From 60da5ca21740adf9033385d718140b7ebd1179d5 Mon Sep 17 00:00:00 2001
From: orboditilt <45944072+orboditilt@users.noreply.github.com>
Date: Sun, 13 Jan 2019 14:45:36 +0100
Subject: [PATCH] first commit

---
 .gitignore                   |   4 +
 LICENSE                      | 674 +++++++++++++++++++++++++++++++++++
 Makefile                     | 184 ++++++++++
 README.md                    |  34 ++
 sd_loader/Makefile           | 178 +++++++++
 sd_loader/src/common.h       |  42 +++
 sd_loader/src/elf_abi.h      | 591 ++++++++++++++++++++++++++++++
 sd_loader/src/entry.c        | 594 ++++++++++++++++++++++++++++++
 sd_loader/src/fs_defs.h      |  60 ++++
 sd_loader/src/kernel_defs.h  |  74 ++++
 sd_loader/src/kernel_hooks.S |  69 ++++
 sd_loader/src/link.ld        |  23 ++
 sd_loader/src/loader_defs.h  |  36 ++
 sd_loader/src/os_defs.h      |  38 ++
 sd_loader/src/os_types.h     | 215 +++++++++++
 src/elf_abi.h                | 591 ++++++++++++++++++++++++++++++
 src/entry.c                  | 277 ++++++++++++++
 src/kernel_patches.S         | 211 +++++++++++
 src/link.ld                  |  20 ++
 19 files changed, 3915 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 LICENSE
 create mode 100644 Makefile
 create mode 100644 README.md
 create mode 100644 sd_loader/Makefile
 create mode 100644 sd_loader/src/common.h
 create mode 100644 sd_loader/src/elf_abi.h
 create mode 100644 sd_loader/src/entry.c
 create mode 100644 sd_loader/src/fs_defs.h
 create mode 100644 sd_loader/src/kernel_defs.h
 create mode 100644 sd_loader/src/kernel_hooks.S
 create mode 100644 sd_loader/src/link.ld
 create mode 100644 sd_loader/src/loader_defs.h
 create mode 100644 sd_loader/src/os_defs.h
 create mode 100644 sd_loader/src/os_types.h
 create mode 100644 src/elf_abi.h
 create mode 100644 src/entry.c
 create mode 100644 src/kernel_patches.S
 create mode 100644 src/link.ld

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..1c41356
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,4 @@
+build/
+*.elf
+src/sd_loader.h
+*.cbp
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..9cecc1d
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    {one line to give the program's name and a brief idea of what it does.}
+    Copyright (C) {year}  {name of author}
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    {project}  Copyright (C) {year}  {fullname}
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..c888e4e
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,184 @@
+#---------------------------------------------------------------------------------
+# Clear the implicit built in rules
+#---------------------------------------------------------------------------------
+.SUFFIXES:
+#---------------------------------------------------------------------------------
+ifeq ($(strip $(DEVKITPPC)),)
+$(error "Please set DEVKITPPC in your environment. export DEVKITPPC=<path to>devkitPPC")
+endif
+export PATH			:=	$(DEVKITPPC)/bin:$(PORTLIBS)/bin:$(PATH)
+export PORTLIBS		:=	$(DEVKITPRO)/portlibs/ppc
+
+PREFIX	:=	powerpc-eabi-
+
+export AS	:=	$(PREFIX)as
+export CC	:=	$(PREFIX)gcc
+export CXX	:=	$(PREFIX)g++
+export AR	:=	$(PREFIX)ar
+export OBJCOPY	:=	$(PREFIX)objcopy
+
+#---------------------------------------------------------------------------------
+# TARGET is the name of the output
+# BUILD is the directory where object files & intermediate files will be placed
+# SOURCES is a list of directories containing source code
+# INCLUDES is a list of directories containing extra header files
+#---------------------------------------------------------------------------------
+TARGET		:=	payload
+BUILD		:=	build
+BUILD_DBG	:=	$(TARGET)_dbg
+SOURCES		:=	src
+DATA		:=
+INCLUDES	:=
+
+#---------------------------------------------------------------------------------
+# options for code generation
+#---------------------------------------------------------------------------------
+CFLAGS	:=  -std=gnu11 -mrvl -mcpu=750 -meabi -mhard-float -ffast-math -fno-builtin \
+		    -O0 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing $(INCLUDE)
+CXXFLAGS := -std=gnu++11 -mrvl -mcpu=750 -meabi -mhard-float -ffast-math \
+		    -O0 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing $(INCLUDE)
+ASFLAGS	:= -mregnames
+LDFLAGS	:= -nostartfiles -Wl,--gc-sections
+
+Q := @
+MAKEFLAGS += --no-print-directory
+#---------------------------------------------------------------------------------
+# any extra libraries we wish to link with the project
+#---------------------------------------------------------------------------------
+LIBS	:=
+
+#---------------------------------------------------------------------------------
+# list of directories containing libraries, this must be the top level containing
+# include and lib
+#---------------------------------------------------------------------------------
+LIBDIRS	:=	$(CURDIR)	\
+			$(DEVKITPPC)/lib  \
+			$(DEVKITPPC)/lib/gcc/powerpc-eabi/4.8.2
+
+
+#---------------------------------------------------------------------------------
+# no real need to edit anything past this point unless you need to add additional
+# rules for different file extensions
+#---------------------------------------------------------------------------------
+ifneq ($(BUILD),$(notdir $(CURDIR)))
+#---------------------------------------------------------------------------------
+export PROJECTDIR := $(CURDIR)
+export OUTPUT	:=	$(CURDIR)/$(TARGETDIR)/$(TARGET)
+export VPATH	:=	$(foreach dir,$(SOURCES),$(CURDIR)/$(dir)) \
+					$(foreach dir,$(DATA),$(CURDIR)/$(dir))
+export DEPSDIR	:=	$(CURDIR)/$(BUILD)
+
+#---------------------------------------------------------------------------------
+# automatically build a list of object files for our project
+#---------------------------------------------------------------------------------
+CFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.c)))
+CPPFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.cpp)))
+sFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.s)))
+SFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.S)))
+BINFILES	:=	$(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.*)))
+TTFFILES	:=	$(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.ttf)))
+PNGFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.png)))
+
+#---------------------------------------------------------------------------------
+# use CXX for linking C++ projects, CC for standard C
+#---------------------------------------------------------------------------------
+ifeq ($(strip $(CPPFILES)),)
+	export LD	:=	$(CC)
+else
+	export LD	:=	$(CXX)
+endif
+
+export OFILES	:=	$(CPPFILES:.cpp=.o) $(CFILES:.c=.o) \
+					$(sFILES:.s=.o) $(SFILES:.S=.o) \
+					$(PNGFILES:.png=.png.o) $(addsuffix .o,$(BINFILES))
+
+#---------------------------------------------------------------------------------
+# build a list of include paths
+#---------------------------------------------------------------------------------
+export INCLUDE	:=	$(foreach dir,$(INCLUDES),-I$(CURDIR)/$(dir)) \
+					$(foreach dir,$(LIBDIRS),-I$(dir)/include) \
+					-I$(CURDIR)/$(BUILD)  \
+					-I$(PORTLIBS)/include 
+
+#---------------------------------------------------------------------------------
+# build a list of library paths
+#---------------------------------------------------------------------------------
+export LIBPATHS	:=	$(foreach dir,$(LIBDIRS),-L$(dir)/lib) \
+					-L$(PORTLIBS)/lib
+
+export OUTPUT	:=	$(CURDIR)/$(TARGET)
+.PHONY: $(BUILD) clean install
+
+#---------------------------------------------------------------------------------
+$(BUILD):  src/sd_loader.h 
+	@[ -d $@ ] || mkdir -p $@
+	@$(MAKE) --no-print-directory -C $(BUILD) -f $(CURDIR)/Makefile
+    
+sd_loader_elf := sd_loader/sd_loader.elf
+src/sd_loader.h: $(sd_loader_elf)
+	xxd -i $< | sed "s/unsigned/static const unsigned/g;s/loader/loader/g;s/build_//g" > $@
+
+$(sd_loader_elf):
+	make -C sd_loader
+
+
+#---------------------------------------------------------------------------------
+clean:
+	@echo clean ...
+	@rm -fr $(BUILD) $(OUTPUT).elf $(OUTPUT).bin $(BUILD_DBG).elf
+
+#---------------------------------------------------------------------------------
+else
+
+DEPENDS	:=	$(OFILES:.o=.d)
+
+#---------------------------------------------------------------------------------
+# main targets
+#---------------------------------------------------------------------------------
+$(OUTPUT).elf: $(OFILES)
+
+#---------------------------------------------------------------------------------
+# This rule links in binary data with the .jpg extension
+#---------------------------------------------------------------------------------
+%.elf: link.ld $(OFILES)
+	@echo "linking ... $(TARGET).elf"
+	$(Q)$(LD) -n -T $^ $(LDFLAGS) -o ../$(BUILD_DBG).elf  $(LIBPATHS) $(LIBS)
+	$(Q)$(OBJCOPY) -S -R .comment -R .gnu.attributes ../$(BUILD_DBG).elf $@
+
+#---------------------------------------------------------------------------------
+%.a:
+#---------------------------------------------------------------------------------
+	@echo $(notdir $@)
+	@rm -f $@
+	@$(AR) -rc $@ $^
+
+#---------------------------------------------------------------------------------
+%.o: %.cpp
+	@echo $(notdir $<)
+	@$(CXX) -MMD -MP -MF $(DEPSDIR)/$*.d $(CXXFLAGS) -c $< -o $@ $(ERROR_FILTER)
+
+#---------------------------------------------------------------------------------
+%.o: %.c
+	@echo $(notdir $<)
+	@$(CC) -MMD -MP -MF $(DEPSDIR)/$*.d $(CFLAGS) -c $< -o $@ $(ERROR_FILTER)
+
+#---------------------------------------------------------------------------------
+%.o: %.S
+	@echo $(notdir $<)
+	@$(CC) -MMD -MP -MF $(DEPSDIR)/$*.d -x assembler-with-cpp $(ASFLAGS) -c $< -o $@ $(ERROR_FILTER)
+
+#---------------------------------------------------------------------------------
+%.png.o : %.png
+	@echo $(notdir $<)
+	@bin2s -a 32 $< | $(AS) -o $(@)
+
+#---------------------------------------------------------------------------------
+%.ttf.o : %.ttf
+	@echo $(notdir $<)
+	@bin2s -a 32 $< | $(AS) -o $(@)
+
+-include $(DEPENDS)
+
+#---------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..3078b1e
--- /dev/null
+++ b/README.md
@@ -0,0 +1,34 @@
+# Homebrew Launcher installer
+Straight port from the offical [homebrew_launcher repo](https://github.com/dimok789/homebrew_launcher)
+
+# Usage
+Meant to be used with the  [payload_loader](https://github.com/wiiu-env/payload_loader).  
+Put the created `payload.elf` on the sd card where the `payload_loader` can find it.
+Check out the repository of the loader for further instructions.
+
+Still requires the [homebrew_launcher.elf](https://github.com/dimok789/homebrew_launcher)
+to be placed on the sd card. Checkout the [official hbl repo](https://github.com/dimok789/homebrew_launcher)
+for further instructions.
+
+## Building
+In order to be able to compile this, you need to have installed
+[devkitPPC](https://devkitpro.org/wiki/Getting_Started) with the following
+pacman packages installed.
+
+```
+pacman -Syu devkitPPC
+```
+
+Make sure the following environment variables are set:
+```
+DEVKITPRO=/opt/devkitpro
+DEVKITPPC=/opt/devkitpro/devkitPPC
+```
+
+The command `make` should produce a `payload.elf`, meant to be used with the
+[payload_loader](https://github.com/wiiu-env/payload_loader)
+
+# Credits
+
+- dimok789: [original installer](https://github.com/dimok789/homebrew_launcher))
+- orboditilt: port to be used with the [payload_loader](https://github.com/wiiu-env/payload_loader)
diff --git a/sd_loader/Makefile b/sd_loader/Makefile
new file mode 100644
index 0000000..a59f8a6
--- /dev/null
+++ b/sd_loader/Makefile
@@ -0,0 +1,178 @@
+#---------------------------------------------------------------------------------
+# Clear the implicit built in rules
+#---------------------------------------------------------------------------------
+.SUFFIXES:
+#---------------------------------------------------------------------------------
+ifeq ($(strip $(DEVKITPPC)),)
+$(error "Please set DEVKITPPC in your environment. export DEVKITPPC=<path to>devkitPPC")
+endif
+export PATH			:=	$(DEVKITPPC)/bin:$(PORTLIBS)/bin:$(PATH)
+export LIBOGC_INC	:=	$(DEVKITPRO)/libogc/include
+export LIBOGC_LIB	:=	$(DEVKITPRO)/libogc/lib/wii
+export PORTLIBS		:=	$(DEVKITPRO)/portlibs/ppc
+
+PREFIX	:=	powerpc-eabi-
+
+export AS	:=	$(PREFIX)as
+export CC	:=	$(PREFIX)gcc
+export CXX	:=	$(PREFIX)g++
+export AR	:=	$(PREFIX)ar
+export OBJCOPY	:=	$(PREFIX)objcopy
+
+#---------------------------------------------------------------------------------
+# TARGET is the name of the output
+# BUILD is the directory where object files & intermediate files will be placed
+# SOURCES is a list of directories containing source code
+# INCLUDES is a list of directories containing extra header files
+#---------------------------------------------------------------------------------
+TARGET		:=	sd_loader
+BUILD		:=	build
+BUILD_DBG	:=	$(TARGET)_dbg
+SOURCES		:=	src
+DATA		:=
+INCLUDES	:=
+
+#---------------------------------------------------------------------------------
+# options for code generation
+#---------------------------------------------------------------------------------
+CFLAGS	:=  -std=gnu11 -mrvl -mcpu=750 -meabi -mhard-float -ffast-math -fno-builtin \
+		    -Os -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing $(INCLUDE)
+CXXFLAGS := -std=gnu++11 -mrvl -mcpu=750 -meabi -mhard-float -ffast-math \
+		    -O3 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing $(INCLUDE)
+ASFLAGS	:= -mregnames
+LDFLAGS	:= -nostartfiles -Wl,--gc-sections
+
+Q := @
+MAKEFLAGS += --no-print-directory
+#---------------------------------------------------------------------------------
+# any extra libraries we wish to link with the project
+#---------------------------------------------------------------------------------
+LIBS	:=
+
+#---------------------------------------------------------------------------------
+# list of directories containing libraries, this must be the top level containing
+# include and lib
+#---------------------------------------------------------------------------------
+LIBDIRS	:=	$(CURDIR)	\
+			$(DEVKITPPC)/lib  \
+			$(DEVKITPPC)/lib/gcc/powerpc-eabi/4.8.2
+
+
+#---------------------------------------------------------------------------------
+# no real need to edit anything past this point unless you need to add additional
+# rules for different file extensions
+#---------------------------------------------------------------------------------
+ifneq ($(BUILD),$(notdir $(CURDIR)))
+#---------------------------------------------------------------------------------
+export PROJECTDIR := $(CURDIR)
+export OUTPUT	:=	$(CURDIR)/$(TARGETDIR)/$(TARGET)
+export VPATH	:=	$(foreach dir,$(SOURCES),$(CURDIR)/$(dir)) \
+					$(foreach dir,$(DATA),$(CURDIR)/$(dir))
+export DEPSDIR	:=	$(CURDIR)/$(BUILD)
+
+#---------------------------------------------------------------------------------
+# automatically build a list of object files for our project
+#---------------------------------------------------------------------------------
+CFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.c)))
+CPPFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.cpp)))
+sFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.s)))
+SFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.S)))
+BINFILES	:=	$(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.*)))
+TTFFILES	:=	$(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.ttf)))
+PNGFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.png)))
+
+#---------------------------------------------------------------------------------
+# use CXX for linking C++ projects, CC for standard C
+#---------------------------------------------------------------------------------
+ifeq ($(strip $(CPPFILES)),)
+	export LD	:=	$(CC)
+else
+	export LD	:=	$(CXX)
+endif
+
+export OFILES	:=	$(CPPFILES:.cpp=.o) $(CFILES:.c=.o) \
+					$(sFILES:.s=.o) $(SFILES:.S=.o) \
+					$(PNGFILES:.png=.png.o) $(addsuffix .o,$(BINFILES))
+
+#---------------------------------------------------------------------------------
+# build a list of include paths
+#---------------------------------------------------------------------------------
+export INCLUDE	:=	$(foreach dir,$(INCLUDES),-I$(CURDIR)/$(dir)) \
+					$(foreach dir,$(LIBDIRS),-I$(dir)/include) \
+					-I$(CURDIR)/$(BUILD) -I$(LIBOGC_INC) \
+					-I$(PORTLIBS)/include -I$(PORTLIBS)/include/freetype2
+
+#---------------------------------------------------------------------------------
+# build a list of library paths
+#---------------------------------------------------------------------------------
+export LIBPATHS	:=	$(foreach dir,$(LIBDIRS),-L$(dir)/lib) \
+					-L$(LIBOGC_LIB) -L$(PORTLIBS)/lib
+
+export OUTPUT	:=	$(CURDIR)/$(TARGET)
+.PHONY: $(BUILD) clean install
+
+#---------------------------------------------------------------------------------
+$(BUILD):
+	@[ -d $@ ] || mkdir -p $@
+	@$(MAKE) --no-print-directory -C $(BUILD) -f $(CURDIR)/Makefile
+
+#---------------------------------------------------------------------------------
+clean:
+	@echo clean ...
+	@rm -fr $(BUILD) $(OUTPUT).elf $(OUTPUT).bin $(BUILD_DBG).elf
+
+#---------------------------------------------------------------------------------
+else
+
+DEPENDS	:=	$(OFILES:.o=.d)
+
+#---------------------------------------------------------------------------------
+# main targets
+#---------------------------------------------------------------------------------
+$(OUTPUT).elf: $(OFILES)
+
+#---------------------------------------------------------------------------------
+# This rule links in binary data with the .jpg extension
+#---------------------------------------------------------------------------------
+%.elf: link.ld $(OFILES)
+	@echo "linking ... $(TARGET).elf"
+	$(Q)$(LD) -n -T $^ $(LDFLAGS) -o ../$(BUILD_DBG).elf  $(LIBPATHS) $(LIBS)
+	$(Q)$(OBJCOPY) -S -R .comment -R .gnu.attributes ../$(BUILD_DBG).elf $@
+
+#---------------------------------------------------------------------------------
+%.a:
+#---------------------------------------------------------------------------------
+	@echo $(notdir $@)
+	@rm -f $@
+	@$(AR) -rc $@ $^
+
+#---------------------------------------------------------------------------------
+%.o: %.cpp
+	@echo $(notdir $<)
+	@$(CXX) -MMD -MP -MF $(DEPSDIR)/$*.d $(CXXFLAGS) -c $< -o $@ $(ERROR_FILTER)
+
+#---------------------------------------------------------------------------------
+%.o: %.c
+	@echo $(notdir $<)
+	@$(CC) -MMD -MP -MF $(DEPSDIR)/$*.d $(CFLAGS) -c $< -o $@ $(ERROR_FILTER)
+
+#---------------------------------------------------------------------------------
+%.o: %.S
+	@echo $(notdir $<)
+	@$(CC) -MMD -MP -MF $(DEPSDIR)/$*.d -x assembler-with-cpp $(ASFLAGS) -c $< -o $@ $(ERROR_FILTER)
+
+#---------------------------------------------------------------------------------
+%.png.o : %.png
+	@echo $(notdir $<)
+	@bin2s -a 32 $< | $(AS) -o $(@)
+
+#---------------------------------------------------------------------------------
+%.ttf.o : %.ttf
+	@echo $(notdir $<)
+	@bin2s -a 32 $< | $(AS) -o $(@)
+
+-include $(DEPENDS)
+
+#---------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------
diff --git a/sd_loader/src/common.h b/sd_loader/src/common.h
new file mode 100644
index 0000000..71beaae
--- /dev/null
+++ b/sd_loader/src/common.h
@@ -0,0 +1,42 @@
+#ifndef COMMON_H
+#define	COMMON_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "os_defs.h"
+
+#define HBL_VERSION                 "v1.4"
+
+#define CAFE_OS_SD_PATH             "/vol/external01"
+#define SD_PATH                     "sd:"
+#define WIIU_PATH                   "/wiiu"
+
+#ifndef MEM_BASE
+#define MEM_BASE                    (0x00800000)
+#endif
+
+#define ELF_DATA_ADDR               (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x00))
+#define ELF_DATA_SIZE               (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x04))
+#define HBL_CHANNEL                 (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x08))
+#define RPX_MAX_SIZE                (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x0C))
+#define RPX_MAX_CODE_SIZE           (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x10))
+#define MAIN_ENTRY_ADDR             (*(volatile unsigned int*)(MEM_BASE + 0x1400 + 0x00))
+#define OS_FIRMWARE                 (*(volatile unsigned int*)(MEM_BASE + 0x1400 + 0x04))
+
+#define OS_SPECIFICS                ((OsSpecifics*)(MEM_BASE + 0x1500))
+
+#define MEM_AREA_TABLE              ((s_mem_area*)(MEM_BASE + 0x1600))
+
+#ifndef EXIT_SUCCESS
+#define EXIT_SUCCESS                0
+#endif
+#define EXIT_RELAUNCH_ON_LOAD       0xFFFFFFFD
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* COMMON_H */
+
diff --git a/sd_loader/src/elf_abi.h b/sd_loader/src/elf_abi.h
new file mode 100644
index 0000000..4d9c796
--- /dev/null
+++ b/sd_loader/src/elf_abi.h
@@ -0,0 +1,591 @@
+/*
+ * Copyright (c) 1995, 1996, 2001, 2002
+ * Erik Theisen.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * This is the ELF ABI header file
+ * formerly known as "elf_abi.h".
