diff --git a/Makefile b/Makefile
index f5b81a8e..a99ae64f 100644
--- a/Makefile
+++ b/Makefile
@@ -33,7 +33,7 @@ objects_cfw = $(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
 
 
 .PHONY: all
-all: launcher a9lh emunand emunando3ds reboot rebootntr ninjhax
+all: launcher a9lh emunand reboot ninjhax
 
 .PHONY: launcher
 launcher: $(dir_out)/$(name).dat 
@@ -42,16 +42,10 @@ launcher: $(dir_out)/$(name).dat
 a9lh: $(dir_out)/arm9loaderhax.bin
 
 .PHONY: emunand
-emunand: $(dir_out)/rei-n3ds/emunand/emunand.bin
-
-.PHONY: emunando3ds
-emunando3ds: $(dir_out)/rei-o3ds/emunand/emunand.bin
+emunand: $(dir_out)/rei/emunand/emunand.bin
 
 .PHONY: reboot
-reboot: $(dir_out)/rei-o3ds/reboot/reboot1.bin $(dir_out)/rei-o3ds/reboot/reboot2.bin
-
-.PHONY: rebootntr
-rebootntr: $(dir_out)/ntr-o3ds/reboot/reboot1.bin $(dir_out)/ntr-o3ds/reboot/reboot2.bin
+reboot: $(dir_out)/rei/reboot/reboot.bin
 
 .PHONY: ninjhax
 ninjhax: $(dir_out)/3ds/$(name)
@@ -62,11 +56,11 @@ clean:
 	@$(MAKE) $(FLAGS) -C $(dir_ninjhax) clean
 	rm -rf $(dir_out) $(dir_build)
 
-$(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei-n3ds/ $(dir_out)/rei-o3ds/
+$(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei
 	@$(MAKE) $(FLAGS) -C $(dir_mset) launcher
 	dd if=$(dir_build)/main.bin of=$@ bs=512 seek=144
 
-$(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)/rei-n3ds/ $(dir_out)/rei-o3ds/
+$(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)/rei
 	@cp -av $(dir_build)/main.bin $(dir_out)/arm9loaderhax.bin
 
 $(dir_out)/3ds/$(name):
@@ -75,36 +69,18 @@ $(dir_out)/3ds/$(name):
 	@mv $(dir_out)/$(name).3dsx $@
 	@mv $(dir_out)/$(name).smdh $@
 
-$(dir_out)/rei-n3ds/:
-	@mkdir -p "$(dir_out)/rei-n3ds"
+$(dir_out)/rei:
+	@mkdir -p "$(dir_out)/rei"
 
-$(dir_out)/rei-o3ds/:
-	@mkdir -p "$(dir_out)/rei-o3ds"
-    
-$(dir_out)/rei-n3ds/emunand/emunand.bin: $(dir_emu)/emuCode.s
+$(dir_out)/rei/emunand/emunand.bin: $(dir_emu)/emuCode.s
 	@armips $<
-	@mkdir -p "$(dir_out)/rei-n3ds/emunand"
-	@cp -av emunand.bin $(dir_out)/rei-n3ds/emunand
+	@mkdir -p "$(dir_out)/rei/emunand"
+	@mv emunand.bin $(dir_out)/rei/emunand
 
-$(dir_out)/rei-o3ds/emunand/emunand.bin: emunand.bin
-	@mkdir -p "$(dir_out)/rei-o3ds/emunand"
-	@mv emunand.bin $(dir_out)/rei-o3ds/emunand
-
-$(dir_out)/rei-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCode.s
+$(dir_out)/rei/reboot/reboot.bin: $(dir_reboot)/rebootCode.s
 	@armips $<
-	@mkdir -p "$(dir_out)/rei-o3ds/reboot"
-	@mv reboot1.bin $(dir_out)/rei-o3ds/reboot
-
-$(dir_out)/rei-o3ds/reboot/reboot2.bin: reboot2.bin
-	@cp -av reboot2.bin $(dir_out)/rei-o3ds/reboot
-
-$(dir_out)/ntr-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCodeNtr.s
-	@armips $<
-	@mkdir -p "$(dir_out)/ntr-o3ds/reboot"
-	@mv reboot1.bin $(dir_out)/ntr-o3ds/reboot
-
-$(dir_out)/ntr-o3ds/reboot/reboot2.bin: reboot2.bin
-	@mv reboot2.bin $(dir_out)/ntr-o3ds/reboot
+	@mkdir -p "$(dir_out)/rei/reboot"
+	@mv reboot.bin $(dir_out)/rei/reboot
 
 $(dir_build)/main.bin: $(dir_build)/main.elf
 	$(OC) -S -O binary $< $@
diff --git a/reboot/rebootCode.s b/reboot/rebootCode.s
index 6c339b19..b4175e05 100644
--- a/reboot/rebootCode.s
+++ b/reboot/rebootCode.s
@@ -1,148 +1,221 @@
-.arm.little
+.nds
+.create "reboot.bin", 0
 
