So the lv2ldr verifys decrypts the lv2_kernal.self. we can get the address of this happening. inside Parameters Layout there are arguments, they are used as commands basically to load a function you want to use. they start in the lv2 @ 0x3E800(seems to be same for other ldrs) that address. There is a argument that is called lv2_in and lv2_out (we have know about these) basically we can use lv2_in to map out the address and lv2_out to map out the address for where the lv2ldr decryptes the self file. We can make a program like readself basically and get the offset, u8* means …

I got major homebrews to work, and now I’ll focus on reporting this to the EU and US version, which both need to be brought up to speed with these latest changes.

From what I could see, syscall estimation basically doesn’t work (which is what JJS discovered a while ago when porting HBL to 6.60), which will limit the amount of homebrews that can be played with this exploit, but as you …