0x1F, 0x8D, 0xE2};

-    return (u8 *)memsearch(pos, pattern, size, 4) - 0x10;
+    return memsearch(pos, pattern, size, 4) - 0x10;
 }

-u32 getfOpen(void *pos, u32 size, u8 *proc9Offset){
+u32 getfOpen(u8 *proc9Offset, void *rebootOffset)
+{
    //Offset Process9 code gets loaded to in memory (defined in ExHeader)
    u32 p9MemAddr = *(u32 *)(proc9Offset + 0xC);
-    //Start of Process9 .code section (start of NCCH + ExeFS offset + ExeFS header size)
+
+    //Process9 code offset (start of NCCH + ExeFS offset + ExeFS header size)
    u32 p9CodeOff = (u32)(proc9Offset - 0x204) + (*(u32 *)(proc9Offset - 0x64) * 0x200) + 0x200;

-    //Calculate fOpen
-    const unsigned char pattern[] = {0xB0, 0x04, 0x98, 0x0D};
-
-    return (u32)memsearch(pos, pattern, size, 4) - 2 - p9CodeOff + p9MemAddr;
+    //Firmlaunch function offset - offset in BLX opcode (A4-16 - ARM DDI 0100E) + 1
+    return (u32)rebootOffset + 9 - (-((*(u32 *)rebootOffset & 0x00FFFFFF) << 2) & 0xFFFFF) - p9CodeOff + p9MemAddr;
 }

-void *getFirmWrite(void *pos, u32 size){
+u16 *getFirmWrite(u8 *pos, u32 size)
+{
    //Look for FIRM writing code
-    u8 *firmwrite = (u8 *)memsearch(pos, "exe:", size, 4);
-    const unsigned char pattern[] = {0x00, 0x28, 0x01, 0xDA};
+    u8 *const off = memsearch(pos, "exe:", size, 4);
+    const u8 pattern[] = {0x00, 0x28, 0x01, 0xDA};

-    return memsearch(firmwrite - 0x100, pattern, 0x100, 4);
+    return (u16 *)memsearch(off - 0x100, pattern, 0x100, 4);
+}
+
+void getLoader(u8 *pos, u32 size, u32 *loaderOffset, u32 *loaderSize)
+{
+    u8 *const off = memsearch(pos, "loade", size, 5);
+
+    *loaderOffset = (u32)off - 0x200;
+    *loaderSize = *(u32 *)(off - 0xFC) * 0x200;
 }
--- a/source/patches.h
+++ b/source/patches.h
@@ -11,17 +11,17 @@
 /**************************************************
 *                   Patches
 **************************************************/
-const u8 mpu[0x2C];       
-u8 nandRedir[0x08];
-const u8 sigPat1[2];
-const u8 sigPat2[4];
-const u8 writeBlock[4];
+const u32 mpuPatch[3];       
+const u16 nandRedir[2];
+const u16 sigPatch[2];
+const u16 writeBlock[2];

 /**************************************************
 *                   Functions
 **************************************************/
-u8 *getProc9(void *pos, u32 size);
-void getSignatures(void *pos, u32 size, u32 *off, u32 *off2);
-void *getReboot(void *pos, u32 size);
-u32 getfOpen(void *pos, u32 size, u8 *proc9Offset);
-void *getFirmWrite(void *pos, u32 size);
+u8 *getProc9(u8 *pos, u32 size);
+void getSigChecks(u8 *pos, u32 size, u32 *off, u32 *off2);
+void *getReboot(u8 *pos, u32 size);
+u32 getfOpen(u8 *proc9Offset, void *rebootOffset);
+u16 *getFirmWrite(u8 *pos, u32 size);
+void getLoader(u8 *pos, u32 size, u32 *loaderOffset, u32 *loaderSize);
--- a/source/screeninit.c
+++ b/source/screeninit.c
@@ -8,13 +8,19 @@
 */

 #include "screeninit.h"
+#include "memory.h"
 #include "draw.h"
 #include "i2c.h"
+#include "../build/screeninit.h"

-static vu32 *const arm11 = (vu32 *)0x1FFFFFF8;
+#define SCREENINIT_ADDRESS 0x24F03000

-void deinitScreens(void){
-    void __attribute__((naked)) ARM11(void){
+static vu32 *const arm11 = (u32 *)0x1FFFFFF8;
+
+void deinitScreens(void)
+{
+    void __attribute__((naked)) ARM11(void)
+    {
        //Disable interrupts
        __asm(".word 0xF10C01C0");

