rosalina: fix volume slider override value calculation

Below 50%, the volume slider moves the dB value twice as fast. When
linearly interpolating the value in dB (lerp in log-scale), we need to
account for that fact to match how the MCU firmware handles the actual
volume slider.

.github/ISSUE_TEMPLATE/bug-report.md

@@ -25,7 +25,7 @@ about: Use this to report bugs you encounter with Luma3DS. Make sure you upload
 
 **SysNAND version (+emu/redNAND version if applicable):**
 
-[e.g. 11.13.0-45U SysNAND, 11.13.0-45E EmuNAND]
+[e.g. 11.17.0-50U SysNAND, 11.17.0-50E EmuNAND]
 <!--You can check which version you're on in System Settings. It will be on the bottom right of the top screen.-->
 
 **Entrypoint (How/what you're using to boot Luma3DS):**
@@ -34,7 +34,7 @@ about: Use this to report bugs you encounter with Luma3DS. Make sure you upload
 
 **Luma3DS version:**
 
-[e.g. v10.2 stable or if using non-releases specify the commit like this https://github.com/LumaTeam/Luma3DS/commit/0543c208fd154e6326ea5da8cbf66ffcbdef010c]
+[e.g. v13.2.1 stable or if using non-releases specify the commit like this https://github.com/LumaTeam/Luma3DS/commit/988ec17ebfce513fc4589f7b12e0d6e3894ae542]
 
 **Luma3DS configuration/options:**
 
@@ -52,31 +52,26 @@ PIN lock: ( )
 New 3DS CPU: ( )
 <!--This option is only available on New 3DS (XL)/New 2DS XL.-->
 
+Hbmenu autoboot: ( )
+
 --
 
 Autoboot EmuNAND: ( )
 <!--This option is only available if there's at least one EmuNAND.-->
 
-Use EmuNAND FIRM if booting with R: ( )
-<!--This option is only available if there's at least one EmuNAND.-->
-
 Enable loading external FIRMs and modules: ( )
 <!--Firmware (.bin) files are not required by Luma, or NTR CFW anymore.
 -- If you're having issues with this option enabled try deleting them from the luma folder on the root of the SD card or /rw/luma on CTRNAND and disabling this option.-->
 
 Enable game patching: ( )
 
+Redirect app. syscore threads to core2: ( )
+<!--This option is only available on New 3DS (XL)/New 2DS XL.-->
+
 Show NAND or user string in System Settings: ( )
 
 Show GBA boot screen in patched AGB_FIRM: ( )
 
-Set developer UNITINFO: ( )
-
-Disable Arm11 exception handlers: ( )
-
-Enable Rosalina on SAFE_FIRM: ( )
-<!--This option is only available on New 3DS (XL)/New 2DS XL.-->
-
 --
 
 
@@ -94,7 +89,8 @@ Enable Rosalina on SAFE_FIRM: ( )
 2.
 
 
-**Dump file:**
+**Dump file (if applicable):**
-<!--If the issue leads to a crash you must uncheck the "Disable Arm11 exception handlers" option.
+<!--If the issue leads to a crash you must ensure the "Disable Arm11 exception handlers"
+-- option is not disabled in config.ini.
 -- The error message will tell you where the dump is.
 -- Zip the dmp file and drag & drop it below.-->

README.md

@@ -1,40 +1,112 @@
 # Luma3DS
 
+![GitHub Downloads (all assets, all releases)](https://img.shields.io/github/downloads/LumaTeam/Luma3DS/total)
+![License](https://img.shields.io/badge/License-GPLv3-blue.svg)
+
 *Nintendo 3DS "Custom Firmware"*
 
-## What it is
+![Boot menu screenshot](img/boot_menu_v1321.png)
-**Luma3DS** is a program patching and reimplementing significant parts of the software running on all models of the Nintendo 3DS family of consoles.
+![Rosalina menu screenshot](img/rosalina_menu_v1321.png)
 
-It aims at greatly improving the user experience and at supporting the 3DS far beyond its end-of-life. Features include:
+## Description
+**Luma3DS** patches and reimplements significant parts of the system software running on all models of the Nintendo 3DS family of consoles. It aims to greatly improve the user experience and support the 3DS far beyond its end-of-life. Features include:
 
-* First class support of 3DSX homebrew
+* **First-class support for homebrew applications**
-* An overlay menu called "Rosalina" (triggerable by <kbd>L+Down+Select</kbd> by default), allowing amongst many thing to take screenshots while in-game
+* **Rosalina**, an overlay menu (triggered by <kbd>L+Down+Select</kbd> by default), allowing things like:
-* Removal of restrictions such as the region lock
+    * Taking screenshots while in game
-* Per-game language settings, asset content path redirection (LayeredFS), game plugins...
+    * Blue light filters and other screen filters
-* A fully-fledged GDB stub allowing to debug software (homebrew and system software alike)
+    * Input redirection to play with external devices, such as controllers
+    * Using cheat codes
+    * Setting time and date accurately from the network (NTP)
+    * ... and much more!
+* **Many game modding features**, such as, but not limited to:
+    * Game plugins (in 3GX format)
+    * Per-game language overrides ("locale emulation")
+    * Asset content path redirection ("LayeredFS")
+* **Support for user-provided patches and/or full "system modules" replacements**, an essential feature for Nintendo Network replacements (amongst other projects)
+* A **fully-fledged GDB stub**, allowing homebrew developers and reverse-engineers alike to work much more efficiently
+* Ability to chainload other firmware files, including other versions of itself
 * ... and much more!
 
-Luma3DS requires a full-system persisent exploit such as [boot9strap](https://github.com/SciresM/boot9strap) to run.
+## Installation and upgrade
+Luma3DS requires [boot9strap](https://github.com/SciresM/boot9strap) to run.
 
-## Compiling
+Once boot9strap has been installed, simply download the [latest release archive](https://github.com/LumaTeam/Luma3DS/releases/latest) and extract the archive onto the root of your SD card to "install" or to upgrade Luma3DS alongside the [homebrew menu and certs bundle](https://github.com/devkitPro/3ds-hbmenu) shipped with it. Replace existing files and merge existing folders if necessary.
+
+## Basic usage
+**The main Luma3DS configuration menu** can be accessed by pressing <kbd>Select</kbd> at boot. The configuration file is stored in `/luma/config.ini` on the SD card (or `/rw/luma/config.ini` on the CTRNAND partition if Luma3DS has been launched from the CTRNAND partition, which happens when SD card is missing).
+
+**The chainloader menu** is accessed by pressing <kbd>Start</kbd> at boot, or from the configuration menu. Payloads are expected to be located in `/luma/payloads` with the `.firm` extension; if there is only one such payload, the aforementionned selection menu will be skipped. Hotkeys can be assigned to payload, for example `x_test.firm` will be chainloaded when <kbd>X</kbd> is pressed at boot.
+
+**The overlay menu, Rosalina**, has a default button combination: <kbd>L+Down+Select</kbd>. For greater flexbility, most Rosalina menu settings aren't saved automatically, hence the "Save settings" option.
+
+**GDB ports**, when enabled, are `4000-4002` for the normal ports. Use of `attach` in "extended-remote" mode, alongside `info os processes` is supported and encouraged (for reverse-engineering, also check out `monitor getmemregions`). The port for the break-on-start feature is `4003` without "extended-remote". Both devkitARM-patched GDB and IDA Pro (without "stepping support" enabled) are actively supported.
+
+We have a wiki, however it is currently very outdated.
+
+## Components
+
+Luma3DS consists of multiple components. While the code style within each component is mostly consistent, these components have been written over many years and may not reflect how maintainers would write new code in new components/projects:
+
+* **arm9**, **arm11**: baremetal main settings menu, chainloader and firmware loader. Aside from showing settings and chainloading to other homebrew firmware files on demand, it is responsible for patching the official firmware to modify `Process9` code and to inject all other custom components. This was the first component ever written for this project, in 2015
+* **k11_extension**: code extending the Arm11 `NATIVE_FIRM` kernel (`Kernel11`). It is injected by the above mentioned baremetal loader into the kernel by hooking its startup code, then hooks itself into the rest of the kernel. Its features include hooking system calls (SVCs), introducing new SVCs and hooking into interprocess communications, to bypass limitations in Nintendo's system design. This is the component that allows Rosalina to pause other processes on overlay menu entry, for example. This was written at a time when we didn't fully reverse-engineer the kernel, and originally released in 2017 alongside Rosalina. Further hooks for "game plugin" support have been merged in 2023
+* **sysmodules**: reimplementation of "system modules" (processes) of the 3DS's OS (except for Rosalina being custom), currently only initial processes loaded directly in-memory by the kernel ("kernel initial process", or KIP in short)
+    * **loader**: process that loads non-KIP processes from storage. Because this is the perfect place to patch/replace executable code, this is where all process patches are done, enabling in particular "game modding" features. This is also the sysmodule handling 3DSX homebrew loading. Introduced in 2016
+    * _**rosalina**_: the most important component of Luma3DS and custom KIP: overlay menu, GDB server, `err:f` (fatal error screen) reimplementation, and much more. Introduced in mid-2017, and has continuously undergone changes and received many external contributions ever since
+    * **pxi**: Arm11<>Arm9 communication KIP, reimplemented just for the sake of it. Introduced late 2017
+    * **sm**: service manager KIP, reimplemented to remove service access control restrictions. Introduced late 2017
+    * **pm**: process manager KIP reponsible of starting/terminating processes and instructing `loader` to load them. The reimplemention allows for break-on-start GDB feature in Rosalina, as well as lifting FS access control restrictions the proper way. Introduced in 2019
+
+## Maintainers
+
+* **[@TuxSH](https://github.com/TuxSH)**: lead developer, created and maintains most features of the project. Joined in 2016
+* **[@AuroraWright](https://github.com/AuroraWright)**: author of the project, implemented the core features (most of the baremetal boot settings menu and firmware loading code) with successful design decisions that made the project popular. Created the project in 2015, currently inactive
+* **[@PabloMK7](https://github.com/PabloMK7)**: maintainer of the plugin loader feature merged for the v13.0 release. Joined in 2023
+
+## Roadmap
+
+There are still a lot more features and consolidation planned for Luma3DS! Here is a list of what is currently in store:
+
+* Full reimplementation of `TwlBg` and `AgbBg`. This will allow much better, and more configurable, upscaling for top screen in DS and GBA games (except on Old 2DS). This is currently being developed privately in C++23 (no ETA). While this is quite a difficult endeavor as this requires rewriting the entire driver stack in semi-bare-metal (limited kernel with no IPC), this is the most critical feature for Luma3DS to have and will make driver sysmodule reimpelementation trivial
+* Reimplementation of `Process9` for `TWL_FIRM` and `AGB_FIRM` to allow for more features in DS and GBA compatibility mode (ones that require file access)
+* Eventually, a full `Kernel11` reimplementation
+
+## Known issues
+
+* **Cheat engine crashes with some applications, in particular Pokémon games**: there is a race condition in Nintendo's `Kernel11` pertaining to attaching a new `KDebugThread` to a `KThread` on thread creation, and another thread null-dereferencing `thread->debugThread`. This causes the cheat engine to crashes games that create and destroy many threads all the time (like Pokémon).
+    * For these games, having a **dedicated "game plugin"** is the only alternative until `Kernel11` is reimplemented.
+* **Applications reacting to Rosalina menu button combo**: Rosalina merely polls button input at an interval to know when to show the menu. This means that the Rosalina menu combo can sometimes be processed by the game/process that is going to be paused.
+    * You can **change the menu combo** in the "Miscellaneous options" submenu (then save it with "Save settings" in the main menu) to work around this.
+
+## Building from source
 
 To build Luma3DS, the following is needed:
 * git
-* up-to-date devkitARM and libctru
+* [makerom](https://github.com/jakcron/Project_CTR) in `$PATH`
-* [makerom](https://github.com/jakcron/Project_CTR) in PATH
 * [firmtool](https://github.com/TuxSH/firmtool) installed
+* up-to-date devkitARM and libctru:
+    * install `dkp-pacman` (or, for distributions that already provide pacman, add repositories): https://devkitpro.org/wiki/devkitPro_pacman
+    * install packages from `3ds-dev` metapackage: `sudo dkp-pacman -S 3ds-dev --needed`
+    * while libctru and Luma3DS releases are kept in sync, you may have to build libctru from source for non-release Luma3DS commits
 
-The produced `boot.firm` is meant to be copied to the root of your SD card for usage with Boot9Strap.
+While Luma3DS releases are bundled with `3ds-hbmenu`, Luma3DS actually compiles into one single file: `boot.firm`. Just copy it over to the root of your SD card ([ftpd](https://github.com/mtheall/ftpd) is the easiest way to do so), and you're done.
-
-## Setup / Usage / Features
-See https://github.com/LumaTeam/Luma3DS/wiki (needs rework)
-
-## Credits
-See https://github.com/LumaTeam/Luma3DS/wiki/Credits (needs rework)
 
 ## Licensing
 This software is licensed under the terms of the GPLv3. You can find a copy of the license in the LICENSE.txt file.
 
-Files in the GDB stub are instead triple-licensed as MIT or "GPLv2 or any later version", in which case it's specified in the file header.
+Files in the GDB stub are instead triple-licensed as MIT or "GPLv2 or any later version", in which case it's specified in the file header. PM, SM, PXI reimplementations are also licensed under MIT.
 
-By contributing to this repository, you agree to license your changes to the project's owners.
+## Credits
+
+Luma3DS would not be what it is without the contributions and constructive feedback of many. We would like to thanks in particular:
+
+* **[@devkitPro](https://github.com/devkitPro)** (especially **[@fincs](https://github.com/fincs)**, **[@WinterMute](https://github.com/WinterMute)** and **[@mtheall](https://github.com/mtheall)**) for providing quality and easy-to-use toolchains with bleeding-edge GCC, and for their continued technical advice
+* **[@Nanquitas](https://github.com/Nanquitas)** for the initial version of the game plugin loader code as well as very useful contributions to the GDB stub
+* **[@piepie62](https://github.com/piepie62)** for the current implementation of the Rosalina cheat engine, **Duckbill** for its original implementation
+* **[@panicbit](https://github.com/panicbit)** for the original implementation of screen filters in Rosalina
+* **[@jasondellaluce](https://github.com/jasondellaluce)** for LayeredFS
+* **[@LiquidFenrir](https://github.com/LiquidFenrir)** for the memory viewer inside Rosalina's "Process List"
+* **ChaN** for [FatFs](http://elm-chan.org/fsw/ff/00index_e.html)
+* Everyone who has contributed to the Luma3DS repository
+* Everyone who has assisted with troubleshooting end-users
+* Everyone who has provided constructive feedback to Luma3DS

arm11/source/main.c

@@ -195,6 +195,28 @@ static void deinitScreens(void)
     *(vu32 *)0x10202014 = 0;
 }
 
+static void zerofillN3dsAblRegisters(void)
+{
+    // It should be fine to write to these regs even on O3DS as they
+    // are RAZ/WI
+
+    // TODO: read from calibration, but null values should do just
+    // fine. From testing, LUT explicitly ignores null values, and
+    // it is probably the case of reg @ 0x54 as well.
+    *(vu32 *)0x10202250 = 0; // unknown 24-bit value, seen: 0
+    *(vu32 *)0x10202254 = 0; // unknown 24-bit value, seen: nonzero
+
+    *(vu32 *)0x10202A50 = 0; // unknown 24-bit value, seen: 0
+    *(vu32 *)0x10202A54 = 0; // unknown 24-bit value, seen: nonzero
+
+    for (u32 i = 0; i < 64; i++) {
+        // Blend colors (w/ color multiplication) for each group
+        // of 4 relative-luminance Rs
+        *(vu32 *)(0x10202300 + 4*i) = 0;
+        *(vu32 *)(0x10202B00 + 4*i) = 0;
+    }
+}
+
 void main(void)
 {
     operation = ARM11_READY;
@@ -223,6 +245,9 @@ void main(void)
             case DEINIT_SCREENS:
                 deinitScreens();
                 break;
+            case ZEROFILL_N3DS_ABL_REGISTERS:
+                zerofillN3dsAblRegisters();
+                break;
             case PREPARE_ARM11_FOR_FIRMLAUNCH:
                 memcpy((void *)0x1FFFFC00, (void *)prepareForFirmlaunch, prepareForFirmlaunchSize);
                 *(vu32 *)0x1FFFFFFC = 0;

arm11/source/types.h

@@ -60,6 +60,7 @@ typedef enum
     SWAP_FRAMEBUFFERS,
     UPDATE_BRIGHTNESS,
     DEINIT_SCREENS,
+    ZEROFILL_N3DS_ABL_REGISTERS,
     PREPARE_ARM11_FOR_FIRMLAUNCH,
     ARM11_READY,
 } Arm11Operation;

arm9/source/config.c

@@ -501,6 +501,11 @@ static int configIniHandler(void* user, const char* section, const char* name, c
             CHECK_PARSE_OPTION(parseBoolOption(&opt, value));
             cfg->topScreenFilter.invert = opt;
             return 1;
+        } else if (strcmp(name, "screen_filters_top_color_curve_adj") == 0) {
+            s64 opt;
+            CHECK_PARSE_OPTION(parseDecIntOption(&opt, value, 0, 2));
+            cfg->topScreenFilter.colorCurveCorrection = (u8)opt;
+            return 1;
         } else if (strcmp(name, "screen_filters_bot_cct") == 0) {
             s64 opt;
             CHECK_PARSE_OPTION(parseDecIntOption(&opt, value, 1000, 25100));
@@ -526,6 +531,11 @@ static int configIniHandler(void* user, const char* section, const char* name, c
             CHECK_PARSE_OPTION(parseBoolOption(&opt, value));
             cfg->bottomScreenFilter.invert = opt;
             return 1;
+        } else if (strcmp(name, "screen_filters_bot_color_curve_adj") == 0) {
+            s64 opt;
+            CHECK_PARSE_OPTION(parseDecIntOption(&opt, value, 0, 2));
+            cfg->bottomScreenFilter.colorCurveCorrection = (u8)opt;
+            return 1;
         } else {
             CHECK_PARSE_OPTION(-1);
         }
@@ -666,6 +676,7 @@ static size_t saveLumaIniConfigToStr(char *out)
         (int)cfg->ntpTzOffetMinutes,
 
