diff --git a/Makefile b/Makefile
index f6a7f47..8fe8eed 100644
--- a/Makefile
+++ b/Makefile
@@ -2,21 +2,23 @@ CC = arm-eabi-gcc
 AS = arm-eabi-as
 LD = arm-eabi-gcc
 OBJCOPY = arm-eabi-objcopy
-CFLAGS = -mbig-endian -fomit-frame-pointer -Os -fpic -Wall -I.
+CFLAGS = -mbig-endian -fomit-frame-pointer -Os -Wall -I.
 ASFLAGS = -mbig-endian
-LDFLAGS = -nostartfiles -mbig-endian -Wl,-T,stub.ld
+LDFLAGS = -nostartfiles -mbig-endian -Wl,-T,miniios.ld -n
 
-TARGET = iosboot.bin
-ELF = iosboot.elf
+ELFLOADER = ../elfloader/elfloader.bin
+MAKEBIN = python ../makebin.py
+
+TARGET = miniios.bin
+ELF = miniios.elf
 OBJECTS = start.o main.o vsprintf.o string.o gecko.o memory.o memory_asm.o \
 	utils_asm.o utils.o ff.o diskio.o sdhc.o powerpc_elf.o powerpc.o panic.o
 
+$(TARGET) : $(ELF) $(ELFLOADER) 
+	@echo  "MAKEBIN	$@"
+	@$(MAKEBIN) $(ELFLOADER) $< $@
 
-$(TARGET) : $(ELF)
-	@echo  "OBJCPY	$@"
-	@$(OBJCOPY) -O binary $< $@
-
-$(ELF) : stub.ld $(OBJECTS)
+$(ELF) : miniios.ld $(OBJECTS)
 	@echo  "LD	$@"
 	@$(LD) $(LDFLAGS) $(OBJECTS) -o $@
 
diff --git a/gecko.c b/gecko.c
index b24b361..fe65b6b 100644
--- a/gecko.c
+++ b/gecko.c
@@ -183,7 +183,7 @@ int gecko_getchar(void)
 
 int gecko_puts(const char *s)
 {
-	udelay(10000);
+	//udelay(10000);
 	return gecko_sendbuffer(s, strlen(s));
 }
 
diff --git a/main.c b/main.c
index 5783723..df8ecfb 100644
--- a/main.c
+++ b/main.c
@@ -18,304 +18,167 @@ typedef struct {
 	u32 argument;
 } ioshdr;
 
-int dogecko = 1;
+u32 match[] = {
+	0xF7FFFFB8,
+	0xBC024708,
+	1,
+	2,
+};
 
-void boot2_loadelf(u8 *elf) {
-	if(dogecko)
-		gecko_puts("Loading boot2 ELF...\n");
-
-	if(memcmp("\x7F" "ELF\x01\x02\x01\x61\x01",elf,9)) {
-		if(dogecko)
-			gecko_printf("Invalid ELF header! 0x%02x 0x%02x 0x%02x 0x%02x\n",elf[0], elf[1], elf[2], elf[3]);
-		panic(0xE3);
+static inline void mem1_poke(u8 *dst, u8 bv)
+{
+	u32 *p = (u32*)(((u32)dst) & ~3);
+	u32 val = *p;
+	
+	switch(((u32)dst) & 3) {
+		case 0:
+			val = (val & 0x00FFFFFF) | bv << 24;
+			break;
+		case 1:
+			val = (val & 0xFF00FFFF) | bv << 16;
+			break;
+		case 2:
+			val = (val & 0xFFFF00FF) | bv << 8;
+			break;
+		case 3:
+			val = (val & 0xFFFFFF00) | bv;
+			break;
 	}
 	