+ */
+
+#ifndef _ELF_ABI_H
+#define _ELF_ABI_H
+
+/*
+ *  This version doesn't work for 64-bit ABIs - Erik.
+ */
+
+/*
+ * These typedefs need to be handled better.
+ */
+typedef unsigned int	Elf32_Addr;	/* Unsigned program address */
+typedef unsigned int	Elf32_Off;	/* Unsigned file offset */
+typedef signed int	Elf32_Sword;	/* Signed large integer */
+typedef unsigned int	Elf32_Word;	/* Unsigned large integer */
+typedef unsigned short	Elf32_Half;	/* Unsigned medium integer */
+
+/* e_ident[] identification indexes */
+#define EI_MAG0		0		/* file ID */
+#define EI_MAG1		1		/* file ID */
+#define EI_MAG2		2		/* file ID */
+#define EI_MAG3		3		/* file ID */
+#define EI_CLASS	4		/* file class */
+#define EI_DATA		5		/* data encoding */
+#define EI_VERSION	6		/* ELF header version */
+#define EI_OSABI	7		/* OS/ABI specific ELF extensions */
+#define EI_ABIVERSION	8		/* ABI target version */
+#define EI_PAD		9		/* start of pad bytes */
+#define EI_NIDENT	16		/* Size of e_ident[] */
+
+/* e_ident[] magic number */
+#define	ELFMAG0		0x7f		/* e_ident[EI_MAG0] */
+#define	ELFMAG1		'E'		/* e_ident[EI_MAG1] */
+#define	ELFMAG2		'L'		/* e_ident[EI_MAG2] */
+#define	ELFMAG3		'F'		/* e_ident[EI_MAG3] */
+#define	ELFMAG		"\177ELF"	/* magic */
+#define	SELFMAG		4		/* size of magic */
+
+/* e_ident[] file class */
+#define	ELFCLASSNONE	0		/* invalid */
+#define	ELFCLASsigned int	1		/* 32-bit objs */
+#define	ELFCLASS64	2		/* 64-bit objs */
+#define	ELFCLASSNUM	3		/* number of classes */
+
+/* e_ident[] data encoding */
+#define ELFDATANONE	0		/* invalid */
+#define ELFDATA2LSB	1		/* Little-Endian */
+#define ELFDATA2MSB	2		/* Big-Endian */
+#define ELFDATANUM	3		/* number of data encode defines */
+
+/* e_ident[] OS/ABI specific ELF extensions */
+#define ELFOSABI_NONE		0	/* No extension specified */
+#define ELFOSABI_HPUX		1	/* Hewlett-Packard HP-UX */
+#define ELFOSABI_NETBSD		2	/* NetBSD */
+#define ELFOSABI_LINUX		3	/* Linux */
+#define ELFOSABI_SOLARIS	6	/* Sun Solaris */
+#define ELFOSABI_AIX		7	/* AIX */
+#define ELFOSABI_IRIX		8	/* IRIX */
+#define ELFOSABI_FREEBSD	9	/* FreeBSD */
+#define ELFOSABI_TRU64		10	/* Compaq TRU64 UNIX */
+#define ELFOSABI_MODESTO	11	/* Novell Modesto */
+#define ELFOSABI_OPENBSD	12	/* OpenBSD */
+/* 64-255 Architecture-specific value range */
+
+/* e_ident[] ABI Version */
+#define ELFABIVERSION		0
+
+/* e_ident */
+#define IS_ELF(ehdr) ((ehdr).e_ident[EI_MAG0] == ELFMAG0 && \
+                      (ehdr).e_ident[EI_MAG1] == ELFMAG1 && \
+                      (ehdr).e_ident[EI_MAG2] == ELFMAG2 && \
+                      (ehdr).e_ident[EI_MAG3] == ELFMAG3)
+
+/* ELF Header */
+typedef struct elfhdr{
+	unsigned char	e_ident[EI_NIDENT]; /* ELF Identification */
+	Elf32_Half	e_type;		/* object file type */
+	Elf32_Half	e_machine;	/* machine */
+	Elf32_Word	e_version;	/* object file version */
+	Elf32_Addr	e_entry;	/* virtual entry point */
+	Elf32_Off	e_phoff;	/* program header table offset */
+	Elf32_Off	e_shoff;	/* section header table offset */
+	Elf32_Word	e_flags;	/* processor-specific flags */
+	Elf32_Half	e_ehsize;	/* ELF header size */
+	Elf32_Half	e_phentsize;	/* program header entry size */
+	Elf32_Half	e_phnum;	/* number of program header entries */
+	Elf32_Half	e_shentsize;	/* section header entry size */
+	Elf32_Half	e_shnum;	/* number of section header entries */
+	Elf32_Half	e_shstrndx;	/* section header table's "section
+					   header string table" entry offset */
+} Elf32_Ehdr;
+
+/* e_type */
+#define ET_NONE		0		/* No file type */
+#define ET_REL		1		/* relocatable file */
+#define ET_EXEC		2		/* executable file */
+#define ET_DYN		3		/* shared object file */
+#define ET_CORE		4		/* core file */
+#define ET_NUM		5		/* number of types */
+#define ET_LOOS		0xfe00		/* reserved range for operating */
+#define ET_HIOS		0xfeff		/*  system specific e_type */
+#define ET_LOPROC	0xff00		/* reserved range for processor */
+#define ET_HIPROC	0xffff		/*  specific e_type */
+
+/* e_machine */
+#define EM_NONE		0		/* No Machine */
+#define EM_M32		1		/* AT&T WE 32100 */
+#define EM_SPARC	2		/* SPARC */
+#define EM_386		3		/* Intel 80386 */
+#define EM_68K		4		/* Motorola 68000 */
+#define EM_88K		5		/* Motorola 88000 */
+#if 0
+#define EM_486		6		/* RESERVED - was Intel 80486 */
+#endif
+#define EM_860		7		/* Intel 80860 */
+#define EM_MIPS		8		/* MIPS R3000 Big-Endian only */
+#define EM_S370		9		/* IBM System/370 Processor */
+#define EM_MIPS_RS4_BE	10		/* MIPS R4000 Big-Endian */
+#if 0
+#define EM_SPARC64	11		/* RESERVED - was SPARC v9
+					     64-bit unoffical */
+#endif
+/* RESERVED 11-14 for future use */
+#define EM_PARISC	15		/* HPPA */
+/* RESERVED 16 for future use */
+#define EM_VPP500	17		/* Fujitsu VPP500 */
+#define EM_SPARC32PLUS	18		/* Enhanced instruction set SPARC */
+#define EM_960		19		/* Intel 80960 */
+#define EM_PPC		20		/* PowerPC */
+#define EM_PPC64	21		/* 64-bit PowerPC */
+#define EM_S390		22		/* IBM System/390 Processor */
+/* RESERVED 23-35 for future use */
+#define EM_V800		36		/* NEC V800 */
+#define EM_FR20		37		/* Fujitsu FR20 */
+#define EM_RH32		38		/* TRW RH-32 */
+#define EM_RCE		39		/* Motorola RCE */
+#define EM_ARM		40		/* Advanced Risc Machines ARM */
+#define EM_ALPHA	41		/* Digital Alpha */
+#define EM_SH		42		/* Hitachi SH */
+#define EM_SPARCV9	43		/* SPARC Version 9 */
+#define EM_TRICORE	44		/* Siemens TriCore embedded processor */
+#define EM_ARC		45		/* Argonaut RISC Core */
+#define EM_H8_300	46		/* Hitachi H8/300 */
+#define EM_H8_300H	47		/* Hitachi H8/300H */
+#define EM_H8S		48		/* Hitachi H8S */
+#define EM_H8_500	49		/* Hitachi H8/500 */
+#define EM_IA_64	50		/* Intel Merced */
+#define EM_MIPS_X	51		/* Stanford MIPS-X */
+#define EM_COLDFIRE	52		/* Motorola Coldfire */
+#define EM_68HC12	53		/* Motorola M68HC12 */
+#define EM_MMA		54		/* Fujitsu MMA Multimedia Accelerator*/
+#define EM_PCP		55		/* Siemens PCP */
+#define EM_NCPU		56		/* Sony nCPU embeeded RISC */
+#define EM_NDR1		57		/* Denso NDR1 microprocessor */
+#define EM_STARCORE	58		/* Motorola Start*Core processor */
+#define EM_ME16		59		/* Toyota ME16 processor */
+#define EM_ST100	60		/* STMicroelectronic ST100 processor */
+#define EM_TINYJ	61		/* Advanced Logic Corp. Tinyj emb.fam*/
+#define EM_X86_64	62		/* AMD x86-64 */
+#define EM_PDSP		63		/* Sony DSP Processor */
+/* RESERVED 64,65 for future use */
+#define EM_FX66		66		/* Siemens FX66 microcontroller */
+#define EM_ST9PLUS	67		/* STMicroelectronics ST9+ 8/16 mc */
+#define EM_ST7		68		/* STmicroelectronics ST7 8 bit mc */
+#define EM_68HC16	69		/* Motorola MC68HC16 microcontroller */
+#define EM_68HC11	70		/* Motorola MC68HC11 microcontroller */
+#define EM_68HC08	71		/* Motorola MC68HC08 microcontroller */
+#define EM_68HC05	72		/* Motorola MC68HC05 microcontroller */
+#define EM_SVX		73		/* Silicon Graphics SVx */
+#define EM_ST19		74		/* STMicroelectronics ST19 8 bit mc */
+#define EM_VAX		75		/* Digital VAX */
+#define EM_CHRIS	76		/* Axis Communications embedded proc. */
+#define EM_JAVELIN	77		/* Infineon Technologies emb. proc. */
+#define EM_FIREPATH	78		/* Element 14 64-bit DSP Processor */
+#define EM_ZSP		79		/* LSI Logic 16-bit DSP Processor */
+#define EM_MMIX		80		/* Donald Knuth's edu 64-bit proc. */
+#define EM_HUANY	81		/* Harvard University mach-indep objs */
+#define EM_PRISM	82		/* SiTera Prism */
+#define EM_AVR		83		/* Atmel AVR 8-bit microcontroller */
+#define EM_FR30		84		/* Fujitsu FR30 */
+#define EM_D10V		85		/* Mitsubishi DV10V */
+#define EM_D30V		86		/* Mitsubishi DV30V */
+#define EM_V850		87		/* NEC v850 */
+#define EM_M32R		88		/* Mitsubishi M32R */
+#define EM_MN10300	89		/* Matsushita MN10200 */
+#define EM_MN10200	90		/* Matsushita MN10200 */
+#define EM_PJ		91		/* picoJava */
+#define EM_NUM		92		/* number of machine types */
+
+/* Version */
+#define EV_NONE		0		/* Invalid */
+#define EV_CURRENT	1		/* Current */
+#define EV_NUM		2		/* number of versions */
+
+/* Section Header */
+typedef struct {
+	Elf32_Word	sh_name;	/* name - index into section header
+					   string table section */
+	Elf32_Word	sh_type;	/* type */
+	Elf32_Word	sh_flags;	/* flags */
+	Elf32_Addr	sh_addr;	/* address */
+	Elf32_Off	sh_offset;	/* file offset */
+	Elf32_Word	sh_size;	/* section size */
+	Elf32_Word	sh_link;	/* section header table index link */
+	Elf32_Word	sh_info;	/* extra information */
+	Elf32_Word	sh_addralign;	/* address alignment */
+	Elf32_Word	sh_entsize;	/* section entry size */
+} Elf32_Shdr;
+
+/* Special Section Indexes */
+#define SHN_UNDEF	0		/* undefined */
+#define SHN_LORESERVE	0xff00		/* lower bounds of reserved indexes */
+#define SHN_LOPROC	0xff00		/* reserved range for processor */
+#define SHN_HIPROC	0xff1f		/*   specific section indexes */
+#define SHN_LOOS	0xff20		/* reserved range for operating */
+#define SHN_HIOS	0xff3f		/*   specific semantics */
+#define SHN_ABS		0xfff1		/* absolute value */
+#define SHN_COMMON	0xfff2		/* common symbol */
+#define SHN_XINDEX	0xffff		/* Index is an extra table */
+#define SHN_HIRESERVE	0xffff		/* upper bounds of reserved indexes */
+
+/* sh_type */
+#define SHT_NULL	0		/* inactive */
+#define SHT_PROGBITS	1		/* program defined information */
+#define SHT_SYMTAB	2		/* symbol table section */
+#define SHT_STRTAB	3		/* string table section */
+#define SHT_RELA	4		/* relocation section with addends*/
+#define SHT_HASH	5		/* symbol hash table section */
+#define SHT_DYNAMIC	6		/* dynamic section */
+#define SHT_NOTE	7		/* note section */
+#define SHT_NOBITS	8		/* no space section */
+#define SHT_REL		9		/* relation section without addends */
+#define SHT_SHLIB	10		/* reserved - purpose unknown */
+#define SHT_DYNSYM	11		/* dynamic symbol table section */
+#define SHT_INIT_ARRAY	14		/* Array of constructors */
+#define SHT_FINI_ARRAY	15		/* Array of destructors */
+#define SHT_PREINIT_ARRAY 16		/* Array of pre-constructors */
+#define SHT_GROUP	17		/* Section group */
+#define SHT_SYMTAB_SHNDX 18		/* Extended section indeces */
+#define SHT_NUM		19		/* number of section types */
+#define SHT_LOOS	0x60000000	/* Start OS-specific */
+#define SHT_HIOS	0x6fffffff	/* End OS-specific */
+#define SHT_LOPROC	0x70000000	/* reserved range for processor */
+#define SHT_HIPROC	0x7fffffff	/*  specific section header types */
+#define SHT_LOUSER	0x80000000	/* reserved range for application */
+#define SHT_HIUSER	0xffffffff	/*  specific indexes */
+
+/* Section names */
+#define ELF_BSS         ".bss"		/* uninitialized data */
+#define ELF_COMMENT	".comment"	/* version control information */
+#define ELF_DATA        ".data"		/* initialized data */
+#define ELF_DATA1       ".data1"	/* initialized data */
+#define ELF_DEBUG       ".debug"	/* debug */
+#define ELF_DYNAMIC     ".dynamic"	/* dynamic linking information */
+#define ELF_DYNSTR      ".dynstr"	/* dynamic string table */
+#define ELF_DYNSYM      ".dynsym"	/* dynamic symbol table */
+#define ELF_FINI        ".fini"		/* termination code */
+#define ELF_FINI_ARRAY	".fini_array"	/* Array of destructors */
+#define ELF_GOT         ".got"		/* global offset table */
+#define ELF_HASH        ".hash"		/* symbol hash table */
+#define ELF_INIT        ".init"		/* initialization code */
+#define ELF_INIT_ARRAY	".init_array"	/* Array of constuctors */
+#define ELF_INTERP	".interp"	/* Pathname of program interpreter */
+#define ELF_LINE	".line"		/* Symbolic line numnber information */
+#define ELF_NOTE	".note"		/* Contains note section */
+#define ELF_PLT		".plt"		/* Procedure linkage table */
+#define ELF_PREINIT_ARRAY ".preinit_array" /* Array of pre-constructors */
+#define ELF_REL_DATA    ".rel.data"	/* relocation data */
+#define ELF_REL_FINI    ".rel.fini"	/* relocation termination code */
+#define ELF_REL_INIT    ".rel.init"	/* relocation initialization code */
+#define ELF_REL_DYN     ".rel.dyn"	/* relocaltion dynamic link info */
+#define ELF_REL_RODATA  ".rel.rodata"	/* relocation read-only data */
+#define ELF_REL_TEXT    ".rel.text"	/* relocation code */
+#define ELF_RODATA      ".rodata"	/* read-only data */
+#define ELF_RODATA1     ".rodata1"	/* read-only data */
+#define ELF_SHSTRTAB    ".shstrtab"	/* section header string table */
+#define ELF_STRTAB      ".strtab"	/* string table */
+#define ELF_SYMTAB      ".symtab"	/* symbol table */
+#define ELF_SYMTAB_SHNDX ".symtab_shndx"/* symbol table section index */
+#define ELF_TBSS	".tbss"		/* thread local uninit data */
+#define ELF_TDATA	".tdata"	/* thread local init data */
+#define ELF_TDATA1	".tdata1"	/* thread local init data */
+#define ELF_TEXT        ".text"		/* code */
+
+/* Section Attribute Flags - sh_flags */
+#define SHF_WRITE	0x1		/* Writable */
+#define SHF_ALLOC	0x2		/* occupies memory */
+#define SHF_EXECINSTR	0x4		/* executable */
+#define SHF_MERGE	0x10		/* Might be merged */
+#define SHF_STRINGS	0x20		/* Contains NULL terminated strings */
+#define SHF_INFO_LINK	0x40		/* sh_info contains SHT index */
+#define SHF_LINK_ORDER	0x80		/* Preserve order after combining*/
+#define SHF_OS_NONCONFORMING 0x100	/* Non-standard OS specific handling */
+#define SHF_GROUP	0x200		/* Member of section group */
+#define SHF_TLS		0x400		/* Thread local storage */
+#define SHF_MASKOS	0x0ff00000	/* OS specific */
+#define SHF_MASKPROC	0xf0000000	/* reserved bits for processor */
+					/*  specific section attributes */
+
+/* Section Group Flags */
+#define GRP_COMDAT	0x1		/* COMDAT group */
+#define GRP_MASKOS	0x0ff00000	/* Mask OS specific flags */
+#define GRP_MASKPROC	0xf0000000	/* Mask processor specific flags */
+
+/* Symbol Table Entry */
+typedef struct elf32_sym {
+	Elf32_Word	st_name;	/* name - index into string table */
+	Elf32_Addr	st_value;	/* symbol value */
+	Elf32_Word	st_size;	/* symbol size */
+	unsigned char	st_info;	/* type and binding */
+	unsigned char	st_other;	/* 0 - no defined meaning */
+	Elf32_Half	st_shndx;	/* section header index */
+} Elf32_Sym;
+
+/* Symbol table index */
+#define STN_UNDEF	0		/* undefined */
+
+/* Extract symbol info - st_info */
+#define ELF32_ST_BIND(x)	((x) >> 4)
+#define ELF32_ST_TYPE(x)	(((unsigned int) x) & 0xf)
+#define ELF32_ST_INFO(b,t)	(((b) << 4) + ((t) & 0xf))
+#define ELF32_ST_VISIBILITY(x)	((x) & 0x3)
+
+/* Symbol Binding - ELF32_ST_BIND - st_info */
+#define STB_LOCAL	0		/* Local symbol */
+#define STB_GLOBAL	1		/* Global symbol */
+#define STB_WEAK	2		/* like global - lower precedence */
+#define STB_NUM		3		/* number of symbol bindings */
+#define STB_LOOS	10		/* reserved range for operating */
+#define STB_HIOS	12		/*   system specific symbol bindings */
+#define STB_LOPROC	13		/* reserved range for processor */
+#define STB_HIPROC	15		/*  specific symbol bindings */
+
+/* Symbol type - ELF32_ST_TYPE - st_info */
+#define STT_NOTYPE	0		/* not specified */
+#define STT_OBJECT	1		/* data object */
+#define STT_FUNC	2		/* function */
+#define STT_SECTION	3		/* section */
+#define STT_FILE	4		/* file */
+#define STT_NUM		5		/* number of symbol types */
+#define STT_TLS		6		/* Thread local storage symbol */
+#define STT_LOOS	10		/* reserved range for operating */
+#define STT_HIOS	12		/*  system specific symbol types */
+#define STT_LOPROC	13		/* reserved range for processor */
+#define STT_HIPROC	15		/*  specific symbol types */
+
+/* Symbol visibility - ELF32_ST_VISIBILITY - st_other */
+#define STV_DEFAULT	0		/* Normal visibility rules */
+#define STV_INTERNAL	1		/* Processor specific hidden class */