         (int)cfg->topScreenFilter.cct, (int)cfg->bottomScreenFilter.cct,
+        (int)cfg->topScreenFilter.colorCurveCorrection, (int)cfg->bottomScreenFilter.colorCurveCorrection,
         topScreenFilterGammaStr, bottomScreenFilterGammaStr,
         topScreenFilterContrastStr, bottomScreenFilterContrastStr,
         topScreenFilterBrightnessStr, bottomScreenFilterBrightnessStr,
@@ -683,7 +694,7 @@ static size_t saveLumaIniConfigToStr(char *out)
     return n < 0 ? 0 : (size_t)n;
 }
 
-static char tmpIniBuffer[0x2000];
+static char tmpIniBuffer[0x2000 + 0x400]; // eyeballed. TODO use #embed
 
 static bool readLumaIniConfig(void)
 {
@@ -698,6 +709,13 @@ static bool readLumaIniConfig(void)
 static bool writeLumaIniConfig(void)
 {
     size_t n = saveLumaIniConfigToStr(tmpIniBuffer);
+
+    // FIXME: this is UB we should port snprintf sometime (as well as fix other tech debt)
+    if (n + 1 >= sizeof(tmpIniBuffer)) {
+        error("Configuration data buffer overflow, please report this issue");
+        __builtin_unreachable();
+    }
+
     return n != 0 && fileWrite(tmpIniBuffer, "config.ini", n);
 }
 

arm9/source/config.h

@@ -36,7 +36,7 @@
 
 #define CONFIG_FILE         "config.ini"
 #define CONFIG_VERSIONMAJOR 3
-#define CONFIG_VERSIONMINOR 12
+#define CONFIG_VERSIONMINOR 13
 
 #define BOOTCFG_NAND         BOOTCONFIG(0, 1)
 #define BOOTCFG_EMUINDEX     BOOTCONFIG(1, 3)

arm9/source/deliver_arg.c

@@ -29,6 +29,8 @@
 #include "memory.h"
 #include "config.h"
 #include "fs.h"
+#include "i2c.h"
+#include "screen.h"
 
 u8 *loadDeliverArg(void)
 {
@@ -70,7 +72,7 @@ u8 *loadDeliverArg(void)
                 bool hasMagic = memcmp(tlnc, "TLNC", 4) == 0;
                 u8 crcLen = tlnc[5];
                 u16 crc = *(u16 *)(tlnc + 6);
-                if (!hasMagic || crcLen <= 248 || crc != crc16(tlnc + 8, crcLen, 0xFFFF))
+                if (!hasMagic || (8 + crcLen) > 0x100 || crc != crc16(tlnc + 8, crcLen, 0xFFFF))
                     memset(tlnc, 0, 0x100);
 
                 memset(deliverArg + 0x400, 0, 0xC00);
@@ -140,6 +142,8 @@ static bool configureHomebrewAutobootCtr(u8 *deliverArg)
         return false;
 
     u8 memtype = configData.autobootCtrAppmemtype;
+    // autobootCtrAppmemtype already checked, but it doesn't hurt to check again
+    memtype = memtype >= 5 ? 0 : memtype;
     deliverArg[0x400] = ISN3DS ? appmemtypesN3ds[memtype] : appmemtypesO3ds[memtype];
 
     // Determine whether to load from the SD card or from NAND. We don't support gamecards for this
@@ -151,6 +155,26 @@ static bool configureHomebrewAutobootCtr(u8 *deliverArg)
     // Tell NS to run the title, and that it's not a title jump from legacy mode
     *(u32 *)(deliverArg + 0x460) = (0 << 1) | (1 << 0);
 
+    // Whenever power button is held long enough ("force shutdown"), mcu sysmodule
+    // stores a flag in free reg 0. It will clear it next boot.
+
+    // During that next boot, if that flag was set and if CFG_BOOTENV.bit0 is set
+    // (warmboot/firm chainload, i.e. not coldbooting), then main() will simulate
+    // a "power button held" interrupt (after upgrading mcu fw if necessary -- it
+    // will reboot console after if it has upgraded mcu fw, I guess that's one of
+    // the reasons the flag is there). This obviously cause other processes to initiate
+    // a shutdown, and it also sets that flag again.
+
+    // In the case of autoboot, ns will panic when this happens. This caused
+    // hb autoboot to keep failing over and over again.
+
+    // Select free reg 0, read it, select it again, write it (clearing force shutdown flag)
+    I2C_writeReg(I2C_DEV_MCU, 0x60, 0);
+    u8 flags = I2C_readReg(I2C_DEV_MCU, 0x61);
+    flags &= ~4;
+    I2C_writeReg(I2C_DEV_MCU, 0x60, 0);
+    I2C_writeReg(I2C_DEV_MCU, 0x61, flags);
+
     CFG_BOOTENV = 1;
 
     return true;
@@ -177,6 +201,29 @@ static bool configureHomebrewAutobootTwl(u8 *deliverArg)
 
     *(u16 *)(tlnc + 6) = crc16(tlnc + 8, 0x18, 0xFFFF);
 
+    // Even though (when running TWL/AGB FIRM) the SoC is in O3DS mode, and the GPU also is,
+    // as well as most other components behaving as such (external RAM, L2C not usable, etc.),
+    // this is NOT the case for the LCD and adaptive backlight logic which retains FULL N3DS
+    // functionality, including a feature where the window is blended with a given color depending
+    // on the overall relative luminance of that window.
+
+    // However, Nintendo's own code mistakenly assumes the opposite, and clearly so ("if GPU in N3DS mode"
+    // checks, not passing N3DS extra adaptive backlight (ABL) to TWL/AGB_FIRM). This has implications:
+
+    // - Powersaving (ABL) settings in TWL/AGB_FIRM is inconsistent with *both* O3DS (because the new RGB blend LUT
+    // has been set to its current value by NATIVE_FIRM) and N3DS (because "pwn_cnt" and "inertia" are missing
+    // their N3DS-only bits)
+    // - "rave party" when booting into TWL/AGB_FIRM or O3DS NATIVE_FIRM without these regs (well, the LUT) initialized.
+    // Easiest way to do so is by leveraging the "DSi autooboot" feature Luma provides. It is worth noting at least
+    // the LUT survives hardware reboots (if Nintendo were using DSi software that was using TLNC-based reboots,
+    // they wouldn't have noticed).
+
+    // As such, zerofill these registers (from testing, hardware explicitly discards null values, so this
+    // should be fine). For now, only touch the Luma-initiated autoboot path
+
+    if (ISN3DS)
+        zerofillN3dsAblRegisters();
+
     CFG_BOOTENV = 3;
 
     return true;

arm9/source/emunand.c

@@ -111,6 +111,23 @@ void locateEmuNand(FirmwareSource *nandType, u32 *emunandIndex, bool configureCt
     else *nandType = FIRMWARE_SYSNAND;
 }
 
+static inline u32 getProtoSdmmc(u32 *sdmmc, u32 firmVersion)
+{
+    switch(firmVersion)
+    {
+        case 243: // SDK 0.9.x (0.9.7?)
+            *sdmmc = (0x080AAA28 + 0x4e0);
+            break;
+        case 238: // SDK 0.10
+            *sdmmc = (0x080BEA70 + 0x690);
+            break;
+        default:
+            return 1;
+    }
+
+    return 0;
+}
+
 static inline u32 getOldSdmmc(u32 *sdmmc, u32 firmVersion)
 {
     switch(firmVersion)
@@ -166,6 +183,111 @@ static inline u32 patchNandRw(u8 *pos, u32 size, u32 hookAddr)
     return 0;
 }
 
+static inline u32 patchProtoNandRw(u8 *pos, u32 size, u32 hookAddr, u32 hookCidAddr)
+{
+    //Look for read/write code
+    static const u8 pattern[] = {
+        0x03, 0x00, 0x51, 0xE3, // cmp r1, #3
+        0x02, 0xC0, 0xA0, 0xE1, // mov r12, r2
+        0x04, 0x00, 0x80, 0xE2, // add r0, r0, #4
+    };
+
+    u32 *writeOffset = (u32 *)memsearch(pos, pattern, size, sizeof(pattern));
+
+    if(writeOffset == NULL) return 1;
+
+    u32 *readOffset = (u32 *)memsearch((u8 *)(writeOffset + 3), pattern, 0x400, sizeof(pattern));
+
+    if(readOffset == NULL) return 1;
+
+    // Find the sdmmc mount/init(?) function
+    static const u8 mount_pattern[] = {
+        0x20, 0x00, 0x84, 0xE2, // add r0, r4, 0x20
+        0x01, 0x20, 0xA0, 0xE3, // mov r2, #1
+        0x00, 0x10, 0xA0, 0xE3, // mov r1, #0
+    };
+    u32* mountOffset = (u32*) memsearch(pos, mount_pattern, size, sizeof(mount_pattern));
+    if (mountOffset == NULL) return 1;
+
+    // Find the sdmmc read cid function.
+    static const u8 readcid_pattern[] = {
+        0x31, 0xFF, 0x2F, 0xE1, // blx r1
+        0x20, 0x60, 0x9F, 0xE5, // ldr r6, [pc, #0x20] // =failing_result
+        0x00, 0x00, 0x50, 0xE3, // cmp r0, #0
+    };
+    u32* readCidOffset = (u32*) memsearch(pos, readcid_pattern, size, sizeof(readcid_pattern));
+    if (readCidOffset == NULL) return 1;
+    readCidOffset -= 5;
+
+    mountOffset[1] = 0xe3a02000; // mov r2, #0 // sd-card
+
+    readOffset[0] = writeOffset[0] = 0xe52de004; // push {lr}
+    readOffset[1] = writeOffset[1] = 0xe59fc000; // ldr r12, [pc, #0]
+    readOffset[2] = writeOffset[2] = 0xe12fff3c; // blx r12
+    readOffset[3] = writeOffset[3] = hookAddr;
+
+    readCidOffset[0] = 0xe59fc000; // ldr r12, [pc, #0]
+    readCidOffset[1] = 0xe12fff3c; // blx r12
+    readCidOffset[2] = hookCidAddr;
+
+    // Read the emmc cid into the place hook will copy it from
+    sdmmc_get_cid(1, emunandPatchNandCid);
+
+    return 0;
+}
+
+static inline u32 patchProtoNandRw238(u8 *pos, u32 size, u32 hookAddr, u32 hookCidAddr)
+{
+    //Look for read/write code
+    static const u8 pattern[] = {
+        0x03, 0x00, 0x50, 0xE3, // cmp r0, #3
+        0x00, 0x00, 0xA0, 0x13, // movne r0, #0
+        0x01, 0x00, 0xA0, 0x03, // moveq r0, #1
+    };
+
+    u32 *writeOffset = (u32 *)memsearch(pos, pattern, size, sizeof(pattern));
+
+    if(writeOffset == NULL) return 1;
+
+    u32 *readOffset = (u32 *)memsearch((u8 *)(writeOffset + 3), pattern, 0x400, sizeof(pattern));
+
+    if(readOffset == NULL) return 1;
+
+    // Find the mmc static ctor...
+    static const u8 mount_pattern[] = {
+        0x08, // last byte of some ptr to something in P9
+        0x01, 0x01, 0x00, 0x00, // emmc controller id
+    };
+    u8* mountOffset = (u8*) memsearch(pos, mount_pattern, size, sizeof(mount_pattern));
+    if (mountOffset == NULL) return 1;
+    mountOffset++;
+
+    // Find the sdmmc read cid function.
+    static const u8 readcid_pattern[] = {
+        0x31, 0xFF, 0x2F, 0xE1, // blx r1
+        0x20, 0x60, 0x9F, 0xE5, // ldr r6, [pc, #0x20] // =failing_result
+        0x00, 0x00, 0x50, 0xE3, // cmp r0, #0
+    };
+    u32* readCidOffset = (u32*) memsearch(pos, readcid_pattern, size, sizeof(readcid_pattern));
+    if (readCidOffset == NULL) return 1;
+    readCidOffset -= 5;
+
+    *(u32*)mountOffset = 0x300; // sd card
+
+    readOffset[0] = writeOffset[0] = 0xe59fc000; // ldr r12, [pc, #0]
+    readOffset[1] = writeOffset[1] = 0xe12fff3c; // blx r12
+    readOffset[2] = writeOffset[2] = hookAddr;
+
+    readCidOffset[0] = 0xe59fc000; // ldr r12, [pc, #0]
+    readCidOffset[1] = 0xe12fff3c; // blx r12
+    readCidOffset[2] = hookCidAddr;
+
+    // Read the emmc cid into the place hook will copy it from
+    sdmmc_get_cid(1, emunandPatchNandCid);
+
+    return 0;
+}
+
 u32 patchEmuNand(u8 *process9Offset, u32 process9Size, u32 firmVersion)
 {
     u32 ret = 0;
@@ -184,3 +306,33 @@ u32 patchEmuNand(u8 *process9Offset, u32 process9Size, u32 firmVersion)
 
     return ret;
 }
+
+u32 patchProtoEmuNand(u8 *process9Offset, u32 process9Size)
+{
+    extern u32 firmProtoVersion;
+    u32 ret = 0;
+
+    // Add the data of the found EmuNAND
+    emunandPatchNandOffset = emuOffset;
+    emunandPatchNcsdHeaderOffset = emuHeader;
+
+    // Find and add the SDMMC struct
+    u32 sdmmc;
+    ret += getProtoSdmmc(&sdmmc, firmProtoVersion);
+    if(!ret) emunandPatchSdmmcStructPtr = sdmmc;
+
+    // Add EmuNAND hooks
+    switch (firmProtoVersion) {
+        case 243: // SDK 0.9.x (0.9.7?)
+            ret += patchProtoNandRw(process9Offset, process9Size, (u32)emunandProtoPatch, (u32)emunandProtoCidPatch);
+            break;
+        case 238: // SDK 0.10.x
+            ret += patchProtoNandRw238(process9Offset, process9Size, (u32)emunandProtoPatch238, (u32)emunandProtoCidPatch);
+            break;
+        default:
+            ret++;
+            break;
+    }
+
+    return ret;
+}

arm9/source/emunand.h

@@ -39,3 +39,4 @@ extern u32 emuOffset,
 
 void locateEmuNand(FirmwareSource *nandType, u32 *emunandIndex, bool configureCtrNandParams);
 u32 patchEmuNand(u8 *process9Offset, u32 process9Size, u32 firmVersion);
+u32 patchProtoEmuNand(u8 *process9Offset, u32 process9Size);

arm9/source/emunand_patch.s

@@ -45,19 +45,150 @@ emunandPatch:
 