+	*p = val;
+}
+
+void *memcpy_mem1(void *dst, const void *src, size_t n)
+{
+	unsigned char *p;
+	const unsigned char *q;
+
+	for (p = dst, q = src; n; n--) {
+		mem1_poke(p++, *q++);
+	}
+
+	return dst;
+}
+
+static void patch_mem(u8 *offset, u32 size, u64 titleID)
+{
+	while(size>sizeof(match)) {
+		if(!memcmp(offset, match, sizeof(match))) {
+			gecko_printf("--> Patching @ %p\n", offset+8);
+			gecko_printf("--> To TitleID %08x%08x\n", (u32)(titleID>>32), (u32)titleID);
+			memcpy_mem1(offset+8, &titleID, sizeof(u64));
+			return;
+		}
+		offset++;
+		size -= 1;
+	}
+}
+
+void boot2_patchelf(u8 *elf, u64 titleID) {
+	gecko_puts("Patching boot2 ELF...\n");
+
+	if(memcmp("\x7F" "ELF\x01\x02\x01\x61\x01",elf,9)) {
+		gecko_printf("Invalid ELF header! 0x%02x 0x%02x 0x%02x 0x%02x\n",elf[0], elf[1], elf[2], elf[3]);
+		return;
+	}
+
 	Elf32_Ehdr *ehdr = (Elf32_Ehdr*)elf;
 	if(ehdr->e_phoff == 0) {
-		if(dogecko)
-			gecko_printf("ELF has no program headers!\n");
-		panic(0xE4);
+		gecko_printf("ELF has no program headers!\n");
+		return;
 	}
 	int count = ehdr->e_phnum;
 	Elf32_Phdr *phdr = (Elf32_Phdr*)(elf + ehdr->e_phoff);
-	if(dogecko)
-		gecko_printf("PHDRS at %p\n",phdr);
+	gecko_printf("PHDRS at %p\n",phdr);
 	while(count--)
 	{
 		if(phdr->p_type != PT_LOAD) {
-			if(dogecko)
-				gecko_printf("Skipping PHDR of type %d\n",phdr->p_type);
+			gecko_printf("Skipping PHDR of type %d\n",phdr->p_type);
 		} else {
 			void *src = elf + phdr->p_offset;
-			if(dogecko)
-				gecko_printf("LOAD %p -> %p [0x%x]\n",src, phdr->p_paddr, phdr->p_filesz);
-			memcpy(phdr->p_paddr, src, phdr->p_filesz);
+			gecko_printf("PATCH %p -> %p/%p [0x%x]\n",src, phdr->p_paddr, phdr->p_vaddr, phdr->p_filesz);
+			if(phdr->p_vaddr == (void*)0x20100000) {
+				gecko_printf("-> Found ES code PHDR\n");
+				patch_mem(src, phdr->p_filesz, titleID);
+			}
 		}
 		phdr++;
 	}
-	if(dogecko)
-		gecko_puts("Done!\n");
+	gecko_puts("Done!\n");
 }
 
 #define PPC_BOOT_FILE "/system/ppcboot.elf"
 
 FATFS fatfs;
 