+#define STV_HIDDEN	2		/* Symbol unavailable in other mods */
+#define STV_PROTECTED	3		/* Not preemptible, not exported */
+
+
+/* Relocation entry with implicit addend */
+typedef struct
+{
+	Elf32_Addr	r_offset;	/* offset of relocation */
+	Elf32_Word	r_info;		/* symbol table index and type */
+} Elf32_Rel;
+
+/* Relocation entry with explicit addend */
+typedef struct
+{
+	Elf32_Addr	r_offset;	/* offset of relocation */
+	Elf32_Word	r_info;		/* symbol table index and type */
+	Elf32_Sword	r_addend;
+} Elf32_Rela;
+
+/* Extract relocation info - r_info */
+#define ELF32_R_SYM(i)		((i) >> 8)
+#define ELF32_R_TYPE(i)		((unsigned char) (i))
+#define ELF32_R_INFO(s,t) 	(((s) << 8) + (unsigned char)(t))
+
+/* Program Header */
+typedef struct {
+	Elf32_Word	p_type;		/* segment type */
+	Elf32_Off	p_offset;	/* segment offset */
+	Elf32_Addr	p_vaddr;	/* virtual address of segment */
+	Elf32_Addr	p_paddr;	/* physical address - ignored? */
+	Elf32_Word	p_filesz;	/* number of bytes in file for seg. */
+	Elf32_Word	p_memsz;	/* number of bytes in mem. for seg. */
+	Elf32_Word	p_flags;	/* flags */
+	Elf32_Word	p_align;	/* memory alignment */
+} Elf32_Phdr;
+
+/* Segment types - p_type */
+#define PT_NULL		0		/* unused */
+#define PT_LOAD		1		/* loadable segment */
+#define PT_DYNAMIC	2		/* dynamic linking section */
+#define PT_INTERP	3		/* the RTLD */
+#define PT_NOTE		4		/* auxiliary information */
+#define PT_SHLIB	5		/* reserved - purpose undefined */
+#define PT_PHDR		6		/* program header */
+#define PT_TLS		7		/* Thread local storage template */
+#define PT_NUM		8		/* Number of segment types */
+#define PT_LOOS		0x60000000	/* reserved range for operating */
+#define PT_HIOS		0x6fffffff	/*   system specific segment types */
+#define PT_LOPROC	0x70000000	/* reserved range for processor */
+#define PT_HIPROC	0x7fffffff	/*  specific segment types */
+
+/* Segment flags - p_flags */
+#define PF_X		0x1		/* Executable */
+#define PF_W		0x2		/* Writable */
+#define PF_R		0x4		/* Readable */
+#define PF_MASKOS	0x0ff00000	/* OS specific segment flags */
+#define PF_MASKPROC	0xf0000000	/* reserved bits for processor */
+					/*  specific segment flags */
+/* Dynamic structure */
+typedef struct
+{
+	Elf32_Sword	d_tag;		/* controls meaning of d_val */
+	union
+	{
+		Elf32_Word	d_val;	/* Multiple meanings - see d_tag */
+		Elf32_Addr	d_ptr;	/* program virtual address */
+	} d_un;
+} Elf32_Dyn;
+
+extern Elf32_Dyn	_DYNAMIC[];
+
+/* Dynamic Array Tags - d_tag */
+#define DT_NULL		0		/* marks end of _DYNAMIC array */
+#define DT_NEEDED	1		/* string table offset of needed lib */
+#define DT_PLTRELSZ	2		/* size of relocation entries in PLT */
+#define DT_PLTGOT	3		/* address PLT/GOT */
+#define DT_HASH		4		/* address of symbol hash table */
+#define DT_STRTAB	5		/* address of string table */
+#define DT_SYMTAB	6		/* address of symbol table */
+#define DT_RELA		7		/* address of relocation table */
+#define DT_RELASZ	8		/* size of relocation table */
+#define DT_RELAENT	9		/* size of relocation entry */
+#define DT_STRSZ	10		/* size of string table */
+#define DT_SYMENT	11		/* size of symbol table entry */
+#define DT_INIT		12		/* address of initialization func. */
+#define DT_FINI		13		/* address of termination function */
+#define DT_SONAME	14		/* string table offset of shared obj */
+#define DT_RPATH	15		/* string table offset of library
+					   search path */
+#define DT_SYMBOLIC	16		/* start sym search in shared obj. */
+#define DT_REL		17		/* address of rel. tbl. w addends */
+#define DT_RELSZ	18		/* size of DT_REL relocation table */
+#define DT_RELENT	19		/* size of DT_REL relocation entry */
+#define DT_PLTREL	20		/* PLT referenced relocation entry */
+#define DT_DEBUG	21		/* bugger */
+#define DT_TEXTREL	22		/* Allow rel. mod. to unwritable seg */
+#define DT_JMPREL	23		/* add. of PLT's relocation entries */
+#define DT_BIND_NOW	24		/* Process relocations of object */
+#define DT_INIT_ARRAY	25		/* Array with addresses of init fct */
+#define DT_FINI_ARRAY	26		/* Array with addresses of fini fct */
+#define DT_INIT_ARRAYSZ	27		/* Size in bytes of DT_INIT_ARRAY */
+#define DT_FINI_ARRAYSZ	28		/* Size in bytes of DT_FINI_ARRAY */
+#define DT_RUNPATH	29		/* Library search path */
+#define DT_FLAGS	30		/* Flags for the object being loaded */
+#define DT_ENCODING	32		/* Start of encoded range */
+#define DT_PREINIT_ARRAY 32		/* Array with addresses of preinit fct*/
+#define DT_PREINIT_ARRAYSZ 33		/* size in bytes of DT_PREINIT_ARRAY */
+#define DT_NUM		34		/* Number used. */
+#define DT_LOOS		0x60000000	/* reserved range for OS */
+#define DT_HIOS		0x6fffffff	/*   specific dynamic array tags */
+#define DT_LOPROC	0x70000000	/* reserved range for processor */
+#define DT_HIPROC	0x7fffffff	/*  specific dynamic array tags */
+
+/* Dynamic Tag Flags - d_un.d_val */
+#define DF_ORIGIN	0x01		/* Object may use DF_ORIGIN */
+#define DF_SYMBOLIC	0x02		/* Symbol resolutions starts here */
+#define DF_TEXTREL	0x04		/* Object contains text relocations */
+#define DF_BIND_NOW	0x08		/* No lazy binding for this object */
+#define DF_STATIC_TLS	0x10		/* Static thread local storage */
+
+/* Standard ELF hashing function */
+unsigned long elf_hash(const unsigned char *name);
+
+#define ELF_TARG_VER	1	/* The ver for which this code is intended */
+
+/*
+ * XXX - PowerPC defines really don't belong in here,
+ * but we'll put them in for simplicity.
+ */
+
+/* Values for Elf32/64_Ehdr.e_flags.  */
+#define EF_PPC_EMB              0x80000000      /* PowerPC embedded flag */
+
+/* Cygnus local bits below */
+#define EF_PPC_RELOCATABLE      0x00010000      /* PowerPC -mrelocatable flag*/
+#define EF_PPC_RELOCATABLE_LIB  0x00008000      /* PowerPC -mrelocatable-lib
+                                                   flag */
+
+/* PowerPC relocations defined by the ABIs */
+#define R_PPC_NONE              0
+#define R_PPC_ADDR32            1       /* 32bit absolute address */
+#define R_PPC_ADDR24            2       /* 26bit address, 2 bits ignored.  */
+#define R_PPC_ADDR16            3       /* 16bit absolute address */
+#define R_PPC_ADDR16_LO         4       /* lower 16bit of absolute address */
+#define R_PPC_ADDR16_HI         5       /* high 16bit of absolute address */
+#define R_PPC_ADDR16_HA         6       /* adjusted high 16bit */
+#define R_PPC_ADDR14            7       /* 16bit address, 2 bits ignored */
+#define R_PPC_ADDR14_BRTAKEN    8
+#define R_PPC_ADDR14_BRNTAKEN   9
+#define R_PPC_REL24             10      /* PC relative 26 bit */
+#define R_PPC_REL14             11      /* PC relative 16 bit */
+#define R_PPC_REL14_BRTAKEN     12
+#define R_PPC_REL14_BRNTAKEN    13
+#define R_PPC_GOT16             14
+#define R_PPC_GOT16_LO          15
+#define R_PPC_GOT16_HI          16
+#define R_PPC_GOT16_HA          17
+#define R_PPC_PLTREL24          18
+#define R_PPC_COPY              19
+#define R_PPC_GLOB_DAT          20
+#define R_PPC_JMP_SLOT          21
+#define R_PPC_RELATIVE          22
+#define R_PPC_LOCAL24PC         23
+#define R_PPC_UADDR32           24
+#define R_PPC_UADDR16           25
+#define R_PPC_REL32             26
+#define R_PPC_PLT32             27
+#define R_PPC_PLTREL32          28
+#define R_PPC_PLT16_LO          29
+#define R_PPC_PLT16_HI          30
+#define R_PPC_PLT16_HA          31
+#define R_PPC_SDAREL16          32
+#define R_PPC_SECTOFF           33
+#define R_PPC_SECTOFF_LO        34
+#define R_PPC_SECTOFF_HI        35
+#define R_PPC_SECTOFF_HA        36
+/* Keep this the last entry.  */
+#define R_PPC_NUM               37
+
+/* The remaining relocs are from the Embedded ELF ABI, and are not
+   in the SVR4 ELF ABI.  */
+#define R_PPC_EMB_NADDR32       101
+#define R_PPC_EMB_NADDR16       102
+#define R_PPC_EMB_NADDR16_LO    103
+#define R_PPC_EMB_NADDR16_HI    104
+#define R_PPC_EMB_NADDR16_HA    105
+#define R_PPC_EMB_SDAI16        106
+#define R_PPC_EMB_SDA2I16       107
+#define R_PPC_EMB_SDA2REL       108
+#define R_PPC_EMB_SDA21         109     /* 16 bit offset in SDA */
+#define R_PPC_EMB_MRKREF        110
+#define R_PPC_EMB_RELSEC16      111
+#define R_PPC_EMB_RELST_LO      112
+#define R_PPC_EMB_RELST_HI      113
+#define R_PPC_EMB_RELST_HA      114
+#define R_PPC_EMB_BIT_FLD       115
+#define R_PPC_EMB_RELSDA        116     /* 16 bit relative offset in SDA */
+
+/* Diab tool relocations.  */
+#define R_PPC_DIAB_SDA21_LO     180     /* like EMB_SDA21, but lower 16 bit */
+#define R_PPC_DIAB_SDA21_HI     181     /* like EMB_SDA21, but high 16 bit */
+#define R_PPC_DIAB_SDA21_HA     182     /* like EMB_SDA21, adjusted high 16 */
+#define R_PPC_DIAB_RELSDA_LO    183     /* like EMB_RELSDA, but lower 16 bit */
+#define R_PPC_DIAB_RELSDA_HI    184     /* like EMB_RELSDA, but high 16 bit */
+#define R_PPC_DIAB_RELSDA_HA    185     /* like EMB_RELSDA, adjusted high 16 */
+
+/* This is a phony reloc to handle any old fashioned TOC16 references
+   that may still be in object files.  */
+#define R_PPC_TOC16             255
+
+#endif /* _ELF_H */
diff --git a/sd_loader/src/entry.c b/sd_loader/src/entry.c
new file mode 100644
index 0000000..4ec1876
--- /dev/null
+++ b/sd_loader/src/entry.c
@@ -0,0 +1,594 @@
+#include "os_types.h"
+#include "elf_abi.h"
+#include "common.h"
+#include "os_defs.h"
+#include "fs_defs.h"
+#include "kernel_defs.h"
+#include "loader_defs.h"
+
+#define EXPORT_DECL(res, func, ...)                     res (* func)(__VA_ARGS__);
+#define OS_FIND_EXPORT(handle, funcName, func)          OSDynLoad_FindExport(handle, 0, funcName, &func)
+
+typedef struct _private_data_t {
+    EXPORT_DECL(void *, MEMAllocFromDefaultHeapEx,int size, int align);
+    EXPORT_DECL(void, MEMFreeToDefaultHeap,void *ptr);
+
+    EXPORT_DECL(void*, memcpy, void *p1, const void *p2, unsigned int s);
+    EXPORT_DECL(void*, memset, void *p1, int val, unsigned int s);
+    EXPORT_DECL(void, OSFatal, const char* msg);
+    EXPORT_DECL(unsigned int, OSEffectiveToPhysical, const void*);
+    EXPORT_DECL(void, exit, int);
+
+    EXPORT_DECL(int, FSInit, void);
+    EXPORT_DECL(int, FSAddClientEx, void *pClient, int unk_zero_param, int errHandling);
+    EXPORT_DECL(int, FSDelClient, void *pClient);
+    EXPORT_DECL(void, FSInitCmdBlock, void *pCmd);
+    EXPORT_DECL(int, FSGetMountSource, void *pClient, void *pCmd, int type, void *source, int errHandling);
+    EXPORT_DECL(int, FSMount, void *pClient, void *pCmd, void *source, const char *target, uint32_t bytes, int errHandling);
+    EXPORT_DECL(int, FSUnmount, void *pClient, void *pCmd, const char *target, int errHandling);
+    EXPORT_DECL(int, FSOpenFile, void *pClient, void *pCmd, const char *path, const char *mode, int *fd, int errHandling);
+    EXPORT_DECL(int, FSGetStatFile, void *pClient, void *pCmd, int fd, void *buffer, int error);
+    EXPORT_DECL(int, FSReadFile, void *pClient, void *pCmd, void *buffer, int size, int count, int fd, int flag, int errHandling);
+    EXPORT_DECL(int, FSCloseFile, void *pClient, void *pCmd, int fd, int errHandling);
+
+    EXPORT_DECL(int, SYSRelaunchTitle, int argc, char** argv);
+} private_data_t;
+
+static void (*DCFlushRange)(void *addr, unsigned int size);
+static void (*DCInvalidateRange)(void *addr, unsigned int size);
+static void (*ICInvalidateRange)(void *addr, unsigned int size);
+static unsigned int hook_LiWaitOneChunk;
+static unsigned int addrphys_LiWaitOneChunk;
+
+extern void SC0x25_KernelCopyData(unsigned int addr, unsigned int src, unsigned int len);
+extern void my_PrepareTitle_hook(void);
+
+/* Write a 32-bit word with kernel permissions */
+static void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value) {
+    asm volatile (
+        "li 3,1\n"
+        "li 4,0\n"
+        "mr 5,%1\n"
+        "li 6,0\n"
+        "li 7,0\n"
+        "lis 8,1\n"
+        "mr 9,%0\n"
+        "mr %1,1\n"
+        "li 0,0x3500\n"
+        "sc\n"
+        "nop\n"
+        "mr 1,%1\n"
+        :
+        :	"r"(addr), "r"(value)
+        :	"memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10",
+        "11", "12"
+    );
+}
+
+static void KernelCopyData(unsigned int addr, unsigned int src, unsigned int len) {
+    /*
+     * Setup a DBAT access with cache inhibited to write through and read directly from memory
+     */
+    unsigned int dbatu0, dbatl0, dbatu1, dbatl1;
+    // save the original DBAT value
+    asm volatile("mfdbatu %0, 0" : "=r" (dbatu0));
+    asm volatile("mfdbatl %0, 0" : "=r" (dbatl0));
+    asm volatile("mfdbatu %0, 1" : "=r" (dbatu1));
+    asm volatile("mfdbatl %0, 1" : "=r" (dbatl1));
+
+    unsigned int target_dbatu0 = 0;
+    unsigned int target_dbatl0 = 0;
+    unsigned int target_dbatu1 = 0;
+    unsigned int target_dbatl1 = 0;
+
+    unsigned int *dst_p = (unsigned int*)addr;
+    unsigned int *src_p = (unsigned int*)src;
+
+    // we only need DBAT modification for addresses out of our own DBAT range
+    // as our own DBAT is available everywhere for user and supervisor
+    // since our own DBAT is on DBAT5 position we don't collide here
+    if(addr < 0x00800000 || addr >= 0x01000000) {
+        target_dbatu0 = (addr & 0x00F00000) | 0xC0000000 | 0x1F;
+        target_dbatl0 = (addr & 0xFFF00000) | 0x32;
+        asm volatile("mtdbatu 0, %0" : : "r" (target_dbatu0));
+        asm volatile("mtdbatl 0, %0" : : "r" (target_dbatl0));
+        dst_p = (unsigned int*)((addr & 0xFFFFFF) | 0xC0000000);
+    }
+    if(src < 0x00800000 || src >= 0x01000000) {
+        target_dbatu1 = (src & 0x00F00000) | 0xB0000000 | 0x1F;
+        target_dbatl1 = (src & 0xFFF00000) | 0x32;
+
+        asm volatile("mtdbatu 1, %0" : : "r" (target_dbatu1));
+        asm volatile("mtdbatl 1, %0" : : "r" (target_dbatl1));
+        src_p = (unsigned int*)((src & 0xFFFFFF) | 0xB0000000);
+    }
+
+    asm volatile("eieio; isync");
+
+    unsigned int i;
+    for(i = 0; i < len; i += 4) {
+        // if we are on the edge to next chunk
+        if((target_dbatu0 != 0) && (((unsigned int)dst_p & 0x00F00000) != (target_dbatu0 & 0x00F00000))) {
+            target_dbatu0 = ((addr + i) & 0x00F00000) | 0xC0000000 | 0x1F;
+            target_dbatl0 = ((addr + i) & 0xFFF00000) | 0x32;
+            dst_p = (unsigned int*)(((addr + i) & 0xFFFFFF) | 0xC0000000);
+
+            asm volatile("eieio; isync");
+            asm volatile("mtdbatu 0, %0" : : "r" (target_dbatu0));
+            asm volatile("mtdbatl 0, %0" : : "r" (target_dbatl0));
+            asm volatile("eieio; isync");
+        }
+        if((target_dbatu1 != 0) && (((unsigned int)src_p & 0x00F00000) != (target_dbatu1 & 0x00F00000))) {
+            target_dbatu1 = ((src + i) & 0x00F00000) | 0xB0000000 | 0x1F;
+            target_dbatl1 = ((src + i) & 0xFFF00000) | 0x32;
+            src_p = (unsigned int*)(((src + i) & 0xFFFFFF) | 0xB0000000);
+
+            asm volatile("eieio; isync");
+            asm volatile("mtdbatu 1, %0" : : "r" (target_dbatu1));
+            asm volatile("mtdbatl 1, %0" : : "r" (target_dbatl1));
+            asm volatile("eieio; isync");
+        }
+
+        *dst_p = *src_p;
+
+        ++dst_p;
+        ++src_p;
+    }
+
+    /*
+     * Restore original DBAT value
+     */
+    asm volatile("eieio; isync");
+    asm volatile("mtdbatu 0, %0" : : "r" (dbatu0));
+    asm volatile("mtdbatl 0, %0" : : "r" (dbatl0));
+    asm volatile("mtdbatu 1, %0" : : "r" (dbatu1));
+    asm volatile("mtdbatl 1, %0" : : "r" (dbatl1));
+    asm volatile("eieio; isync");
+}
+
+// This function is called every time after LiBounceOneChunk.