 .pool
 
+_emunandPatchEnd:
+
+.global emunandProtoPatch
+emunandProtoPatch:
+    @ Save registers
+    push {r0-r3}
+
+    @ If we're already trying to access the SD, return
+    ldr r2, [r0, #4]
+    ldr r1, emunandPatchSdmmcStructPtr
+    cmp r2, r1
+    beq _out
+
+    ldrb r2, [r1, #0xc] @ Get sdmc->m_isInitialised
+    cmp r2, #0 @ Is initialised?
+    beq _pastSdmc @ if not, use "NAND" object, patched elsewhere to access SD
+    str r1, [r0, #4] @ Set object to be SD
+    _pastSdmc:
+    ldr r2, [r0, #8] @ Get sector to read
+    cmp r2, #0 @ For GW compatibility, see if we're trying to read the ncsd header (sector 0)
+
+    ldr r3, emunandPatchNandOffset
+    add r2, r3 @ Add the offset to the NAND in the SD
+
+    ldreq r3, emunandPatchNcsdHeaderOffset
+    addeq r2, r3 @ If we're reading the ncsd header, add the offset of that sector
+
+    str r2, [r0, #8] @ Store sector to read
+
+    _out:
+        @ Restore registers
+        pop {r0-r3}
+        @ Execute original code that got patched.
+        cmp r1, #3
+        mov r12, r2
+        add r0, r0, #4
+        movne r1, #0
+        moveq r1, #1
+        @ r2 about to be overwritten, so it's free to use here.
+        @ Save off our return address and restore lr.
+        mov r2, lr
+        pop {lr}
+        @ r2+0 is return address (patched movne r1, #0)
+        @ r2+4 is moveq r1, #1
+        @ r2+8 is the following instruction (mov r2, r3)
+        add r2, #8
+        bx r2
+
+.global emunandProtoCidPatch
+emunandProtoCidPatch:
+    @ If we're already trying to access the SD, return
+    ldr r4, emunandPatchSdmmcStructPtr
+    cmp r0, r4
+    beq _cid_return
+    
+    @ Trying to access nand, so copy the NAND cid into r1
+    adr r4, emunandPatchNandCid
+    ldr r2, [r4, #0]
+    ldr r3, [r4, #4]
+    ldr r5, [r4, #8]
+    ldr r6, [r4, #0xc]
+    str r2, [r1, #0]
+    str r3, [r1, #4]
+    str r5, [r1, #8]
+    str r6, [r1, #0xc]
+    @ And return from whence we came
+    mov r0, #0
+    pop {r4-r6, pc}
+    
+    _cid_return:
+        @ Execute original code that got patched.
+        mov r4, r0
+        ldr r0, [r0]
+        mov r5, r1
+        @ lr+0 is return address (patched mov r5, r1)
+        @ lr+4 is following instruction (ldr r1, [r0,#8])
+        add lr, #4
+        bx lr
+
+.global emunandProtoPatch238
+emunandProtoPatch238:
+    @ Save registers
+    push {r0-r3}
+
+    @ If we're already trying to access the SD, return
+    ldr r2, [r4, #4]
+    ldr r1, emunandPatchSdmmcStructPtr
+    cmp r2, r1
+    beq _out238
+
+    ldr r2, [r1, #0x24] @ Get sdmc->m_someObjInitedLater
+    cmp r2, #0 @ Is initialised?
+    beq _pastSdmc238 @ if not, use "NAND" object, patched elsewhere to access SD
+    str r1, [r4, #4] @ Set object to be SD
+    _pastSdmc238:
+
+    ldr r2, [r4, #8] @ Get sector to read
+    cmp r2, #0 @ For GW compatibility, see if we're trying to read the ncsd header (sector 0)
+
+    ldr r3, emunandPatchNandOffset
+    add r2, r3 @ Add the offset to the NAND in the SD
+
+    ldreq r3, emunandPatchNcsdHeaderOffset
+    addeq r2, r3 @ If we're reading the ncsd header, add the offset of that sector
+
+    str r2, [r4, #8] @ Store sector to read
+
+    _out238:
+        @ Restore registers
+        pop {r0-r3}
+        @ Execute original code that got patched.
+        cmp r0, #3
+        movne r0, #0
+        moveq r0, #1
+        @ r1 about to be overwritten, so it's free to use here.
+        @ Save off our return address.
+        mov r1, lr
+        @ r1+0 is return address (patched moveq r1, #1)
+        @ r1+4 is tst r0, #0xff or sub sp, sp, #0xc
+        add r1, #4
+        bx r1
+
+.pool
+
 .global emunandPatchSdmmcStructPtr
 .global emunandPatchNandOffset
 .global emunandPatchNcsdHeaderOffset
+.global emunandPatchNandCid
 
+_emunandPatchBssStart:
 emunandPatchSdmmcStructPtr:     .word   0 @ Pointer to sdmmc struct
 emunandPatchNandOffset:         .word   0 @ For rednand this should be 1
 emunandPatchNcsdHeaderOffset:   .word   0 @ Depends on nand manufacturer + emunand type (GW/RED)
+emunandPatchNandCid:                      @ Store emmc cid here, to override "sdmc's" when trying to read emmc's
+    .word 0,0,0,0 
+_emunandPatchBssEnd:
 
 .pool
 .balign 4
 
-_emunandPatchEnd:
-
 .global emunandPatchSize
 emunandPatchSize:
     .word _emunandPatchEnd - emunandPatch
+
+.global emunandPatchBssSize
+emunandPatchBssSize:
+    .word _emunandPatchBssEnd - _emunandPatchBssStart

arm9/source/firm.c

@@ -39,6 +39,7 @@
 #include "chainloader.h"
 
 static Firm *firm = (Firm *)0x20001000;
+u32 firmProtoVersion = 0;
 
 static __attribute__((noinline)) bool overlaps(u32 as, u32 ae, u32 bs, u32 be)
 {
@@ -154,7 +155,21 @@ u32 loadNintendoFirm(FirmwareType *firmType, FirmwareSource nandType, bool loadF
     u32 firmVersion = 0xFFFFFFFF,
         firmSize;
 
-    bool ctrNandError = isSdMode && !remountCtrNandPartition(false);
+    bool ctrNandError = true;
+    bool loadedFromStorage = false;
+    bool storageLoadError = false;
+
+    // Try loading FIRM from sdmc first if specified.
+    if (loadFromStorage) {
+        firmSize = loadFirmFromStorage(*firmType);
+        if (firmSize != 0) loadedFromStorage = true;
+        else storageLoadError = true;
+    }
+
+    // Remount ctrnand and load FIRM from it if loading from sdmc failed.
+    if (!loadedFromStorage) {
+        ctrNandError = isSdMode && !remountCtrNandPartition(false);
+    }
 
     if(!ctrNandError)
     {
@@ -169,10 +184,8 @@ u32 loadNintendoFirm(FirmwareType *firmType, FirmwareSource nandType, bool loadF
             if(!firmSize || !checkFirm(firmSize)) ctrNandError = true;
         }
     }
-
+    // If CTRNAND load failed, and it wasn't tried yet, load FIRM from sdmc.
-    bool loadedFromStorage = false;
+    if (ctrNandError && !storageLoadError)
-
-    if(loadFromStorage || ctrNandError)
     {
         u32 result = loadFirmFromStorage(*firmType);
 
@@ -181,11 +194,69 @@ u32 loadNintendoFirm(FirmwareType *firmType, FirmwareSource nandType, bool loadF
             loadedFromStorage = true;
             firmSize = result;
         }
-        else if(ctrNandError) error("Unable to mount CTRNAND or load the CTRNAND FIRM.\nPlease use an external one.");
+        else storageLoadError = true;
     }
+    // If all attempts failed, panic.
+    if(ctrNandError && storageLoadError) error("Unable to mount CTRNAND or load the CTRNAND FIRM.\nPlease use an external one.");
 
     //Check that the FIRM is right for the console from the Arm9 section address
-    if((firm->section[3].offset != 0 ? firm->section[3].address : firm->section[2].address) != (ISN3DS ? (u8 *)0x8006000 : (u8 *)0x8006800))
+    bool isO3dsFirm = firm->section[3].offset == 0 && firm->section[2].address == (u8 *)0x8006800;
+
+    if(loadedFromStorage || ISDEVUNIT)
+    {
+        firmVersion = 0xFFFFFFFF;
+
+        if(isO3dsFirm && (*firmType == NATIVE_FIRM || *firmType == NATIVE_FIRM1X2X))
+        {
+            __attribute__((aligned(4))) static const u8 hashes[5][0x20] = {
+                {0xD7, 0x43, 0x0F, 0x27, 0x8D, 0xC9, 0x3F, 0x4C, 0x96, 0xB5, 0xA8, 0x91, 0x48, 0xDB, 0x08, 0x8A,
+                 0x7E, 0x46, 0xB3, 0x95, 0x65, 0xA2, 0x05, 0xF1, 0xF2, 0x41, 0x21, 0xF1, 0x0C, 0x59, 0x6A, 0x9D},
+                {0x93, 0xDF, 0x49, 0xA1, 0x24, 0x86, 0xBB, 0x6F, 0xAF, 0x49, 0x99, 0x2D, 0xD0, 0x8D, 0xB1, 0x88,
+                 0x8A, 0x00, 0xB6, 0xDD, 0x36, 0x89, 0xC0, 0xE2, 0xC9, 0xA9, 0x99, 0x62, 0x57, 0x5E, 0x6C, 0x23},
+                {0x39, 0x75, 0xB5, 0x28, 0x24, 0x5E, 0x8B, 0x56, 0xBC, 0x83, 0x79, 0x41, 0x09, 0x2C, 0x42, 0xE6,
+                 0x26, 0xB6, 0x80, 0x59, 0xA5, 0x56, 0xF9, 0xF9, 0x6E, 0xF3, 0x63, 0x05, 0x58, 0xDF, 0x35, 0xEF},
+                {0x81, 0x9E, 0x71, 0x58, 0xE5, 0x44, 0x73, 0xF7, 0x48, 0x78, 0x7C, 0xEF, 0x5E, 0x30, 0xE2, 0x28,
+                 0x78, 0x0B, 0x21, 0x23, 0x94, 0x63, 0xE8, 0x4E, 0x06, 0xBB, 0xD6, 0x8D, 0xA0, 0x99, 0xAE, 0x98},
+                {0x1D, 0xD5, 0xB0, 0xC2, 0xD9, 0x4A, 0x4A, 0xF3, 0x23, 0xDD, 0x2F, 0x65, 0x21, 0x95, 0x9B, 0x7E,
+                 0xF2, 0x71, 0x7E, 0xB6, 0x7A, 0x3A, 0x74, 0x78, 0x0D, 0xE3, 0xB5, 0x0C, 0x2B, 0x7F, 0x85, 0x37},
+            };
+
+            u32 i;
+            for(i = 0; i < sizeof(hashes)/sizeof(hashes[0]); i++)
+            {
+                if(memcmp(firm->section[1].hash, hashes[i], 0x20) == 0) break;
+            }
+
+            switch(i)
+            {
+                // Beta
+                case 0:
+                    firmVersion = 0x0;
+                    firmProtoVersion = 243;
+                    *firmType = NATIVE_PROTOTYPE;
+                    break;
+                case 1:
+                    firmVersion = 0x0;
+                    firmProtoVersion = 238;
+                    *firmType = NATIVE_PROTOTYPE;
+                    break;
+                // Release
+                case 2:
+                    firmVersion = 0x18;
+                    break;
+                case 3:
+                    firmVersion = 0x1D;
+                    break;
+                case 4:
+                    firmVersion = 0x1F;
+                    break;
+                default:
+                    break;
+            }
+        }
+    }
+
+    if(*firmType != NATIVE_PROTOTYPE && (firm->section[3].offset != 0 ? firm->section[3].address : firm->section[2].address) != (ISN3DS ? (u8 *)0x8006000 : (u8 *)0x8006800))
         error("The %s FIRM is not for this console.", loadedFromStorage ? "external" : "CTRNAND");
 
     if(!ISN3DS && *firmType == NATIVE_FIRM && firm->section[0].address == (u8 *)0x1FF80000)
@@ -199,41 +270,6 @@ u32 loadNintendoFirm(FirmwareType *firmType, FirmwareSource nandType, bool loadF
         *firmType = NATIVE_FIRM1X2X;
     }
 
-    if(loadedFromStorage || ISDEVUNIT)
-    {
-        firmVersion = 0xFFFFFFFF;
-
-        if(!ISN3DS && *firmType == NATIVE_FIRM)
-        {
-            __attribute__((aligned(4))) static const u8 hashes[3][0x20] = {
-                {0x39, 0x75, 0xB5, 0x28, 0x24, 0x5E, 0x8B, 0x56, 0xBC, 0x83, 0x79, 0x41, 0x09, 0x2C, 0x42, 0xE6,
-                 0x26, 0xB6, 0x80, 0x59, 0xA5, 0x56, 0xF9, 0xF9, 0x6E, 0xF3, 0x63, 0x05, 0x58, 0xDF, 0x35, 0xEF},
-                {0x81, 0x9E, 0x71, 0x58, 0xE5, 0x44, 0x73, 0xF7, 0x48, 0x78, 0x7C, 0xEF, 0x5E, 0x30, 0xE2, 0x28,
-                 0x78, 0x0B, 0x21, 0x23, 0x94, 0x63, 0xE8, 0x4E, 0x06, 0xBB, 0xD6, 0x8D, 0xA0, 0x99, 0xAE, 0x98},
-                {0x1D, 0xD5, 0xB0, 0xC2, 0xD9, 0x4A, 0x4A, 0xF3, 0x23, 0xDD, 0x2F, 0x65, 0x21, 0x95, 0x9B, 0x7E,
-                 0xF2, 0x71, 0x7E, 0xB6, 0x7A, 0x3A, 0x74, 0x78, 0x0D, 0xE3, 0xB5, 0x0C, 0x2B, 0x7F, 0x85, 0x37}
-            };
-
-            u32 i;
-            for(i = 0; i < 3; i++) if(memcmp(firm->section[1].hash, hashes[i], 0x20) == 0) break;
-
-            switch(i)
-            {
-                case 0:
-                    firmVersion = 0x18;
-                    break;
-                case 1:
-                    firmVersion = 0x1D;
-                    break;
-                case 2:
-                    firmVersion = 0x1F;
-                    break;
-                default:
-                    break;
-            }
-        }
-    }
-
     return firmVersion;
 }
 
@@ -645,6 +681,11 @@ u32 patchAgbFirm(bool loadFromStorage, bool doUnitinfoPatch)
 {
     u8 *arm9Section = (u8 *)firm + firm->section[3].offset;
 
+    u8 *section1 = (u8 *)firm + firm->section[1].offset;
+    u32 section1Size = firm->section[1].size;
+    u8 *section2 = (u8 *)firm + firm->section[2].offset;
+    u32 section2Size = firm->section[2].size;
+
     //On N3DS, decrypt Arm9Bin and patch Arm9 entrypoint to skip kernel9loader
     if(ISN3DS)
     {
@@ -662,6 +703,7 @@ u32 patchAgbFirm(bool loadFromStorage, bool doUnitinfoPatch)
 
     ret += patchLgySignatureChecks(process9Offset, process9Size);
     if(CONFIG(SHOWGBABOOT)) ret += patchAgbBootSplash(process9Offset, process9Size);
+    ret += patchLgyK11(section1, section1Size, section2, section2Size);
 
     //Apply UNITINFO patch
     if(doUnitinfoPatch) ret += patchUnitInfoValueSet(arm9Section, kernel9Size);
@@ -731,6 +773,29 @@ u32 patch1x2xNativeAndSafeFirm(void)
     return ret;
 }
 
+u32 patchPrototypeNative(FirmwareSource nandType)
+{
+    u8 *arm9Section = (u8 *)firm + firm->section[2].offset;
+
+    //Find the Process9 .code location, size and memory address
+    u32 process9Size,
+        process9MemAddr;
+    u8 *process9Offset = getProcess9Info(arm9Section, firm->section[2].size, &process9Size, &process9MemAddr);
+
+    u32 kernel9Size = (u32)(process9Offset - arm9Section) - sizeof(Cxi) - 0x200,
+        ret = 0;
+
+    ret += patchProtoNandSignatureCheck(process9Offset, process9Size);
+
+    //Arm9 exception handlers
+    ret += patchArm9ExceptionHandlersInstall(arm9Section, kernel9Size);
+
+    //Apply EmuNAND patches
+    if(nandType != FIRMWARE_SYSNAND) ret += patchProtoEmuNand(process9Offset, process9Size);
+
+    return ret;
+}
+
 void launchFirm(int argc, char **argv)
 {
     prepareArm11ForFirmlaunch();

arm9/source/firm.h

@@ -35,4 +35,5 @@ u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStora
 u32 patchTwlFirm(u32 firmVersion, bool loadFromStorage, bool doUnitinfoPatch);
 u32 patchAgbFirm(bool loadFromStorage, bool doUnitinfoPatch);
 u32 patch1x2xNativeAndSafeFirm(void);
+u32 patchPrototypeNative(FirmwareSource nandType);
 void launchFirm(int argc, char **argv);

arm9/source/fs.c

@@ -81,31 +81,10 @@ bool remountCtrNandPartition(bool switchMainDir)
     static bool nandInitialized = false;
     int res = FR_OK;
 