-firm_size equ 0x000EA000
-firm_addr equ 0x24000000
-fopen equ 0x08059D10
-fread equ 0x0804CC54
-pxi_wait_recv equ 0x08054134
+byteswritten equ 0x2000E000
+externalFirm equ 0x2000A000
+kernelCode equ 0x080F0000
+buffer equ 0x24000000
+fileOpen equ 0x4E45504F ;dummy
 
-.create "reboot1.bin", 0x080849DC
-.org 0x080849DC
 .arm
-patch005:
-	ldr r0, =0x2000E000
-	mov r1, #0x200
-	mov r2, #0
-	add r1, r1, r0
-@@memset_loop:
-	str r2, [r0]
-	add r0, r0, #4
-	cmp r0, r1
-	blt @@memset_loop
-	ldr r0, =0x2000E000
-	ldr r1, =firm_fname
-	mov r2, #1
-	blx fopen
-	ldr r0, =0x2000E000
-	ldr r1, =0x2000E100
-	mov r2, #firm_addr
-	mov r3, #firm_size
-	blx fread
+//Code jumps here right after the sprintf call
+process9Reboot:
+	doPxi:
+        ldr r4, =0x44846
+		ldr r0, =0x10008000
+		readPxiLoop1:
+			ldrh r1, [r0,#4]
+			.word 0xE1B01B81	//lsls r1, r1, #0x17
+			bmi readPxiLoop1
+			ldr r0, [r0,#0xC]		
+        cmp r0, r4
+        bne doPxi
+	
+	GetFirmPath:
+		add r0, sp, #0x3A8-0x70+0x24
+		ldr r1, [r0], #4
+		ldr r2, =0x00300030
+		cmp r1, r2
+		ldreq r1, [r0], #4
+		ldreq r2, =0x002F0032
+		cmpeq r1, r2
+		
+	OpenFirm:
+		ldreq r1, =(FileName - OpenFirm - 12)
+		addeq r1, pc
+		addne r1, sp, #0x3A8-0x70
+		ldr r0, =externalFirm
+		moveq r2, #1
+		movne r2, #0
+		str r2, [r0]
+		mov r2, #1
+		add r0, r7, #8
+		ldr r6, =fileOpen
+		blx r6
+	
+    SeekFirm:
+		ldr r0, =externalFirm
+		ldr r0, [r0]
+		cmp r0, #1
+		moveq r0, r7
+        ldreq r1, =byteswritten
+        ldreq r2, =buffer
+        ldreq r3, =0x0
+		ldreq r6, [sp,#0x3A8-0x198]
+		ldreq r6, [r6,#0x28]	//fread function stored here
+		blxeq r6
+		
+	ReadFirm:
+		mov r0, r7
+        ldr r1, =byteswritten
+        ldr r2, =buffer
+        ldr r3, =0x200000
+		ldr r6, [sp,#0x3A8-0x198]
+		ldr r6, [r6,#0x28]	//fread function stored here
+		blx r6
 
-	ldr r4, =0x44846
-	blx pxi_wait_recv
-	cmp r0, r4
-	bne patch005
-	mov r2, #0
-	mov r3, r2
-	mov r1, r2
-	mov r0, r2
-	swi 0x7C
-	ldr r0, =0x80FF4FC
-	swi 0x7B
+    KernelSetState:
+        mov r2, #0
+        mov r3, r2
+        mov r1, r2
+        mov r0, r2
+        .word 0xEF00007C    //SVC 0x7C
+
+    GoToReboot:
+        ldr r0, =(KernelCodeStart - GoToReboot - 12)
+		add r0, pc
+		ldr r1, =kernelCode
+		ldr r2, =0x300
+		bl Memcpy
+		
+		ldr r0, =kernelCode
+        .word 0xEF00007B    //SVC 0x7B
+
+    InfiniteLoop:
+        b InfiniteLoop
+
+Memcpy:
+	MOV     R12, LR
+	STMFD   SP!, {R0-R4}
+	ADD     R2, R2, R0
+
+	memcpyLoop:
+		LDR     R3, [R0],#4
+		STR     R3, [R1],#4
+		CMP     R0, R2
+		BLT     memcpyLoop
+		LDMFD   SP!, {R0-R4}
+		MOV     LR, R12
+		BX      LR
+	
+FileName:
+	.dcw "sdmc:/rei/patched_firmware.bin"
+	.word 0x0
 