+// It waits for the asynchronous call of LiLoadAsync for the IOSU to fill data to the RPX/RPL address
+// and return the still remaining bytes to load.
+// We override it and replace the loaded date from LiLoadAsync with our data and our remaining bytes to load.
+static int LiWaitOneChunk(unsigned int * iRemainingBytes, const char *filename, int fileType) {
+    unsigned int result;
+    register int core_id;
+    int remaining_bytes = 0;
+
+    int sgFileOffset;
+    int sgBufferNumber;
+    int *sgBounceError;
+    int *sgGotBytes;
+    int *sgTotalBytes;
+    int *sgIsLoadingBuffer;
+    int *sgFinishedLoadingBuffer;
+
+    // get the current core
+    asm volatile("mfspr %0, 0x3EF" : "=r" (core_id));
+
+    // get the offset of per core global variable for dynload initialized (just a simple address + (core_id * 4))
+    unsigned int gDynloadInitialized = *(volatile unsigned int*)(OS_SPECIFICS->addr_gDynloadInitialized + (core_id << 2));
+
+    // Comment (Dimok):
+    // time measurement at this position for logger  -> we don't need it right now except maybe for debugging
+    //unsigned long long systemTime1 = Loader_GetSystemTime();
+
+    if(OS_FIRMWARE == 550) {
+        // pointer to global variables of the loader
+        loader_globals_550_t *loader_globals = (loader_globals_550_t*)(0xEFE19E80);
+
+        sgBufferNumber = loader_globals->sgBufferNumber;
+        sgFileOffset = loader_globals->sgFileOffset;
+        sgBounceError = &loader_globals->sgBounceError;
+        sgGotBytes = &loader_globals->sgGotBytes;
+        sgTotalBytes = &loader_globals->sgTotalBytes;
+        sgFinishedLoadingBuffer = &loader_globals->sgFinishedLoadingBuffer;
+        // not available on 5.5.x
+        sgIsLoadingBuffer = NULL;
+    } else {
+        // pointer to global variables of the loader
+        loader_globals_t *loader_globals = (loader_globals_t*)(OS_SPECIFICS->addr_sgIsLoadingBuffer);
+
+        sgBufferNumber = loader_globals->sgBufferNumber;
+        sgFileOffset = loader_globals->sgFileOffset;
+        sgBounceError = &loader_globals->sgBounceError;
+        sgGotBytes = &loader_globals->sgGotBytes;
+        sgIsLoadingBuffer = &loader_globals->sgIsLoadingBuffer;
+        // not available on < 5.5.x
+        sgTotalBytes = NULL;
+        sgFinishedLoadingBuffer = NULL;
+    }
+
+    // the data loading was started in LiBounceOneChunk() and here it waits for IOSU to finish copy the data
+    if(gDynloadInitialized != 0) {
+        result = OS_SPECIFICS->LiWaitIopCompleteWithInterrupts(0x2160EC0, &remaining_bytes);
+
+    } else {
+        result = OS_SPECIFICS->LiWaitIopComplete(0x2160EC0, &remaining_bytes);
+    }
+
+    // Comment (Dimok):
+    // time measurement at this position for logger -> we don't need it right now except maybe for debugging
+    //unsigned long long systemTime2 = Loader_GetSystemTime();
+
+    //------------------------------------------------------------------------------------------------------------------
+    // Start of our function intrusion:
+    // After IOSU is done writing the data into the 0xF6000000/0xF6400000 address,
+    // we overwrite it with our data before setting the global flag for IsLoadingBuffer to 0
+    // Do this only if we are in the game that was launched by our method
+    s_mem_area *mem_area = MEM_AREA_TABLE;
+    if((ELF_DATA_ADDR == mem_area->address) && (fileType == 0)) {
+        unsigned int load_address = (sgBufferNumber == 1) ? 0xF6000000 : (0xF6000000 + 0x00400000);
+        unsigned int load_addressPhys = (sgBufferNumber == 1) ? 0x1B000000 : (0x1B000000 + 0x00400000); // virtual 0xF6000000 and 0xF6400000
+
+        remaining_bytes = ELF_DATA_SIZE - sgFileOffset;
+        if (remaining_bytes > 0x400000)
+            // truncate size
+            remaining_bytes = 0x400000;
+
+        DCFlushRange((void*)load_address, remaining_bytes);
+
+        u32 rpxBlockPos = 0;
+        u32 done = 0;
+        u32 mapOffset = 0;
+
+        while((done < (u32)sgFileOffset) && mem_area) {
+            if((done + mem_area->size) > (u32)sgFileOffset) {
+                mapOffset = sgFileOffset - done;
+                done = sgFileOffset;
+            } else {
+                done += mem_area->size;
+                mem_area = mem_area->next;
+            }
+        }
+
+        while((done < ELF_DATA_SIZE) && (rpxBlockPos < 0x400000) && mem_area) {
+            u32 address = mem_area->address + mapOffset;
+            u32 blockSize = ELF_DATA_SIZE - done;
+
+            if(blockSize > (0x400000 - rpxBlockPos)) {
+                blockSize = 0x400000 - rpxBlockPos;
+            }
+            if((mapOffset + blockSize) >= mem_area->size) {
+                blockSize = mem_area->size - mapOffset;
+                //! this value is incremented later by blockSize, so set it to -blockSize for it to be 0 after copy
+                //! it makes smaller code then if(mapOffset == mem_area->size) after copy
+                mapOffset = -blockSize;
+                mem_area = mem_area->next;
+            }
+
+            SC0x25_KernelCopyData(load_addressPhys + rpxBlockPos, address, blockSize);
+            done += blockSize;
+            rpxBlockPos += blockSize;
+            mapOffset += blockSize;
+        }
+
+        DCInvalidateRange((void*)load_address, remaining_bytes);
+
+        if((u32)(sgFileOffset + remaining_bytes) == ELF_DATA_SIZE) {
+            ELF_DATA_ADDR = 0xDEADC0DE;
+            ELF_DATA_SIZE = 0;
+            MAIN_ENTRY_ADDR = 0xC001C0DE;
+        }
+        // set result to 0 -> "everything OK"
+        result = 0;
+    }
+
+    // end of our little intrusion into this function
+    //------------------------------------------------------------------------------------------------------------------
+
+    // set the result to the global bounce error variable
+    if(sgBounceError) {
+        *sgBounceError = result;
+    }
+
+    // disable global flag that buffer is still loaded by IOSU
+    if(sgFinishedLoadingBuffer) {
+        unsigned int zeroBitCount = 0;
+        asm volatile("cntlzw %0, %0" : "=r" (zeroBitCount) : "r"(*sgFinishedLoadingBuffer));
+        *sgFinishedLoadingBuffer = zeroBitCount >> 5;
+    } else if(sgIsLoadingBuffer) {
+        *sgIsLoadingBuffer = 0;
+    }
+
+    // check result for errors
+    if(result == 0) {
+        // the remaining size is set globally and in stack variable only
+        // if a pointer was passed to this function
+        if(iRemainingBytes) {
+            if(sgGotBytes) {
+                *sgGotBytes = remaining_bytes;
+            }
+
+            *iRemainingBytes = remaining_bytes;
+
+            // on 5.5.x a new variable for total loaded bytes was added
+            if(sgTotalBytes) {
+                *sgTotalBytes += remaining_bytes;
+            }
+        }
+        // Comment (Dimok):
+        // calculate time difference and print it on logging how long the wait for asynchronous data load took
+        // something like (systemTime2 - systemTime1) * constant / bus speed, did not look deeper into it as we don't need that crap
+    } else {
+        // Comment (Dimok):
+        // a lot of error handling here. depending on error code sometimes calls Loader_Panic() -> we don't make errors so we can skip that part ;-P
+    }
+    return result;
+}
+
+void my_PrepareTitle(CosAppXmlInfo *xmlKernelInfo) {
+    if(ELF_DATA_ADDR == MEM_AREA_TABLE->address) {
+        xmlKernelInfo->max_size = RPX_MAX_SIZE;
+        xmlKernelInfo->max_codesize = RPX_MAX_CODE_SIZE;
+        //! setup our hook to LiWaitOneChunk for RPX loading
+        hook_LiWaitOneChunk = ((u32)LiWaitOneChunk) | 0x48000002;
+        KernelCopyData(addrphys_LiWaitOneChunk, (u32) &hook_LiWaitOneChunk, 4);
+        asm volatile("icbi 0, %0" : : "r" (OS_SPECIFICS->addr_LiWaitOneChunk & ~31));
+    } else if((MAIN_ENTRY_ADDR == 0xC001C0DE) && (*(u32*)xmlKernelInfo->rpx_name == 0x66666c5f)) { // ffl_
+        //! restore original LiWaitOneChunk instruction as our RPX is done
+        MAIN_ENTRY_ADDR = 0xDEADC0DE;
+        KernelCopyData(addrphys_LiWaitOneChunk, (u32)&OS_SPECIFICS->orig_LiWaitOneChunkInstr, 4);
+        asm volatile("icbi 0, %0" : : "r" (OS_SPECIFICS->addr_LiWaitOneChunk & ~31));
+    }
+}
+
+static int LoadFileToMem(private_data_t *private_data, const char *filepath, unsigned char **fileOut, unsigned int * sizeOut) {
+    int iFd = -1;
+    void *pClient = private_data->MEMAllocFromDefaultHeapEx(FS_CLIENT_SIZE, 4);
+    if(!pClient)
+        return 0;
+
+    void *pCmd = private_data->MEMAllocFromDefaultHeapEx(FS_CMD_BLOCK_SIZE, 4);
+    if(!pCmd) {
+        private_data->MEMFreeToDefaultHeap(pClient);
+        return 0;
+    }
+
+    int success = 0;
+    private_data->FSInit();
+    private_data->FSInitCmdBlock(pCmd);
+    private_data->FSAddClientEx(pClient, 0, -1);
+
+    do {
+        char tempPath[FS_MOUNT_SOURCE_SIZE];
+        char mountPath[FS_MAX_MOUNTPATH_SIZE];
+
+        int status = private_data->FSGetMountSource(pClient, pCmd, 0, tempPath, -1);
+        if (status != 0) {
+            private_data->OSFatal("FSGetMountSource failed.");
+        }
+        status = private_data->FSMount(pClient, pCmd, tempPath, mountPath, FS_MAX_MOUNTPATH_SIZE, -1);
+        if(status != 0) {
+            private_data->OSFatal("SD mount failed.");
+        }
+
+        status = private_data->FSOpenFile(pClient, pCmd, filepath, "r", &iFd, -1);
+        if(status != 0) {
+            private_data->OSFatal("FSOpenFile failed.");
+        }
+
+        FSStat stat;
+        stat.size = 0;
+
+        void *pBuffer = NULL;
+
+        private_data->FSGetStatFile(pClient, pCmd, iFd, &stat, -1);
+
+        if(stat.size > 0)
+            pBuffer = private_data->MEMAllocFromDefaultHeapEx((stat.size + 0x3F) & ~0x3F, 0x40);
+        else
+            private_data->OSFatal("ELF file empty.");
+
+        unsigned int done = 0;
+
+        while(done < stat.size) {
+            int readBytes = private_data->FSReadFile(pClient, pCmd, pBuffer + done, 1, stat.size - done, iFd, 0, -1);
+            if(readBytes <= 0) {
+                break;
+            }
+            done += readBytes;
+        }
+
+        if(done != stat.size) {
+            private_data->MEMFreeToDefaultHeap(pBuffer);
+        } else {
+            *fileOut = (unsigned char*)pBuffer;
+            *sizeOut = stat.size;
+            success = 1;
+        }
+
+        private_data->FSCloseFile(pClient, pCmd, iFd, -1);
+        private_data->FSUnmount(pClient, pCmd, mountPath, -1);
+    } while(0);
+
+    private_data->FSDelClient(pClient);
+    private_data->MEMFreeToDefaultHeap(pClient);
+    private_data->MEMFreeToDefaultHeap(pCmd);
+    return success;
+}
+
+static void setup_patches(private_data_t *private_data) {
+    //! setup necessary syscalls and hooks for HBL
+    kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl1 + (0x25 * 4)), (unsigned int)KernelCopyData);
+    kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl2 + (0x25 * 4)), (unsigned int)KernelCopyData);
+    kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl3 + (0x25 * 4)), (unsigned int)KernelCopyData);
+    kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl4 + (0x25 * 4)), (unsigned int)KernelCopyData);
+    kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl5 + (0x25 * 4)), (unsigned int)KernelCopyData);
+
+    //! store physical address for later use
+    addrphys_LiWaitOneChunk = private_data->OSEffectiveToPhysical((void*)OS_SPECIFICS->addr_LiWaitOneChunk);
+
+    u32 addr_my_PrepareTitle_hook = ((u32)my_PrepareTitle_hook) | 0x48000003;
+    DCFlushRange(&addr_my_PrepareTitle_hook, 4);
+
+    //! create our copy syscall
+    SC0x25_KernelCopyData(OS_SPECIFICS->addr_PrepareTitle_hook, private_data->OSEffectiveToPhysical(&addr_my_PrepareTitle_hook), 4);
+
+}
+
+static unsigned int load_elf_image (private_data_t *private_data, unsigned char *elfstart) {
+    Elf32_Ehdr *ehdr;
+    Elf32_Phdr *phdrs;
+    unsigned char *image;
+    int i;
+
+    ehdr = (Elf32_Ehdr *) elfstart;
+
+    if(ehdr->e_phoff == 0 || ehdr->e_phnum == 0)
+        return 0;
+
+    if(ehdr->e_phentsize != sizeof(Elf32_Phdr))
+        return 0;
+
+    phdrs = (Elf32_Phdr*)(elfstart + ehdr->e_phoff);
+
+    for(i = 0; i < ehdr->e_phnum; i++) {
+        if(phdrs[i].p_type != PT_LOAD)
+            continue;
+
+        if(phdrs[i].p_filesz > phdrs[i].p_memsz)
+            continue;
+
+        if(!phdrs[i].p_filesz)
+            continue;
+
+        unsigned int p_paddr = phdrs[i].p_paddr;
+        image = (unsigned char *) (elfstart + phdrs[i].p_offset);
+
+        private_data->memcpy ((void *) p_paddr, image, phdrs[i].p_filesz);
+        DCFlushRange((void*)p_paddr, phdrs[i].p_filesz);
+
+        if(phdrs[i].p_flags & PF_X)
+            ICInvalidateRange ((void *) p_paddr, phdrs[i].p_memsz);
+    }
+
+    //! clear BSS
+    Elf32_Shdr *shdr = (Elf32_Shdr *) (elfstart + ehdr->e_shoff);
+    for(i = 0; i < ehdr->e_shnum; i++) {
+        const char *section_name = ((const char*)elfstart) + shdr[ehdr->e_shstrndx].sh_offset + shdr[i].sh_name;
+        if(section_name[0] == '.' && section_name[1] == 'b' && section_name[2] == 's' && section_name[3] == 's') {
+            private_data->memset((void*)shdr[i].sh_addr, 0, shdr[i].sh_size);
+            DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size);
+        } else if(section_name[0] == '.' && section_name[1] == 's' && section_name[2] == 'b' && section_name[3] == 's' && section_name[4] == 's') {
+            private_data->memset((void*)shdr[i].sh_addr, 0, shdr[i].sh_size);
+            DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size);
+        }
+    }
+
+    return ehdr->e_entry;
+}
+
+static void loadFunctionPointers(private_data_t * private_data) {
+    unsigned int coreinit_handle;
+
+    EXPORT_DECL(int, OSDynLoad_Acquire, const char* rpl, u32 *handle);
+    EXPORT_DECL(int, OSDynLoad_FindExport, u32 handle, int isdata, const char *symbol, void *address);
+
+    OSDynLoad_Acquire = (int (*)(const char*, u32 *))OS_SPECIFICS->addr_OSDynLoad_Acquire;
+    OSDynLoad_FindExport = (int (*)(u32, int, const char *, void *))OS_SPECIFICS->addr_OSDynLoad_FindExport;
+
+    OSDynLoad_Acquire("coreinit", &coreinit_handle);
+
+    unsigned int *functionPtr = 0;
+
+    OSDynLoad_FindExport(coreinit_handle, 1, "MEMAllocFromDefaultHeapEx", &functionPtr);
+    private_data->MEMAllocFromDefaultHeapEx = (void * (*)(int, int))*functionPtr;
+    OSDynLoad_FindExport(coreinit_handle, 1, "MEMFreeToDefaultHeap", &functionPtr);
+    private_data->MEMFreeToDefaultHeap = (void (*)(void *))*functionPtr;
+
+    OS_FIND_EXPORT(coreinit_handle, "memcpy", private_data->memcpy);
+    OS_FIND_EXPORT(coreinit_handle, "memset", private_data->memset);
+    OS_FIND_EXPORT(coreinit_handle, "OSFatal", private_data->OSFatal);
+    OS_FIND_EXPORT(coreinit_handle, "DCFlushRange", DCFlushRange);
+    OS_FIND_EXPORT(coreinit_handle, "DCInvalidateRange", DCInvalidateRange);
+    OS_FIND_EXPORT(coreinit_handle, "ICInvalidateRange", ICInvalidateRange);
+    OS_FIND_EXPORT(coreinit_handle, "OSEffectiveToPhysical", private_data->OSEffectiveToPhysical);
+    OS_FIND_EXPORT(coreinit_handle, "exit", private_data->exit);
+
+    OS_FIND_EXPORT(coreinit_handle, "FSInit", private_data->FSInit);
+    OS_FIND_EXPORT(coreinit_handle, "FSAddClientEx", private_data->FSAddClientEx);
+    OS_FIND_EXPORT(coreinit_handle, "FSDelClient", private_data->FSDelClient);
+    OS_FIND_EXPORT(coreinit_handle, "FSInitCmdBlock", private_data->FSInitCmdBlock);
+    OS_FIND_EXPORT(coreinit_handle, "FSGetMountSource", private_data->FSGetMountSource);
+    OS_FIND_EXPORT(coreinit_handle, "FSMount", private_data->FSMount);
+    OS_FIND_EXPORT(coreinit_handle, "FSUnmount", private_data->FSUnmount);
+    OS_FIND_EXPORT(coreinit_handle, "FSOpenFile", private_data->FSOpenFile);
+    OS_FIND_EXPORT(coreinit_handle, "FSGetStatFile", private_data->FSGetStatFile);
+    OS_FIND_EXPORT(coreinit_handle, "FSReadFile", private_data->FSReadFile);
+    OS_FIND_EXPORT(coreinit_handle, "FSCloseFile", private_data->FSCloseFile);
+
+    unsigned int sysapp_handle;
+    OSDynLoad_Acquire("sysapp.rpl", &sysapp_handle);
+    OS_FIND_EXPORT(sysapp_handle, "SYSRelaunchTitle", private_data->SYSRelaunchTitle);
+}
+
+int _start(int argc, char **argv) {
+    private_data_t private_data;
+
+    if(MAIN_ENTRY_ADDR != 0xC001C0DE) {
+        loadFunctionPointers(&private_data);
+
+        while(1) {
+            if(ELF_DATA_ADDR != 0xDEADC0DE && ELF_DATA_SIZE > 0) {
+                //! copy data to safe area before processing it
+                unsigned char * pElfBuffer = (unsigned char *)private_data.MEMAllocFromDefaultHeapEx(ELF_DATA_SIZE, 4);
+                if(pElfBuffer) {
+                    private_data.memcpy(pElfBuffer, (unsigned char*)ELF_DATA_ADDR, ELF_DATA_SIZE);
+                    MAIN_ENTRY_ADDR = load_elf_image(&private_data, pElfBuffer);
+                    private_data.MEMFreeToDefaultHeap(pElfBuffer);
+
+                }
+                ELF_DATA_ADDR = 0xDEADC0DE;
+                ELF_DATA_SIZE = 0;
+            }
+
+            if(MAIN_ENTRY_ADDR == 0xDEADC0DE || MAIN_ENTRY_ADDR == 0) {
+                //! setup necessary syscalls and hooks for HBL before launching it
+                setup_patches(&private_data);
+
+                if(HBL_CHANNEL) {
+                    break;
+                } else {
+                    unsigned char *pElfBuffer = NULL;
+                    unsigned int uiElfSize = 0;
+
+                    LoadFileToMem(&private_data, CAFE_OS_SD_PATH WIIU_PATH "/apps/homebrew_launcher/homebrew_launcher.elf", &pElfBuffer, &uiElfSize);
+
+                    if(!pElfBuffer) {
+                        private_data.OSFatal("Failed to load homebrew_launcher.elf");
+                    } else {
+                        MAIN_ENTRY_ADDR = load_elf_image(&private_data, pElfBuffer);
+                        if(MAIN_ENTRY_ADDR == 0) {
+                            private_data.OSFatal("Failed to load homebrew_launcher.elf");
+                        } else {
+                            private_data.MEMFreeToDefaultHeap(pElfBuffer);
+                        }
+                    }
+                }
+            } else {
+                int returnVal = ((int (*)(int, char **))MAIN_ENTRY_ADDR)(argc, argv);
+                //! exit to miimaker and restart application on re-enter of another application
+                if(returnVal == (int)EXIT_RELAUNCH_ON_LOAD) {
+                    break;
+                }
+                //! exit to homebrew launcher in all other cases
+                else {
+                    MAIN_ENTRY_ADDR = 0xDEADC0DE;
+                    private_data.SYSRelaunchTitle(0, 0);