-void turn_stuff_on(void)
-{
-	clear32(HW_GPIO1OUT, 0x10);
-	udelay(100);
-	set32(HW_RESETS, 0x7FFFFCF);
-}
-
-void reset_audio(u8 flag)
-{
-
-	// GPIO2IN is probably mislabeled
-	if(flag)
-		clear32(HW_DIFLAGS, 0x180);
-	else
-		mask32(HW_DIFLAGS, 0x80, 0x100);
-	
-	clear32(HW_GPIO2IN, 0x80000000);
-	udelay(2);
-	clear32(HW_GPIO2IN, 0x40000000);
-	
-	if(flag) {
-		clear32(HW_GPIO2IN, 0x10000000);
-		mask32(HW_GPIO2DIR, 0x7FFFFFF, 0x4B0FFCE);
-	} else {
-		mask32(HW_GPIO2DIR, 0x7FFFFFF, 0x4640FC0);
-	}
-	udelay(10);
-	set32(HW_GPIO2IN, 0x40000000);
-	udelay(500);
-	set32(HW_GPIO2IN, 0x80000000);
-	udelay(2);
-}
-
-void boot2_init1() { //func_ffff5d08
-        u32 reg = 0xd8001c8;
-
-        if((s32) read32(reg) < 0)
-                return;
-        clear32(reg, 0x80000000);
-        udelay( 2);
-        clear32(reg, 0x40000000);
-        udelay(10);
-        set32(reg,   0x40000000);
-        udelay(50);
-        set32(reg,   0x80000000);
-        udelay( 2);
-}
-
-void boot2_init2(u32 hlywdVerHi) { //func_ffff5c40
-        u32 reg = 0xD800088;
-        write32(reg, 0xFE);
-        udelay(2);
-        clear32(0xD80001D8, 0x80000000);
-        udelay(2);
-        clear32(0xD80001D8, 0x40000000);
-        udelay(10);
-        set32(0xD80001D8, 0x40000000);
-        udelay(50);
-        set32(0xD80001DB, 0x80000000);
-        udelay(2);
-        write32(reg, 0xF6);
-        udelay(50);
-        write32(reg, 0xF4);
-        udelay(1);
-        write32(reg, 0xF0);
-        udelay(1);
-        write32(reg, 0x70);
-        udelay(1);
-        write32(reg, 0x60);
-        udelay(1);
-        write32(reg, 0x40);
-        udelay(1);
-        write32(reg, 0);
-        udelay(1);
-        write32(0xD0400B4, 0x2214);
-        if (hlywdVerHi)
-                write32(0xD0400B0, 0x20600);
-        else
-                write32(0xD0400B0, 0x20400);
-        write32(0xD0400A4, 0x26);
-        udelay(1);
-        write32(0xD0400A4, 0x2026);
-        udelay(1);
-        write32(0xD0400A4, 0x4026);
-        udelay(20);
-        write32(0xD0400CC, 0x111);
-}
-
-void setup_gpios()
-{
-        //do this later
-}
-void (*boot2_setup_audio)(u32) = (void*)0xFFFF5E29;
-void regs_setup(void)
-{
-        u8 hwood_ver, hwood_hi, hwood_lo;
-        hwood_ver = read32(0xd800214)  & 0xFF;
-        hwood_hi = hwood_ver >> 4; //R0
-        hwood_lo = hwood_ver & 0xF; //R1
-
-        write32(0xFFFF897C, read32(0xFFFF86D0));
-        set32(HW_EXICTRL, EXICTRL_ENABLE_EXI);
-        mem_protect(1, (void*)0x13420000, (void*)0x1fffffff);
-        clear32(HW_EXICTRL, 0x10);
-        if(hwood_hi == 0)
-                write32(0xd8b0010, 0);
-        write32(0xd8b0010, 0);
-        if(hwood_hi == 1 && hwood_lo == 0)
-                mask32(0xd800140, 0x0000FFF0, 1);
-        set32(0xd80018C, 0x400);
-        set32(0xd80018C, 0x800);
-
-        //double check this to see if we can fix buzzing
-	//reset_audio(0);
-        boot2_setup_audio(0);
-	boot2_init1();
-        boot2_init2(hwood_hi);
-        setup_gpios();
-
-        turn_stuff_on();
-        // what do these two pokes do? no clue. Not needed but I'm leaving them in anyway.
-        write32(0xd8001e0, 0x65244A); //?
-        write32(0xd8001e4, 0x46A024); //?
-
-        clear32(HW_GPIO1OWNER, 0x10);
-        set32(HW_GPIO1DIR, 0x10);
-        //write32(HW_ALARM,0);
-        //write32(HW_ALARM,0);
-}
-
-void load_boot2(void *base)
+void *patch_boot2(void *base, u64 titleID)
 {
 
 	ioshdr *hdr = (ioshdr*)base;
 	ioshdr *parhdr = (ioshdr*)hdr->argument;
 	u8 *elf;
 
-	gecko_puts("Loading BOOT2 for leet hax\n");
+	gecko_puts("Patching BOOT2 for leet hax\n");
 	gecko_printf("Parent BOOT2 header (@%p):\n",parhdr);
 	gecko_printf(" Header size: %08x\n", parhdr->hdrsize);
 	gecko_printf(" Loader size: %08x\n", parhdr->loadersize);
 	gecko_printf(" ELF size: %08x\n", parhdr->elfsize);
 	gecko_printf(" Argument: %08x\n", parhdr->argument);
-	
+
 	elf = (u8*) parhdr;
 	elf += parhdr->hdrsize + parhdr->loadersize;
 	gecko_printf("ELF at %p\n",elf);
+
+	boot2_patchelf(elf, titleID);
+
+	parhdr->argument = 0x42;
 	
-	boot2_loadelf(elf);
+	gecko_printf("Vector: %p\n", (void*)(((u32)parhdr) + parhdr->hdrsize));
+
+	return (void*)(((u32)parhdr) + parhdr->hdrsize);
 }
 