@@ -28,124 +34,32 @@ void deinitScreens(void){
    
        //Wait for the entry to be set
        while(!*arm11);
+
        //Jump to it
        ((void (*)())*arm11)();
    }

-    if(PDN_GPU_CNT != 0x1){
+    if(PDN_GPU_CNT != 1)
+    {
        *arm11 = (u32)ARM11;
        while(*arm11);
    }
 }

-void initScreens(void){
-    void __attribute__((naked)) ARM11(void){
-        //Disable interrupts
-        __asm(".word 0xF10C01C0");
+void initScreens(void)
+{
+    if(PDN_GPU_CNT == 1)
+    {
+        //Write brightness level for the stub to pick up
+        *(vu32 *)0x24F04000 = (config >> 10) & 3;

-        *(vu32 *)0x10141200 = 0x1007F;
-        *(vu32 *)0x10202014 = 0x00000001;
-        *(vu32 *)0x1020200C &= 0xFFFEFFFE;
-        *(vu32 *)0x10202240 = 0x45;
-        *(vu32 *)0x10202A40 = 0x45;
-        *(vu32 *)0x10202244 = 0x1023E;
-        *(vu32 *)0x10202A44 = 0x1023E;
+        memcpy((void *)SCREENINIT_ADDRESS, screeninit, screeninit_size);

-        // Top screen
-        *(vu32 *)0x10400400 = 0x000001c2;
-        *(vu32 *)0x10400404 = 0x000000d1;
-        *(vu32 *)0x10400408 = 0x000001c1;
-        *(vu32 *)0x1040040c = 0x000001c1;
-        *(vu32 *)0x10400410 = 0x00000000;
-        *(vu32 *)0x10400414 = 0x000000cf;
-        *(vu32 *)0x10400418 = 0x000000d1;
-        *(vu32 *)0x1040041c = 0x01c501c1;
-        *(vu32 *)0x10400420 = 0x00010000;
-        *(vu32 *)0x10400424 = 0x0000019d;
-        *(vu32 *)0x10400428 = 0x00000002;
-        *(vu32 *)0x1040042c = 0x00000192;
-        *(vu32 *)0x10400430 = 0x00000192;
-        *(vu32 *)0x10400434 = 0x00000192;
-        *(vu32 *)0x10400438 = 0x00000001;
-        *(vu32 *)0x1040043c = 0x00000002;
-        *(vu32 *)0x10400440 = 0x01960192;
-        *(vu32 *)0x10400444 = 0x00000000;
-        *(vu32 *)0x10400448 = 0x00000000;
-        *(vu32 *)0x1040045C = 0x00f00190;
-        *(vu32 *)0x10400460 = 0x01c100d1;
-        *(vu32 *)0x10400464 = 0x01920002;
-        *(vu32 *)0x10400468 = 0x18300000;
-        *(vu32 *)0x10400470 = 0x80341;
-        *(vu32 *)0x10400474 = 0x00010501;
-        *(vu32 *)0x10400478 = 0;
-        *(vu32 *)0x10400490 = 0x000002D0;
-        *(vu32 *)0x1040049C = 0x00000000;
-
-        // Disco register
-        for(vu32 i = 0; i < 256; i++)
-            *(vu32 *)0x10400484 = 0x10101 * i;
-
-        // Bottom screen
-        *(vu32 *)0x10400500 = 0x000001c2;
-        *(vu32 *)0x10400504 = 0x000000d1;
-        *(vu32 *)0x10400508 = 0x000001c1;
-        *(vu32 *)0x1040050c = 0x000001c1;
-        *(vu32 *)0x10400510 = 0x000000cd;
-        *(vu32 *)0x10400514 = 0x000000cf;
-        *(vu32 *)0x10400518 = 0x000000d1;
-        *(vu32 *)0x1040051c = 0x01c501c1;
-        *(vu32 *)0x10400520 = 0x00010000;
-        *(vu32 *)0x10400524 = 0x0000019d;
-        *(vu32 *)0x10400528 = 0x00000052;
-        *(vu32 *)0x1040052c = 0x00000192;
-        *(vu32 *)0x10400530 = 0x00000192;
-        *(vu32 *)0x10400534 = 0x0000004f;
-        *(vu32 *)0x10400538 = 0x00000050;
-        *(vu32 *)0x1040053c = 0x00000052;
-        *(vu32 *)0x10400540 = 0x01980194;
-        *(vu32 *)0x10400544 = 0x00000000;
-        *(vu32 *)0x10400548 = 0x00000011;
-        *(vu32 *)0x1040055C = 0x00f00140;
-        *(vu32 *)0x10400560 = 0x01c100d1;
-        *(vu32 *)0x10400564 = 0x01920052;
-        *(vu32 *)0x10400568 = 0x18300000 + 0x46500;
-        *(vu32 *)0x10400570 = 0x80301;
-        *(vu32 *)0x10400574 = 0x00010501;
-        *(vu32 *)0x10400578 = 0;
-        *(vu32 *)0x10400590 = 0x000002D0;
-        *(vu32 *)0x1040059C = 0x00000000;
-
-        // Disco register
-        for(vu32 i = 0; i < 256; i++)
-            *(vu32 *)0x10400584 = 0x10101 * i;
-
-        // Enable backlight
-        i2cWriteRegister(I2C_DEV_MCU, 0x22, 0x2A);
-
-        *(vu32 *)0x10400468 = 0x18300000;
-        *(vu32 *)0x1040046c = 0x18300000;
-        *(vu32 *)0x10400494 = 0x18300000;
-        *(vu32 *)0x10400498 = 0x18300000;
-        *(vu32 *)0x10400568 = 0x18346500;
-        *(vu32 *)0x1040056c = 0x18346500;
-
-        //Set CakeBrah framebuffers
-        *((vu32 *)0x23FFFE00) = 0x18300000;
-        *((vu32 *)0x23FFFE04) = 0x18300000;
-        *((vu32 *)0x23FFFE08) = 0x18346500;
-
-        //Clear ARM11 entry offset
-        *arm11 = 0;
-
-        //Wait for the entry to be set
-        while(!*arm11);
-        //Jump to it
-        ((void (*)())*arm11)();
-    }
-
-    if(PDN_GPU_CNT == 0x1){
-        *arm11 = (u32)ARM11;
+        *arm11 = SCREENINIT_ADDRESS;
        while(*arm11);
+
+        //Turn on backlight
+        i2cWriteRegister(I2C_DEV_MCU, 0x22, 0x2A);
    }