-@@inf_loop:
-	b @@inf_loop
-.pool
-firm_fname:
-.close
-
-.create "reboot2.bin", 0x080933CC
-.org 0x080933CC
-.arm
-	stmfd sp!, {r4-r11,lr}
-	sub sp, sp, #0x3C
-	mrc p15, 0, r0, c2, c0, 0	; dcacheable
-	mrc p15, 0, r12, c2, c0, 1	; icacheable
-	mrc p15, 0, r1, c3, c0, 0	; write bufferable
-	mrc p15, 0, r2, c5, c0, 2	; daccess
-	mrc p15, 0, r3, c5, c0, 3	; iaccess
-	ldr r4, =0x18000035			; 0x18000000 128M
-	bic r2, r2, #0xF0000		; unprotect region 4
-	bic r3, r3, #0xF0000		; unprotect region 4
-	orr r0, r0, #0x10			; dcacheable region 4
-	orr r2, r2, #0x30000		; region 4 r/w
-	orr r3, r3, #0x30000		; region 4 r/w
-	orr r12, r12, #0x10			; icacheable region 4
-	orr r1, r1, #0x10			; write bufferable region 4
-	mcr p15, 0, r0, c2, c0, 0
-	mcr p15, 0, r12, c2, c0, 1
-	mcr p15, 0, r1, c3, c0, 0	; write bufferable
-	mcr p15, 0, r2, c5, c0, 2	; daccess
-	mcr p15, 0, r3, c5, c0, 3	; iaccess
-	mcr p15, 0, r4, c6, c4, 0	; region 4 (hmmm)
-
-	mrc p15, 0, r0, c2, c0, 0	; dcacheable
-	mrc p15, 0, r1, c2, c0, 1	; icacheable
-	mrc p15, 0, r2, c3, c0, 0	; write bufferable
-	orr r0, r0, #0x20			; dcacheable region 5
-	orr r1, r1, #0x20			; icacheable region 5
-	orr r2, r2, #0x20			; write bufferable region 5
-	mcr p15, 0, r0, c2, c0, 0	; dcacheable
-	mcr p15, 0, r1, c2, c0, 1	; icacheable
-	mcr p15, 0, r2, c3, c0, 0	; write bufferable
-
-	mov r4, #firm_addr
-	add r3, r4, #0x40
-	ldr r0, [r3]				; offset
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	add r3, r4, #0x70
-	ldr r0, [r3]
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	add r3, r4, #0xA0
-	ldr r0, [r3]
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	mov r2, #0
-	mov r1, r2
-@flush_cache:
-	mov r0, #0
-	mov r3, r2, lsl#30
-@flush_cache_inner_loop:
-	orr r12, r3, r0, lsl#5
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-	mcr p15, 0, r12, c7, c14, 2	; clean and flush dcache entry (index and segment)
-	add r0, r0, #1
-	cmp r0, #0x20
-	bcc @flush_cache_inner_loop
-	add r2, r2, #1
-	cmp r2, #4
-	bcc @flush_cache
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-@mpu_enable:
-	ldr r0, =0x42078			; alt vector select, enable itcm
-	mcr p15, 0, r0, c1, c0, 0
-	mcr p15, 0, r1, c7, c5, 0	; flush dcache
-	mcr p15, 0, r1, c7, c6, 0	; flush icache
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-	mov r0, #firm_addr
-	mov r1, 0X1FFFFFFC
-	ldr r2, [r0,#8]				; arm11 entry
-	str r2, [r1]
-	ldr r0, [r0,#0xC]			; arm9 entry
-	add sp, sp, #0x3C
-	ldmfd sp!, {r4-r11,lr}
-	bx r0
-.pool
-memcpy32: ; memcpy32(void *src, void *dst, unsigned int size)
-	mov r12, lr
-	stmfd sp!, {r0-r4}
-	add r2, r2, r0
-@memcpy_loop:
-	ldr r3, [r0], #4
-	str r3, [r1], #4
-	cmp r0, r2
-	blt @memcpy_loop
-	ldmfd sp!, {r0-r4}
-	mov lr, r12
-	bx lr
 .pool
+
+// Kernel Code
+.align 4
+KernelCodeStart:
+	memorySetting:
+		MRC     p15, 0, R0,c2,c0, 0
+        MRC     p15, 0, R12,c2,c0, 1
+        MRC     p15, 0, R1,c3,c0, 0
+        MRC     p15, 0, R2,c5,c0, 2
+        MRC     p15, 0, R3,c5,c0, 3
+        LDR     R4, =0x18000035
+        BIC     R2, R2, #0xF0000
+        BIC     R3, R3, #0xF0000
+        ORR     R0, R0, #0x10
+        ORR     R2, R2, #0x30000
+        ORR     R3, R3, #0x30000
+        ORR     R12, R12, #0x10
+        ORR     R1, R1, #0x10
+        MCR     p15, 0, R0,c2,c0, 0
+        MCR     p15, 0, R12,c2,c0, 1
+        MCR     p15, 0, R1,c3,c0, 0