+                    private_data.exit(0);
+                    break;
+                }
+            }
+        }
+    }
+
+    int ret = ( (int (*)(int, char **))(*(unsigned int*)OS_SPECIFICS->addr_OSTitle_main_entry) )(argc, argv);
+
+    //! if an application returns and was an RPX launch then launch HBL again
+    if(MAIN_ENTRY_ADDR == 0xC001C0DE) {
+        private_data.SYSRelaunchTitle(0, 0);
+        private_data.exit(0);
+    }
+    return ret;
+}
diff --git a/sd_loader/src/fs_defs.h b/sd_loader/src/fs_defs.h
new file mode 100644
index 0000000..8e48273
--- /dev/null
+++ b/sd_loader/src/fs_defs.h
@@ -0,0 +1,60 @@
+#ifndef FS_DEFS_H
+#define	FS_DEFS_H
+
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/* FS defines and types */
+#define FS_MAX_LOCALPATH_SIZE           511
+#define FS_MAX_MOUNTPATH_SIZE           128
+#define FS_MAX_FULLPATH_SIZE            (FS_MAX_LOCALPATH_SIZE + FS_MAX_MOUNTPATH_SIZE)
+#define FS_MAX_ARGPATH_SIZE             FS_MAX_FULLPATH_SIZE
+
+#define FS_STATUS_OK                    0
+#define FS_RET_UNSUPPORTED_CMD          0x0400
+#define FS_RET_NO_ERROR                 0x0000
+#define FS_RET_ALL_ERROR                (unsigned int)(-1)
+
+#define FS_STAT_FLAG_IS_DIRECTORY       0x80000000
+
+/* max length of file/dir name */
+#define FS_MAX_ENTNAME_SIZE             256
+
+#define FS_SOURCETYPE_EXTERNAL          0
+#define FS_SOURCETYPE_HFIO              1
+#define FS_SOURCETYPE_HFIO              1
+
+#define FS_MOUNT_SOURCE_SIZE            0x300
+#define FS_CLIENT_SIZE                  0x1700
+#define FS_CMD_BLOCK_SIZE               0xA80
+
+typedef struct {
+    uint32_t flag;
+    uint32_t permission;
+    uint32_t owner_id;
+    uint32_t group_id;
+    uint32_t size;
+    uint32_t alloc_size;
+    uint64_t quota_size;
+    uint32_t ent_id;
+    uint64_t ctime;
+    uint64_t mtime;
+    uint8_t attributes[48];
+} __attribute__((packed)) FSStat;
+
+typedef struct {
+    FSStat      stat;
+    char        name[FS_MAX_ENTNAME_SIZE];
+} FSDirEntry;
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* FS_DEFS_H */
+
diff --git a/sd_loader/src/kernel_defs.h b/sd_loader/src/kernel_defs.h
new file mode 100644
index 0000000..efbf04a
--- /dev/null
+++ b/sd_loader/src/kernel_defs.h
@@ -0,0 +1,74 @@
+#ifndef __KERNEL_DEFS_H_
+#define __KERNEL_DEFS_H_
+
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// original structure in the kernel that is originally 0x1270 long
+typedef struct {
+    uint32_t version_cos_xml;           // version tag from cos.xml
+    uint64_t os_version;                // os_version from app.xml
+    uint64_t title_id;                  // title_id tag from app.xml
+    uint32_t app_type;                  // app_type tag from app.xml
+    uint32_t cmdFlags;                  // unknown tag as it is always 0 (might be cmdFlags from cos.xml but i am not sure)
+    char rpx_name[0x1000];              // rpx name from cos.xml
+    uint32_t unknown2;                  // 0x050B8304 in mii maker and system menu (looks a bit like permissions complex that got masked!?)
+    uint32_t unknown3[63];              // those were all zeros, but its probably connected with unknown2
+    uint32_t max_size;                  // max_size in cos.xml which defines the maximum amount of memory reserved for the app
+    uint32_t avail_size;                // avail_size or codegen_size in cos.xml (seems to mostly be 0?)
+    uint32_t codegen_size;              // codegen_size or avail_size in cos.xml (seems to mostly be 0?)
+    uint32_t codegen_core;              // codegen_core in cos.xml (seems to mostly be 1?)
+    uint32_t max_codesize;              // max_codesize in cos.xml
+    uint32_t overlay_arena;             // overlay_arena in cos.xml
+    uint32_t unknown4[59];              // all zeros it seems
+    uint32_t default_stack0_size;       // not sure because always 0 but very likely
+    uint32_t default_stack1_size;       // not sure because always 0 but very likely
+    uint32_t default_stack2_size;       // not sure because always 0 but very likely
+    uint32_t default_redzone0_size;     // not sure because always 0 but very likely
+    uint32_t default_redzone1_size;     // not sure because always 0 but very likely
+    uint32_t default_redzone2_size;     // not sure because always 0 but very likely
+    uint32_t exception_stack0_size;     // from cos.xml, 0x1000 on mii maker
+    uint32_t exception_stack1_size;     // from cos.xml, 0x1000 on mii maker
+    uint32_t exception_stack2_size;     // from cos.xml, 0x1000 on mii maker
+    uint32_t sdk_version;               // from app.xml, 20909 (0x51AD) on mii maker
+    uint32_t title_version;             // from app.xml, 0x32 on mii maker
+    /*
+    // ---------------------------------------------------------------------------------------------------------------------------------------------
+    // the next part might be changing from title to title?! I don't think its important but nice to know maybe....
+    // ---------------------------------------------------------------------------------------------------------------------------------------------
+    char mlc[4];                        // string "mlc" on mii maker and sysmenu
+    uint32_t unknown5[7];               // all zeros on mii maker and sysmenu
+    uint32_t unknown6_one;              // 0x01 on mii maker and sysmenu
+    // ---------------------------------------------------------------------------------------------------------------------------------------------
+    char ACP[4];                        // string "ACP" on mii maker and sysmenu
+    uint32_t unknown7[15];              // all zeros on mii maker and sysmenu
+    uint32_t unknown8_5;                // 0x05 on mii maker and sysmenu
+    uint32_t unknown9_zero;             // 0x00 on mii maker and sysmenu
+    uint32_t unknown10_ptr;             // 0xFF23DD0C pointer on mii maker and sysmenu
+    // ---------------------------------------------------------------------------------------------------------------------------------------------
+    char UVD[4];                        // string "UVD" on mii maker and sysmenu
+    uint32_t unknown11[15];             // all zeros on mii maker and sysmenu
+    uint32_t unknown12_5;               // 0x05 on mii maker and sysmenu
+    uint32_t unknown13_zero;            // 0x00 on mii maker and sysmenu
+    uint32_t unknown14_ptr;             // 0xFF23EFC8 pointer on mii maker and sysmenu
+    // ---------------------------------------------------------------------------------------------------------------------------------------------
+    char SND[4];                        // string "SND" on mii maker and sysmenu
+    uint32_t unknown15[15];             // all zeros on mii maker and sysmenu
+    uint32_t unknown16_5;               // 0x05 on mii maker and sysmenu
+    uint32_t unknown17_zero;            // 0x00 on mii maker and sysmenu
+    uint32_t unknown18_ptr;             // 0xFF23F014 pointer on mii maker and sysmenu
+    // ---------------------------------------------------------------------------------------------------------------------------------------------
+    uint32_t unknown19;                 // 0x02 on miimaker, 0x0F on system menu
+    */
+    // after that only zeros follow
+} __attribute__((packed)) CosAppXmlInfo;
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // __KERNEL_DEFS_H_
diff --git a/sd_loader/src/kernel_hooks.S b/sd_loader/src/kernel_hooks.S
new file mode 100644
index 0000000..0d7f11f
--- /dev/null
+++ b/sd_loader/src/kernel_hooks.S
@@ -0,0 +1,69 @@
+# This stuff may need a change in different kernel versions
+# This is only needed when launched directly through browser and not SD card.
+
+.section ".kernel_code"
+    .globl SaveAndResetDataBATs_And_SRs_hook
+SaveAndResetDataBATs_And_SRs_hook:
+    # setup CTR to the position we need to return to
+    mflr r5
+    mtctr r5
+    # set link register to its original value
+    mtlr r7
+    # setup us a nice DBAT for our code data with same region as our code
+    mfspr r5, 560
+    mtspr 570, r5
+    mfspr r5, 561
+    mtspr 571, r5
+    # restore the original kernel instructions that we replaced
+    lwz r5, 0x34(r3)
+    lwz r6, 0x38(r3)
+    lwz r7, 0x3C(r3)
+    lwz r8, 0x40(r3)
+    lwz r9, 0x44(r3)
+    lwz r10, 0x48(r3)
+    lwz r11, 0x4C(r3)
+    lwz r3, 0x50(r3)
+    isync
+    mtsr 7, r5
+    # jump back to the position in kernel after our patch (from LR)
+    bctr
+
+.extern my_PrepareTitle
+    .globl my_PrepareTitle_hook
+my_PrepareTitle_hook:
+    # store all registers on stack to avoid issues with the call to C functions
+    stwu r1, -0x90(r1)
+    # registers for our own usage
+    # just store everything
+    stmw r3, 0x10(r1)
+
+    # save the LR from where we came
+    mflr r31
+
+    # the cos.xml/app.xml structure is at the location 0x68 of r11
+    # there are actually many places that can be hooked for it
+    # e.g. 0xFFF16130 and r27 points to this structure
+    addi r3, r11, 0x68
+
+    bl my_PrepareTitle
+
+    # setup LR to jump back to kernel code
+    mtlr r31
+
+    # restore all original values of registers from stack
+    lmw r3, 0x10(r1)
+
+    # restore the stack
+    addi r1, r1, 0x90
+
+    # restore original instruction that we replaced in the kernel
+    clrlwi    r7, r12, 0
+
+    # jump back
+    blr
+
+     .globl SC0x25_KernelCopyData
+SC0x25_KernelCopyData:
+    li r0, 0x2500
+    sc
+    blr
diff --git a/sd_loader/src/link.ld b/sd_loader/src/link.ld
new file mode 100644
index 0000000..1d82ead
--- /dev/null
+++ b/sd_loader/src/link.ld
@@ -0,0 +1,23 @@
+OUTPUT(sd_loader.elf);
+
+ENTRY(_start);
+
+SECTIONS {
+	. = 0x00800000;
+	.text : {
+		*(.kernel_code*);
+		*(.text*);
+		/* Tell linker to not garbage collect this section as it is not referenced anywhere */
+		KEEP(*(.kernel_code*));
+	}
+	.data : {
+		*(.rodata*);
+		*(.data*);
+		*(.bss*);
+	}
+	/DISCARD/ : {
+		*(*);
+	}
+}
+
+ASSERT((SIZEOF(.text) + SIZEOF(.data)) < 0x1300, "Memory overlapping with main elf.");
diff --git a/sd_loader/src/loader_defs.h b/sd_loader/src/loader_defs.h
new file mode 100644
index 0000000..2ac8188
--- /dev/null
+++ b/sd_loader/src/loader_defs.h
@@ -0,0 +1,36 @@
+#ifndef __LOADER_DEFS_H_
+#define __LOADER_DEFS_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// struct holding the globals of the loader (there are actually more but we don't need others)
+typedef struct _loader_globals_t {
+    int sgIsLoadingBuffer;
+    int sgFileType;
+    int sgProcId;
+    int sgGotBytes;
+    int sgFileOffset;
+    int sgBufferNumber;
+    int sgBounceError;
+    char sgLoadName[0x1000];
+} __attribute__((packed)) loader_globals_t;
+
+typedef struct _loader_globals_550_t {
+    int sgFinishedLoadingBuffer;
+    int sgFileType;
+    int sgProcId;
+    int sgGotBytes;
+    int sgTotalBytes;
+    int sgFileOffset;
+    int sgBufferNumber;
+    int sgBounceError;
+    char sgLoadName[0x1000];
+} __attribute__((packed)) loader_globals_550_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // __LOADER_DEFS_H_
diff --git a/sd_loader/src/os_defs.h b/sd_loader/src/os_defs.h
new file mode 100644
index 0000000..6394cc8
--- /dev/null
+++ b/sd_loader/src/os_defs.h
@@ -0,0 +1,38 @@
+#ifndef __OS_DEFS_H_
+#define __OS_DEFS_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct _OsSpecifics {
+    unsigned int addr_OSDynLoad_Acquire;
+    unsigned int addr_OSDynLoad_FindExport;
+    unsigned int addr_OSTitle_main_entry;
+
+    unsigned int addr_KernSyscallTbl1;
+    unsigned int addr_KernSyscallTbl2;
+    unsigned int addr_KernSyscallTbl3;
+    unsigned int addr_KernSyscallTbl4;
+    unsigned int addr_KernSyscallTbl5;
+
+    int (*LiWaitIopComplete)(int, int *);
+    int (*LiWaitIopCompleteWithInterrupts)(int, int *);
+    unsigned int addr_LiWaitOneChunk;
+    unsigned int addr_PrepareTitle_hook;
+    unsigned int addr_sgIsLoadingBuffer;
+    unsigned int addr_gDynloadInitialized;
+    unsigned int orig_LiWaitOneChunkInstr;
+} OsSpecifics;
+
+typedef struct _s_mem_area {
+    unsigned int        address;
+    unsigned int        size;
+    struct _s_mem_area* next;
+} s_mem_area;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // __OS_DEFS_H_
diff --git a/sd_loader/src/os_types.h b/sd_loader/src/os_types.h
new file mode 100644
index 0000000..5d57abf
--- /dev/null
+++ b/sd_loader/src/os_types.h
@@ -0,0 +1,215 @@
+#ifndef _OS_TYPES_H_
+#define _OS_TYPES_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdint.h>
+
+/*+----------------------------------------------------------------------------------------------+*/
+typedef uint8_t u8;					///< 8bit unsigned integer
+typedef uint16_t u16;				///< 16bit unsigned integer
+typedef uint32_t u32;				///< 32bit unsigned integer
+typedef uint64_t u64;				///< 64bit unsigned integer
+/*+----------------------------------------------------------------------------------------------+*/
+typedef int8_t s8;					///< 8bit signed integer
+typedef int16_t s16;				///< 16bit signed integer
+typedef int32_t s32;				///< 32bit signed integer
+typedef int64_t s64;				///< 64bit signed integer
+/*+----------------------------------------------------------------------------------------------+*/
+typedef volatile u8 vu8;			///< 8bit unsigned volatile integer
+typedef volatile u16 vu16;			///< 16bit unsigned volatile integer
+typedef volatile u32 vu32;			///< 32bit unsigned volatile integer
+typedef volatile u64 vu64;			///< 64bit unsigned volatile integer
+/*+----------------------------------------------------------------------------------------------+*/
+typedef volatile s8 vs8;			///< 8bit signed volatile integer
+typedef volatile s16 vs16;			///< 16bit signed volatile integer
+typedef volatile s32 vs32;			///< 32bit signed volatile integer
+typedef volatile s64 vs64;			///< 64bit signed volatile integer
+/*+----------------------------------------------------------------------------------------------+*/
+// fixed point math typedefs
+typedef s16 sfp16;					///< signed 8:8 fixed point
+typedef s32 sfp32;					///< signed 20:8 fixed point
+typedef u16 ufp16;					///< unsigned 8:8 fixed point
+typedef u32 ufp32;					///< unsigned 24:8 fixed point
+/*+----------------------------------------------------------------------------------------------+*/
+typedef float f32;
+typedef double f64;
+/*+----------------------------------------------------------------------------------------------+*/
+typedef volatile float vf32;
+typedef volatile double vf64;
+/*+----------------------------------------------------------------------------------------------+*/
+
+#define OS_MESSAGE_NOBLOCK 0
+#define OS_MESSAGE_BLOCK 1
+
+#define OS_EXCEPTION_DSI 2
+#define OS_EXCEPTION_ISI 3
+#define OS_EXCEPTION_PROGRAM 6
+#define OS_EXCEPTION_MODE_THREAD 1
+#define OS_EXCEPTION_MODE_GLOBAL_ALL_CORES 4
+
+#define OS_THREAD_ATTR_AFFINITY_NONE    0x0007u        // affinity to run on every core
+#define OS_THREAD_ATTR_AFFINITY_CORE0   0x0001u        // run only on core0
+#define OS_THREAD_ATTR_AFFINITY_CORE1   0x0002u        // run only on core1
+#define OS_THREAD_ATTR_AFFINITY_CORE2   0x0004u        // run only on core2
+#define OS_THREAD_ATTR_DETACH           0x0008u        // detached
+#define OS_THREAD_ATTR_PINNED_AFFINITY  0x0010u        // pinned (affinitized) to a single core
+#define OS_THREAD_ATTR_CHECK_STACK_USE  0x0040u        // check for stack usage
+#define OS_THREAD_ATTR_NAME_SENT        0x0080u        // debugger has seen the name
+#define OS_THREAD_ATTR_LAST (OS_THREAD_ATTR_DETACH | OS_THREAD_ATTR_PINNED_AFFINITY | OS_THREAD_ATTR_AFFINITY_NONE)
+
+typedef struct OSThread_ OSThread;
+
+typedef struct OSThreadLink_ {
+    OSThread *next;
+    OSThread *prev;
+}  OSThreadLink;
+
+typedef struct OSThreadQueue_ {
+    OSThread *head;
+    OSThread *tail;
+    void *parentStruct;
+    u32 reserved;
+} OSThreadQueue;
+
+typedef struct OSMessage_ {
+    u32 message;
+    u32 data0;
+    u32 data1;
+    u32 data2;
+} OSMessage;
+
+typedef struct OSMessageQueue_ {
+    u32 tag;
+    char *name;
+    u32 reserved;
+
+    OSThreadQueue sendQueue;
+    OSThreadQueue recvQueue;
+    OSMessage *messages;
+    int msgCount;
+    int firstIndex;
+    int usedCount;
+} OSMessageQueue;
+
+typedef struct OSContext_ {
+    char tag[8];
+
+    u32 gpr[32];
+
+    u32 cr;
+    u32 lr;
+    u32 ctr;
+    u32 xer;
+
+    u32 srr0;
+    u32 srr1;
+
+    u32 ex0;
+    u32 ex1;
+
+    u32 exception_type;
+    u32 reserved;
+
+    double fpscr;
+    double fpr[32];
+
+    u16 spinLockCount;
+    u16 state;
+
+    u32 gqr[8];
+    u32 pir;
+    double psf[32];
+
+    u64 coretime[3];
+    u64 starttime;
+
+    u32 error;
+    u32 attributes;
+
+    u32 pmc1;
+    u32 pmc2;
+    u32 pmc3;
+    u32 pmc4;
+    u32 mmcr0;
+    u32 mmcr1;
+} OSContext;
+
+typedef enum OSExceptionType {
+    OS_EXCEPTION_TYPE_SYSTEM_RESET         = 0,
+    OS_EXCEPTION_TYPE_MACHINE_CHECK        = 1,
+    OS_EXCEPTION_TYPE_DSI                  = 2,
+    OS_EXCEPTION_TYPE_ISI                  = 3,
+    OS_EXCEPTION_TYPE_EXTERNAL_INTERRUPT   = 4,
+    OS_EXCEPTION_TYPE_ALIGNMENT            = 5,
+    OS_EXCEPTION_TYPE_PROGRAM              = 6,
+    OS_EXCEPTION_TYPE_FLOATING_POINT       = 7,
+    OS_EXCEPTION_TYPE_DECREMENTER          = 8,
+    OS_EXCEPTION_TYPE_SYSTEM_CALL          = 9,
+    OS_EXCEPTION_TYPE_TRACE                = 10,
+    OS_EXCEPTION_TYPE_PERFORMANCE_MONITOR  = 11,
+    OS_EXCEPTION_TYPE_BREAKPOINT           = 12,
+    OS_EXCEPTION_TYPE_SYSTEM_INTERRUPT     = 13,
+    OS_EXCEPTION_TYPE_ICI                  = 14,
+} OSExceptionType;
+
+typedef int (*ThreadFunc)(int argc, void *argv);
+
+struct OSThread_ {
+    OSContext context;
+
+    u32 txtTag;
+    u8 state;
+    u8 attr;
+
+    short threadId;
+    int suspend;
+    int priority;
+
+    char _[0x394 - 0x330 - sizeof(OSThreadLink)];
+    OSThreadLink linkActive;
+
+    void *stackBase;
+    void *stackEnd;
+
+    ThreadFunc entryPoint;
+
+    char _3A0[0x6A0 - 0x3A0];
+};
+
+typedef struct _OSCalendarTime {
+    int sec;
+    int min;
+    int hour;
+    int mday;
+    int mon;
+    int year;
+    int wday;
+    int yday;
+    int msec;
+    int usec;
+} OSCalendarTime;
+
+
+typedef struct MCPTitleListType {
+    u64 titleId;
+    u8 unknwn[4];
+    s8 path[56];
+    u32 appType;
+    u8 unknwn1[0x54 - 0x48];
+    u8 device;
+    u8 unknwn2;
+    s8 indexedDevice[10];
+    u8 unk0x60;
+} MCPTitleListType;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/elf_abi.h b/src/elf_abi.h
new file mode 100644
index 0000000..4d9c796
--- /dev/null
+++ b/src/elf_abi.h
@@ -0,0 +1,591 @@
+/*
+ * Copyright (c) 1995, 1996, 2001, 2002
+ * Erik Theisen.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * This is the ELF ABI header file
+ * formerly known as "elf_abi.h".