    clearScreens();
--- a/source/screeninit.h
+++ b/source/screeninit.h
@@ -13,5 +13,7 @@

 #define PDN_GPU_CNT (*(vu8 *)0x10141200)

+u32 config;
+
 void deinitScreens(void);
 void initScreens(void);
--- a/source/start.s
+++ b/source/start.s
@@ -50,7 +50,4 @@ _start:
    mov r1, #0x340
    str r1, [r0]

-    bl main
-
-.die:
-    b .die
+    b main
--- a/source/utils.c
+++ b/source/utils.c
@@ -11,24 +11,20 @@
 #include "i2c.h"
 #include "buttons.h"

-//Number of options that can be configured
-#define OPTIONS 3
-
 #define COLOR_TITLE    0xFF9900
 #define COLOR_WHITE    0xFFFFFF
 #define COLOR_RED      0x0000FF
 #define COLOR_BLACK    0x000000

-struct options {
-    char *text[OPTIONS];
-    int pos_y[OPTIONS];
-    u32 enabled[OPTIONS];
-    u32 selected;
+struct option {
+    int posY;
+    u32 enabled;
 };

-static u16 waitInput(void){
-    u32 pressedkey = 0;
-    u16 key;
+static u32 waitInput(void)
+{
+    u32 pressedKey = 0;
+    u32 key;

    //Wait for no keys to be pressed
    while(HID_PAD);
@@ -36,84 +32,136 @@ static u16 waitInput(void){
    do {
        //Wait for a key to be pressed
        while(!HID_PAD);
+
        key = HID_PAD;

        //Make sure it's pressed
-        for(u32 i = 0x13000; i; i--){
-            if (key != HID_PAD)
-                break;
-            if(i==1) pressedkey = 1;
+        for(u32 i = 0x13000; i; i--)
+        {
+            if(key != HID_PAD) break;
+            if(i == 1) pressedKey = 1;
        }
-    } while (!pressedkey);
+    }
+    while(!pressedKey);

    return key;
 }

-void configureCFW(const char *configPath){
-    struct options options;
-
-    options.text[0] = "( ) Updated SysNAND mode (A9LH-only)";
-    options.text[1] = "( ) Use pre-patched FIRMs";
-    options.text[2] = "( ) Force A9LH detection";
-
+void configureCFW(const char *configPath, const char *patchedFirms[])
+{
    initScreens();