-void (*boot2_setup_memory)(void) = (void*)0xFFFF1EAD;
 void *_main(void *base)
 {
 	FRESULT fres;
 	int res;
-	
+
 	gecko_init();
-	printf("In bootmii arm\n");	
-	mem_setswap(1);
-	
-	write32(HW_IRQENABLE, 0);
-	
-	regs_setup();
-	//debug_output(0x50);
-	//debug_output(0x51);
-	debug_output(0xF8);
-	
-	//gecko_init();
-	
-	debug_output(0xF9);
-
 	gecko_puts("MiniIOS v0.1 loading\n");
-	
-	load_boot2(base);
-	
-	write32(0xFFFF1F60,0);	
-	
-	gecko_puts("Setting up hardware\n");
-	
-	//boot2_setup_memory();
-	//regs_setup();	
-	gecko_puts("Done hardware setup\n");
-
-	write32(0xFFFF1F60,0xF002FB74);	
-
-	gecko_printf("GPIO1OUT %08x\n",read32(HW_GPIO1OUT));
-	gecko_printf("GPIO1DIR %08x\n",read32(HW_GPIO1DIR));
-	gecko_printf("GPIO1IN  %08x\n",read32(HW_GPIO1IN));
-	gecko_printf("GPIO1OWN %08x\n",read32(HW_GPIO1OWNER));
-
-/*
-// Starlet side of GPIO1
-// Output state
-#define		HW_GPIO1OUT			(HW_REG_BASE + 0x0e0)
-// Direction (1=output)
-#define		HW_GPIO1DIR			(HW_REG_BASE + 0x0e4)
-// Input state
-#define		HW_GPIO1IN			(HW_REG_BASE + 0x0e8)
-// Interrupt level
-#define		HW_GPIO1INTLVL		(HW_REG_BASE + 0x0ec)
-// Interrupt flags (write 1 to clear)
-#define		HW_GPIO1INTFLAG		(HW_REG_BASE + 0x0f0)
-// Interrupt propagation enable (interrupts go to main interrupt 0x800)
-#define		HW_GPIO1INTENABLE	(HW_REG_BASE + 0x0f4)
-//??? seems to be a mirror of inputs at some point... power-up state?
-#define		HW_GPIO1INMIR		(HW_REG_BASE + 0x0f8)
-// Owner of each GPIO bit. If 1, GPIO1B registers assume control. If 0, GPIO1 registers assume control.
-#define		HW_GPIO1OWNER		(HW_REG_BASE + 0x0fc)
-*/
 
 	fres = f_mount(0, &fatfs);
-	
+
 	if(fres != FR_OK) {
 		gecko_printf("Error %d while trying to mount SD\n", fres);
 		panic2(0, PANIC_MOUNT);
 	}
-	
+
 	gecko_puts("Trying to boot:" PPC_BOOT_FILE "\n");
-	
+
 	write32(HW_IPC_PPCMSG, 0);
 	write32(HW_IPC_ARMMSG, 0);
 	write32(HW_IPC_PPCCTRL, IPC_CTRL_SENT|IPC_CTRL_RECV);
 	write32(HW_IPC_ARMCTRL, IPC_CTRL_SENT|IPC_CTRL_RECV);
-	
+
 	res = powerpc_load_file(PPC_BOOT_FILE);
 	if(res < 0) {
 		gecko_printf("Failed to boot PPC: %d\n", res);
 		gecko_puts("Continuing anyway\n");
 	}
 
+	u32 tidh=0, tidl;
+
 	while(1) {
-		u32 tidh, tidl;
 		if(read32(HW_IPC_ARMCTRL) & IPC_CTRL_RECV) {
-			gecko_puts("STARLET ping1\n");
 			tidh = read32(HW_IPC_PPCMSG);
-			gecko_printf("TIDH = %08x\n",tidh);
-			//load_boot2(base);
-			write32(0x135c0d20, tidh);
-			gecko_puts("TIDH written\n");
 			write32(HW_IPC_ARMCTRL, read32(HW_IPC_ARMCTRL) | IPC_CTRL_RECV);
-			gecko_puts("STARLET ping1 end\n");
 		}
 		if(read32(HW_IPC_ARMCTRL) & IPC_CTRL_SENT) {
-			gecko_puts("STARLET ping2\n");
 			tidl = read32(HW_IPC_PPCMSG);
-			gecko_printf("TIDL = %08x\n",tidl);
-			//load_boot2(base);
-			write32(0x135c0d24, tidl);
-			gecko_puts("TIDL written\n");
 			write32(HW_IPC_ARMCTRL, read32(HW_IPC_ARMCTRL) | IPC_CTRL_SENT);
-			gecko_puts("STARLET ping2 end\n");
 			break;
 		}
 	}
 
-	return (void *) 0xFFFF0000;
+	return patch_boot2(base, (((u64)tidh)<<32) | tidl);
 }
diff --git a/stub.ld b/miniios.ld
similarity index 65%
rename from stub.ld
rename to miniios.ld
index 9c85281..7e76383 100644
--- a/stub.ld
+++ b/miniios.ld
@@ -3,42 +3,22 @@ OUTPUT_ARCH(arm)
 EXTERN(_start)
 ENTRY(_start)
 