+        MCR     p15, 0, R2,c5,c0, 2
+        MCR     p15, 0, R3,c5,c0, 3
+        MCR     p15, 0, R4,c6,c4, 0
+        MRC     p15, 0, R0,c2,c0, 0
+        MRC     p15, 0, R1,c2,c0, 1
+        MRC     p15, 0, R2,c3,c0, 0
+        ORR     R0, R0, #0x20
+        ORR     R1, R1, #0x20
+        ORR     R2, R2, #0x20
+        MCR     p15, 0, R0,c2,c0, 0
+        MCR     p15, 0, R1,c2,c0, 1
+        MCR     p15, 0, R2,c3,c0, 0
+
+    copyFirmPartitions:
+        LDR     R4, =buffer
+        ADD     R3, R4, #0x40
+        LDR     R0, [R3]
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8] 
+		bl KernelMemcpy
+		
+        ADD     R3, R4, #0x70
+        LDR     R0, [R3]
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8]
+        bl KernelMemcpy
+			
+        ADD     R3, R4, #0xA0
+        LDR     R0, [R3]
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8]
+        bl KernelMemcpy
+			
+		ADD     R3, R4, #0xD0
+        LDR     R0, [R3]
+		CMP		R0, #0
+		BEQ		invalidateDataCache
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8]
+        bl KernelMemcpy
+		
+    invalidateDataCache:
+        MOV     R2, #0
+        MOV     R1, R2
+        loc_809460C:
+        MOV     R0, #0
+        MOV     R3, R2,LSL#30
+        loc_8094614:
+        ORR     R12, R3, R0,LSL#5
+        MCR     p15, 0, R1,c7,c10, 4
+        MCR     p15, 0, R12,c7,c14, 2
+        ADD     R0, R0, #1
+        CMP     R0, #0x20
+        BCC     loc_8094614
+        ADD     R2, R2, #1
+        CMP     R2, #4
+        BCC     loc_809460C
+
+    jumpToEntrypoint:
+        MCR     p15, 0, R1,c7,c10, 4
+        LDR     R0, =0x42078
+        MCR     p15, 0, R0,c1,c0, 0
+        MCR     p15, 0, R1,c7,c5, 0
+        MCR     p15, 0, R1,c7,c6, 0
+        MCR     p15, 0, R1,c7,c10, 4
+		LDR     R4, =buffer
+        MOV     R1, #0x1FFFFFFC
+		LDR     R2, [R4,#8]
+		STR     R2, [R1]
+		LDR     R0, [R4,#0xC]
+		BX      R0
+.pool
+
+KernelMemcpy:
+	MOV     R12, LR
+	STMFD   SP!, {R0-R4}
+	ADD     R2, R2, R0
+
+	kmemcpyLoop:
+		LDR     R3, [R0],#4
+		STR     R3, [R1],#4
+		CMP     R0, R2
+		BLT     kmemcpyLoop
+		LDMFD   SP!, {R0-R4}
+		MOV     LR, R12
+		BX      LR
+.pool
+
+KernelCodeEnd:
+
 .close
diff --git a/reboot/rebootCodeNtr.s b/reboot/rebootCodeNtr.s
deleted file mode 100644
index 3c8db3c5..00000000
--- a/reboot/rebootCodeNtr.s
+++ /dev/null
@@ -1,48 +0,0 @@
-.arm.little
-
-firm_size equ 0x000EB000
-firm_addr equ 0x24000000
-fopen equ 0x0805B180
-fread equ 0x0804D9B0
-pxi_wait_recv equ 0x08055178
-
-.create "reboot1.bin", 0x080859C8
-.org 0x080859C8
-.arm
-patch005:
-	ldr r0, =0x2000E000
-	mov r1, #0x200
-	mov r2, #0
-	add r1, r1, r0
-@@memset_loop:
-	str r2, [r0]
-	add r0, r0, #4
-	cmp r0, r1
-	blt @@memset_loop
-	ldr r0, =0x2000E000
-	ldr r1, =firm_fname
-	mov r2, #1
-	blx fopen
-	ldr r0, =0x2000E000
-	ldr r1, =0x2000E100
-	mov r2, #firm_addr
-	mov r3, #firm_size
-	blx fread
-
-	ldr r4, =0x44846
-	blx pxi_wait_recv
-	cmp r0, r4
-	bne patch005
-	mov r2, #0
-	mov r3, r2
-	mov r1, r2
-	mov r0, r2
-	swi 0x7C
-	ldr r0, =0x80FF4FC
-	swi 0x7B
-
-@@inf_loop:
-	b @@inf_loop
-.pool
-firm_fname:
-.close
diff --git a/source/crypto.h b/source/crypto.h
index 197132fe..cdbaf198 100755
--- a/source/crypto.h
+++ b/source/crypto.h
@@ -131,7 +131,6 @@ void rsa_use_keyslot(u32 keyslot);
 int rsa_verify(const void* data, u32 size, const void* sig, u32 mode);
 