-    drawString("AuReiNand configuration", 10, 10, COLOR_TITLE);
+    drawString(CONFIG_TITLE, 10, 10, COLOR_TITLE);
    drawString("Press A to select, START to save and reboot", 10, 30, COLOR_WHITE);

+    const char *optionsText[] = { "( ) Updated SysNAND mode (A9LH-only)",
+                                  "( ) Use pre-patched FIRMs",
+                                  "( ) Force A9LH detection",
+                                  "( ) Use 9.0 FIRM as default",
+                                  "( ) Use second EmuNAND as default",
+                                  "( ) Show current NAND in System Settings",
+                                  "( ) Show GBA boot screen in patched AGB_FIRM" };
+
+    u32 optionsAmount = sizeof(optionsText) / sizeof(char *);
+    struct option options[optionsAmount];
+
    //Read and parse the existing configuration
-    u16 tempConfig = 0;
-    fileRead((u8 *)&tempConfig, configPath, 2);
-    for(u32 i = 0; i < OPTIONS; i++)
-        options.enabled[i] = (tempConfig >> i) & 0x1;
+    u32 tempConfig = 0;
+    fileRead(&tempConfig, configPath, 3);
+
+    for(u32 i = 0; i < optionsAmount; i++)
+        options[i].enabled = (tempConfig >> i) & 1;
+
+    options[optionsAmount].enabled = (tempConfig >> 10) & 3;

    //Pre-select the first configuration option
-    options.selected = 0;
+    u32 selectedOption = 0;

    //Boring configuration menu
-    while(1){
+    while(1)
+    {
        u16 pressed = 0;

-        do{
-            for(u32 i = 0; i < OPTIONS; i++){
-                options.pos_y[i] = drawString(options.text[i], 10, !i ? 60 : options.pos_y[i - 1] + SPACING_VERT, options.selected == i ? COLOR_RED : COLOR_WHITE);
-                drawCharacter('x', 10 + SPACING_HORIZ, options.pos_y[i], options.enabled[i] ? (options.selected == i ? COLOR_RED : COLOR_WHITE) : COLOR_BLACK);
-            }
-            pressed = waitInput();
-        } while(!(pressed & (BUTTON_UP | BUTTON_DOWN | BUTTON_A | BUTTON_START)));
+        do {
+            options[optionsAmount].posY = drawString("Screen-init brightness: 4( ) 3( ) 2( ) 1( )", 10, 53, selectedOption == optionsAmount ? COLOR_RED : COLOR_WHITE);

-        if(pressed == BUTTON_UP) options.selected = !options.selected ? OPTIONS - 1 : options.selected - 1;
-        else if(pressed == BUTTON_DOWN) options.selected = options.selected == OPTIONS - 1 ? 0 : options.selected + 1;
-        else if(pressed == BUTTON_A) options.enabled[options.selected] = !options.enabled[options.selected];
-        else if(pressed == BUTTON_START) break;
+            for(u32 i = 0; i < optionsAmount; i++)
+            {
+                options[i].posY = drawString(optionsText[i], 10, !i ? options[optionsAmount].posY + 2 * SPACING_Y : options[i - 1].posY + SPACING_Y, selectedOption == i ? COLOR_RED : COLOR_WHITE);
+                drawCharacter('x', 10 + SPACING_X, options[i].posY, options[i].enabled ? (selectedOption == i ? COLOR_RED : COLOR_WHITE) : COLOR_BLACK);
+            }
+
+            for(u32 i = 0; i < 4; i++)
+                drawCharacter('x', 10 + (26 + 5 * i) * SPACING_X, options[optionsAmount].posY, options[optionsAmount].enabled == i ? (selectedOption == optionsAmount ? COLOR_RED : COLOR_WHITE) : COLOR_BLACK);
+
+            pressed = waitInput();
+        }
+        while(!(pressed & MENU_BUTTONS));
+
+        switch(pressed)
+        {
+            case BUTTON_UP:
+                selectedOption = !selectedOption ? optionsAmount : selectedOption - 1;
+                break;
+            case BUTTON_DOWN:
+                selectedOption = selectedOption >= optionsAmount - 1 ? 0 : selectedOption + 1;
+                break;
+            case BUTTON_LEFT:
+                selectedOption = 0;
+                break;
+            case BUTTON_RIGHT:
+                selectedOption = optionsAmount - 1;
+                break;
+            case BUTTON_A:
+                if(selectedOption != optionsAmount) options[selectedOption].enabled = !options[selectedOption].enabled;
+                else options[optionsAmount].enabled = options[optionsAmount].enabled == 3 ? 0 : options[optionsAmount].enabled + 1;
+                break;
+        }
+
+        if(pressed == BUTTON_START) break;
    }