-#if 0
-    Unfortunately the sdmmc driver is really flaky and returns TMIO_STAT_CMD_RESPEND as error.
-    (after timing out)
-    TODO: fix all this tech debt... one day, maybe?
-
-    if (nandInitialized)
-    {
-        res = f_unmount("nand:");
-        if (res != FR_OK)
-        {
-            error("f_unmount returned %d", res);
-            return false;
-        }
-        nandInitialized = false;
-    }
-#endif
-
     if (!nandInitialized)
     {
         res = f_mount(&nandFs, "nand:", 1);
         nandInitialized = res == FR_OK;
-        if (res != FR_OK)
-        {
-            error("f_mount returned %d", res);
-        }
     }
 
     if (nandInitialized && switchMainDir)
@@ -158,6 +137,7 @@ bool fileWrite(const void *buffer, const char *path, u32 size)
             return result == FR_OK && (u32)written == size;
         }
         case FR_NO_PATH:
+            // Only create the last dir in the hierarchy
             for(u32 i = 1; path[i] != 0; i++)
                 if(path[i] == '/')
                 {
@@ -199,6 +179,7 @@ bool fileCopy(const char *pathSrc, const char *pathDst, bool replace, void *tmpB
     }
     else if (res == FR_NO_PATH)
     {
+        // Only create the last dir in the hierarchy
         const char *c;
         for (c = pathDst + strlen(pathDst); *c != '/' && c >= pathDst; --c);
         if (c >= pathDst && c - pathDst <= FF_MAX_LFN && *c != '\0')
@@ -251,6 +232,12 @@ bool fileCopy(const char *pathSrc, const char *pathDst, bool replace, void *tmpB
     return true;
 }
 
+bool createDir(const char *path)
+{
+    FRESULT res = f_mkdir(path);
+    return res == FR_OK || res == FR_EXIST;
+}
+
 bool findPayload(char *path, u32 pressed)
 {
     const char *pattern;
@@ -456,21 +443,38 @@ static bool backupEssentialFiles(void)
 {
     size_t sz = sizeof(fileCopyBuffer);
 
+    u32 deviceID = *(vu32*)0x01FFB804;
+    char pathStart[0x20];
+    sprintf(pathStart, "backups/%08lX/", deviceID);
+    char fullPath[0x80];
+
+    // Since the other funcs in this file don't create directories recursively (only the last one),
+    // and nor does f_mkdir, create the directories anyway and ignore the result
+    f_mkdir("backups");
+    f_mkdir(pathStart);
+
     bool ok = true;
-    ok = ok && fileCopy("nand:/ro/sys/HWCAL0.dat", "backups/HWCAL0.dat", false, fileCopyBuffer, sz);
+    sprintf(fullPath, "%sHWCAL0.dat", pathStart);
-    ok = ok && fileCopy("nand:/ro/sys/HWCAL1.dat", "backups/HWCAL1.dat", false, fileCopyBuffer, sz);
+    ok = ok && fileCopy("nand:/ro/sys/HWCAL0.dat", fullPath, false, fileCopyBuffer, sz);
+    sprintf(fullPath, "%sHWCAL1.dat", pathStart);
+    ok = ok && fileCopy("nand:/ro/sys/HWCAL1.dat", fullPath, false, fileCopyBuffer, sz);
 
-    ok = ok && fileCopy("nand:/rw/sys/LocalFriendCodeSeed_A", "backups/LocalFriendCodeSeed_A", false, fileCopyBuffer, sz); // often doesn't exist
+    sprintf(fullPath, "%sLocalFriendCodeSeed_A", pathStart);
-    ok = ok && fileCopy("nand:/rw/sys/LocalFriendCodeSeed_B", "backups/LocalFriendCodeSeed_B", false, fileCopyBuffer, sz);
+    ok = ok && fileCopy("nand:/rw/sys/LocalFriendCodeSeed_A", fullPath, false, fileCopyBuffer, sz); // often doesn't exist
+    sprintf(fullPath, "%sLocalFriendCodeSeed_B", pathStart);
+    ok = ok && fileCopy("nand:/rw/sys/LocalFriendCodeSeed_B", fullPath, false, fileCopyBuffer, sz);
 
-    ok = ok && fileCopy("nand:/rw/sys/SecureInfo_A", "backups/SecureInfo_A", false, fileCopyBuffer, sz);
+    sprintf(fullPath, "%sSecureInfo_A", pathStart);
-    ok = ok && fileCopy("nand:/rw/sys/SecureInfo_B", "backups/SecureInfo_B", false, fileCopyBuffer, sz); // often doesn't exist
+    ok = ok && fileCopy("nand:/rw/sys/SecureInfo_A", fullPath, false, fileCopyBuffer, sz);
+    sprintf(fullPath, "%sSecureInfo_B", pathStart);
+    ok = ok && fileCopy("nand:/rw/sys/SecureInfo_B", fullPath, false, fileCopyBuffer, sz); // often doesn't exist
 
     if (!ok) return false;
 
     alignedseqmemcpy(fileCopyBuffer, (const void *)0x10012000, 0x100);
-    if (getFileSize("backups/otp.bin") != 0x100)
+    sprintf(fullPath, "%sotp.bin", pathStart);
-        ok = ok && fileWrite(fileCopyBuffer, "backups/otp.bin", 0x100);
+    if (getFileSize(fullPath) != 0x100)
+        ok = ok && fileWrite(fileCopyBuffer, fullPath, 0x100);
 
     if (!ok) return false;
 
@@ -478,49 +482,32 @@ static bool backupEssentialFiles(void)
     u8 c = mcuConsoleInfo[0];
     if (c == 2 || c == 4 || (ISN3DS && c == 5) || c == 6)
     {
+        sprintf(fullPath, "%sHWCAL_01_EEPROM.dat", pathStart);
         I2C_readRegBuf(I2C_DEV_EEPROM, 0, fileCopyBuffer, 0x1000); // Up to two instances of hwcal, with the second one @0x800
-        if (getFileSize("backups/HWCAL_01_EEPROM.dat") != 0x1000)
+        if (getFileSize(fullPath) != 0x1000)
-            ok = ok && fileWrite(fileCopyBuffer, "backups/HWCAL_01_EEPROM.dat", 0x1000);
+            ok = ok && fileWrite(fileCopyBuffer, fullPath, 0x1000);
     }
 
     // B9S bootrom backups
     u32 hash[32/4];
     sha(hash, (const void *)0x08080000, 0x10000, SHA_256_MODE);
-    if (memcmp(hash, boot9Sha256, 32) == 0 && getFileSize("backups/boot9.bin") != 0x10000)
+    sprintf(fullPath, "%sboot9.bin", pathStart);
-        ok = ok && fileWrite((const void *)0x08080000, "backups/boot9.bin", 0x10000);
+    if (memcmp(hash, boot9Sha256, 32) == 0 && getFileSize(fullPath) != 0x10000)
+        ok = ok && fileWrite((const void *)0x08080000, fullPath, 0x10000);
     sha(hash, (const void *)0x08090000, 0x10000, SHA_256_MODE);
-    if (memcmp(hash, boot11Sha256, 32) == 0 && getFileSize("backups/boot11.bin") != 0x10000)
+    sprintf(fullPath, "%sboot11.bin", pathStart);
-        ok = ok && fileWrite((const void *)0x08090000, "backups/boot11.bin", 0x10000);
+    if (memcmp(hash, boot11Sha256, 32) == 0 && getFileSize(fullPath) != 0x10000)
+        ok = ok && fileWrite((const void *)0x08090000, fullPath, 0x10000);
 
     return ok;
 }
 
 bool doLumaUpgradeProcess(void)
 {
-    FirmwareSource oldCtrNandLocation = ctrNandLocation;
+    bool ok = true, ok2 = true;
-    bool ok = true, ok2 = true, ok3 = true;
 
-#if 0
-    Unfortunately the sdmmc driver is really flaky and returns TMIO_STAT_CMD_RESPEND as error.
-    (after timing out)
-    TODO: fix all this tech debt... one day, maybe?
-
-    // Ensure SysNAND CTRNAND is mounted
-    if (isSdMode)
-    {
-        ctrNandLocation = FIRMWARE_SYSNAND;
-        if (!remountCtrNandPartition(false))
-        {
-            error("failed to mount");
-            ctrNandLocation = oldCtrNandLocation;
-            return false;
-        }
-    }
-#else
-    (void)oldCtrNandLocation;
     // Ensure CTRNAND is mounted
     remountCtrNandPartition(false);
-#endif
 
     // Try to boot.firm to CTRNAND, when applicable
 #ifndef BUILD_FOR_EXPLOIT_DEV
@@ -535,17 +522,8 @@ bool doLumaUpgradeProcess(void)
     fileDelete("sdmc:/luma/config.bin");
     fileDelete("nand:/rw/luma/config.bin");
 
-#if 0
+    createDir("sdmc:/luma/payloads");
-    if (isSdMode)
+    createDir("nand:/rw/luma/payloads");
-    {
-        ctrNandLocation = oldCtrNandLocation;
-        ok3 = remountCtrNandPartition(false);
-        if (!ok3)
-            error("failed to unmount");
-    }
-#else
-    (void)ok3;
-#endif
 
-    return ok && ok2 && ok3;
+    return ok && ok2;
 }

arm9/source/fs.h

@@ -39,6 +39,7 @@ u32 getFileSize(const char *path);
 bool fileWrite(const void *buffer, const char *path, u32 size);
 bool fileDelete(const char *path);
 bool fileCopy(const char *pathSrc, const char *pathDst, bool replace, void *tmpBuffer, size_t bufferSize);
+bool createDir(const char *path);
 bool findPayload(char *path, u32 pressed);
 bool payloadMenu(char *path, bool *hasDisplayedMenu);
 u32 firmRead(void *dest, u32 firmType);

arm9/source/i2c.h

@@ -40,6 +40,8 @@ typedef enum
     I2C_DEV_CAMERA    = 1, 	// Unconfirmed
     I2C_DEV_CAMERA2   = 2, 	// Unconfirmed
     I2C_DEV_MCU       = 3,
+    I2C_DEV_LCD_TOP   = 5,
+    I2C_DEV_LCD_BOT   = 6,
     I2C_DEV_GYRO      = 10,
     I2C_DEV_DEBUG_PAD = 12,
     I2C_DEV_IR        = 13,

arm9/source/large_patches.h

@@ -28,9 +28,11 @@
 
 #include "types.h"
 
-extern const u8 emunandPatch[];
+extern const u8 emunandPatch[], emunandProtoPatch[], emunandProtoCidPatch[];
-extern const u32 emunandPatchSize;
+extern const u8 emunandProtoPatch238[];
+extern const u32 emunandPatchSize, emunandPatchBssSize;
 extern u32 emunandPatchSdmmcStructPtr, emunandPatchNandOffset, emunandPatchNcsdHeaderOffset;
+extern u32 emunandPatchNandCid[4];
 
 extern const u8 rebootPatch[];
 extern const u32 rebootPatchSize;

arm9/source/main.c

@@ -386,6 +386,9 @@ boot:
         case NATIVE_FIRM1X2X:
             res = patch1x2xNativeAndSafeFirm();
             break;
+        case NATIVE_PROTOTYPE:
+            res = patchPrototypeNative(nandType);
+            break;
     }
 
     if(res != 0) error("Failed to apply %u FIRM patch(es).", res);

arm9/source/patches.c

@@ -45,6 +45,7 @@
 #define K11EXT_VA         0x70000000
 
 extern u16 launchedPath[];
+extern u32 firmProtoVersion;
 
 u8 *getProcess9Info(u8 *pos, u32 size, u32 *process9Size, u32 *process9MemAddr)
 {
@@ -54,10 +55,20 @@ u8 *getProcess9Info(u8 *pos, u32 size, u32 *process9Size, u32 *process9MemAddr)
 
     Cxi *off = (Cxi *)(temp - 0x100);
 
-    *process9Size = (off->ncch.exeFsSize - 1) * 0x200;
     *process9MemAddr = off->exHeader.systemControlInfo.textCodeSet.address;
 
-    return (u8 *)off + (off->ncch.exeFsOffset + 1) * 0x200;
+    // Prototype FW has a different NCCH format
+    if (firmProtoVersion && firmProtoVersion <= 243)
+    {
+        *process9Size = off->ncch.exeFsSize;
+        return (u8 *)off + off->ncch.exeFsOffset;
+    }
+    else
+    {
+        *process9Size = (off->ncch.exeFsSize - 1) * 0x200;
+        return (u8 *)off + (off->ncch.exeFsOffset + 1) * 0x200;
+    }
+
 }
 
 u32 *getKernel11Info(u8 *pos, u32 size, u32 *baseK11VA, u8 **freeK11Space, u32 **arm11SvcHandler, u32 **arm11ExceptionsPage)
@@ -832,5 +843,56 @@ u32 patchLgyK11(u8 *section1, u32 section1Size, u8 *section2, u32 section2Size)
         return 1;
     *off2 = 0xE01A;
 
+    // Patch kernelpanic to skip devunit check, so that it sets the LCD fill regs
+    // which are useful to detect such panics
+    u16 *off3;
+    for (off3 = (u16 *)section1; (u8 *)off3 <= section1 + section1Size && (off3[0] != 0x481D || off3[1] != 0xB570); off3++);
+    if ((u8 *)off3 >= section1 + section1Size)
+        return 1;
+    off3[2] = 0x2001; // movs r0, #1
+
+    // Patch kernel to avoid allocating the two "configuration memory" pages, freeing
+    // 0x2000 bytes of kernel "heap" (which is 0xD000 AXIWRAM bytes on LGY K11 instead
+    // of the entire FCRAM on NFIRM). This is indeed a bug because if prevents two of the
+    // 12 KThread objects from being created
+    u16 *off4;
+    for (off4 = (u16 *)section1; (u8 *)off4 <= section1 + section1Size && (off4[0] != 0xB570 || off4[1] != 0x2200); off4++);
+    if ((u8 *)off4 >= section1 + section1Size)
+        return 1;
+    *off4 = 0x4770; // bx lr
+
     return 0;
 }
+
+u32 patchProtoNandSignatureCheck(u8 *pos, u32 size) {
+    if (firmProtoVersion == 243) {
+        static const u8 pattern[] = {0x08, 0x31, 0x9F, 0xE5};
+
+        // Signature check function returns 0 if failed and 1 if succeeded.
+        // Proc9 breaks if the returned value is 0, change it to break if
+        // the returned value is 2 (never).
+        u8 *off = memsearch(pos, pattern, size, sizeof(pattern));
+        if (!off)
+            return 1;
+
+        off[0x20] = 2;
+    }
+
+    else if (firmProtoVersion == 238) { // SDK 0.10
+        // Same patch as for v243 ported to the different ncsd_read() function
+        static const u8 pattern[] = {
+            0x00, 0x11, 0x9f, 0xe5,
+            0x00, 0x51, 0x9f, 0xe5,
+        };
+
+        u8 *off = memsearch(pos, pattern, size, sizeof(pattern));
+        if (!off)
+            return 1;
+
+        off[0x20] = 2;
+    }
+
+    else return 1;
+
+    return 0;
+}

arm9/source/patches.h

@@ -31,6 +31,7 @@
 *   FIRM partition writes patches by delebile
 *   Idea for svcBreak patches from yellows8 and others on #3dsdev
 *   TWL_FIRM patches by Steveice10 and others
+*   Signature patches for prototype FW by PabloMK7
 */
 
 #pragma once
@@ -68,3 +69,4 @@ u32 patchTwlShaHashChecks(u8 *pos, u32 size);
 u32 patchAgbBootSplash(u8 *pos, u32 size);
 void patchTwlBg(u8 *pos, u32 size); // silently fails
 u32 patchLgyK11(u8 *section1, u32 section1Size, u8 *section2, u32 section2Size);
+u32 patchProtoNandSignatureCheck(u8 *pos, u32 size);

arm9/source/screen.c

@@ -70,6 +70,14 @@ void prepareArm11ForFirmlaunch(void)
 void deinitScreens(void)
 {
     if(ARESCREENSINITIALIZED) invokeArm11Function(DEINIT_SCREENS);
+
+    // Backlight voltage off
+    I2C_writeReg(I2C_DEV_MCU, 0x22, 0x14);
+    wait(50);
+
+    // LCD panel voltage off
+    I2C_writeReg(I2C_DEV_MCU, 0x22, 0x01);
+    wait(50);
 }
 
 void updateBrightness(u32 brightnessIndex)
@@ -102,8 +110,31 @@ void initScreens(void)
             memcpy((void *)(ARM11_PARAMETERS_ADDRESS + 4), fbs, sizeof(fbs));
             invokeArm11Function(INIT_SCREENS);
 