-__base_addr	=	0;
+__base_addr	=	0xffff0000;
+
+__data_addr =   0x11000000;
+
+__stack_area =  0xfffe0000;
 
 SECTIONS
 {
 	. = __base_addr;
-	.header :
-	{
-		__header = .;
-		/* Entry point (offset) */
-		LONG(__code_start);
-		/* Loader size */
-		LONG(__loader_size);
-		/* ELF size */
-		LONG(0);
-		/* Boot argument? */
-		LONG(0);
-		. = ALIGN(64);
-	}
-	
-	__code_start = .;
-	
+
 	.init :
 	{
 		*(.init)
 		. = ALIGN(4);
 	}
-	
-	.got :
-	{
-		__got_start = .;
-		*(.got.*)
-		*(.got)
-		. = ALIGN(4);
-		__got_end = . ;
-	}
-	
+
 	.text :
 	{
 		*(.text.*)
@@ -50,6 +30,8 @@ SECTIONS
 	}
 
 	__text_end = . ;
+	
+	. = __data_addr;
 
 	.rodata :
 	{
@@ -81,7 +63,7 @@ SECTIONS
 		__bss_end = . ;
 	}
 
-	. = ALIGN(64);
+	. = __stack_area;
 	.stack :
 	{
 		__stack_end = .;
@@ -94,11 +76,8 @@ SECTIONS
 	__end = .;
 	
 }
-__loader_size = __end - __code_start;
 
 PROVIDE (__stack_end = __stack_end);
 PROVIDE (__stack_addr = __stack_addr);
-PROVIDE (__got_start = __got_start);
-PROVIDE (__got_end = __got_end);
 PROVIDE (__bss_start = __bss_start);
 PROVIDE (__bss_end = __bss_end);
diff --git a/start.S b/start.S
index 9b3aed9..04fbc8c 100644
--- a/start.S
+++ b/start.S
@@ -10,19 +10,26 @@
 .globl debug_output
 .globl panic
 .globl delay
-.globl read32, write32
-.globl read16, write16
-.globl read8, write8
-.globl getcpuid
 
 .section .init
 
+_vectors:
 _start:
-	@ Get real address of _start
-	sub	r4, pc, #8
-	@ Subtract offset to get the address that we were loaded at
-	ldr	r0, =_start
-	sub	r4, r4, r0
+	ldr	pc, =v_reset
+	ldr	pc, =v_undf
+	ldr	pc, =v_swi
+	ldr	pc, =v_instr_abrt
+	ldr	pc, =v_data_abrt
+	ldr	pc, =v_reserved
+	ldr	pc, =v_irq
+	ldr	pc, =v_fiq
+
+.pool
+
+v_reset:
+	@ Get loader base from ELF loader
+	mov	r4, r0
+
 	@ Output 0x42 to the debug port
 	mov	r0, #0x42
 	bl	debug_output
@@ -30,33 +37,7 @@ _start:
 	@ Set up a stack
 	ldr	sp, =__stack_addr
 	add	sp, r4
-	
-	@ perform boot2v3 memory controller poke
-	bl memctrl_do_sub_sub_poke
 
-	@ Output 0x43 to the debug port
-	mov	r0, #0x43
-	bl	debug_output
-	
-	@ relocate the GOT entries
-	ldr	r1, =__got_start
-	add	r1, r4
-	ldr	r2, =__got_end
-	add	r2, r4
-got_loop:
-	@ check for the end
-	cmp	r1, r2
-	beq	done_got
-	@ read the GOT entry
-	ldr	r3, [r1]
-	@ add our base address
-	add	r3, r4
-	str	r3, [r1]
-	@ move on
-	add	r1, r1, #4
-	b	got_loop
-
-done_got:
 	@ clear BSS
 	ldr	r1, =__bss_start
 	add	r1, r4
@@ -73,7 +54,7 @@ bss_loop:
 	b	bss_loop
 
 done_bss:
-	mov	r0, #0x44
+	mov	r0, #0x84
 	bl	debug_output
 	@ take the plunge
 	mov	r0, r4
@@ -81,34 +62,29 @@ done_bss:
 	@ _main returned! Go to whatever address it returned...
 	mov	pc, r0
 