-    //Preserve the last-used boot options (second byte)
-    tempConfig &= 0xFF00;
+    //If the user has been using A9LH and the "Updated SysNAND" setting changed, delete the patched 9.0 FIRM
+    if(((tempConfig >> 16) & 1) && ((tempConfig & 1) != options[0].enabled)) fileDelete(patchedFirms[3]);
+
+    //If the "Show GBA boot screen in patched AGB_FIRM" setting changed, delete the patched AGB_FIRM
+    if(((tempConfig >> 6) & 1) != options[6].enabled) fileDelete(patchedFirms[5]);
+
+    //Preserve the last-used boot options (last 12 bits)
+    tempConfig &= 0xFFF000;

    //Parse and write the selected options
-    for(u32 i = 0; i < OPTIONS; i++)
-        tempConfig |= options.enabled[i] << i;
-    fileWrite((u8 *)&tempConfig, configPath, 2);
+    for(u32 i = 0; i < optionsAmount; i++)
+        tempConfig |= options[i].enabled << i;
+
+    tempConfig |= options[optionsAmount].enabled << 10;
+
+    fileWrite(&tempConfig, configPath, 3);
+
+    //Zero the last booted FIRM flag
+    CFG_BOOTENV = 0;

    //Reboot
    i2cWriteRegister(I2C_DEV_MCU, 0x20, 1 << 2);
    while(1);
 }

-void deleteFirms(const char *firmPaths[], u32 firms){
-    while(firms){
+void deleteFirms(const char *firmPaths[], u32 firms)
+{
+    while(firms)
+    {
        fileDelete(firmPaths[firms - 1]);
        firms--;
    }
 }

-void error(const char *message){
+void error(const char *message)
+{
    initScreens();

    drawString("An error has occurred:", 10, 10, COLOR_RED);
-    int pos_y = drawString(message, 10, 30, COLOR_WHITE);
-    drawString("Press any button to shutdown", 10, pos_y + 2 * SPACING_VERT, COLOR_WHITE);
+    int posY = drawString(message, 10, 30, COLOR_WHITE);
+    drawString("Press any button to shutdown", 10, posY + 2 * SPACING_Y, COLOR_WHITE);

    waitInput();

--- a/source/utils.h
+++ b/source/utils.h
@@ -8,6 +8,8 @@

 #include "types.h"