-            //Turn on backlight
+            // Fragile code, needs proper fix/total rewrite of the baremetal components anyway
-            I2C_writeReg(I2C_DEV_MCU, 0x22, 0x2A);
+            // Assume controller revision is not 0x00 for either screen (this revision is extremely
+            // old and shouldn't be seen in retail units nor normal devunits)
+
+            // Controller reset off
+            I2C_writeReg(I2C_DEV_LCD_TOP, 0xFE, 0xAA);
+            I2C_writeReg(I2C_DEV_LCD_BOT, 0xFE, 0xAA);
+            wait(5);
+
+            // Controller power on
+            I2C_writeReg(I2C_DEV_LCD_TOP, 0x01, 0x10);
+            I2C_writeReg(I2C_DEV_LCD_BOT, 0x01, 0x10);
+            wait(5);
+
+            // Clear error flag
+            I2C_writeReg(I2C_DEV_LCD_TOP, 0x60, 0x00);
+            I2C_writeReg(I2C_DEV_LCD_BOT, 0x60, 0x00);
+            wait(5);
+
+            // LCD panel (bias ?) voltage on
+            I2C_writeReg(I2C_DEV_MCU, 0x22, 0x02);
+            wait(50);
+
+            // Backlight voltage on
+            I2C_writeReg(I2C_DEV_MCU, 0x22, 0x28);
             wait(5);
         }
         else updateBrightness(MULTICONFIG(BRIGHTNESS));
@@ -118,3 +149,8 @@ void initScreens(void)
     clearScreens(false);
     swapFramebuffers(false);
 }
+
+void zerofillN3dsAblRegisters(void)
+{
+    invokeArm11Function(ZEROFILL_N3DS_ABL_REGISTERS);
+}

arm9/source/screen.h

@@ -59,6 +59,7 @@ typedef enum
     SWAP_FRAMEBUFFERS,
     UPDATE_BRIGHTNESS,
     DEINIT_SCREENS,
+    ZEROFILL_N3DS_ABL_REGISTERS,
     PREPARE_ARM11_FOR_FIRMLAUNCH,
     ARM11_READY,
 } Arm11Operation;
@@ -73,3 +74,4 @@ void swapFramebuffers(bool isAlternate);
 void updateBrightness(u32 brightnessIndex);
 void clearScreens(bool isAlternate);
 void initScreens(void);
+void zerofillN3dsAblRegisters(void);

arm9/source/types.h

@@ -64,6 +64,7 @@ typedef volatile s64 vs64;
 typedef struct ScreenFiltersCfgData {
     u16 cct;
     bool invert;
+    u8 colorCurveCorrection;
     s64 gammaEnc;
     s64 contrastEnc;
     s64 brightnessEnc;
@@ -133,7 +134,8 @@ typedef enum FirmwareType
     AGB_FIRM,
     SAFE_FIRM,
     SYSUPDATER_FIRM,
-    NATIVE_FIRM1X2X
+    NATIVE_FIRM1X2X,
+    NATIVE_PROTOTYPE,
 } FirmwareType;
 
 typedef enum bootType

arm9/source/utils.c

@@ -158,23 +158,44 @@ void error(const char *fmt, ...)
     mcuPowerOff();
 }
 
+
+// CRC-16/MODBUS
 u16 crc16(const void *data, size_t size, u16 initialValue)
 {
-    static u16 lut[256] = {0};
+    static const u16 lut[256] = {
-    static bool lutInitialized = false;
+        0x0000,0xC0C1,0xC181,0x0140,0xC301,0x03C0,0x0280,0xC241,
-
+        0xC601,0x06C0,0x0780,0xC741,0x0500,0xC5C1,0xC481,0x0440,
-    if (!lutInitialized)
+        0xCC01,0x0CC0,0x0D80,0xCD41,0x0F00,0xCFC1,0xCE81,0x0E40,
-    {
+        0x0A00,0xCAC1,0xCB81,0x0B40,0xC901,0x09C0,0x0880,0xC841,
-        static const u16 poly = 0xA001;
+        0xD801,0x18C0,0x1980,0xD941,0x1B00,0xDBC1,0xDA81,0x1A40,
-        for (u32 i = 0; i < 256; i++)
+        0x1E00,0xDEC1,0xDF81,0x1F40,0xDD01,0x1DC0,0x1C80,0xDC41,
-        {
+        0x1400,0xD4C1,0xD581,0x1540,0xD701,0x17C0,0x1680,0xD641,
-            u16 r = i;
+        0xD201,0x12C0,0x1380,0xD341,0x1100,0xD1C1,0xD081,0x1040,
-            for (u32 j = 0; j < 8; j++)
+        0xF001,0x30C0,0x3180,0xF141,0x3300,0xF3C1,0xF281,0x3240,
-                r = (r >> 1) ^ ((r & 1) != 0 ? poly : 0);
+        0x3600,0xF6C1,0xF781,0x3740,0xF501,0x35C0,0x3480,0xF441,
-            lut[i] = r;
+        0x3C00,0xFCC1,0xFD81,0x3D40,0xFF01,0x3FC0,0x3E80,0xFE41,
-        }
+        0xFA01,0x3AC0,0x3B80,0xFB41,0x3900,0xF9C1,0xF881,0x3840,
-        lutInitialized = true;
+        0x2800,0xE8C1,0xE981,0x2940,0xEB01,0x2BC0,0x2A80,0xEA41,
-    }
+        0xEE01,0x2EC0,0x2F80,0xEF41,0x2D00,0xEDC1,0xEC81,0x2C40,
+        0xE401,0x24C0,0x2580,0xE541,0x2700,0xE7C1,0xE681,0x2640,
+        0x2200,0xE2C1,0xE381,0x2340,0xE101,0x21C0,0x2080,0xE041,
+        0xA001,0x60C0,0x6180,0xA141,0x6300,0xA3C1,0xA281,0x6240,
+        0x6600,0xA6C1,0xA781,0x6740,0xA501,0x65C0,0x6480,0xA441,
+        0x6C00,0xACC1,0xAD81,0x6D40,0xAF01,0x6FC0,0x6E80,0xAE41,
+        0xAA01,0x6AC0,0x6B80,0xAB41,0x6900,0xA9C1,0xA881,0x6840,
+        0x7800,0xB8C1,0xB981,0x7940,0xBB01,0x7BC0,0x7A80,0xBA41,
+        0xBE01,0x7EC0,0x7F80,0xBF41,0x7D00,0xBDC1,0xBC81,0x7C40,
+        0xB401,0x74C0,0x7580,0xB541,0x7700,0xB7C1,0xB681,0x7640,
+        0x7200,0xB2C1,0xB381,0x7340,0xB101,0x71C0,0x7080,0xB041,
+        0x5000,0x90C1,0x9181,0x5140,0x9301,0x53C0,0x5280,0x9241,
+        0x9601,0x56C0,0x5780,0x9741,0x5500,0x95C1,0x9481,0x5440,
+        0x9C01,0x5CC0,0x5D80,0x9D41,0x5F00,0x9FC1,0x9E81,0x5E40,
+        0x5A00,0x9AC1,0x9B81,0x5B40,0x9901,0x59C0,0x5880,0x9841,
+        0x8801,0x48C0,0x4980,0x8941,0x4B00,0x8BC1,0x8A81,0x4A40,
+        0x4E00,0x8EC1,0x8F81,0x4F40,0x8D01,0x4DC0,0x4C80,0x8C41,
+        0x4400,0x84C1,0x8581,0x4540,0x8701,0x47C0,0x4680,0x8641,
+        0x8201,0x42C0,0x4380,0x8341,0x4100,0x81C1,0x8081,0x4040,
+    };
 
     u16 r = initialValue;
     const u8 *data8 = (const u8 *)data;
@@ -186,21 +207,40 @@ u16 crc16(const void *data, size_t size, u16 initialValue)
 
 u32 crc32(const void *data, size_t size, u32 initialValue)
 {
-    static u32 lut[256] = {0};
+    static const u32 lut[256] = {
-    static bool lutInitialized = false;
+        0x00000000,0x77073096,0xEE0E612C,0x990951BA,0x076DC419,0x706AF48F,0xE963A535,0x9E6495A3,
-
+        0x0EDB8832,0x79DCB8A4,0xE0D5E91E,0x97D2D988,0x09B64C2B,0x7EB17CBD,0xE7B82D07,0x90BF1D91,
-    if (!lutInitialized)
+        0x1DB71064,0x6AB020F2,0xF3B97148,0x84BE41DE,0x1ADAD47D,0x6DDDE4EB,0xF4D4B551,0x83D385C7,
-    {
+        0x136C9856,0x646BA8C0,0xFD62F97A,0x8A65C9EC,0x14015C4F,0x63066CD9,0xFA0F3D63,0x8D080DF5,
-        static const u32 poly = 0xEDB88320;
+        0x3B6E20C8,0x4C69105E,0xD56041E4,0xA2677172,0x3C03E4D1,0x4B04D447,0xD20D85FD,0xA50AB56B,
-        for (u32 i = 0; i < 256; i++)
+        0x35B5A8FA,0x42B2986C,0xDBBBC9D6,0xACBCF940,0x32D86CE3,0x45DF5C75,0xDCD60DCF,0xABD13D59,
-        {
+        0x26D930AC,0x51DE003A,0xC8D75180,0xBFD06116,0x21B4F4B5,0x56B3C423,0xCFBA9599,0xB8BDA50F,
-            u32 r = i;
+        0x2802B89E,0x5F058808,0xC60CD9B2,0xB10BE924,0x2F6F7C87,0x58684C11,0xC1611DAB,0xB6662D3D,
-            for (u32 j = 0; j < 8; j++)
+        0x76DC4190,0x01DB7106,0x98D220BC,0xEFD5102A,0x71B18589,0x06B6B51F,0x9FBFE4A5,0xE8B8D433,
-                r = (r >> 1) ^ ((r & 1) != 0 ? poly : 0);
+        0x7807C9A2,0x0F00F934,0x9609A88E,0xE10E9818,0x7F6A0DBB,0x086D3D2D,0x91646C97,0xE6635C01,
-            lut[i] = r;
+        0x6B6B51F4,0x1C6C6162,0x856530D8,0xF262004E,0x6C0695ED,0x1B01A57B,0x8208F4C1,0xF50FC457,
-        }
+        0x65B0D9C6,0x12B7E950,0x8BBEB8EA,0xFCB9887C,0x62DD1DDF,0x15DA2D49,0x8CD37CF3,0xFBD44C65,
-        lutInitialized = true;
+        0x4DB26158,0x3AB551CE,0xA3BC0074,0xD4BB30E2,0x4ADFA541,0x3DD895D7,0xA4D1C46D,0xD3D6F4FB,
-    }
+        0x4369E96A,0x346ED9FC,0xAD678846,0xDA60B8D0,0x44042D73,0x33031DE5,0xAA0A4C5F,0xDD0D7CC9,
+        0x5005713C,0x270241AA,0xBE0B1010,0xC90C2086,0x5768B525,0x206F85B3,0xB966D409,0xCE61E49F,
+        0x5EDEF90E,0x29D9C998,0xB0D09822,0xC7D7A8B4,0x59B33D17,0x2EB40D81,0xB7BD5C3B,0xC0BA6CAD,
+        0xEDB88320,0x9ABFB3B6,0x03B6E20C,0x74B1D29A,0xEAD54739,0x9DD277AF,0x04DB2615,0x73DC1683,
+        0xE3630B12,0x94643B84,0x0D6D6A3E,0x7A6A5AA8,0xE40ECF0B,0x9309FF9D,0x0A00AE27,0x7D079EB1,
+        0xF00F9344,0x8708A3D2,0x1E01F268,0x6906C2FE,0xF762575D,0x806567CB,0x196C3671,0x6E6B06E7,
+        0xFED41B76,0x89D32BE0,0x10DA7A5A,0x67DD4ACC,0xF9B9DF6F,0x8EBEEFF9,0x17B7BE43,0x60B08ED5,
+        0xD6D6A3E8,0xA1D1937E,0x38D8C2C4,0x4FDFF252,0xD1BB67F1,0xA6BC5767,0x3FB506DD,0x48B2364B,
+        0xD80D2BDA,0xAF0A1B4C,0x36034AF6,0x41047A60,0xDF60EFC3,0xA867DF55,0x316E8EEF,0x4669BE79,
+        0xCB61B38C,0xBC66831A,0x256FD2A0,0x5268E236,0xCC0C7795,0xBB0B4703,0x220216B9,0x5505262F,
+        0xC5BA3BBE,0xB2BD0B28,0x2BB45A92,0x5CB36A04,0xC2D7FFA7,0xB5D0CF31,0x2CD99E8B,0x5BDEAE1D,
+        0x9B64C2B0,0xEC63F226,0x756AA39C,0x026D930A,0x9C0906A9,0xEB0E363F,0x72076785,0x05005713,
+        0x95BF4A82,0xE2B87A14,0x7BB12BAE,0x0CB61B38,0x92D28E9B,0xE5D5BE0D,0x7CDCEFB7,0x0BDBDF21,
+        0x86D3D2D4,0xF1D4E242,0x68DDB3F8,0x1FDA836E,0x81BE16CD,0xF6B9265B,0x6FB077E1,0x18B74777,
+        0x88085AE6,0xFF0F6A70,0x66063BCA,0x11010B5C,0x8F659EFF,0xF862AE69,0x616BFFD3,0x166CCF45,
+        0xA00AE278,0xD70DD2EE,0x4E048354,0x3903B3C2,0xA7672661,0xD06016F7,0x4969474D,0x3E6E77DB,
+        0xAED16A4A,0xD9D65ADC,0x40DF0B66,0x37D83BF0,0xA9BCAE53,0xDEBB9EC5,0x47B2CF7F,0x30B5FFE9,
+        0xBDBDF21C,0xCABAC28A,0x53B39330,0x24B4A3A6,0xBAD03605,0xCDD70693,0x54DE5729,0x23D967BF,
+        0xB3667A2E,0xC4614AB8,0x5D681B02,0x2A6F2B94,0xB40BBE37,0xC30C8EA1,0x5A05DF1B,0x2D02EF8D,
+    };
 
     u32 r = initialValue;
     const u8 *data8 = (const u8 *)data;

k11_extension/include/globals.h

@@ -131,6 +131,7 @@ extern void* (*kAlloc)(FcramDescriptor *fcramDesc, u32 nbPages, u32 alignment, u
 typedef struct ScreenFiltersCfgData {
     u16 cct;
     bool invert;
+    u8 colorCurveCorrection;
     s64 gammaEnc;
     s64 contrastEnc;
     s64 brightnessEnc;

k11_extension/include/svc/MapProcessMemoryEx.h

@@ -30,5 +30,11 @@
 #include "kernel.h"
 #include "svc.h"
 
-Result MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size);
+/// Flags for svcMapProcessMemoryEx
-Result MapProcessMemoryExWrapper(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size);
+typedef enum MapExFlags
+{
+    MAPEXFLAGS_PRIVATE = BIT(0), ///< Maps the memory as PRIVATE (0xBB05) instead of SHARED (0x5806)
+} MapExFlags;
+
+Result MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size, MapExFlags flags);
+Result MapProcessMemoryExWrapper(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size, MapExFlags flags);

k11_extension/source/svc/GetSystemInfo.c

@@ -43,7 +43,7 @@ Result GetSystemInfoHook(s64 *out, s32 type, s32 param)
                 s32 toCopy = (s32)sizeof(cfwInfo.launchedPath) - offset;
                 if (toCopy > 8) toCopy = 8;
                 memcpy(out, (u8*)cfwInfo.launchedPath + offset, (toCopy > 0) ? toCopy : 0);
-            } 
+            }
             else switch(param)
             {
                 // Please do not use these, except 0, 1, and 0x200
@@ -120,6 +120,12 @@ Result GetSystemInfoHook(s64 *out, s32 type, s32 param)
                 case 0x10C:
                     *out = (s64)cfwInfo.bottomScreenFilter.invert;
                     break;
+                case 0x10D:
+                    *out = (s64)cfwInfo.topScreenFilter.colorCurveCorrection;
+                    break;
+                case 0x10E:
+                    *out = (s64)cfwInfo.bottomScreenFilter.colorCurveCorrection;
+                    break;
                 case 0x180:
                     *out = cfwInfo.pluginLoaderFlags;
                     break;

k11_extension/source/svc/MapProcessMemoryEx.c

@@ -26,7 +26,7 @@
 
 #include "svc/MapProcessMemoryEx.h"
 