 //NAND/FIRM stuff
-void getNandCTR(u8 *buf, u8 console);
 void nandFirm0(u8 *outbuf, const u32 size, u8 console);
 void arm9loader(void *armHdr, u8 mode);
 
diff --git a/source/draw.c b/source/draw.c
index 2c98511a..5666532f 100644
--- a/source/draw.c
+++ b/source/draw.c
@@ -17,7 +17,7 @@ void clearScreen(void){
 }
 
 void loadSplash(void){
-    //Check that it's a no-LCD-init boot via PDN_GPU_CNT
+    //Check if it's a no-screen-init A9LH boot via PDN_GPU_CNT
     if (*((u8*)0x10141200) == 0x1) return;
     clearScreen();
     if(fileRead(fb->top_left, "/rei/splash.bin", 0x46500) != 0) return;
diff --git a/source/draw.h b/source/draw.h
index f1306a9c..88a14c74 100644
--- a/source/draw.h
+++ b/source/draw.h
@@ -12,5 +12,4 @@ struct fb {
     u8 *bottom;
 };
 
-void clearScreen(void);
 void loadSplash(void);
\ No newline at end of file
diff --git a/source/firm.c b/source/firm.c
index 253024a6..ca274aa8 100755
--- a/source/firm.c
+++ b/source/firm.c
@@ -13,6 +13,7 @@
 
 firmHeader *firmLocation = (firmHeader *)0x24000000;
 firmSectionHeader *section;
+vu32 *arm11Entry = (vu32*)0x1FFFFFF8;
 u32 firmSize = 0;
 u8  mode = 1,
     console = 1,
@@ -20,13 +21,14 @@ u8  mode = 1,
     updatedSys = 0;
 u16 pressed;
 
-//Load firm into FCRAM
-u8 loadFirm(void){
+void setupCFW(void){
 
     //Detect the console being used
     if(PDN_MPCORE_CFG == 1) console = 0;
+
     //Get pressed buttons
     pressed = HID_PAD;
+
     //Determine if A9LH is installed via PDN_SPI_CNT and an user flag
     if((*((u8*)0x101401C0) == 0x0) || fileExists("/rei/installeda9lh")){
         a9lhSetup = 1;
@@ -34,17 +36,20 @@ u8 loadFirm(void){
         if(fileExists("/rei/updatedsysnand")) updatedSys = 1;
     }
 
-    section = firmLocation->section;
-
     /* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
        is not pressed, boot 9.0 FIRM */
     if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
+}
 
-    //If not using an A9LH setup, do so by decrypting FIRM0
+//Load firm into FCRAM
+u8 loadFirm(void){
+
+    //If not using an A9LH setup, load 9.0 FIRM from NAND
     if(!a9lhSetup && !mode){
         //Read FIRM from NAND and write to FCRAM
         firmSize = console ? 0xF2000 : 0xE9000;
         nandFirm0((u8*)firmLocation, firmSize, console);
+        //Check for correct decryption
         if(memcmp((u8*)firmLocation, "FIRM", 4) != 0) return 1;
     }
     //Load FIRM from SD
@@ -56,6 +61,10 @@ u8 loadFirm(void){
         if (!firmSize) return 1;
         fileRead((u8*)firmLocation, pathPtr, firmSize);
     }
+
+    section = firmLocation->section;
+
+    //Check that the loaded FIRM matches the console
     if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1;
 
     if(console) arm9loader((u8*)firmLocation + section[2].offset, mode);
@@ -96,6 +105,7 @@ u8 loadEmu(void){
     *pos_sdmmc = sdmmcOffset;
     *pos_offset = emuOffset;
     *pos_header = emuHeader;
+
     //Patch emuNAND code in memory for O3DS and 9.0 N3DS
     if(!console || !mode){
         u32 *pos_instr = memsearch((u32*)emuCodeOffset, "\xA6\x01\x08\x30", size, 4);
@@ -121,82 +131,69 @@ u8 patchFirm(void){
        (!updatedSys && mode && !(pressed & (BUTTON_L1 | BUTTON_R1)))){
         if (loadEmu()) return 1;
     }
-    else if(a9lhSetup){
+    else if (a9lhSetup){
         //Patch FIRM partitions writes on SysNAND to protect A9LH
         u32 writeOffset = 0;
         getFIRMWrite(firmLocation, firmSize, &writeOffset);
         memcpy((u8*)writeOffset, FIRMblock, sizeof(FIRMblock));
     }
 
+    //Disable signature checks
     u32 sigOffset = 0,
         sigOffset2 = 0;
 
-    //Disable signature checks
     getSignatures(firmLocation, firmSize, &sigOffset, &sigOffset2);
     memcpy((u8*)sigOffset, sigPat1, sizeof(sigPat1));
     memcpy((u8*)sigOffset2, sigPat2, sizeof(sigPat2));
 
-    //Apply FIRM reboot patch. Not needed on N3DS
-    if(!console && mode && pressed != SAFEMODE &&
-       fileExists("/rei/reversereboot") == (pressed & BUTTON_A)){
+    //Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
+    if(mode){
         u32 rebootOffset = 0,
-            rebootOffset2 = 0;
+            fOpenOffset = 0;
 