-void configureCFW(const char *configPath);
+#define CFG_BOOTENV (*(vu32 *)0x10010000)
+
+void configureCFW(const char *configPath, const char *patchedFirms[]);
 void deleteFirms(const char *firmPaths[], u32 firms);
 void error(const char *message);
Author	SHA1	Message	Date
Aurora	3aacbd17ce	Upped patch version	2016-04-05 02:29:36 +02:00
Aurora	6f8a9421ef	Added basic support for configuring the brightness level for the built-in screen init	2016-04-05 02:24:21 +02:00
Aurora	bb437f6f7b	Better commenting	2016-04-04 19:14:49 +02:00
Aurora	0001f301f8	Cleanup, fixed the second emuNAND patched FIRM still getting created, removed injector SOAP patch as it changes nothing without going to great lengths to change the region of a NNID, made L not needed to load payloads except for R and Select (Start is now default)	2016-04-04 18:07:13 +02:00
Aurora	f7bbc4bfec	Made the AGB_FIRM splash screen optional Apparently it causes compatibility issues	2016-04-04 01:08:42 +02:00
Aurora	a127a38438	Updated ReadME	2016-04-03 19:53:03 +02:00
Aurora	16225b97d7	Small changes	2016-04-03 18:18:44 +02:00
Aurora	0587c14162	Forgot stuff	2016-04-03 18:10:48 +02:00
Aurora	a181bba9f2	Added TWL/AGB FIRM patching/SD loading for New and Old 3DS (thanks to mid-kid of CakesFW for making it possible!)	2016-04-03 17:56:09 +02:00
Aurora	993e564fbb	u32-ify	2016-04-02 22:02:16 +02:00
Aurora	956829864c	This looks unused (my AUS N3DS has 2)	2016-04-02 18:57:52 +02:00
Aurora	24186a7148	Some more tidying up	2016-04-02 18:48:31 +02:00
Aurora	3475cfe1e6	Changed indentation style across the code to make it more readable, added newlines before comments, moved patches to separate functions, made memory operations slightly faster by compiling them with O3 (thanks TuxSH!)	2016-04-02 18:22:47 +02:00
Aurora	6b64a10362	Fixed ARM11 access to chainloaded payloads	2016-04-01 14:27:31 +02:00
Aurora	5e99fb3aa0	Fixed dumb mistakes	2016-03-31 18:25:50 +02:00
Aurora	060d8e9945	Comment things better	2016-03-31 16:04:12 +02:00
Aurora	1026471842	Leftover from testing	2016-03-31 15:59:40 +02:00
Aurora	645208ec82	EmuNAND is detected almost instantly when the CFW configures itself, if the user is attempting to load an EmuNAND and none is found, SysNAND and 9.6/10.x FIRM are forced. Also prevents the second EmuNAND patched FIRM from being created if no second EmuNAND exists.	2016-03-31 15:57:02 +02:00
Aurora	f4c48a64ca	Fixed loading the alternate EmuNAND if 9.0 FIRM was set as default, improved comments and further cleanup of the injector	2016-03-31 01:38:28 +02:00
Aurora	c80ac985fe	Further clean-up of the patcher code	2016-03-29 22:43:15 +02:00
Aurora	ac9bdc7665	Fixed exiting GBA games with updated SysNAND	2016-03-29 18:56:51 +02:00
Aurora	217d75024d	These should be u32s	2016-03-29 18:47:30 +02:00
Aurora	12e5b4adb9	Updated readME	2016-03-29 18:17:22 +02:00
Aurora	945f80993b	Zero the last-FIRM-booted flag when exiting config	2016-03-29 17:58:33 +02:00
Aurora	5f32779ceb	Lots of changes/new features - To override the last used boot mode on soft reboot, you only need to press A if you want to boot to the default option. Holding L(+payload button)/R is enough for the other modes. - Added version number to the config menu - Replaced the memsearch algorithm with a faster one - Integrated 3ds_injector from @yifanlu. This brings us region free and all the other FreeMultiPatcher patches. Other than that, you now have the possibility to display the currently booted NAND/FIRM in System Settings! - Rewritten most code for the config menu. You now can navigate to the first/last options with left and right. - You can now choose the 9.0 FIRM to be default in the config menu. This will essentially switch "no buttons" and L in both modes. - You can now choose the second emuNAND to be default in the config menu. This will essentially switch "B is not pressed" and "B is pressed". - When the second emuNAND is booted, it will persist like the other boot options on soft reboot - Bugfixes	2016-03-29 17:43:53 +02:00
Aurora	e8ebb2f7fe	Fixed signature patterns searching area, aligned variable/function names to the latest ReiNand	2016-03-27 19:19:35 +02:00
Aurora	034e63669a	Readability	2016-03-27 18:47:08 +02:00
Aurora	c75ed567fc	Added version number to the config menu	2016-03-27 18:39:16 +02:00
Aurora	1e2bf61dcf	Possibly makes FatFs faster, does not affect loader size much	2016-03-27 16:42:19 +02:00
Aurora	de4fea77a1	Make the code more readable by defining variables locally, avoid useless redefinitions, when rebooting from TWL and NATIVE_FIRM you can now override with just A (same as pressing nothing), L(+payload buttons) or R	2016-03-27 16:31:05 +02:00
Aurora	441c143b3e	No reason for these not to be u8s	2016-03-26 19:28:46 +01:00
Aurora	feff28a4fe	Added multi redNAND support (thanks to @Desterly for the original commit)	2016-03-26 17:48:12 +01:00
Aurora	b3d25ce64a	Better commenting	2016-03-26 17:28:47 +01:00
Aurora	0f44205959	Simplified patching, yet one memsearch less, fixed override with A+L when boot options are forced	2016-03-26 17:25:05 +01:00
Aurora	1861d556a6	Spaces and stuff Makes things more uniform	2016-03-25 18:17:12 +01:00
Aurora	9b1df43687	Useless casts again	2016-03-25 01:58:42 +01:00
Aurora	56e0157d64	Forgot about MCU reboots	2016-03-24 17:33:32 +01:00
Aurora	d23cd5acd5	More logical this way	2016-03-24 17:24:16 +01:00