+ */
+
+#ifndef _ELF_ABI_H
+#define _ELF_ABI_H
+
+/*
+ *  This version doesn't work for 64-bit ABIs - Erik.
+ */
+
+/*
+ * These typedefs need to be handled better.
+ */
+typedef unsigned int	Elf32_Addr;	/* Unsigned program address */
+typedef unsigned int	Elf32_Off;	/* Unsigned file offset */
+typedef signed int	Elf32_Sword;	/* Signed large integer */
+typedef unsigned int	Elf32_Word;	/* Unsigned large integer */
+typedef unsigned short	Elf32_Half;	/* Unsigned medium integer */
+
+/* e_ident[] identification indexes */
+#define EI_MAG0		0		/* file ID */
+#define EI_MAG1		1		/* file ID */
+#define EI_MAG2		2		/* file ID */
+#define EI_MAG3		3		/* file ID */
+#define EI_CLASS	4		/* file class */
+#define EI_DATA		5		/* data encoding */
+#define EI_VERSION	6		/* ELF header version */
+#define EI_OSABI	7		/* OS/ABI specific ELF extensions */
+#define EI_ABIVERSION	8		/* ABI target version */
+#define EI_PAD		9		/* start of pad bytes */
+#define EI_NIDENT	16		/* Size of e_ident[] */
+
+/* e_ident[] magic number */
+#define	ELFMAG0		0x7f		/* e_ident[EI_MAG0] */
+#define	ELFMAG1		'E'		/* e_ident[EI_MAG1] */
+#define	ELFMAG2		'L'		/* e_ident[EI_MAG2] */
+#define	ELFMAG3		'F'		/* e_ident[EI_MAG3] */
+#define	ELFMAG		"\177ELF"	/* magic */
+#define	SELFMAG		4		/* size of magic */
+
+/* e_ident[] file class */
+#define	ELFCLASSNONE	0		/* invalid */
+#define	ELFCLASsigned int	1		/* 32-bit objs */
+#define	ELFCLASS64	2		/* 64-bit objs */
+#define	ELFCLASSNUM	3		/* number of classes */
+
+/* e_ident[] data encoding */
+#define ELFDATANONE	0		/* invalid */
+#define ELFDATA2LSB	1		/* Little-Endian */
+#define ELFDATA2MSB	2		/* Big-Endian */
+#define ELFDATANUM	3		/* number of data encode defines */
+
+/* e_ident[] OS/ABI specific ELF extensions */
+#define ELFOSABI_NONE		0	/* No extension specified */
+#define ELFOSABI_HPUX		1	/* Hewlett-Packard HP-UX */
+#define ELFOSABI_NETBSD		2	/* NetBSD */
+#define ELFOSABI_LINUX		3	/* Linux */
+#define ELFOSABI_SOLARIS	6	/* Sun Solaris */
+#define ELFOSABI_AIX		7	/* AIX */
+#define ELFOSABI_IRIX		8	/* IRIX */
+#define ELFOSABI_FREEBSD	9	/* FreeBSD */
+#define ELFOSABI_TRU64		10	/* Compaq TRU64 UNIX */
+#define ELFOSABI_MODESTO	11	/* Novell Modesto */
+#define ELFOSABI_OPENBSD	12	/* OpenBSD */
+/* 64-255 Architecture-specific value range */
+
+/* e_ident[] ABI Version */
+#define ELFABIVERSION		0
+
+/* e_ident */
+#define IS_ELF(ehdr) ((ehdr).e_ident[EI_MAG0] == ELFMAG0 && \
+                      (ehdr).e_ident[EI_MAG1] == ELFMAG1 && \
+                      (ehdr).e_ident[EI_MAG2] == ELFMAG2 && \
+                      (ehdr).e_ident[EI_MAG3] == ELFMAG3)
+
+/* ELF Header */
+typedef struct elfhdr{
+	unsigned char	e_ident[EI_NIDENT]; /* ELF Identification */
+	Elf32_Half	e_type;		/* object file type */
+	Elf32_Half	e_machine;	/* machine */
+	Elf32_Word	e_version;	/* object file version */
+	Elf32_Addr	e_entry;	/* virtual entry point */
+	Elf32_Off	e_phoff;	/* program header table offset */
+	Elf32_Off	e_shoff;	/* section header table offset */
+	Elf32_Word	e_flags;	/* processor-specific flags */
+	Elf32_Half	e_ehsize;	/* ELF header size */
+	Elf32_Half	e_phentsize;	/* program header entry size */
+	Elf32_Half	e_phnum;	/* number of program header entries */
+	Elf32_Half	e_shentsize;	/* section header entry size */
+	Elf32_Half	e_shnum;	/* number of section header entries */
+	Elf32_Half	e_shstrndx;	/* section header table's "section
+					   header string table" entry offset */
+} Elf32_Ehdr;
+
+/* e_type */
+#define ET_NONE		0		/* No file type */
+#define ET_REL		1		/* relocatable file */
+#define ET_EXEC		2		/* executable file */
+#define ET_DYN		3		/* shared object file */
+#define ET_CORE		4		/* core file */
+#define ET_NUM		5		/* number of types */
+#define ET_LOOS		0xfe00		/* reserved range for operating */
+#define ET_HIOS		0xfeff		/*  system specific e_type */
+#define ET_LOPROC	0xff00		/* reserved range for processor */
+#define ET_HIPROC	0xffff		/*  specific e_type */
+
+/* e_machine */
+#define EM_NONE		0		/* No Machine */
+#define EM_M32		1		/* AT&T WE 32100 */
+#define EM_SPARC	2		/* SPARC */
+#define EM_386		3		/* Intel 80386 */
+#define EM_68K		4		/* Motorola 68000 */
+#define EM_88K		5		/* Motorola 88000 */
+#if 0
+#define EM_486		6		/* RESERVED - was Intel 80486 */
+#endif
+#define EM_860		7		/* Intel 80860 */
+#define EM_MIPS		8		/* MIPS R3000 Big-Endian only */
+#define EM_S370		9		/* IBM System/370 Processor */
+#define EM_MIPS_RS4_BE	10		/* MIPS R4000 Big-Endian */
+#if 0
+#define EM_SPARC64	11		/* RESERVED - was SPARC v9
+					     64-bit unoffical */
+#endif
+/* RESERVED 11-14 for future use */
+#define EM_PARISC	15		/* HPPA */
+/* RESERVED 16 for future use */
+#define EM_VPP500	17		/* Fujitsu VPP500 */
+#define EM_SPARC32PLUS	18		/* Enhanced instruction set SPARC */
+#define EM_960		19		/* Intel 80960 */
+#define EM_PPC		20		/* PowerPC */
+#define EM_PPC64	21		/* 64-bit PowerPC */
+#define EM_S390		22		/* IBM System/390 Processor */
+/* RESERVED 23-35 for future use */
+#define EM_V800		36		/* NEC V800 */
+#define EM_FR20		37		/* Fujitsu FR20 */
+#define EM_RH32		38		/* TRW RH-32 */
+#define EM_RCE		39		/* Motorola RCE */
+#define EM_ARM		40		/* Advanced Risc Machines ARM */
+#define EM_ALPHA	41		/* Digital Alpha */
+#define EM_SH		42		/* Hitachi SH */
+#define EM_SPARCV9	43		/* SPARC Version 9 */
+#define EM_TRICORE	44		/* Siemens TriCore embedded processor */
+#define EM_ARC		45		/* Argonaut RISC Core */
+#define EM_H8_300	46		/* Hitachi H8/300 */
+#define EM_H8_300H	47		/* Hitachi H8/300H */
+#define EM_H8S		48		/* Hitachi H8S */
+#define EM_H8_500	49		/* Hitachi H8/500 */
+#define EM_IA_64	50		/* Intel Merced */
+#define EM_MIPS_X	51		/* Stanford MIPS-X */
+#define EM_COLDFIRE	52		/* Motorola Coldfire */
+#define EM_68HC12	53		/* Motorola M68HC12 */
+#define EM_MMA		54		/* Fujitsu MMA Multimedia Accelerator*/
+#define EM_PCP		55		/* Siemens PCP */
+#define EM_NCPU		56		/* Sony nCPU embeeded RISC */
+#define EM_NDR1		57		/* Denso NDR1 microprocessor */
+#define EM_STARCORE	58		/* Motorola Start*Core processor */
+#define EM_ME16		59		/* Toyota ME16 processor */
+#define EM_ST100	60		/* STMicroelectronic ST100 processor */
+#define EM_TINYJ	61		/* Advanced Logic Corp. Tinyj emb.fam*/
+#define EM_X86_64	62		/* AMD x86-64 */
+#define EM_PDSP		63		/* Sony DSP Processor */
+/* RESERVED 64,65 for future use */
+#define EM_FX66		66		/* Siemens FX66 microcontroller */
+#define EM_ST9PLUS	67		/* STMicroelectronics ST9+ 8/16 mc */
+#define EM_ST7		68		/* STmicroelectronics ST7 8 bit mc */
+#define EM_68HC16	69		/* Motorola MC68HC16 microcontroller */
+#define EM_68HC11	70		/* Motorola MC68HC11 microcontroller */
+#define EM_68HC08	71		/* Motorola MC68HC08 microcontroller */
+#define EM_68HC05	72		/* Motorola MC68HC05 microcontroller */
+#define EM_SVX		73		/* Silicon Graphics SVx */
+#define EM_ST19		74		/* STMicroelectronics ST19 8 bit mc */
+#define EM_VAX		75		/* Digital VAX */
+#define EM_CHRIS	76		/* Axis Communications embedded proc. */
+#define EM_JAVELIN	77		/* Infineon Technologies emb. proc. */
+#define EM_FIREPATH	78		/* Element 14 64-bit DSP Processor */
+#define EM_ZSP		79		/* LSI Logic 16-bit DSP Processor */
+#define EM_MMIX		80		/* Donald Knuth's edu 64-bit proc. */
+#define EM_HUANY	81		/* Harvard University mach-indep objs */
+#define EM_PRISM	82		/* SiTera Prism */
+#define EM_AVR		83		/* Atmel AVR 8-bit microcontroller */
+#define EM_FR30		84		/* Fujitsu FR30 */
+#define EM_D10V		85		/* Mitsubishi DV10V */
+#define EM_D30V		86		/* Mitsubishi DV30V */
+#define EM_V850		87		/* NEC v850 */
+#define EM_M32R		88		/* Mitsubishi M32R */
+#define EM_MN10300	89		/* Matsushita MN10200 */
+#define EM_MN10200	90		/* Matsushita MN10200 */
+#define EM_PJ		91		/* picoJava */
+#define EM_NUM		92		/* number of machine types */
+
+/* Version */
+#define EV_NONE		0		/* Invalid */
+#define EV_CURRENT	1		/* Current */
+#define EV_NUM		2		/* number of versions */
+
+/* Section Header */
+typedef struct {
+	Elf32_Word	sh_name;	/* name - index into section header
+					   string table section */
+	Elf32_Word	sh_type;	/* type */
+	Elf32_Word	sh_flags;	/* flags */
+	Elf32_Addr	sh_addr;	/* address */
+	Elf32_Off	sh_offset;	/* file offset */
+	Elf32_Word	sh_size;	/* section size */
+	Elf32_Word	sh_link;	/* section header table index link */
+	Elf32_Word	sh_info;	/* extra information */
+	Elf32_Word	sh_addralign;	/* address alignment */
+	Elf32_Word	sh_entsize;	/* section entry size */
+} Elf32_Shdr;
+
+/* Special Section Indexes */
+#define SHN_UNDEF	0		/* undefined */
+#define SHN_LORESERVE	0xff00		/* lower bounds of reserved indexes */
+#define SHN_LOPROC	0xff00		/* reserved range for processor */
+#define SHN_HIPROC	0xff1f		/*   specific section indexes */
+#define SHN_LOOS	0xff20		/* reserved range for operating */
+#define SHN_HIOS	0xff3f		/*   specific semantics */
+#define SHN_ABS		0xfff1		/* absolute value */
+#define SHN_COMMON	0xfff2		/* common symbol */
+#define SHN_XINDEX	0xffff		/* Index is an extra table */
+#define SHN_HIRESERVE	0xffff		/* upper bounds of reserved indexes */
+
+/* sh_type */
+#define SHT_NULL	0		/* inactive */
+#define SHT_PROGBITS	1		/* program defined information */
+#define SHT_SYMTAB	2		/* symbol table section */
+#define SHT_STRTAB	3		/* string table section */
+#define SHT_RELA	4		/* relocation section with addends*/
+#define SHT_HASH	5		/* symbol hash table section */
+#define SHT_DYNAMIC	6		/* dynamic section */
+#define SHT_NOTE	7		/* note section */
+#define SHT_NOBITS	8		/* no space section */
+#define SHT_REL		9		/* relation section without addends */
+#define SHT_SHLIB	10		/* reserved - purpose unknown */
+#define SHT_DYNSYM	11		/* dynamic symbol table section */
+#define SHT_INIT_ARRAY	14		/* Array of constructors */
+#define SHT_FINI_ARRAY	15		/* Array of destructors */
+#define SHT_PREINIT_ARRAY 16		/* Array of pre-constructors */
+#define SHT_GROUP	17		/* Section group */
+#define SHT_SYMTAB_SHNDX 18		/* Extended section indeces */
+#define SHT_NUM		19		/* number of section types */
+#define SHT_LOOS	0x60000000	/* Start OS-specific */
+#define SHT_HIOS	0x6fffffff	/* End OS-specific */
+#define SHT_LOPROC	0x70000000	/* reserved range for processor */
+#define SHT_HIPROC	0x7fffffff	/*  specific section header types */
+#define SHT_LOUSER	0x80000000	/* reserved range for application */
+#define SHT_HIUSER	0xffffffff	/*  specific indexes */
+
+/* Section names */
+#define ELF_BSS         ".bss"		/* uninitialized data */
+#define ELF_COMMENT	".comment"	/* version control information */
+#define ELF_DATA        ".data"		/* initialized data */
+#define ELF_DATA1       ".data1"	/* initialized data */
+#define ELF_DEBUG       ".debug"	/* debug */
+#define ELF_DYNAMIC     ".dynamic"	/* dynamic linking information */
+#define ELF_DYNSTR      ".dynstr"	/* dynamic string table */
+#define ELF_DYNSYM      ".dynsym"	/* dynamic symbol table */
+#define ELF_FINI        ".fini"		/* termination code */
+#define ELF_FINI_ARRAY	".fini_array"	/* Array of destructors */
+#define ELF_GOT         ".got"		/* global offset table */
+#define ELF_HASH        ".hash"		/* symbol hash table */
+#define ELF_INIT        ".init"		/* initialization code */
+#define ELF_INIT_ARRAY	".init_array"	/* Array of constuctors */
+#define ELF_INTERP	".interp"	/* Pathname of program interpreter */
+#define ELF_LINE	".line"		/* Symbolic line numnber information */
+#define ELF_NOTE	".note"		/* Contains note section */
+#define ELF_PLT		".plt"		/* Procedure linkage table */
+#define ELF_PREINIT_ARRAY ".preinit_array" /* Array of pre-constructors */
+#define ELF_REL_DATA    ".rel.data"	/* relocation data */
+#define ELF_REL_FINI    ".rel.fini"	/* relocation termination code */
+#define ELF_REL_INIT    ".rel.init"	/* relocation initialization code */
+#define ELF_REL_DYN     ".rel.dyn"	/* relocaltion dynamic link info */
+#define ELF_REL_RODATA  ".rel.rodata"	/* relocation read-only data */
+#define ELF_REL_TEXT    ".rel.text"	/* relocation code */
+#define ELF_RODATA      ".rodata"	/* read-only data */
+#define ELF_RODATA1     ".rodata1"	/* read-only data */
+#define ELF_SHSTRTAB    ".shstrtab"	/* section header string table */
+#define ELF_STRTAB      ".strtab"	/* string table */
+#define ELF_SYMTAB      ".symtab"	/* symbol table */
+#define ELF_SYMTAB_SHNDX ".symtab_shndx"/* symbol table section index */
+#define ELF_TBSS	".tbss"		/* thread local uninit data */
+#define ELF_TDATA	".tdata"	/* thread local init data */
+#define ELF_TDATA1	".tdata1"	/* thread local init data */
+#define ELF_TEXT        ".text"		/* code */
+
+/* Section Attribute Flags - sh_flags */
+#define SHF_WRITE	0x1		/* Writable */
+#define SHF_ALLOC	0x2		/* occupies memory */
+#define SHF_EXECINSTR	0x4		/* executable */
+#define SHF_MERGE	0x10		/* Might be merged */
+#define SHF_STRINGS	0x20		/* Contains NULL terminated strings */
+#define SHF_INFO_LINK	0x40		/* sh_info contains SHT index */
+#define SHF_LINK_ORDER	0x80		/* Preserve order after combining*/
+#define SHF_OS_NONCONFORMING 0x100	/* Non-standard OS specific handling */
+#define SHF_GROUP	0x200		/* Member of section group */
+#define SHF_TLS		0x400		/* Thread local storage */
+#define SHF_MASKOS	0x0ff00000	/* OS specific */
+#define SHF_MASKPROC	0xf0000000	/* reserved bits for processor */
+					/*  specific section attributes */
+
+/* Section Group Flags */
+#define GRP_COMDAT	0x1		/* COMDAT group */
+#define GRP_MASKOS	0x0ff00000	/* Mask OS specific flags */
+#define GRP_MASKPROC	0xf0000000	/* Mask processor specific flags */
+
+/* Symbol Table Entry */
+typedef struct elf32_sym {
+	Elf32_Word	st_name;	/* name - index into string table */
+	Elf32_Addr	st_value;	/* symbol value */
+	Elf32_Word	st_size;	/* symbol size */
+	unsigned char	st_info;	/* type and binding */
+	unsigned char	st_other;	/* 0 - no defined meaning */
+	Elf32_Half	st_shndx;	/* section header index */
+} Elf32_Sym;
+
+/* Symbol table index */
+#define STN_UNDEF	0		/* undefined */
+
+/* Extract symbol info - st_info */
+#define ELF32_ST_BIND(x)	((x) >> 4)
+#define ELF32_ST_TYPE(x)	(((unsigned int) x) & 0xf)
+#define ELF32_ST_INFO(b,t)	(((b) << 4) + ((t) & 0xf))
+#define ELF32_ST_VISIBILITY(x)	((x) & 0x3)
+
+/* Symbol Binding - ELF32_ST_BIND - st_info */
+#define STB_LOCAL	0		/* Local symbol */
+#define STB_GLOBAL	1		/* Global symbol */
+#define STB_WEAK	2		/* like global - lower precedence */
+#define STB_NUM		3		/* number of symbol bindings */
+#define STB_LOOS	10		/* reserved range for operating */