-Result  MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size)
+Result  MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size, MapExFlags flags)
 {
     Result          res = 0;
     u32             sizeInPage = size >> 12;
@@ -69,7 +69,7 @@ Result  MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcess
         // Check if the destination address is free and large enough
         res = KProcessHwInfo__CheckVaState(hwInfoOfProcess(dstProcess), vaDst, size, 0, 0);
         if (res == 0)
-            res = KProcessHwInfo__MapListOfKBlockInfo(hwInfoOfProcess(dstProcess), vaDst, &list, 0x5806, MEMPERM_RW | 0x18, 0);
+            res = KProcessHwInfo__MapListOfKBlockInfo(hwInfoOfProcess(dstProcess), vaDst, &list, (flags & MAPEXFLAGS_PRIVATE) ? 0xBB05 : 0x5806, MEMPERM_RW | 0x18, 0);
     }
 
     KLinkedList_KBlockInfo__Clear(&list);

k11_extension/source/svc/wrappers.s

@@ -118,8 +118,12 @@ ControlMemoryUnsafeWrapper:
 .global MapProcessMemoryExWrapper
 .type   MapProcessMemoryExWrapper, %function
 MapProcessMemoryExWrapper:
-    push {lr}
+    push {r5, lr} @ We need to save r5 because the old implementation doesn't save it
+    cmp r0, #0xFFFFFFF2 @ Check magic value, for backwards compatibility
+    moveq r0, r6 @ If value present, flags present in r5 and dst process in r6, so move dst process back to r0
+    movne r5, #0 @ If value not present, clear the flags as its the old version
+    str r5, [sp, #-4]!
     str r4, [sp, #-4]!
     bl MapProcessMemoryEx
-    add sp, #4
+    add sp, #8
-    pop {pc}
+    pop {r5, pc}

sysmodules/loader/source/hbldr.c

@@ -34,6 +34,12 @@
 
 extern bool isN3DS;
 
+// Note: just switch to [[attribute]] once we use clangd and cmake
+// vscode-cpptools has (or had?) some issues with C23 support
+#if __GNUC__ >= 15
+// Required by GCC 15+ but ignored (with warning) before
+__attribute__((nonstring))
+#endif
 static const char serviceList[34][8] =
 {
     "APT:U",

sysmodules/loader/source/ifile.c

@@ -23,7 +23,9 @@ Result IFile_OpenFromArchive(IFile *file, FS_Archive archive, FS_Path filePath,
 
 Result IFile_Close(IFile *file)
 {
-  return FSFILE_Close(file->handle);
+  Result res = file->handle != 0 ? FSFILE_Close(file->handle) : 0;
+  file->handle = 0;
+  return res;
 }
 
 Result IFile_GetSize(IFile *file, u64 *size)

sysmodules/loader/source/loader.c

@@ -272,7 +272,7 @@ Result  PLGLDR__IsPluginLoaderEnabled(bool *isEnabled)
 }
 
 // Try to load a plugin for the game
-static Result PLGLDR_LoadPlugin(u32 processID)
+static Result PLGLDR_LoadPlugin(u32 processID, bool isHomebrew)
 {
     // Special case handling: games rebooting the 3DS on old models
     if (!isN3DS && g_exheaderInfo.aci.local_caps.core_info.o3ds_system_mode > 0)
@@ -288,8 +288,9 @@ static Result PLGLDR_LoadPlugin(u32 processID)
 
     u32* cmdbuf = getThreadCommandBuffer();
 
-    cmdbuf[0] = IPC_MakeHeader(1, 1, 0);
+    cmdbuf[0] = IPC_MakeHeader(1, 2, 0);
     cmdbuf[1] = processID;
+    cmdbuf[2] = isHomebrew;
     return svcSendSyncRequest(plgldrHandle);
 }
 
@@ -452,12 +453,12 @@ static Result LoadProcessImpl(Handle *outProcessHandle, const ExHeader_Info *exh
             res = R_SUCCEEDED(res) ? 0 : res;
             
             // check for plugin
-            if (!res && !isHomebrew && ((u32)((titleId >> 0x20) & 0xFFFFFFEDULL) == 0x00040000))
+            if (!res && ((u32)((titleId >> 0x20) & 0xFFFFFFEDULL) == 0x00040000))
             {
                 u32 processID;
                 assertSuccess(svcGetProcessId(&processID, *outProcessHandle));
                 assertSuccess(plgldrInit());
-                assertSuccess(PLGLDR_LoadPlugin(processID));
+                assertSuccess(PLGLDR_LoadPlugin(processID, isHomebrew));
                 plgldrExit();
             }
         }

sysmodules/loader/source/main.c

@@ -10,7 +10,7 @@
 #include "hbldr.h"
 
 u32 config, multiConfig, bootConfig;
-bool isN3DS, isSdMode, nextGamePatchDisabled;
+bool isN3DS, isSdMode, nextGamePatchDisabled, isLumaWithKext;
 
 // MAKE SURE fsreg has been init before calling this
 static Result fsldrPatchPermissions(void)
@@ -33,7 +33,7 @@ static inline void loadCFWInfo(void)
     s64 out;
     u64 hbldrTid = 0;
 
-    bool isLumaWithKext = svcGetSystemInfo(&out, 0x20000, 0) == 1;
+    isLumaWithKext = svcGetSystemInfo(&out, 0x20000, 0) == 1;
     if (isLumaWithKext)
     {
         svcGetSystemInfo(&out, 0x10000, 3);
@@ -60,7 +60,8 @@ static inline void loadCFWInfo(void)
             panic(0xDEADCAFE);
 
 #ifndef BUILD_FOR_EXPLOIT_DEV
-        config = 1u << PATCHVERSTRING; // all options 0, except maybe the MSET version display patch
+        // Most options 0, except select ones
+        config = BIT(PATCHVERSTRING) | BIT(PATCHGAMES) | BIT(LOADEXTFIRMSANDMODULES);
 #else
         config = 0;
 #endif

sysmodules/loader/source/patcher.c

@@ -148,7 +148,7 @@ static u32 findFunctionStart(u8 *code, u32 pos)
     return 0xFFFFFFFF;
 }
 
-static inline bool findLayeredFsSymbols(u8 *code, u32 size, u32 *fsMountArchive, u32 *fsRegisterArchive, u32 *fsTryOpenFile, u32 *fsOpenFileDirectly)
+static inline bool findLayeredFsSymbols(u8 *code, u32 size, u32 *fsMountArchive, u32 *fsRegisterArchive, u32 *fsTryOpenFile, u32 *fsOpenFileDirectly, u32 *fsUnMountArchive)
 {
     u32 found = 0,
         *temp = NULL;
@@ -165,6 +165,12 @@ static inline bool findLayeredFsSymbols(u8 *code, u32 size, u32 *fsMountArchive,
             case 0xE24DD028:
                 if(addr <= size - 16 && *fsMountArchive == 0xFFFFFFFF && addr32[1] == 0xE1A04000 && addr32[2] == 0xE59F60A8 && addr32[3] == 0xE3A0C001) temp = fsMountArchive;
                 break;
+            case 0xE2844001:
+                if(addr <= size - 12 && *fsUnMountArchive == 0xFFFFFFFF && addr32[1] == 0xE3540020 && addr32[2] == 0x3AFFFFF0) temp = fsUnMountArchive;
+                break;
+            case 0xE353003A:
+                if(addr <= size - 12 && *fsUnMountArchive == 0xFFFFFFFF && (addr32[1] & 0xFFFFFF0F) == 0x0A000009 && (addr32[2] & 0xFFFF0FF0) == 0xE1A00400) temp = fsUnMountArchive;
+                break;
             case 0xE3500008:
                 if(addr <= size - 12 && *fsRegisterArchive == 0xFFFFFFFF && (addr32[1] & 0xFFF00FF0) == 0xE1800400 && (addr32[2] & 0xFFF00FF0) == 0xE1800FC0) temp = fsRegisterArchive;
                 break;
@@ -183,14 +189,14 @@ static inline bool findLayeredFsSymbols(u8 *code, u32 size, u32 *fsMountArchive,
             if(*temp != 0xFFFFFFFF)
             {
                 found++;
-                if(found == 4) break;
+                if(found == 5) break;
             }
 
             temp = NULL;
         }
     }
 
-    return found == 4;
+    return found == 5;
 }
 
 static inline bool findLayeredFsPayloadOffset(u8 *code, u32 size, u32 roSize, u32 dataSize, u32 roAddress, u32 dataAddress, u32 *payloadOffset, u32 *pathOffset, u32 *pathAddress)
@@ -478,7 +484,7 @@ static inline bool loadTitleLocaleConfig(u64 progId, u8 *mask, u8 *regionId, u8
     if(R_FAILED(IFile_GetSize(&file, &fileSize)) || fileSize < 3) goto exit;
     if(fileSize >= 12) fileSize = 12;
 
-    char buf[12] = "------------";
+    char buf[12+1] = "------------";
     u64 total;
 
     if(R_FAILED(IFile_Read(&file, &total, buf, fileSize))) goto exit;
@@ -502,7 +508,7 @@ static inline bool loadTitleLocaleConfig(u64 progId, u8 *mask, u8 *regionId, u8
                                       "HK", "MO", "--", "--", "--", "--", "--", "--", "ID", "SG", "TH", "PH",
                                       "MY", "--", "--", "--", "CN", "--", "--", "--", "--", "--", "--", "--",
                                       "AE", "IN", "EG", "OM", "QA", "KW", "SA", "SY", "BH", "JO", "--", "--",
-                                      "--", "--", "--", "--", "SM", "VA"};
+                                      "--", "--", "--", "--", "SM", "VA", "BM"};
 
     u32 i;
     for(i = 0; i < sizeof(regions) / sizeof(char *); i++)
@@ -569,6 +575,7 @@ static inline bool patchLayeredFs(u64 progId, u8 *code, u32 size, u32 textSize,
     if(!archiveId) return true;
 
     u32 fsMountArchive = 0xFFFFFFFF,
+        fsUnMountArchive = 0xFFFFFFFF,
         fsRegisterArchive = 0xFFFFFFFF,
         fsTryOpenFile = 0xFFFFFFFF,
         fsOpenFileDirectly = 0xFFFFFFFF,
@@ -576,7 +583,7 @@ static inline bool patchLayeredFs(u64 progId, u8 *code, u32 size, u32 textSize,
         pathOffset = 0,
         pathAddress = 0xDEADCAFE;
 
-    if(!findLayeredFsSymbols(code, textSize, &fsMountArchive, &fsRegisterArchive, &fsTryOpenFile, &fsOpenFileDirectly) ||
+    if(!findLayeredFsSymbols(code, textSize, &fsMountArchive, &fsRegisterArchive, &fsTryOpenFile, &fsOpenFileDirectly, &fsUnMountArchive) ||
        !findLayeredFsPayloadOffset(code, textSize, roSize, dataSize, roAddress, dataAddress, &payloadOffset, &pathOffset, &pathAddress)) return false;
 
     static const char *updateRomFsMounts[] = { "ro2:",
@@ -599,7 +606,7 @@ static inline bool patchLayeredFs(u64 progId, u8 *code, u32 size, u32 textSize,
     {
         updateRomFsMount = "pat1"; // Isolated to prevent false-positives
     }
-    
+
     else
     {
         u32 updateRomFsIndex;
@@ -624,8 +631,9 @@ static inline bool patchLayeredFs(u64 progId, u8 *code, u32 size, u32 textSize,
     romfsRedirPatchSubstituted2 = *(u32 *)(code + fsTryOpenFile);
     romfsRedirPatchHook2 = MAKE_BRANCH(payloadOffset + (u32)&romfsRedirPatchHook2 - (u32)romfsRedirPatch, fsTryOpenFile + 4);
     romfsRedirPatchCustomPath = pathAddress;
-    romfsRedirPatchFsMountArchive = 0x100000 + fsMountArchive;
+    romfsRedirPatchFsMountArchive = MAKE_BRANCH_LINK(payloadOffset + (u32)&romfsRedirPatchFsMountArchive - (u32)romfsRedirPatch, fsMountArchive);
-    romfsRedirPatchFsRegisterArchive = 0x100000 + fsRegisterArchive;
+    romfsRedirPatchFsUnMountArchive = MAKE_BRANCH_LINK(payloadOffset + (u32)&romfsRedirPatchFsUnMountArchive - (u32)romfsRedirPatch, fsUnMountArchive);
+    romfsRedirPatchFsRegisterArchive = MAKE_BRANCH_LINK(payloadOffset + (u32)&romfsRedirPatchFsRegisterArchive - (u32)romfsRedirPatch, fsRegisterArchive);
     romfsRedirPatchArchiveId = archiveId;
     memcpy(&romfsRedirPatchUpdateRomFsMount, updateRomFsMount, 4);
 
@@ -726,33 +734,65 @@ void patchCode(u64 progId, u16 progVer, u8 *code, u32 size, u32 textSize, u32 ro
              progId == 0x0004001000022000LL || //EUR MSET
              progId == 0x0004001000026000LL || //CHN MSET
              progId == 0x0004001000027000LL || //KOR MSET
-             progId == 0x0004001000028000LL) //TWN MSET
+             progId == 0x0004001000028000LL)) //TWN MSET
-            && CONFIG(PATCHVERSTRING))
     {
-        static const u16 pattern[] = u"Ve";
+        if (CONFIG(PATCHVERSTRING))
-        const u16 *patch;
-        u32 patchSize = 0,
-        currentNand = BOOTCFG_NAND;
-
-        u16 customVerString[19];
-        loadCustomVerString(customVerString, &patchSize, currentNand);
-
-        if(patchSize != 0) patch = customVerString;
-        else
         {
-            patchSize = 8;
+            static const u16 pattern[] = u"Ve";
+            const u16 *patch;
+            u32 patchSize = 0,
+            currentNand = BOOTCFG_NAND;
 
-            static const u16 *const verStringNandEmu[] = { u" Emu", u"Emu2", u"Emu3", u"Emu4" };
+            u16 customVerString[19];
-            patch = currentNand == 0 ? u" Sys" : verStringNandEmu[BOOTCFG_EMUINDEX];
+            loadCustomVerString(customVerString, &patchSize, currentNand);
+
+            if(patchSize != 0) patch = customVerString;
+            else
+            {
+                patchSize = 8;
+
+                static const u16 *const verStringNandEmu[] = { u" Emu", u"Emu2", u"Emu3", u"Emu4" };
+                patch = currentNand == 0 ? u" Sys" : verStringNandEmu[BOOTCFG_EMUINDEX];
+            }
+
+            //Patch Ver. string
+            if(!patchMemory(code, textSize,
+                    pattern,
+                    sizeof(pattern) - 2, 0,
+                    patch,
+                    patchSize, 1
+                )) goto error;
         }
 
-        //Patch Ver. string
+        // Allow date picker to select year up to 2099, not just 2050.
-        if(!patchMemory(code, textSize,
+        // NNID user's year-of-birth seems to have a similar restriction,
-                pattern,
+        // I'm not removing that as long as any NNID stuff is still active.
-                sizeof(pattern) - 2, 0,
+
-                patch,
+        // Patch date picker check on entry (date load):
-                patchSize, 1
+        // Look for:
-            )) goto error;
+        // 32 00 5x E3 CMP             Rx, #0x32
+        // ...
+        // 32 x0 A0 C3 MOVGT           Rx, #0x32
+        u32 *off = (u32 *)code;
+        for (; (u8 *)off < code + textSize && ((off[0] & 0xFFF0FFFF) != 0xE3500032 || (off[2] & 0xFFFF0FFF) != 0xC3A00032); off++)
+        {
+            if (((off[0] >> 16) & 0xF) != ((off[2] >> 12) & 0xF)) // ensure same register used
+                continue;
+        }
+        if ((u8 *)off >= code + textSize) goto error;
+        off[0] = (off[0] & ~0xFF) | 99;
+        off[2] = (off[2] & ~0xFF) | 99;
+
+        // Patch date picker actions:
+        // Look for:
+        // 01 00 80 E2 ADD             R0, R0, #1
+        // 32 00 50 E3 CMP             R0, #0x32
+        off = (u32 *)code;
+        for (; (u8 *)off < code + textSize && (off[0] != 0xE2800001 || off[1] != 0xE3500032); off++);
+        if ((u8 *)off >= code + textSize) goto error;
+
+        off[1] = (off[1] & ~0xFF) | 99; // patch increment wrap-around compare instruction
+        off[9] = (off[9] & ~0xFF) | 99; // patch decrement wrap-around conditional move instruction
     }
 
     else if(progId == 0x0004013000008002LL) //NS
@@ -966,7 +1006,7 @@ void patchCode(u64 progId, u16 progVer, u8 *code, u32 size, u32 textSize, u32 ro
                countryId,
                stateId;
 