-memctrl_do_sub_sub_poke:
-	stmdb	sp!, {lr}
-	ldr		r0, =0x163	@ reg_address
-	mov		r1, #0x4C	@ address
-	bl		memctrl_sub_poke
-	ldr		r0, =0x163	@ read address back (flush?)
-	bl		memctrl_sub_peek
-	ldr		r0, =0x162	@ reg_data
-	mov		r1, #1		@ data
-	bl		memctrl_sub_poke
-	ldmia	sp!, {pc}
-
-memctrl_sub_poke:
-	ldr		r2, =0xD8B4000
-	strh	r0, [r2, #0x74] @ reg_address <= address
-	ldrh	r0, [r2, #0x74] @ read reg_address back
-	strh	r1, [r2, #0x76] @ reg_data <= data
-	mov		pc, lr
-
-memctrl_sub_peek:
-	ldr		r2, =0xD8B4000
-	strh	r0, [r2, #0x74] @ reg_address <= address
-	ldrh	r0, [r2, #0x74] @ read reg_address back
-	ldrh	r0, [r2, #0x76] @ data <= reg_data
-	mov		pc, lr
-
 .pool
 
+v_undf:
+	b v_undf
+
+v_swi:
+	b v_swi
+
+v_instr_abrt:
+	b v_instr_abrt
+
+v_data_abrt:
+	b v_data_abrt
+
+v_reserved:
+	b v_reserved
+
+v_irq:
+	b v_irq
+
+v_fiq:
+	b v_fiq
+
 debug_output:
 	@ load address of port
 	mov	r3, #0xd800000
@@ -147,31 +123,4 @@ delay:
 	bne	1b
 	mov	pc, lr
 