+#define STB_HIOS	12		/*   system specific symbol bindings */
+#define STB_LOPROC	13		/* reserved range for processor */
+#define STB_HIPROC	15		/*  specific symbol bindings */
+
+/* Symbol type - ELF32_ST_TYPE - st_info */
+#define STT_NOTYPE	0		/* not specified */
+#define STT_OBJECT	1		/* data object */
+#define STT_FUNC	2		/* function */
+#define STT_SECTION	3		/* section */
+#define STT_FILE	4		/* file */
+#define STT_NUM		5		/* number of symbol types */
+#define STT_TLS		6		/* Thread local storage symbol */
+#define STT_LOOS	10		/* reserved range for operating */
+#define STT_HIOS	12		/*  system specific symbol types */
+#define STT_LOPROC	13		/* reserved range for processor */
+#define STT_HIPROC	15		/*  specific symbol types */
+
+/* Symbol visibility - ELF32_ST_VISIBILITY - st_other */
+#define STV_DEFAULT	0		/* Normal visibility rules */
+#define STV_INTERNAL	1		/* Processor specific hidden class */
+#define STV_HIDDEN	2		/* Symbol unavailable in other mods */
+#define STV_PROTECTED	3		/* Not preemptible, not exported */
+
+
+/* Relocation entry with implicit addend */
+typedef struct
+{
+	Elf32_Addr	r_offset;	/* offset of relocation */
+	Elf32_Word	r_info;		/* symbol table index and type */
+} Elf32_Rel;
+
+/* Relocation entry with explicit addend */
+typedef struct
+{
+	Elf32_Addr	r_offset;	/* offset of relocation */
+	Elf32_Word	r_info;		/* symbol table index and type */
+	Elf32_Sword	r_addend;
+} Elf32_Rela;
+
+/* Extract relocation info - r_info */
+#define ELF32_R_SYM(i)		((i) >> 8)
+#define ELF32_R_TYPE(i)		((unsigned char) (i))
+#define ELF32_R_INFO(s,t) 	(((s) << 8) + (unsigned char)(t))
+
+/* Program Header */
+typedef struct {
+	Elf32_Word	p_type;		/* segment type */
+	Elf32_Off	p_offset;	/* segment offset */
+	Elf32_Addr	p_vaddr;	/* virtual address of segment */
+	Elf32_Addr	p_paddr;	/* physical address - ignored? */
+	Elf32_Word	p_filesz;	/* number of bytes in file for seg. */
+	Elf32_Word	p_memsz;	/* number of bytes in mem. for seg. */
+	Elf32_Word	p_flags;	/* flags */
+	Elf32_Word	p_align;	/* memory alignment */
+} Elf32_Phdr;
+
+/* Segment types - p_type */
+#define PT_NULL		0		/* unused */
+#define PT_LOAD		1		/* loadable segment */
+#define PT_DYNAMIC	2		/* dynamic linking section */
+#define PT_INTERP	3		/* the RTLD */
+#define PT_NOTE		4		/* auxiliary information */
+#define PT_SHLIB	5		/* reserved - purpose undefined */
+#define PT_PHDR		6		/* program header */
+#define PT_TLS		7		/* Thread local storage template */
+#define PT_NUM		8		/* Number of segment types */
+#define PT_LOOS		0x60000000	/* reserved range for operating */
+#define PT_HIOS		0x6fffffff	/*   system specific segment types */
+#define PT_LOPROC	0x70000000	/* reserved range for processor */
+#define PT_HIPROC	0x7fffffff	/*  specific segment types */
+
+/* Segment flags - p_flags */
+#define PF_X		0x1		/* Executable */
+#define PF_W		0x2		/* Writable */
+#define PF_R		0x4		/* Readable */
+#define PF_MASKOS	0x0ff00000	/* OS specific segment flags */
+#define PF_MASKPROC	0xf0000000	/* reserved bits for processor */
+					/*  specific segment flags */
+/* Dynamic structure */
+typedef struct
+{
+	Elf32_Sword	d_tag;		/* controls meaning of d_val */
+	union
+	{
+		Elf32_Word	d_val;	/* Multiple meanings - see d_tag */
+		Elf32_Addr	d_ptr;	/* program virtual address */
+	} d_un;
+} Elf32_Dyn;
+
+extern Elf32_Dyn	_DYNAMIC[];
+
+/* Dynamic Array Tags - d_tag */
+#define DT_NULL		0		/* marks end of _DYNAMIC array */
+#define DT_NEEDED	1		/* string table offset of needed lib */
+#define DT_PLTRELSZ	2		/* size of relocation entries in PLT */
+#define DT_PLTGOT	3		/* address PLT/GOT */
+#define DT_HASH		4		/* address of symbol hash table */
+#define DT_STRTAB	5		/* address of string table */
+#define DT_SYMTAB	6		/* address of symbol table */
+#define DT_RELA		7		/* address of relocation table */
+#define DT_RELASZ	8		/* size of relocation table */
+#define DT_RELAENT	9		/* size of relocation entry */
+#define DT_STRSZ	10		/* size of string table */
+#define DT_SYMENT	11		/* size of symbol table entry */
+#define DT_INIT		12		/* address of initialization func. */
+#define DT_FINI		13		/* address of termination function */
+#define DT_SONAME	14		/* string table offset of shared obj */
+#define DT_RPATH	15		/* string table offset of library
+					   search path */
+#define DT_SYMBOLIC	16		/* start sym search in shared obj. */
+#define DT_REL		17		/* address of rel. tbl. w addends */
+#define DT_RELSZ	18		/* size of DT_REL relocation table */
+#define DT_RELENT	19		/* size of DT_REL relocation entry */
+#define DT_PLTREL	20		/* PLT referenced relocation entry */
+#define DT_DEBUG	21		/* bugger */
+#define DT_TEXTREL	22		/* Allow rel. mod. to unwritable seg */
+#define DT_JMPREL	23		/* add. of PLT's relocation entries */
+#define DT_BIND_NOW	24		/* Process relocations of object */
+#define DT_INIT_ARRAY	25		/* Array with addresses of init fct */
+#define DT_FINI_ARRAY	26		/* Array with addresses of fini fct */
+#define DT_INIT_ARRAYSZ	27		/* Size in bytes of DT_INIT_ARRAY */
+#define DT_FINI_ARRAYSZ	28		/* Size in bytes of DT_FINI_ARRAY */
+#define DT_RUNPATH	29		/* Library search path */
+#define DT_FLAGS	30		/* Flags for the object being loaded */
+#define DT_ENCODING	32		/* Start of encoded range */
+#define DT_PREINIT_ARRAY 32		/* Array with addresses of preinit fct*/
+#define DT_PREINIT_ARRAYSZ 33		/* size in bytes of DT_PREINIT_ARRAY */
+#define DT_NUM		34		/* Number used. */
+#define DT_LOOS		0x60000000	/* reserved range for OS */
+#define DT_HIOS		0x6fffffff	/*   specific dynamic array tags */
+#define DT_LOPROC	0x70000000	/* reserved range for processor */
+#define DT_HIPROC	0x7fffffff	/*  specific dynamic array tags */
+
+/* Dynamic Tag Flags - d_un.d_val */
+#define DF_ORIGIN	0x01		/* Object may use DF_ORIGIN */
+#define DF_SYMBOLIC	0x02		/* Symbol resolutions starts here */
+#define DF_TEXTREL	0x04		/* Object contains text relocations */
+#define DF_BIND_NOW	0x08		/* No lazy binding for this object */
+#define DF_STATIC_TLS	0x10		/* Static thread local storage */
+
+/* Standard ELF hashing function */
+unsigned long elf_hash(const unsigned char *name);
+
+#define ELF_TARG_VER	1	/* The ver for which this code is intended */
+
+/*
+ * XXX - PowerPC defines really don't belong in here,
+ * but we'll put them in for simplicity.
+ */
+
+/* Values for Elf32/64_Ehdr.e_flags.  */
+#define EF_PPC_EMB              0x80000000      /* PowerPC embedded flag */
+
+/* Cygnus local bits below */
+#define EF_PPC_RELOCATABLE      0x00010000      /* PowerPC -mrelocatable flag*/
+#define EF_PPC_RELOCATABLE_LIB  0x00008000      /* PowerPC -mrelocatable-lib
+                                                   flag */
+
+/* PowerPC relocations defined by the ABIs */
+#define R_PPC_NONE              0
+#define R_PPC_ADDR32            1       /* 32bit absolute address */
+#define R_PPC_ADDR24            2       /* 26bit address, 2 bits ignored.  */
+#define R_PPC_ADDR16            3       /* 16bit absolute address */
+#define R_PPC_ADDR16_LO         4       /* lower 16bit of absolute address */
+#define R_PPC_ADDR16_HI         5       /* high 16bit of absolute address */
+#define R_PPC_ADDR16_HA         6       /* adjusted high 16bit */
+#define R_PPC_ADDR14            7       /* 16bit address, 2 bits ignored */
+#define R_PPC_ADDR14_BRTAKEN    8
+#define R_PPC_ADDR14_BRNTAKEN   9
+#define R_PPC_REL24             10      /* PC relative 26 bit */
+#define R_PPC_REL14             11      /* PC relative 16 bit */
+#define R_PPC_REL14_BRTAKEN     12
+#define R_PPC_REL14_BRNTAKEN    13
+#define R_PPC_GOT16             14
+#define R_PPC_GOT16_LO          15
+#define R_PPC_GOT16_HI          16
+#define R_PPC_GOT16_HA          17
+#define R_PPC_PLTREL24          18
+#define R_PPC_COPY              19
+#define R_PPC_GLOB_DAT          20
+#define R_PPC_JMP_SLOT          21
+#define R_PPC_RELATIVE          22
+#define R_PPC_LOCAL24PC         23
+#define R_PPC_UADDR32           24
+#define R_PPC_UADDR16           25
+#define R_PPC_REL32             26
+#define R_PPC_PLT32             27
+#define R_PPC_PLTREL32          28
+#define R_PPC_PLT16_LO          29
+#define R_PPC_PLT16_HI          30
+#define R_PPC_PLT16_HA          31
+#define R_PPC_SDAREL16          32
+#define R_PPC_SECTOFF           33
+#define R_PPC_SECTOFF_LO        34
+#define R_PPC_SECTOFF_HI        35
+#define R_PPC_SECTOFF_HA        36
+/* Keep this the last entry.  */
+#define R_PPC_NUM               37
+
+/* The remaining relocs are from the Embedded ELF ABI, and are not
+   in the SVR4 ELF ABI.  */
+#define R_PPC_EMB_NADDR32       101
+#define R_PPC_EMB_NADDR16       102
+#define R_PPC_EMB_NADDR16_LO    103
+#define R_PPC_EMB_NADDR16_HI    104
+#define R_PPC_EMB_NADDR16_HA    105
+#define R_PPC_EMB_SDAI16        106
+#define R_PPC_EMB_SDA2I16       107
+#define R_PPC_EMB_SDA2REL       108
+#define R_PPC_EMB_SDA21         109     /* 16 bit offset in SDA */
+#define R_PPC_EMB_MRKREF        110
+#define R_PPC_EMB_RELSEC16      111
+#define R_PPC_EMB_RELST_LO      112
+#define R_PPC_EMB_RELST_HI      113
+#define R_PPC_EMB_RELST_HA      114
+#define R_PPC_EMB_BIT_FLD       115
+#define R_PPC_EMB_RELSDA        116     /* 16 bit relative offset in SDA */
+
+/* Diab tool relocations.  */
+#define R_PPC_DIAB_SDA21_LO     180     /* like EMB_SDA21, but lower 16 bit */
+#define R_PPC_DIAB_SDA21_HI     181     /* like EMB_SDA21, but high 16 bit */
+#define R_PPC_DIAB_SDA21_HA     182     /* like EMB_SDA21, adjusted high 16 */
+#define R_PPC_DIAB_RELSDA_LO    183     /* like EMB_RELSDA, but lower 16 bit */
+#define R_PPC_DIAB_RELSDA_HI    184     /* like EMB_RELSDA, but high 16 bit */
+#define R_PPC_DIAB_RELSDA_HA    185     /* like EMB_RELSDA, adjusted high 16 */
+
+/* This is a phony reloc to handle any old fashioned TOC16 references
+   that may still be in object files.  */
+#define R_PPC_TOC16             255
+
+#endif /* _ELF_H */
diff --git a/src/entry.c b/src/entry.c
new file mode 100644
index 0000000..de94000
--- /dev/null
+++ b/src/entry.c
@@ -0,0 +1,277 @@
+#include "elf_abi.h"
+#include "sd_loader.h"
+#include "../sd_loader/src/common.h"
+#include <stdint.h>
+
+#define OSDynLoad_Acquire ((void (*)(char* rpl, unsigned int *handle))0x0102A3B4)
+#define OSDynLoad_FindExport ((void (*)(unsigned int handle, int isdata, char *symbol, void *address))0x0102B828)
+#define OSFatal ((void (*)(char* msg))0x01031618)
+
+#define EXPORT_DECL(res, func, ...) res (* func)(__VA_ARGS__);
+#define OS_FIND_EXPORT(handle, funcName, func) OSDynLoad_FindExport(handle, 0, funcName, &func)
+
+#define ADDRESS_OSTitle_main_entry_ptr              0x1005E040
+#define ADDRESS_main_entry_hook                     0x0101c56c
+
+#define KERN_SYSCALL_TBL_1                          0xFFE84C70 // unknown
+#define KERN_SYSCALL_TBL_2                          0xFFE85070 // works with games
+#define KERN_SYSCALL_TBL_3                          0xFFE85470 // works with loader
+#define KERN_SYSCALL_TBL_4                          0xFFEAAA60 // works with home menu
+#define KERN_SYSCALL_TBL_5                          0xFFEAAE60 // works with browser (previously KERN_SYSCALL_TBL)
+
+#define address_LiWaitIopComplete                   0x01010180
+#define address_LiWaitIopCompleteWithInterrupts     0x0101006C
+#define address_LiWaitOneChunk                      0x0100080C
+#define address_PrepareTitle_hook                   0xFFF184E4
+#define address_sgIsLoadingBuffer                   0xEFE19E80
+#define address_gDynloadInitialized                 0xEFE13DBC
+
+/* assembly functions */
+extern void Syscall_0x36(void);
+extern void KernelPatches(void);
+extern void SCKernelCopyData(unsigned int addr, unsigned int src, unsigned int len);
+
+extern void SC_0x25_KernelCopyData(unsigned int addr, unsigned int src, unsigned int len);
+
+
+void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value);
+
+typedef struct _private_data_t {
+    EXPORT_DECL(void *, MEMAllocFromDefaultHeapEx,int size, int align);
+    EXPORT_DECL(void, MEMFreeToDefaultHeap,void *ptr);
+
+    EXPORT_DECL(void*, memcpy, void *p1, const void *p2, unsigned int s);
+    EXPORT_DECL(void*, memset, void *p1, int val, unsigned int s);
+
+    EXPORT_DECL(unsigned int, OSEffectiveToPhysical, const void*);
+    EXPORT_DECL(void, exit, int);
+    EXPORT_DECL(void, DCInvalidateRange, const void *addr, unsigned int length);
+    EXPORT_DECL(void, DCFlushRange, const void *addr, unsigned int length);
+    EXPORT_DECL(void, ICInvalidateRange, const void *addr, unsigned int length);
+
+    EXPORT_DECL(int, FSInit, void);
+    EXPORT_DECL(int, FSAddClientEx, void *pClient, int unk_zero_param, int errHandling);
+    EXPORT_DECL(int, FSDelClient, void *pClient);
+    EXPORT_DECL(void, FSInitCmdBlock, void *pCmd);
+    EXPORT_DECL(int, FSGetMountSource, void *pClient, void *pCmd, int type, void *source, int errHandling);
+    EXPORT_DECL(int, FSMount, void *pClient, void *pCmd, void *source, const char *target, uint32_t bytes, int errHandling);
+    EXPORT_DECL(int, FSUnmount, void *pClient, void *pCmd, const char *target, int errHandling);
+    EXPORT_DECL(int, FSOpenFile, void *pClient, void *pCmd, const char *path, const char *mode, int *fd, int errHandling);
+    EXPORT_DECL(int, FSGetStatFile, void *pClient, void *pCmd, int fd, void *buffer, int error);
+    EXPORT_DECL(int, FSReadFile, void *pClient, void *pCmd, void *buffer, int size, int count, int fd, int flag, int errHandling);
+    EXPORT_DECL(int, FSCloseFile, void *pClient, void *pCmd, int fd, int errHandling);
+
+    EXPORT_DECL(int, SYSRelaunchTitle, int argc, char** argv);
+} private_data_t;
+
+static void InstallPatches(private_data_t *private_data);
+
+
+static void loadFunctionPointers(private_data_t * private_data) {
+    unsigned int coreinit_handle;
+
+    OSDynLoad_Acquire("coreinit", &coreinit_handle);
+
+    unsigned int *functionPtr = 0;
+
+    OSDynLoad_FindExport(coreinit_handle, 1, "MEMAllocFromDefaultHeapEx", &functionPtr);
+    private_data->MEMAllocFromDefaultHeapEx = (void * (*)(int, int))*functionPtr;
+    OSDynLoad_FindExport(coreinit_handle, 1, "MEMFreeToDefaultHeap", &functionPtr);
+    private_data->MEMFreeToDefaultHeap = (void (*)(void *))*functionPtr;
+
+    OS_FIND_EXPORT(coreinit_handle, "memcpy", private_data->memcpy);
+    OS_FIND_EXPORT(coreinit_handle, "memset", private_data->memset);
+    OS_FIND_EXPORT(coreinit_handle, "DCFlushRange", private_data->DCFlushRange);
+    OS_FIND_EXPORT(coreinit_handle, "DCInvalidateRange", private_data->DCInvalidateRange);