-            if(loadTitleLocaleConfig(progId, &mask, &regionId, &languageId, &countryId, &stateId))
+            if(isLumaWithKext && loadTitleLocaleConfig(progId, &mask, &regionId, &languageId, &countryId, &stateId))
                 svcKernelSetState(0x10001, ((u32)stateId << 24) | ((u32)countryId << 16) | ((u32)languageId << 8) | ((u32)regionId << 4) | (u32)mask , progId);
             if(!patchLayeredFs(progId, code, size, textSize, roSize, dataSize, roAddress, dataAddress)) goto error;
         }

sysmodules/loader/source/patcher.h

@@ -43,7 +43,7 @@ enum singleOptions
 };
 
 extern u32 config, multiConfig, bootConfig;
-extern bool isN3DS, isSdMode, nextGamePatchDisabled;
+extern bool isN3DS, isSdMode, nextGamePatchDisabled, isLumaWithKext;
 
 void patchCode(u64 progId, u16 progVer, u8 *code, u32 size, u32 textSize, u32 roSize, u32 dataSize, u32 roAddress, u32 dataAddress);
 bool loadTitleCodeSection(u64 progId, u8 *code, u32 size);

sysmodules/loader/source/romfsredir.h

@@ -10,6 +10,7 @@ extern u32 romfsRedirPatchSubstituted2, romfsRedirPatchHook2;
 
 extern u32 romfsRedirPatchArchiveName;
 extern u32 romfsRedirPatchFsMountArchive;
+extern u32 romfsRedirPatchFsUnMountArchive;
 extern u32 romfsRedirPatchFsRegisterArchive;
 extern u32 romfsRedirPatchArchiveId;
 extern u32 romfsRedirPatchRomFsMount;

sysmodules/loader/source/romfsredir.s

@@ -30,17 +30,23 @@ romfsRedirPatch:
         cmp     r3, #3
         bne     romfsRedirPatchSubstituted1
         stmfd   sp!, {r0-r4, lr}
+        adr     r0, romfsRedirPatchArchiveName
+        .global romfsRedirPatchFsUnMountArchive
+        romfsRedirPatchFsUnMountArchive:
+            .word 0xdead0004
         sub     sp, sp, #4
         ldr     r1, romfsRedirPatchArchiveId
         mov     r0, sp
-        ldr     r4, romfsRedirPatchFsMountArchive
+        .global romfsRedirPatchFsMountArchive
-        blx     r4
+        romfsRedirPatchFsMountArchive:
+            .word 0xdead0005
         mov     r3, #0
         mov     r2, #0
         ldr     r1, [sp]
         adr     r0, romfsRedirPatchArchiveName
-        ldr     r4, romfsRedirPatchFsRegisterArchive
+        .global romfsRedirPatchFsRegisterArchive
-        blx     r4
+        romfsRedirPatchFsRegisterArchive:
+            .word 0xdead0006
         add     sp, sp, #4
         ldmfd   sp!, {r0-r4, lr}
         b       romfsRedirPatchSubstituted1
@@ -108,20 +114,16 @@ romfsRedirPatch:
 .balign 4
 
     .global romfsRedirPatchArchiveName
-    .global romfsRedirPatchFsMountArchive
-    .global romfsRedirPatchFsRegisterArchive
     .global romfsRedirPatchArchiveId
     .global romfsRedirPatchRomFsMount
     .global romfsRedirPatchUpdateRomFsMount
     .global romfsRedirPatchCustomPath
 
     romfsRedirPatchArchiveName       : .ascii "lf:\0"
-    romfsRedirPatchFsMountArchive    : .word 0xdead0005
-    romfsRedirPatchFsRegisterArchive : .word 0xdead0006
     romfsRedirPatchArchiveId         : .word 0xdead0007
     romfsRedirPatchRomFsMount        : .ascii "rom:"
     romfsRedirPatchUpdateRomFsMount  : .word 0xdead0008
-    romfsRedirPatchCustomPath        : .word 0xdead0004
+    romfsRedirPatchCustomPath        : .word 0xdead0009
 
 _romfsRedirPatchEnd:
 

sysmodules/rosalina/include/csvc.h

@@ -73,6 +73,13 @@ void svcInvalidateEntireInstructionCache(void);
 
 ///@name Memory management
 ///@{
+
+/// Flags for svcMapProcessMemoryEx
+typedef enum MapExFlags
+{
+    MAPEXFLAGS_PRIVATE = BIT(0), ///< Maps the memory as PRIVATE (0xBB05) instead of SHARED (0x5806)
+} MapExFlags;
+
 /**
  * @brief Maps a block of process memory.
  * @param dstProcessHandle Handle of the process to map the memory in (destination)
@@ -80,8 +87,9 @@ void svcInvalidateEntireInstructionCache(void);
  * @param srcProcessHandle Handle of the process to map the memory from (source)
  * @param srcAddress Start address of the memory block in the source process
  * @param size Size of the block of the memory to map (truncated to a multiple of 0x1000 bytes)
+ * @param flags Extended flags for mapping the memory (see MapExFlags)
 */
-Result svcMapProcessMemoryEx(Handle dstProcessHandle, u32 destAddress, Handle srcProcessHandle, u32 srcAddress, u32 size);
+Result svcMapProcessMemoryEx(Handle dstProcessHandle, u32 destAddress, Handle srcProcessHandle, u32 srcAddress, u32 size, MapExFlags flags);
 
 /**
  * @brief Unmaps a block of process memory.

sysmodules/rosalina/include/draw.h

@@ -108,4 +108,4 @@ u32 Draw_GetCurrentFramebufferAddress(bool top, bool left);
 void Draw_GetCurrentScreenInfo(u32 *width, bool *is3d, bool top);
 
 void Draw_CreateBitmapHeader(u8 *dst, u32 width, u32 heigth);
-void Draw_ConvertFrameBufferLines(u8 *buf, u32 width, u32 startingLine, u32 numLines, bool top, bool left);
+void Draw_ConvertFrameBufferLines(u8 *buf, u32 width, u32 startingLine, u32 numLines, u32 scaleFactorY, bool top, bool left);

sysmodules/rosalina/include/gdb.h

@@ -16,6 +16,9 @@
 #include "memory.h"
 #include "ifile.h"
 
+// Uncomment the line below to dump GDB communications to a file
+//#define DEBUG_GDB_COMMUNICATIONS
+
 #define MAX_DEBUG           3
 #define MAX_DEBUG_THREAD    127
 #define MAX_BREAKPOINT      64
@@ -154,6 +157,10 @@ typedef struct GDBContext
 
     char memoryOsInfoXmlData[0x800];
     char processesOsInfoXmlData[0x1800];
+
+#ifdef DEBUG_GDB_COMMUNICATIONS
+    IFile debugFile;
+#endif
 } GDBContext;
 
 typedef int (*GDBCommandHandler)(GDBContext *ctx);

sysmodules/rosalina/include/ifile.h

@@ -44,3 +44,4 @@ Result IFile_GetSize(IFile *file, u64 *size);
 Result IFile_SetSize(IFile *file, u64 size);
 Result IFile_Read(IFile *file, u64 *total, void *buffer, u32 len);
 Result IFile_Write(IFile *file, u64 *total, const void *buffer, u32 len, u32 flags);
+Result IFile_Flush(IFile *file);

sysmodules/rosalina/include/menu.h

@@ -62,12 +62,18 @@ typedef struct MenuItem {
 typedef struct Menu {
     const char *title;
 
-    MenuItem items[16];
+    MenuItem items[25];
 } Menu;
 
 extern u32 menuCombo;
 extern bool isHidInitialized;
+extern bool isQtmInitialized;
 extern u32 mcuFwVersion;
+extern u8 mcuInfoTable[10];
+extern bool mcuInfoTableRead;
+extern const char *topScreenType;
+extern const char *bottomScreenType;
+extern bool areScreenTypesInitialized;
 
 // From main.c
 extern bool isN3DS;

sysmodules/rosalina/include/menus.h

@@ -33,13 +33,17 @@
 extern Menu rosalinaMenu;
 
 void RosalinaMenu_TakeScreenshot(void);
-void RosalinaMenu_ChangeScreenBrightness(void);
 void RosalinaMenu_ShowCredits(void);
 void RosalinaMenu_ProcessList(void);
 void RosalinaMenu_SaveSettings(void);
-void RosalinaMenu_PowerOff(void);
+void RosalinaMenu_ReturnToHomeMenu(void);
-void RosalinaMenu_Reboot(void);
 void RosalinaMenu_Cheats(void);
 
+void RosalinaMenu_PowerOffOrReboot(void);
+
+void RosalinaMenu_ShowSystemInfo();
+
 bool rosalinaMenuShouldShowDebugInfo(void);
 void RosalinaMenu_ShowDebugInfo(void);
+
+void menuTakeSelfScreenshot(void);

sysmodules/rosalina/include/menus/n3ds.h

@@ -31,6 +31,12 @@
 
 extern Menu N3DSMenu;
 
+bool N3DSMenu_CheckNotN2dsXl(void);
+
 void N3DSMenu_UpdateStatus(void);
 void N3DSMenu_ChangeClockRate(void);
 void N3DSMenu_EnableDisableL2Cache(void);
+
+void N3DSMenu_ToggleSs3d(void);
+void N3DSMenu_TestBarrierPositions(void);
+void N3DSMenu_Ss3dCalibration(void);

sysmodules/rosalina/include/menus/screen_filters.h

@@ -33,6 +33,7 @@ extern Menu screenFiltersMenu;
 typedef struct ScreenFilter {
     u16 cct;
     bool invert;
+    u8 colorCurveCorrection;
     float gamma;
     float contrast;
     float brightness;
@@ -56,4 +57,9 @@ void ScreenFiltersMenu_SetWarmIncandescent(void);   // 2300K
 void ScreenFiltersMenu_SetCandle(void);             // 1900K
 void ScreenFiltersMenu_SetEmber(void);              // 1200K
 
+void ScreenFiltersMenu_SetTopScreenSrgbColorCurve(void);
+void ScreenFiltersMenu_RestoreTopScreenColorCurve(void);
+void ScreenFiltersMenu_SetBottomScreenSrgbColorCurve(void);
+void ScreenFiltersMenu_RestoreBottomScreenColorCurve(void);
+
 void ScreenFiltersMenu_AdvancedConfiguration(void);

