diff --git a/source/ios_kernel/source/instant_patches.c b/source/ios_kernel/source/instant_patches.c
index 4e50efc..720c267 100644
--- a/source/ios_kernel/source/instant_patches.c
+++ b/source/ios_kernel/source/instant_patches.c
@@ -83,6 +83,9 @@ void instant_patches_setup(void) {
 
     *(volatile u32 *) (0x0501dd78 - 0x05000000 + 0x081C0000) = THUMB_BL(0x0501dd78, MCP_ReadCOSXml_patch);
     *(volatile u32 *) (0x051105ce - 0x05000000 + 0x081C0000) = THUMB_BL(0x051105ce, MCP_ReadCOSXml_patch);
+    
+    // give us bsp::ee:read permission for PPC
+    *(volatile u32 *) (0xe6044db0 - 0xe6042000 + 0x13d02000) = 0x000001F0;
 
     // Patch MCP debugmode check for syslog
     *(volatile u32 *) (0x050290d8 - 0x05000000 + 0x081C0000) = 0x20004770;
diff --git a/source/ios_kernel/source/kernel_patches.c b/source/ios_kernel/source/kernel_patches.c
index ea2d52d..af54417 100644
--- a/source/ios_kernel/source/kernel_patches.c
+++ b/source/ios_kernel/source/kernel_patches.c
@@ -128,6 +128,9 @@ void kernel_run_patches(u32 ios_elf_start) {
     // Write magic word to disable custom IPC
     section_write_word(ios_elf_start, 0x050290dc, 0x42424242);
     
+    // give us bsp::ee:read permission for PPC
+    section_write_word(ios_elf_start, 0xe6044db0, 0x000001F0);
+    
     // patch TEST debug mode check
     //section_write_word(ios_elf_start, 0xe4016a78, 0xe3a00000);
     section_write_word(ios_elf_start, 0xe4007828, 0xe3a00000);