-read32:
-	ldr	r0, [r0]
-	mov	pc, lr
-
-write32:
-	str	r1,	[r0]
-	mov	pc, lr
-
-read16:
-	ldrh	r0, [r0]
-	mov	pc, lr
-
-write16:
-	strh	r1,	[r0]
-	mov	pc, lr
-
-read8:
-	ldrb	r0, [r0]
-	mov	pc, lr
-
-write8:
-	strb	r1,	[r0]
-	mov	pc, lr
-
-getcpuid:
-	mrc     p15, 0, r0, c0, c0 
-	mov pc, lr
-	
\ No newline at end of file
+.pool
diff --git a/stub.c b/stub.c
deleted file mode 100644
index e702860..0000000
--- a/stub.c
+++ /dev/null
@@ -1,327 +0,0 @@
-#include "types.h"
-#include "utils.h"
-#include "start.h"
-#include "hollywood.h"
-#include "sdhc.h"
-#include "string.h"
-#include "memory.h"
-#include "elf.h"
-#include "gecko.h"
-#include "ff.h"
-#include "lcd.h"
-
-void hexline(void *addr, int len)
-{
-	u8 *p = (u8*)addr;
-	while(len--) {
-		gecko_printf("%02x",*p++);
-	}
-}
-
-typedef struct {
-	u32 hdrsize;
-	u32 loadersize;
-	u32 elfsize;
-	u32 argument;
-} ioshdr;
-
-int dogecko;
-
-void boot2_loadelf(u8 *elf) {
-	if(dogecko)
-		gecko_puts("Loading boot2 ELF...\n");
-
-	if(memcmp("\x7F" "ELF\x01\x02\x01\x61\x01",elf,9)) {
-		if(dogecko)
-			gecko_printf("Invalid ELF header! 0x%02x 0x%02x 0x%02x 0x%02x\n",elf[0], elf[1], elf[2], elf[3]);
-		panic(0xE3);
-	}
-	
-	Elf32_Ehdr *ehdr = (Elf32_Ehdr*)elf;
-	if(ehdr->e_phoff == 0) {
-		if(dogecko)
-			gecko_printf("ELF has no program headers!\n");
-		panic(0xE4);
-	}
-	int count = ehdr->e_phnum;
-	Elf32_Phdr *phdr = (Elf32_Phdr*)(elf + ehdr->e_phoff);
-	if(dogecko)
-		gecko_printf("PHDRS at %p\n",phdr);
-	while(count--)
-	{
-		if(phdr->p_type != PT_LOAD) {
-			if(dogecko)
-				gecko_printf("Skipping PHDR of type %d\n",phdr->p_type);
-		} else {
-			void *src = elf + phdr->p_offset;
-			if(dogecko)
-				gecko_printf("LOAD %p -> %p [0x%x]\n",src, phdr->p_paddr, phdr->p_filesz);
-			memcpy(phdr->p_paddr, src, phdr->p_filesz);
-		}
-		phdr++;
-	}
-	if(dogecko)
-		gecko_puts("Done!\n");
-}
-
-#define BOOT_FILE "/system/iosboot.bin"
-
-FATFS fatfs;
-
-void turn_stuff_on(void)
-{
-	clear32(HW_GPIO1OUT, 0x10);
-	udelay(100);
-	set32(HW_RESETS, 0x7FFFFCF);
-}
-
-void reset_audio(u8 flag)
-{
-
-	// GPIO2IN is probably mislabeled
-	if(flag)
-		clear32(HW_DIFLAGS, 0x180);
-	else
-		mask32(HW_DIFLAGS, 0x80, 0x100);
-	
-	clear32(HW_GPIO2IN, 0x80000000);
-	udelay(2);
-	clear32(HW_GPIO2IN, 0x40000000);
-	
-	if(flag) {
-		clear32(HW_GPIO2IN, 0x10000000);
-		mask32(HW_GPIO2DIR, 0x7FFFFFF, 0x4B0FFCE);
-	} else {
-		mask32(HW_GPIO2DIR, 0x7FFFFFF, 0x4640FC0);
-	}
-	udelay(10);
-	set32(HW_GPIO2IN, 0x40000000);
-	udelay(500);
-	set32(HW_GPIO2IN, 0x80000000);
-	udelay(2);
-}
-
-void regs_setup(void)
-{
-	u8 hwood_ver, hwood_hi, hwood_lo;
-	hwood_ver = read32(0xd800214);
-	hwood_hi = hwood_ver >> 4; //R0
-	hwood_lo = hwood_ver & 0xF; //R1
-	
-	*(u32*)0xFFFF897C = *(u32*)0xFFFF86D0;
-	set32(HW_EXICTRL, EXICTRL_ENABLE_EXI);
-	mem_protect(1, (void*)0x13420000, (void*)0x1fffffff);
-	clear32(HW_EXICTRL, 0x10);
-	if(hwood_hi == 0)
-		write32(0xd8b0010, 0);
-	write32(0xd8b0010, 0);
-	if(hwood_hi == 1 && hwood_lo == 0)
-		mask32(0xd800140, 0x0000FFF0, 1);
-	set32(0xd80018C, 0x400);
-	set32(0xd80018C, 0x800);
-	
-	reset_audio(0);
-	//boot2_sub_FFFF5D08(0);
-	//boot2_sub_FFFF5C40(hwood_hi);
-	//boot2_sub_FFFF6AA8();
-	
-	turn_stuff_on();
-	// what do these two pokes do? no clue. Not needed but I'm leaving them in anyway.
-	write32(0xd8001e0, 0x65244A); //?
-	write32(0xd8001e4, 0x46A024); //?
-	
-	clear32(HW_GPIO1OWNER, 0x10);
-	set32(HW_GPIO1DIR, 0x10);
-	//write32(HW_ALARM,0);
-	//write32(HW_ALARM,0);
-}
-
-void hex32(u32 x) {
-	int i;
-	u8 b;
-	for(i=0;i<8;i++) {
-		b = x >> 28;
-		if(b > 9)
-			lcd_putchar(b-10+'a');
-		else
-			lcd_putchar(b+'0');
-		x <<= 4;
-	}
-}
-
-extern void *__end;
-
-void *_main(void *base)
-{
-	FRESULT fres;
-	
-	ioshdr *hdr = (ioshdr*)base;
-	ioshdr *iosboot;
-	u8 *elf;
-	
-	elf = (u8*) base;
-	elf += hdr->hdrsize + hdr->loadersize;