-        //Read reboot code from SD and write patched FIRM path in memory
-        char path[] = "/rei/reboot/reboot1.bin";
+        //Read reboot code from SD
+        char path[] = "/rei/reboot/reboot.bin";
         u32 size = fileSize(path);
         if (!size) return 1;
-        getReboot(firmLocation, firmSize, &rebootOffset, &rebootOffset2);
+        getReboot(firmLocation, firmSize, &rebootOffset);
         fileRead((u8*)rebootOffset, path, size);
-        memcpy((u8*)rebootOffset + size, L"sdmc:", 10);
-        memcpy((u8*)rebootOffset + size + 10, L"" PATCHED_FIRM_PATH, sizeof(PATCHED_FIRM_PATH) * 2);
-        path[18] = '2';
-        size = fileSize(path);
-        if (!size) return 1;
-        fileRead((u8*)rebootOffset2, path, size);
+
+        //Calculate the fOpen offset and put it in the right location
+        u32 *pos_fopen = memsearch((u32*)rebootOffset, "OPEN", size, 4);
+        getfOpen(firmLocation, firmSize, &fOpenOffset);
+        *pos_fopen = fOpenOffset;
 
         //Write patched FIRM to SD
-        if (fileWrite((u8*)firmLocation, PATCHED_FIRM_PATH, firmSize) != 0) return 1;
+        if(fileWrite((u8*)firmLocation, "/rei/patched_firmware.bin", firmSize) != 0) return 1;
     }
 
     return 0;
 }
 
+//De-initialize the screens, fixes N3DS 3D
+void __attribute__((naked)) deinitScreen(void)
+{
+    *arm11Entry = 0;
+
+    *(vu32*)0x10202A44 = 0;
+    *(vu32*)0x10202244 = 0;
+    *(vu32*)0x1020200C = 0;
+    *(vu32*)0x10202014 = 0;
+
+    while (!*arm11Entry);
+    ((void (*)())*arm11Entry)();
+}
+
 //Firmlaunchhax
 void launchFirm(void){
 
-    //Set MPU
-    __asm__ (
-        "msr cpsr_c, #0xDF\n\t"         //Set system mode, disable interrupts
-        "ldr r0, =0x10000035\n\t"       //Memory area 0x10000000-0x18000000, enabled, 128MB
-        "ldr r4, =0x18000035\n\t"       //Memory area 0x18000000-0x20000000, enabled, 128MB
-        "mcr p15, 0, r0, c6, c3, 0\n\t" //Set memory area 3 (0x10000000-0x18000000)
-        "mcr p15, 0, r4, c6, c4, 0\n\t" //Set memory area 4 (0x18000000-0x20000000)
-        "mrc p15, 0, r0, c2, c0, 0\n\t" //read data cacheable bit
-        "mrc p15, 0, r4, c2, c0, 1\n\t" //read inst cacheable bit
-        "mrc p15, 0, r1, c3, c0, 0\n\t" //read data writeable
-        "mrc p15, 0, r2, c5, c0, 2\n\t" //read data access permission
-        "mrc p15, 0, r3, c5, c0, 3\n\t" //read inst access permission
-        "orr r0, r0, #0x30\n\t"
-        "orr r4, r4, #0x30\n\t"
-        "orr r1, r1, #0x30\n\t"
-        "bic r2, r2, #0xF0000\n\t"
-        "bic r3, r3, #0xF0000\n\t"
-        "orr r2, r2, #0x30000\n\t"
-        "orr r3, r3, #0x30000\n\t"
-        "mcr p15, 0, r0, c2, c0, 0\n\t" //write data cacheable bit
-        "mcr p15, 0, r4, c2, c0, 1\n\t" //write inst cacheable bit
-        "mcr p15, 0, r1, c3, c0, 0\n\t" //write data writeable
-        "mcr p15, 0, r2, c5, c0, 2\n\t" //write data access permission
-        "mcr p15, 0, r3, c5, c0, 3\n\t" //write inst access permission
-        ::: "r0", "r1", "r2", "r3", "r4"
-    );
-    
     //Copy firm partitions to respective memory locations
     memcpy(section[0].address, (u8*)firmLocation + section[0].offset, section[0].size);
     memcpy(section[1].address, (u8*)firmLocation + section[1].offset, section[1].size);
     memcpy(section[2].address, (u8*)firmLocation + section[2].offset, section[2].size);
-    *(u32 *)0x1FFFFFF8 = (u32)firmLocation->arm11Entry;
+    *arm11Entry = (u32)deinitScreen;
+    while (*arm11Entry);
+    *arm11Entry = (u32)firmLocation->arm11Entry;
     