+    OS_FIND_EXPORT(coreinit_handle, "ICInvalidateRange", private_data->ICInvalidateRange);
+    OS_FIND_EXPORT(coreinit_handle, "OSEffectiveToPhysical", private_data->OSEffectiveToPhysical);
+    OS_FIND_EXPORT(coreinit_handle, "exit", private_data->exit);
+
+    OS_FIND_EXPORT(coreinit_handle, "FSInit", private_data->FSInit);
+    OS_FIND_EXPORT(coreinit_handle, "FSAddClientEx", private_data->FSAddClientEx);
+    OS_FIND_EXPORT(coreinit_handle, "FSDelClient", private_data->FSDelClient);
+    OS_FIND_EXPORT(coreinit_handle, "FSInitCmdBlock", private_data->FSInitCmdBlock);
+    OS_FIND_EXPORT(coreinit_handle, "FSGetMountSource", private_data->FSGetMountSource);
+    OS_FIND_EXPORT(coreinit_handle, "FSMount", private_data->FSMount);
+    OS_FIND_EXPORT(coreinit_handle, "FSUnmount", private_data->FSUnmount);
+    OS_FIND_EXPORT(coreinit_handle, "FSOpenFile", private_data->FSOpenFile);
+    OS_FIND_EXPORT(coreinit_handle, "FSGetStatFile", private_data->FSGetStatFile);
+    OS_FIND_EXPORT(coreinit_handle, "FSReadFile", private_data->FSReadFile);
+    OS_FIND_EXPORT(coreinit_handle, "FSCloseFile", private_data->FSCloseFile);
+
+    unsigned int sysapp_handle;
+    OSDynLoad_Acquire("sysapp.rpl", &sysapp_handle);
+    OS_FIND_EXPORT(sysapp_handle, "SYSRelaunchTitle", private_data->SYSRelaunchTitle);
+}
+
+static unsigned int load_elf_image (private_data_t *private_data, unsigned char *elfstart) {
+    Elf32_Ehdr *ehdr;
+    Elf32_Phdr *phdrs;
+    unsigned char *image;
+    int i;
+
+    ehdr = (Elf32_Ehdr *) elfstart;
+
+    if(ehdr->e_phoff == 0 || ehdr->e_phnum == 0)
+        return 0;
+
+    if(ehdr->e_phentsize != sizeof(Elf32_Phdr))
+        return 0;
+
+    phdrs = (Elf32_Phdr*)(elfstart + ehdr->e_phoff);
+
+    for(i = 0; i < ehdr->e_phnum; i++) {
+        if(phdrs[i].p_type != PT_LOAD)
+            continue;
+
+        if(phdrs[i].p_filesz > phdrs[i].p_memsz)
+            continue;
+
+        if(!phdrs[i].p_filesz)
+            continue;
+
+        unsigned int p_paddr = phdrs[i].p_paddr;
+        image = (unsigned char *) (elfstart + phdrs[i].p_offset);
+
+        private_data->memcpy ((void *) p_paddr, image, phdrs[i].p_filesz);
+        private_data->DCFlushRange((void*)p_paddr, phdrs[i].p_filesz);
+
+        if(phdrs[i].p_flags & PF_X)
+            private_data->ICInvalidateRange ((void *) p_paddr, phdrs[i].p_memsz);
+    }
+
+    //! clear BSS
+    Elf32_Shdr *shdr = (Elf32_Shdr *) (elfstart + ehdr->e_shoff);
+    for(i = 0; i < ehdr->e_shnum; i++) {
+        const char *section_name = ((const char*)elfstart) + shdr[ehdr->e_shstrndx].sh_offset + shdr[i].sh_name;
+        if(section_name[0] == '.' && section_name[1] == 'b' && section_name[2] == 's' && section_name[3] == 's') {
+            private_data->memset((void*)shdr[i].sh_addr, 0, shdr[i].sh_size);
+            private_data->DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size);
+        } else if(section_name[0] == '.' && section_name[1] == 's' && section_name[2] == 'b' && section_name[3] == 's' && section_name[4] == 's') {
+            private_data->memset((void*)shdr[i].sh_addr, 0, shdr[i].sh_size);
+            private_data->DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size);
+        }
+    }
+
+    return ehdr->e_entry;
+}
+
+
+void KernelWriteU32(uint32_t addr, uint32_t value, private_data_t * pdata) {
+    pdata->ICInvalidateRange(&value, 4);
+    pdata->DCFlushRange(&value, 4);
+
+    uint32_t dst = (uint32_t) pdata->OSEffectiveToPhysical((void *)addr);
+    uint32_t src = (uint32_t) pdata->OSEffectiveToPhysical((void *)&value);
+
+    SC_0x25_KernelCopyData(dst, src, 4);
+
+    pdata->DCFlushRange((void *)addr, 4);
+    pdata->ICInvalidateRange((void *)addr, 4);
+}
+
+int _start(int argc, char **argv) {
+    kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x25 * 4)), (unsigned int)SCKernelCopyData);
+    kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x25 * 4)), (unsigned int)SCKernelCopyData);
+    kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x25 * 4)), (unsigned int)SCKernelCopyData);
+    kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x25 * 4)), (unsigned int)SCKernelCopyData);
+    kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x25 * 4)), (unsigned int)SCKernelCopyData);
+
+    kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x36 * 4)), (unsigned int)KernelPatches);
+    kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x36 * 4)), (unsigned int)KernelPatches);
+    kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x36 * 4)), (unsigned int)KernelPatches);
+    kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x36 * 4)), (unsigned int)KernelPatches);
+    kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x36 * 4)), (unsigned int)KernelPatches);
+
+    Syscall_0x36();
+
+    private_data_t private_data;
+    loadFunctionPointers(&private_data);
+
+    InstallPatches(&private_data);
+
+    unsigned char * pElfBuffer = (unsigned char *) sd_loader_sd_loader_elf; // use this address as temporary to load the elf
+
+    unsigned int mainEntryPoint = load_elf_image(&private_data, pElfBuffer);
+
+    if(mainEntryPoint == 0) {
+        OSFatal("failed to load elf");
+    }
+
+    //! Install our entry point hook
+    unsigned int repl_addr = ADDRESS_main_entry_hook;
+    unsigned int jump_addr = mainEntryPoint & 0x03fffffc;
+
+    unsigned int bufferU32 = 0x48000003 | jump_addr;
+    KernelWriteU32(repl_addr,bufferU32,&private_data);
+
+    // restart mii maker.
+    private_data.SYSRelaunchTitle(0, 0);
+    private_data.exit(0);
+    return 0;
+
+    //return ((int (*)(int, char **))mainEntryPoint)(argc, argv);
+}
+
+/* Write a 32-bit word with kernel permissions */
+void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value) {
+    asm volatile (
+        "li 3,1\n"
+        "li 4,0\n"
+        "mr 5,%1\n"
+        "li 6,0\n"
+        "li 7,0\n"
+        "lis 8,1\n"
+        "mr 9,%0\n"
+        "mr %1,1\n"
+        "li 0,0x3500\n"
+        "sc\n"
+        "nop\n"
+        "mr 1,%1\n"
+        :
+        :	"r"(addr), "r"(value)
+        :	"memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10",
+        "11", "12"
+    );
+}
+
+/* ****************************************************************** */
+/*                         INSTALL PATCHES                            */
+/* All OS specific stuff is done here                                 */
+/* ****************************************************************** */
+static void InstallPatches(private_data_t *private_data) {
+    OsSpecifics osSpecificFunctions;
+    private_data->memset(&osSpecificFunctions, 0, sizeof(OsSpecifics));
+
+    unsigned int bufferU32;
+    /* Pre-setup a few options to defined values */
+    bufferU32 = 550;
+    private_data->memcpy((void*)&OS_FIRMWARE, &bufferU32, sizeof(bufferU32));
+    bufferU32 = 0xDEADC0DE;
+    private_data->memcpy((void*)&MAIN_ENTRY_ADDR, &bufferU32, sizeof(bufferU32));
+    private_data->memcpy((void*)&ELF_DATA_ADDR, &bufferU32, sizeof(bufferU32));
+    bufferU32 = 0;
+    private_data->memcpy((void*)&ELF_DATA_SIZE, &bufferU32, sizeof(bufferU32));
+
+    osSpecificFunctions.addr_OSDynLoad_Acquire = (unsigned int)OSDynLoad_Acquire;
+    osSpecificFunctions.addr_OSDynLoad_FindExport = (unsigned int)OSDynLoad_FindExport;
+
+    osSpecificFunctions.addr_KernSyscallTbl1 = KERN_SYSCALL_TBL_1;
+    osSpecificFunctions.addr_KernSyscallTbl2 = KERN_SYSCALL_TBL_2;
+    osSpecificFunctions.addr_KernSyscallTbl3 = KERN_SYSCALL_TBL_3;
+    osSpecificFunctions.addr_KernSyscallTbl4 = KERN_SYSCALL_TBL_4;
+    osSpecificFunctions.addr_KernSyscallTbl5 = KERN_SYSCALL_TBL_5;
+
+    osSpecificFunctions.LiWaitIopComplete = (int (*)(int, int *)) address_LiWaitIopComplete;
+    osSpecificFunctions.LiWaitIopCompleteWithInterrupts = (int (*)(int, int *)) address_LiWaitIopCompleteWithInterrupts;
+    osSpecificFunctions.addr_LiWaitOneChunk = address_LiWaitOneChunk;
+    osSpecificFunctions.addr_PrepareTitle_hook = address_PrepareTitle_hook;
+    osSpecificFunctions.addr_sgIsLoadingBuffer = address_sgIsLoadingBuffer;
+    osSpecificFunctions.addr_gDynloadInitialized = address_gDynloadInitialized;
+    osSpecificFunctions.orig_LiWaitOneChunkInstr = *(unsigned int*)address_LiWaitOneChunk;
+
+    //! pointer to main entry point of a title
+    osSpecificFunctions.addr_OSTitle_main_entry = ADDRESS_OSTitle_main_entry_ptr;
+
+    private_data->memcpy((void*)OS_SPECIFICS, &osSpecificFunctions, sizeof(OsSpecifics));
+}
diff --git a/src/kernel_patches.S b/src/kernel_patches.S
new file mode 100644
index 0000000..90187cb
--- /dev/null
+++ b/src/kernel_patches.S
@@ -0,0 +1,211 @@
+#define BAT_SETUP_HOOK_ADDR         0xFFF1D624
+# not all of those NOP address are required for every firmware
+# mainly these should stop the kernel from removing our IBAT4 and DBAT5
+#define BAT_SET_NOP_ADDR_1          0xFFF06B6C
+#define BAT_SET_NOP_ADDR_2          0xFFF06BF8
+#define BAT_SET_NOP_ADDR_3          0xFFF003C8
+#define BAT_SET_NOP_ADDR_4          0xFFF003CC
+#define BAT_SET_NOP_ADDR_5          0xFFF1D70C
+#define BAT_SET_NOP_ADDR_6          0xFFF1D728
+#define BAT_SET_NOP_ADDR_7          0xFFF1D82C
+
+#define BAT_SET_NOP_ADDR_8          0xFFEE11C4
+#define BAT_SET_NOP_ADDR_9          0xFFEE11C8
+
+#define BAT_SETUP_HOOK_ENTRY        0x00800000
+
+
+#define BAT4U_VAL                   0x008000FF
+#define BAT4L_VAL                   0x30800012
+
+
+#define SET_R4_TO_ADDR(addr)        \
+    lis r3, addr@h              ;   \
+    ori r3, r3, addr@l          ;   \
+    stw r4, 0(r3)               ;   \
+    dcbf 0, r3                  ;   \
+    icbi 0, r3                  ;
+
+     .globl Syscall_0x36
+Syscall_0x36:
+    li r0, 0x3600
+    sc
+    blr
+    
+    
+.global SCKernelCopyData
+SCKernelCopyData:
+	// Disable data address translation
+	mfmsr %r6
+	li %r7, 0x10
+	andc %r6, %r6, %r7
+	mtmsr %r6
+	
+	// Copy data
+	addi %r3, %r3, -1
+	addi %r4, %r4, -1
+	mtctr %r5
+SCKernelCopyData_loop:
+	lbzu %r5, 1(%r4)
+	stbu %r5, 1(%r3)
+	bdnz SCKernelCopyData_loop
+	
+	// Enable data address translation
+	ori %r6, %r6, 0x10
+	mtmsr %r6
+blr
+
+.global SC_0x25_KernelCopyData
+SC_0x25_KernelCopyData:
+	li %r0, 0x2500
+	sc
+blr
+
+    .globl KernelPatches
+KernelPatches:
+    # store the old DBAT0
+    mfdbatu r5, 0
+    mfdbatl r6, 0
+
+    # memory barrier
+    eieio
+    isync
+
+    # setup DBAT0 for access to kernel code memory
+    lis r3, 0xFFF0
+    ori r3, r3, 0x0002
+    mtdbatu 0, r3
+    lis r3, 0xFFF0
+    ori r3, r3, 0x0032
+    mtdbatl 0, r3
+
+    # memory barrier
+    eieio
+    isync
+
+    # SaveAndResetDataBATs_And_SRs hook setup, but could be any BAT function though
+    # just chosen because its simple
+    lis r3, BAT_SETUP_HOOK_ADDR@h
+    ori r3, r3, BAT_SETUP_HOOK_ADDR@l
+
+    # make the kernel setup our section in IBAT4 and
+    # jump to our function to restore the replaced instructions
+    lis r4, 0x3ce0      				#   lis r7, BAT4L_VAL@h
+    ori r4, r4, BAT4L_VAL@h
+    stw r4, 0x00(r3)
+    lis r4, 0x60e7      				#   ori r7, r7, BAT4L_VAL@l
+    ori r4, r4, BAT4L_VAL@l
+    stw r4, 0x04(r3)
+    lis r4, 0x7cf1      				#   mtspr 561, r7
+    ori r4, r4, 0x8ba6
+    stw r4, 0x08(r3)
+    lis r4, 0x3ce0      				#   lis r7, BAT4U_VAL@h
+    ori r4, r4, BAT4U_VAL@h
+    stw r4, 0x0C(r3)
+    lis r4, 0x60e7      				#   ori r7, r7, BAT4U_VAL@l
+    ori r4, r4, BAT4U_VAL@l
+    stw r4, 0x10(r3)
+    lis r4, 0x7cf0      				#   mtspr 560, r7
+    ori r4, r4, 0x8ba6
+    stw r4, 0x14(r3)
+    lis r4, 0x7c00      				#   eieio
+    ori r4, r4, 0x06ac
+    stw r4, 0x18(r3)
+    lis r4, 0x4c00      				#   isync
+    ori r4, r4, 0x012c
+    stw r4, 0x1C(r3)
+    lis r4, 0x7ce8     				    #   mflr r7
+    ori r4, r4, 0x02a6
+    stw r4, 0x20(r3)
+    lis r4, (BAT_SETUP_HOOK_ENTRY | 0x48000003)@h      #   bla BAT_SETUP_HOOK_ENTRY
+    ori r4, r4, (BAT_SETUP_HOOK_ENTRY | 0x48000003)@l
+    stw r4, 0x24(r3)
+
+    # flush and invalidate the replaced instructions
+    lis r3, (BAT_SETUP_HOOK_ADDR & ~31)@h
+    ori r3, r3, (BAT_SETUP_HOOK_ADDR & ~31)@l
+    dcbf 0, r3
+    icbi 0, r3
+    lis r3, ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31)@h
+    ori r3, r3, ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31)@l
+    dcbf 0, r3
+    icbi 0, r3
+    sync
+
+    # setup IBAT4 for core 1 at this position (not really required but wont hurt)
+    # IBATL 4
+    lis r3, BAT4L_VAL@h
+    ori r3, r3, BAT4L_VAL@l
+    mtspr 561, r3
+
+    # IBATU 4
+    lis r3, BAT4U_VAL@h
+    ori r3, r3, BAT4U_VAL@l
+    mtspr 560, r3
+
+    # memory barrier
+    eieio
+    isync
+
+    # write "nop" to some positions
+    lis r4, 0x6000
+    # nop on IBATU 4 and DBAT 5 set/reset
+#ifdef BAT_SET_NOP_ADDR_1
+    SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_1)
+#endif
+#ifdef BAT_SET_NOP_ADDR_2
+    SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_2)
+#endif
+#ifdef BAT_SET_NOP_ADDR_3
+    SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_3)
+#endif
+#ifdef BAT_SET_NOP_ADDR_4
+    SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_4)
+#endif
+#ifdef BAT_SET_NOP_ADDR_5
+    SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_5)
+#endif
+#ifdef BAT_SET_NOP_ADDR_6
+    SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_6)
+#endif
+#ifdef BAT_SET_NOP_ADDR_7
+    SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_7)
+#endif
+
+#if (defined(BAT_SET_NOP_ADDR_8) && defined(BAT_SET_NOP_ADDR_9))
+    # memory barrier
+    eieio
+    isync
+
+    # setup DBAT0 for access to kernel code memory
+    lis r3, 0xFFEE
+    ori r3, r3, 0x0002
+    mtdbatu 0, r3
+    lis r3, 0xFFEE
+    ori r3, r3, 0x0032
+    mtdbatl 0, r3
+
+    # memory barrier
+    eieio
+    isync
+
+    # write "nop" to some positions
+    lis r4, 0x6000
+    SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_8)
+    SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_9)
+#endif
+
+    # memory barrier
+    eieio
+    isync
+
+    # restore DBAT 0 and return from interrupt
+    mtdbatu 0, r5
+    mtdbatl 0, r6
+
+    # memory barrier
+    eieio
+    isync
+
+    blr
+
diff --git a/src/link.ld b/src/link.ld
new file mode 100644
index 0000000..385a69d
--- /dev/null
+++ b/src/link.ld
@@ -0,0 +1,20 @@
+OUTPUT(payload.elf);
+
+ENTRY(_start);
+
+SECTIONS {
+	. = 0x00840000;
+	.text : {		
+		*(.text*);
+	}
+	.data : {
+		*(.rodata*);
+		*(.data*);
+		*(.bss*);
+	}
+	/DISCARD/ : {
+		*(*);
+	}
+}
+
+ASSERT((SIZEOF(.text) + SIZEOF(.data)) < 0x400000, "elf is too big");