-	
-	dogecko = 1;
-	
-	debug_output(0xF1);
-	mem_setswap(1);
-	
-	write32(HW_IRQENABLE, 0);
-	
-	clear32(HW_GPIO1DIR, 0x80);
-	clear32(HW_GPIO1OWNER, 0x80);
-	udelay(10000);
-	if(read32(HW_GPIO1IN) & 0x80) {
-		dogecko = 0;
-		goto boot2;
-	}
-	
-	// NOTE: END DEBUG CRITICAL ZONE
-	
-	lcd_init();
-	
-	regs_setup();
-	//debug_output(0x50);
-	//debug_output(0x51);
-	debug_output(0xF8);
-	
-	gecko_init();
-	
-	debug_output(0xF9);
-
-	lcd_puts("BootMii v0.1\n");
-
-	if(dogecko) {
-		gecko_puts("Hello, world from Starlet again!\n");
-		gecko_puts("BootMii here, version 0.1\n");
-		gecko_printf("BOOT2 header (@%p):\n",hdr);
-		gecko_printf(" Header size: %08x\n", hdr->hdrsize);
-		gecko_printf(" Loader size: %08x\n", hdr->loadersize);
-		gecko_printf(" ELF size: %08x\n", hdr->elfsize);
-		gecko_printf(" Argument: %08x\n", hdr->argument);
-		
-		gecko_printf("ELF at %p\n",elf);
-		
-		gecko_puts("Trying to mount SD...\n");
-	}
-	
-	fres = f_mount(0, &fatfs);
-	
-	if(fres != FR_OK) {
-		if(dogecko)
-			gecko_printf("Error %d while trying to mount SD\n", fres);
-		debug_output(0x12);
-		debug_output(fres&0xFF);
-		goto boot2;
-	}
-	
-	//debug_output(0xF2);
-	
-	if(dogecko)
-		gecko_puts("Trying to open SD:" BOOT_FILE "\n");
-	
-	FIL fd;
-	u32 read;
-	
-	fres = f_open(&fd, BOOT_FILE, FA_READ);
-	if(fres != FR_OK) {
-		if(dogecko)
-			gecko_printf("Error %d while trying to open file\n", fres);
-		//debug_output(0x13);
-		//debug_output(fres&0xFF);
-		goto boot2;
-	}
-	
-	lcd_puts(".");
-	
-	// NOTE: END CRITICAL ZONE
-	// anything from here to boot2: shouldn't be able to cause a brick
-	
-	debug_output(0xF2);
-	
-	iosboot = (ioshdr *)ALIGN_FORWARD(((u32)&__end) + 0x100, 0x100);
-	
-	if(dogecko)
-		gecko_printf("Trying to read IOSBOOT header to %p\n", iosboot);
-	
-	fres = f_read(&fd, iosboot, sizeof(ioshdr), &read);
-	if(fres != FR_OK) {
-		if(dogecko)
-			gecko_printf("Error %d while trying to read file header\n", fres);
-		//debug_output(0x14);
-		//debug_output(fres&0xFF);
-		goto boot2;
-	}
-	if(read != sizeof(ioshdr)) {
-		if(dogecko)
-			gecko_printf("Got %d bytes, expected %d\n", read, sizeof(ioshdr));
-		//debug_output(0x24);
-		goto boot2;
-	}
-	
-	lcd_puts(".");
-	//debug_output(0xF5);
-	
-	if(dogecko) {
-		gecko_printf("IOSBOOT header (@%p):\n",iosboot);
-		gecko_printf(" Header size: %08x\n", iosboot->hdrsize);
-		gecko_printf(" Loader size: %08x\n", iosboot->loadersize);
-		gecko_printf(" ELF size: %08x\n", iosboot->elfsize);
-		gecko_printf(" Argument: %08x\n", iosboot->argument);
-	}
-	
-	u32 totalsize = iosboot->hdrsize + iosboot->loadersize + iosboot->elfsize;
-	
-	if(dogecko) {
-		gecko_printf("Total IOSBOOT size: 0x%x\n", totalsize);
-		
-		gecko_printf("Trying to read IOSBOOT to %p\n", iosboot);
-	}
-	
-	fres = f_read(&fd, iosboot+1, totalsize-sizeof(ioshdr), &read);
-	if(fres != FR_OK) {
-		if(dogecko)
-			gecko_printf("Error %d while trying to read file header\n", fres);
-		//debug_output(0x15);
-		//debug_output(fres&0xFF);
-		goto boot2;
-	}
-	if(read != (totalsize-sizeof(ioshdr))) {
-		if(dogecko)
-			gecko_printf("Got %d bytes, expected %d\n", read, (totalsize-sizeof(ioshdr)));
-		//debug_output(0x25);
-		goto boot2;
-	}
-	
-	lcd_puts(".");
-	
-	//debug_output(0xF6);
-	
-	if(dogecko) {
-		gecko_puts("IOSBOOT read\n");
-		gecko_printf("Setting argument to %p\n", base);
-	}
-	iosboot->argument = (u32)base;
-	
-	void *entry = (void*)(((u32)iosboot) + iosboot->hdrsize);
-	
-	lcd_puts(" \x7e IOSBOOT \n");
-	
-	if(dogecko)
-		gecko_printf("Launching IOSBOOT @ %p\n",entry);
-	
-	debug_output(0xF3);
-	
-	return entry;
-
-boot2:
-	debug_output(0xC8);
-	if(dogecko)
-		gecko_puts("Couldn't load from SD, falling back to boot2\n");
-	lcd_puts(" \x7e BOOT2 \n");
-	boot2_loadelf(elf);
-	debug_output(0xC9);
-	return (void *) 0xFFFF0000;
-
-}