     //Final jump to arm9 binary
     console ? ((void (*)())0x801B01C)() : ((void (*)())firmLocation->arm9Entry)();
diff --git a/source/firm.h b/source/firm.h
index cd41a7fa..f1f3f770 100644
--- a/source/firm.h
+++ b/source/firm.h
@@ -14,10 +14,9 @@
 #define BUTTON_L1          (1 << 9)
 #define BUTTON_A           1
 #define SAFEMODE           (BUTTON_L1 | BUTTON_R1 | BUTTON_A | (1 << 6))
-#define PATCHED_FIRM_PATH  "/rei/patched_firmware.bin"
 
+void setupCFW(void);
 u8 loadFirm(void);
-u8 loadEmu(void);
 u8 patchFirm(void);
 void launchFirm(void);
 
diff --git a/source/main.c b/source/main.c
index e7409c75..d1bd5dd7 100644
--- a/source/main.c
+++ b/source/main.c
@@ -13,6 +13,7 @@
 u8 main(){
     mountSD();
     loadSplash();
+    setupCFW();
     if (loadFirm()) return 1;
     if (patchFirm()) return 1;
     launchFirm();
diff --git a/source/patches.c b/source/patches.c
index 9de28715..c3436133 100644
--- a/source/patches.c
+++ b/source/patches.c
@@ -43,13 +43,21 @@ void getSignatures(void *pos, u32 size, u32 *off, u32 *off2){
     *off2 = (u32)memsearch(pos, pattern2, size, 4) - 1;
 }
 
-void getReboot(void *pos, u32 size, u32 *off, u32 *off2){
+void getReboot(void *pos, u32 size, u32 *off){
     //Look for FIRM reboot code
-    unsigned char pattern[] = {0x8D, 0xE5, 0x00, 0xC0, 0x91};
-    unsigned char pattern2[] = {0xF0, 0x4F, 0x2D, 0xE9, 0x3C};
+    unsigned char pattern[] = {0xDE, 0x1F, 0x8D, 0xE2};
 
-    *off = (u32)memsearch(pos, pattern, size, 5) + 2;
-    *off2 = (u32)memsearch(pos, pattern2, size, 5);
+    *off = (u32)memsearch(pos, pattern, size, 4) - 0x10;
+}
+
+void getfOpen(void *pos, u32 size, u32 *off){
+    //Calculate fOpen
+    u32 p9addr = *(u32*)(memsearch(pos, "ess9", size, 4) + 0xC);
+    u32 p9off = (u32)(memsearch(pos, "code", size, 4) + 0x1FF);
+
+    unsigned char pattern[] = {0xB0, 0x04, 0x98, 0x0D};
+
+    *off = (u32)memsearch(pos, pattern, size, 4) - 2 - p9off + p9addr;
 }
 
 void getFIRMWrite(void *pos, u32 size, u32 *off){
diff --git a/source/patches.h b/source/patches.h
index 7ecc0b88..e00a34e0 100644
--- a/source/patches.h
+++ b/source/patches.h
@@ -22,7 +22,8 @@ u8 emuInstr[5];
 *                   Functions
 **************************************************/
 void getSignatures(void *pos, u32 size, u32 *off, u32 *off2);
-void getReboot(void *pos, u32 size, u32 *off, u32 *off2);
+void getReboot(void *pos, u32 size, u32 *off);
+void getfOpen(void *pos, u32 size, u32 *off);
 void getFIRMWrite(void *pos, u32 size, u32 *off);
 
 #endif
\ No newline at end of file
diff --git a/source/start.s b/source/start.s
index 6ceab5f2..23253e70 100644
--- a/source/start.s
+++ b/source/start.s
@@ -5,39 +5,49 @@ _start:
     @ Change the stack pointer
     mov sp, #0x27000000
 
+    @ Give read/write access to all the memory regions
+    ldr r5, =0x33333333
+    mcr p15, 0, r5, c5, c0, 2 @ write data access
+    mcr p15, 0, r5, c5, c0, 3 @ write instruction access
+
     @ Sets MPU permissions and cache settings
-    ldr r0, =0xFFFF001D			@ ffff0000 32k
-	ldr r1, =0x01FF801D			@ 01ff8000 32k
-	ldr r2, =0x08000027			@ 08000000 1M
-	ldr r3, =0x10000021			@ 10000000 128k
-	ldr r4, =0x10100025			@ 10100000 512k
-	ldr r5, =0x20000035			@ 20000000 128M
-	ldr r6, =0x2800801B			@ 28008000 16k
-	ldr r7, =0x1800002D			@ 18000000 8M
-	ldr r8, =0x33333336
-	ldr r9, =0x60600666
-	mov r10, #0x25
-	mov r11, #0x25
-	mov r12, #0x25
-	mcr p15, 0, r0, c6, c0, 0
-	mcr p15, 0, r1, c6, c1, 0
-	mcr p15, 0, r2, c6, c2, 0
-	mcr p15, 0, r3, c6, c3, 0
-	mcr p15, 0, r4, c6, c4, 0
-	mcr p15, 0, r5, c6, c5, 0
-	mcr p15, 0, r6, c6, c6, 0
-	mcr p15, 0, r7, c6, c7, 0
-	mcr p15, 0, r8, c5, c0, 2	@ Enable data r/w for all regions
-	mcr p15, 0, r9, c5, c0, 3	@ Enable inst read for 0, 1, 2, 5, 7
-	mcr p15, 0, r10, c3, c0, 0	@ Write bufferable 0, 2, 5
-	mcr p15, 0, r11, c2, c0, 0	@ Data cacheable 0, 2, 5
-	mcr p15, 0, r12, c2, c0, 1	@ Inst cacheable 0, 2, 5
+    ldr r0, =0xFFFF001D	@ ffff0000 32k
+    ldr r1, =0x01FF801D	@ 01ff8000 32k
+    ldr r2, =0x08000027	@ 08000000 1M
+    ldr r3, =0x10000021	@ 10000000 128k
+    ldr r4, =0x10100025	@ 10100000 512k
+    ldr r5, =0x20000035	@ 20000000 128M
+    ldr r6, =0x1FF00027	@ 1FF00000 1M
+    ldr r7, =0x1800002D	@ 18000000 8M
+    mov r10, #0x25
+    mov r11, #0x25
+    mov r12, #0x25
+    mcr p15, 0, r0, c6, c0, 0
+    mcr p15, 0, r1, c6, c1, 0
+    mcr p15, 0, r2, c6, c2, 0
+    mcr p15, 0, r3, c6, c3, 0
+    mcr p15, 0, r4, c6, c4, 0
+    mcr p15, 0, r5, c6, c5, 0
+    mcr p15, 0, r6, c6, c6, 0
+    mcr p15, 0, r7, c6, c7, 0
+    mcr p15, 0, r10, c3, c0, 0	@ Write bufferable 0, 2, 5
+    mcr p15, 0, r11, c2, c0, 0	@ Data cacheable 0, 2, 5
+    mcr p15, 0, r12, c2, c0, 1	@ Inst cacheable 0, 2, 5
 
-    @ Enables all the settings we specified above
-	ldr r0, =0x5307D
-	mcr p15, 0, r0, c1, c0, 0	@ cp15 ctl register enable mpu, enable cache and use alt vector table
+    @ Enable caches
+    mrc p15, 0, r4, c1, c0, 0  @ read control register
+    orr r4, r4, #(1<<12)       @ - instruction cache enable
+    orr r4, r4, #(1<<2)        @ - data cache enable
+    orr r4, r4, #(1<<0)        @ - mpu enable
+    mcr p15, 0, r4, c1, c0, 0  @ write control register
 
-    @ Undocumented: Fixes mounting of SDMC
+    @ Flush caches
+    mov r5, #0
+    mcr p15, 0, r5, c7, c5, 0  @ flush I-cache
+    mcr p15, 0, r5, c7, c6, 0  @ flush D-cache
+    mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
+
+    @ Fixes mounting of SDMC
 	ldr r0, =0x10000020
 	mov r1, #0x340
 	str r1, [r0]
diff --git a/source/start.s.a9lh b/source/start.s.a9lh
deleted file mode 100644
index 6633f9c7..00000000
--- a/source/start.s.a9lh
+++ /dev/null
@@ -1,34 +0,0 @@
-.section .text.start
-.align 4
-.global _start
-_start:
-    @ Change the stack pointer
-    mov sp, #0x27000000
-
-    @ Give read/write access to all the memory regions
-    ldr r5, =0x33333333
-    mcr p15, 0, r5, c5, c0, 2 @ write data access
-    mcr p15, 0, r5, c5, c0, 3 @ write instruction access
-    
-    @ Enable caches
-    mrc p15, 0, r4, c1, c0, 0  @ read control register
-    orr r4, r4, #(1<<12)       @ - instruction cache enable
-    orr r4, r4, #(1<<2)        @ - data cache enable
-    orr r4, r4, #(1<<0)        @ - mpu enable
-    mcr p15, 0, r4, c1, c0, 0  @ write control register
-    
-    @ Flush caches
-    mov r5, #0
-    mcr p15, 0, r5, c7, c5, 0  @ flush I-cache
-    mcr p15, 0, r5, c7, c6, 0  @ flush D-cache
-    mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
-
-    @ Fixes mounting of SDMC
-	ldr r0, =0x10000020
-	mov r1, #0x340
-	str r1, [r0]
-
-    bl main
-
-.die:
-    b .die
diff --git a/source/types.h b/source/types.h
index 34f32008..82fb5e46 100644
--- a/source/types.h
+++ b/source/types.h
@@ -13,6 +13,7 @@
 typedef uint8_t u8;
 typedef uint16_t u16;
 typedef uint32_t u32;
+typedef volatile u32 vu32;
 typedef uint64_t u64;
 
 //FIRM Header layout