sysmodules/rosalina/include/menus/screen_filters_srgb_tables.h

@@ -0,0 +1,527 @@
+// SPDX-License-Identifier: MIT
+// (c) 2024 LumaTeam
+
+#pragma once
+#include <3ds/types.h>
+
+// Originally from OAF and taken with permission,
+// though it is unclear whether LUT data can be licensed
+// like code is.
+
+static const u8 ctrToSrgbTableTop[256][3] = {
+    { 0x00, 0x00, 0x00, }, // i = 0x00
+    { 0x01, 0x01, 0x01, }, // i = 0x01
+    { 0x02, 0x01, 0x02, }, // i = 0x02
+    { 0x03, 0x02, 0x03, }, // i = 0x03
+    { 0x04, 0x03, 0x04, }, // i = 0x04
+    { 0x05, 0x04, 0x05, }, // i = 0x05
+    { 0x06, 0x04, 0x06, }, // i = 0x06
+    { 0x07, 0x05, 0x06, }, // i = 0x07
+    { 0x08, 0x06, 0x07, }, // i = 0x08
+    { 0x08, 0x06, 0x08, }, // i = 0x09
+    { 0x09, 0x07, 0x09, }, // i = 0x0A
+    { 0x0A, 0x08, 0x0A, }, // i = 0x0B
+    { 0x0B, 0x09, 0x0B, }, // i = 0x0C
+    { 0x0C, 0x09, 0x0B, }, // i = 0x0D
+    { 0x0D, 0x0A, 0x0C, }, // i = 0x0E
+    { 0x0E, 0x0B, 0x0D, }, // i = 0x0F
+    { 0x0F, 0x0B, 0x0E, }, // i = 0x10
+    { 0x10, 0x0C, 0x0F, }, // i = 0x11
+    { 0x10, 0x0D, 0x0F, }, // i = 0x12
+    { 0x11, 0x0E, 0x10, }, // i = 0x13
+    { 0x12, 0x0E, 0x11, }, // i = 0x14
+    { 0x13, 0x0F, 0x12, }, // i = 0x15
+    { 0x14, 0x10, 0x12, }, // i = 0x16
+    { 0x15, 0x11, 0x13, }, // i = 0x17
+    { 0x16, 0x11, 0x14, }, // i = 0x18
+    { 0x16, 0x12, 0x15, }, // i = 0x19
+    { 0x17, 0x13, 0x15, }, // i = 0x1A
+    { 0x18, 0x14, 0x16, }, // i = 0x1B
+    { 0x19, 0x14, 0x17, }, // i = 0x1C
+    { 0x1A, 0x15, 0x18, }, // i = 0x1D
+    { 0x1B, 0x16, 0x18, }, // i = 0x1E
+    { 0x1C, 0x17, 0x19, }, // i = 0x1F
+    { 0x1C, 0x17, 0x1A, }, // i = 0x20
+    { 0x1D, 0x18, 0x1B, }, // i = 0x21
+    { 0x1E, 0x19, 0x1B, }, // i = 0x22
+    { 0x1F, 0x1A, 0x1C, }, // i = 0x23
+    { 0x20, 0x1B, 0x1D, }, // i = 0x24
+    { 0x21, 0x1B, 0x1E, }, // i = 0x25
+    { 0x22, 0x1C, 0x1E, }, // i = 0x26
+    { 0x23, 0x1D, 0x1F, }, // i = 0x27
+    { 0x23, 0x1E, 0x20, }, // i = 0x28
+    { 0x24, 0x1F, 0x21, }, // i = 0x29
+    { 0x25, 0x1F, 0x21, }, // i = 0x2A
+    { 0x26, 0x20, 0x22, }, // i = 0x2B
+    { 0x27, 0x21, 0x23, }, // i = 0x2C
+    { 0x28, 0x22, 0x24, }, // i = 0x2D
+    { 0x29, 0x23, 0x24, }, // i = 0x2E
+    { 0x2A, 0x24, 0x25, }, // i = 0x2F
+    { 0x2B, 0x24, 0x26, }, // i = 0x30
+    { 0x2C, 0x25, 0x27, }, // i = 0x31
+    { 0x2D, 0x26, 0x28, }, // i = 0x32
+    { 0x2E, 0x27, 0x28, }, // i = 0x33
+    { 0x2E, 0x28, 0x29, }, // i = 0x34
+    { 0x2F, 0x29, 0x2A, }, // i = 0x35
+    { 0x30, 0x2A, 0x2B, }, // i = 0x36
+    { 0x31, 0x2B, 0x2B, }, // i = 0x37
+    { 0x32, 0x2B, 0x2C, }, // i = 0x38
+    { 0x33, 0x2C, 0x2D, }, // i = 0x39
+    { 0x34, 0x2D, 0x2E, }, // i = 0x3A
+    { 0x35, 0x2E, 0x2F, }, // i = 0x3B
+    { 0x36, 0x2F, 0x30, }, // i = 0x3C
+    { 0x37, 0x30, 0x30, }, // i = 0x3D
+    { 0x38, 0x31, 0x31, }, // i = 0x3E
+    { 0x39, 0x32, 0x32, }, // i = 0x3F
+    { 0x3A, 0x33, 0x33, }, // i = 0x40
+    { 0x3B, 0x34, 0x34, }, // i = 0x41
+    { 0x3C, 0x35, 0x34, }, // i = 0x42
+    { 0x3D, 0x35, 0x35, }, // i = 0x43
+    { 0x3E, 0x36, 0x36, }, // i = 0x44
+    { 0x3F, 0x37, 0x37, }, // i = 0x45
+    { 0x40, 0x38, 0x38, }, // i = 0x46
+    { 0x41, 0x39, 0x39, }, // i = 0x47
+    { 0x42, 0x3A, 0x3A, }, // i = 0x48
+    { 0x43, 0x3B, 0x3A, }, // i = 0x49
+    { 0x44, 0x3C, 0x3B, }, // i = 0x4A
+    { 0x45, 0x3D, 0x3C, }, // i = 0x4B
+    { 0x46, 0x3E, 0x3D, }, // i = 0x4C
+    { 0x47, 0x3F, 0x3E, }, // i = 0x4D
+    { 0x48, 0x40, 0x3F, }, // i = 0x4E
+    { 0x49, 0x41, 0x40, }, // i = 0x4F
+    { 0x4A, 0x42, 0x41, }, // i = 0x50
+    { 0x4B, 0x43, 0x41, }, // i = 0x51
+    { 0x4C, 0x44, 0x42, }, // i = 0x52
+    { 0x4D, 0x45, 0x43, }, // i = 0x53
+    { 0x4E, 0x46, 0x44, }, // i = 0x54
+    { 0x4F, 0x47, 0x45, }, // i = 0x55
+    { 0x50, 0x48, 0x46, }, // i = 0x56
+    { 0x51, 0x49, 0x47, }, // i = 0x57
+    { 0x52, 0x4A, 0x48, }, // i = 0x58
+    { 0x53, 0x4B, 0x49, }, // i = 0x59
+    { 0x54, 0x4C, 0x4A, }, // i = 0x5A
+    { 0x55, 0x4D, 0x4B, }, // i = 0x5B
+    { 0x56, 0x4E, 0x4B, }, // i = 0x5C
+    { 0x57, 0x4F, 0x4C, }, // i = 0x5D
+    { 0x58, 0x50, 0x4D, }, // i = 0x5E
+    { 0x59, 0x51, 0x4E, }, // i = 0x5F
+    { 0x5B, 0x52, 0x4F, }, // i = 0x60
+    { 0x5C, 0x53, 0x50, }, // i = 0x61
+    { 0x5D, 0x54, 0x51, }, // i = 0x62
+    { 0x5E, 0x55, 0x52, }, // i = 0x63
+    { 0x5F, 0x56, 0x53, }, // i = 0x64
+    { 0x60, 0x57, 0x54, }, // i = 0x65
+    { 0x61, 0x58, 0x55, }, // i = 0x66
+    { 0x62, 0x59, 0x56, }, // i = 0x67
+    { 0x63, 0x5A, 0x57, }, // i = 0x68
+    { 0x64, 0x5B, 0x57, }, // i = 0x69
+    { 0x65, 0x5C, 0x58, }, // i = 0x6A
+    { 0x66, 0x5D, 0x59, }, // i = 0x6B
+    { 0x67, 0x5E, 0x5A, }, // i = 0x6C
+    { 0x68, 0x5F, 0x5B, }, // i = 0x6D
+    { 0x69, 0x60, 0x5C, }, // i = 0x6E
+    { 0x6A, 0x61, 0x5D, }, // i = 0x6F
+    { 0x6B, 0x62, 0x5E, }, // i = 0x70
+    { 0x6C, 0x63, 0x5F, }, // i = 0x71
+    { 0x6D, 0x64, 0x60, }, // i = 0x72
+    { 0x6E, 0x65, 0x61, }, // i = 0x73
+    { 0x6F, 0x66, 0x62, }, // i = 0x74
+    { 0x70, 0x67, 0x63, }, // i = 0x75
+    { 0x71, 0x68, 0x64, }, // i = 0x76
+    { 0x73, 0x69, 0x65, }, // i = 0x77
+    { 0x74, 0x6A, 0x66, }, // i = 0x78
+    { 0x75, 0x6B, 0x67, }, // i = 0x79
+    { 0x76, 0x6C, 0x68, }, // i = 0x7A
+    { 0x77, 0x6D, 0x68, }, // i = 0x7B
+    { 0x78, 0x6E, 0x69, }, // i = 0x7C
+    { 0x79, 0x6F, 0x6A, }, // i = 0x7D
+    { 0x7A, 0x70, 0x6B, }, // i = 0x7E
+    { 0x7B, 0x71, 0x6C, }, // i = 0x7F
+    { 0x7C, 0x72, 0x6D, }, // i = 0x80
+    { 0x7D, 0x73, 0x6E, }, // i = 0x81
+    { 0x7E, 0x74, 0x6F, }, // i = 0x82
+    { 0x7F, 0x75, 0x70, }, // i = 0x83
+    { 0x80, 0x76, 0x71, }, // i = 0x84
+    { 0x81, 0x77, 0x72, }, // i = 0x85
+    { 0x82, 0x78, 0x73, }, // i = 0x86
+    { 0x83, 0x79, 0x74, }, // i = 0x87
+    { 0x84, 0x7A, 0x75, }, // i = 0x88
+    { 0x85, 0x7B, 0x76, }, // i = 0x89
+    { 0x86, 0x7C, 0x77, }, // i = 0x8A
+    { 0x87, 0x7D, 0x78, }, // i = 0x8B
+    { 0x88, 0x7E, 0x79, }, // i = 0x8C
+    { 0x89, 0x7F, 0x7A, }, // i = 0x8D
+    { 0x8A, 0x81, 0x7B, }, // i = 0x8E
+    { 0x8B, 0x82, 0x7C, }, // i = 0x8F
+    { 0x8C, 0x83, 0x7C, }, // i = 0x90
+    { 0x8D, 0x84, 0x7D, }, // i = 0x91
+    { 0x8E, 0x85, 0x7E, }, // i = 0x92
+    { 0x8F, 0x86, 0x7F, }, // i = 0x93
+    { 0x90, 0x87, 0x80, }, // i = 0x94
+    { 0x91, 0x88, 0x81, }, // i = 0x95
+    { 0x92, 0x89, 0x82, }, // i = 0x96
+    { 0x93, 0x8A, 0x83, }, // i = 0x97
+    { 0x94, 0x8B, 0x84, }, // i = 0x98
+    { 0x95, 0x8C, 0x85, }, // i = 0x99
+    { 0x96, 0x8D, 0x86, }, // i = 0x9A
+    { 0x97, 0x8E, 0x87, }, // i = 0x9B
+    { 0x98, 0x8F, 0x88, }, // i = 0x9C
+    { 0x99, 0x90, 0x89, }, // i = 0x9D
+    { 0x9A, 0x91, 0x8A, }, // i = 0x9E
+    { 0x9B, 0x92, 0x8B, }, // i = 0x9F
+    { 0x9C, 0x93, 0x8C, }, // i = 0xA0
+    { 0x9D, 0x94, 0x8D, }, // i = 0xA1
+    { 0x9E, 0x95, 0x8E, }, // i = 0xA2
+    { 0x9F, 0x96, 0x8F, }, // i = 0xA3
+    { 0xA0, 0x97, 0x90, }, // i = 0xA4
+    { 0xA1, 0x98, 0x91, }, // i = 0xA5
+    { 0xA2, 0x99, 0x92, }, // i = 0xA6
+    { 0xA4, 0x9A, 0x93, }, // i = 0xA7
+    { 0xA5, 0x9B, 0x94, }, // i = 0xA8
+    { 0xA6, 0x9C, 0x95, }, // i = 0xA9
+    { 0xA7, 0x9D, 0x96, }, // i = 0xAA
+    { 0xA8, 0x9F, 0x97, }, // i = 0xAB
+    { 0xA9, 0xA0, 0x98, }, // i = 0xAC
+    { 0xAA, 0xA1, 0x99, }, // i = 0xAD
+    { 0xAB, 0xA2, 0x9A, }, // i = 0xAE
+    { 0xAC, 0xA3, 0x9B, }, // i = 0xAF
+    { 0xAD, 0xA4, 0x9C, }, // i = 0xB0
+    { 0xAE, 0xA5, 0x9D, }, // i = 0xB1
+    { 0xAF, 0xA6, 0x9E, }, // i = 0xB2
+    { 0xB0, 0xA7, 0x9F, }, // i = 0xB3
+    { 0xB1, 0xA8, 0xA0, }, // i = 0xB4
+    { 0xB2, 0xA9, 0xA1, }, // i = 0xB5
+    { 0xB3, 0xAA, 0xA2, }, // i = 0xB6
+    { 0xB4, 0xAB, 0xA3, }, // i = 0xB7
+    { 0xB5, 0xAC, 0xA4, }, // i = 0xB8
+    { 0xB6, 0xAD, 0xA5, }, // i = 0xB9
+    { 0xB7, 0xAF, 0xA6, }, // i = 0xBA
+    { 0xB8, 0xB0, 0xA7, }, // i = 0xBB
+    { 0xB9, 0xB1, 0xA9, }, // i = 0xBC
+    { 0xBA, 0xB2, 0xAA, }, // i = 0xBD
+    { 0xBB, 0xB3, 0xAB, }, // i = 0xBE
+    { 0xBC, 0xB4, 0xAC, }, // i = 0xBF
+    { 0xBD, 0xB5, 0xAD, }, // i = 0xC0
+    { 0xBE, 0xB6, 0xAE, }, // i = 0xC1
+    { 0xBF, 0xB7, 0xAF, }, // i = 0xC2
+    { 0xC0, 0xB9, 0xB0, }, // i = 0xC3
+    { 0xC1, 0xBA, 0xB1, }, // i = 0xC4
+    { 0xC3, 0xBB, 0xB2, }, // i = 0xC5
+    { 0xC4, 0xBC, 0xB4, }, // i = 0xC6
+    { 0xC5, 0xBD, 0xB5, }, // i = 0xC7
+    { 0xC6, 0xBE, 0xB6, }, // i = 0xC8
+    { 0xC7, 0xBF, 0xB7, }, // i = 0xC9
+    { 0xC8, 0xC0, 0xB8, }, // i = 0xCA
+    { 0xC9, 0xC2, 0xB9, }, // i = 0xCB
+    { 0xCA, 0xC3, 0xBB, }, // i = 0xCC
+    { 0xCB, 0xC4, 0xBC, }, // i = 0xCD
+    { 0xCC, 0xC5, 0xBD, }, // i = 0xCE
+    { 0xCD, 0xC6, 0xBE, }, // i = 0xCF
+    { 0xCE, 0xC7, 0xBF, }, // i = 0xD0
+    { 0xCF, 0xC8, 0xC1, }, // i = 0xD1
+    { 0xD0, 0xCA, 0xC2, }, // i = 0xD2
+    { 0xD2, 0xCB, 0xC3, }, // i = 0xD3
+    { 0xD3, 0xCC, 0xC4, }, // i = 0xD4
+    { 0xD4, 0xCD, 0xC5, }, // i = 0xD5
+    { 0xD5, 0xCE, 0xC7, }, // i = 0xD6
+    { 0xD6, 0xCF, 0xC8, }, // i = 0xD7
+    { 0xD7, 0xD1, 0xC9, }, // i = 0xD8
+    { 0xD8, 0xD2, 0xCB, }, // i = 0xD9
+    { 0xD9, 0xD3, 0xCC, }, // i = 0xDA
+    { 0xDA, 0xD4, 0xCD, }, // i = 0xDB
+    { 0xDB, 0xD5, 0xCE, }, // i = 0xDC
+    { 0xDC, 0xD7, 0xD0, }, // i = 0xDD
+    { 0xDE, 0xD8, 0xD1, }, // i = 0xDE
+    { 0xDF, 0xD9, 0xD2, }, // i = 0xDF
+    { 0xE0, 0xDA, 0xD4, }, // i = 0xE0
+    { 0xE1, 0xDB, 0xD5, }, // i = 0xE1
+    { 0xE2, 0xDD, 0xD6, }, // i = 0xE2
+    { 0xE3, 0xDE, 0xD8, }, // i = 0xE3
+    { 0xE4, 0xDF, 0xD9, }, // i = 0xE4
+    { 0xE5, 0xE0, 0xDA, }, // i = 0xE5
+    { 0xE6, 0xE1, 0xDC, }, // i = 0xE6
+    { 0xE7, 0xE3, 0xDD, }, // i = 0xE7
+    { 0xE8, 0xE4, 0xDE, }, // i = 0xE8
+    { 0xEA, 0xE5, 0xE0, }, // i = 0xE9
+    { 0xEB, 0xE6, 0xE1, }, // i = 0xEA
+    { 0xEC, 0xE7, 0xE2, }, // i = 0xEB
+    { 0xED, 0xE9, 0xE4, }, // i = 0xEC
+    { 0xEE, 0xEA, 0xE5, }, // i = 0xED
+    { 0xEF, 0xEB, 0xE7, }, // i = 0xEE
+    { 0xF0, 0xEC, 0xE8, }, // i = 0xEF
+    { 0xF1, 0xED, 0xE9, }, // i = 0xF0
+    { 0xF2, 0xEF, 0xEB, }, // i = 0xF1
+    { 0xF3, 0xF0, 0xEC, }, // i = 0xF2
+    { 0xF4, 0xF1, 0xEE, }, // i = 0xF3
+    { 0xF5, 0xF2, 0xEF, }, // i = 0xF4
+    { 0xF6, 0xF3, 0xF1, }, // i = 0xF5
+    { 0xF7, 0xF5, 0xF2, }, // i = 0xF6
+    { 0xF8, 0xF6, 0xF3, }, // i = 0xF7
+    { 0xF9, 0xF7, 0xF5, }, // i = 0xF8
+    { 0xFA, 0xF8, 0xF6, }, // i = 0xF9
+    { 0xFB, 0xF9, 0xF8, }, // i = 0xFA
+    { 0xFC, 0xFA, 0xF9, }, // i = 0xFB
+    { 0xFD, 0xFC, 0xFA, }, // i = 0xFC
+    { 0xFD, 0xFD, 0xFC, }, // i = 0xFD
+    { 0xFE, 0xFE, 0xFD, }, // i = 0xFE
+    { 0xFF, 0xFF, 0xFF, }, // i = 0xFF
+};
+
+static const u8 ctrToSrgbTableBottom[256][3] = {
+    { 0x00, 0x00, 0x00, }, // i = 0x00
+    { 0x01, 0x00, 0x00, }, // i = 0x01
+    { 0x01, 0x00, 0x01, }, // i = 0x02
+    { 0x02, 0x01, 0x01, }, // i = 0x03
+    { 0x02, 0x01, 0x02, }, // i = 0x04
+    { 0x03, 0x01, 0x03, }, // i = 0x05
+    { 0x04, 0x02, 0x03, }, // i = 0x06
+    { 0x04, 0x02, 0x04, }, // i = 0x07
+    { 0x05, 0x02, 0x04, }, // i = 0x08
+    { 0x05, 0x03, 0x05, }, // i = 0x09
+    { 0x06, 0x03, 0x05, }, // i = 0x0A
+    { 0x07, 0x04, 0x06, }, // i = 0x0B
+    { 0x07, 0x04, 0x07, }, // i = 0x0C
+    { 0x08, 0x05, 0x07, }, // i = 0x0D
+    { 0x09, 0x05, 0x08, }, // i = 0x0E
+    { 0x0A, 0x06, 0x08, }, // i = 0x0F
+    { 0x0A, 0x06, 0x09, }, // i = 0x10
+    { 0x0B, 0x07, 0x0A, }, // i = 0x11
+    { 0x0C, 0x08, 0x0A, }, // i = 0x12
+    { 0x0C, 0x08, 0x0B, }, // i = 0x13
+    { 0x0D, 0x09, 0x0C, }, // i = 0x14
+    { 0x0E, 0x09, 0x0C, }, // i = 0x15
+    { 0x0F, 0x0A, 0x0D, }, // i = 0x16
+    { 0x10, 0x0B, 0x0E, }, // i = 0x17
+    { 0x10, 0x0B, 0x0F, }, // i = 0x18
+    { 0x11, 0x0C, 0x0F, }, // i = 0x19
+    { 0x12, 0x0D, 0x10, }, // i = 0x1A
+    { 0x13, 0x0D, 0x11, }, // i = 0x1B
+    { 0x14, 0x0E, 0x12, }, // i = 0x1C
+    { 0x14, 0x0F, 0x12, }, // i = 0x1D
+    { 0x15, 0x10, 0x13, }, // i = 0x1E
+    { 0x16, 0x10, 0x14, }, // i = 0x1F
+    { 0x17, 0x11, 0x15, }, // i = 0x20
+    { 0x18, 0x12, 0x15, }, // i = 0x21
+    { 0x19, 0x13, 0x16, }, // i = 0x22
+    { 0x19, 0x13, 0x17, }, // i = 0x23
+    { 0x1A, 0x14, 0x18, }, // i = 0x24
+    { 0x1B, 0x15, 0x18, }, // i = 0x25
+    { 0x1C, 0x16, 0x19, }, // i = 0x26
+    { 0x1D, 0x17, 0x1A, }, // i = 0x27
+    { 0x1E, 0x18, 0x1B, }, // i = 0x28
+    { 0x1F, 0x18, 0x1C, }, // i = 0x29
+    { 0x20, 0x19, 0x1C, }, // i = 0x2A
+    { 0x21, 0x1A, 0x1D, }, // i = 0x2B
+    { 0x22, 0x1B, 0x1E, }, // i = 0x2C
+    { 0x22, 0x1C, 0x1F, }, // i = 0x2D
+    { 0x23, 0x1D, 0x20, }, // i = 0x2E
+    { 0x24, 0x1E, 0x21, }, // i = 0x2F
+    { 0x25, 0x1E, 0x21, }, // i = 0x30
+    { 0x26, 0x1F, 0x22, }, // i = 0x31
+    { 0x27, 0x20, 0x23, }, // i = 0x32
+    { 0x28, 0x21, 0x24, }, // i = 0x33
+    { 0x29, 0x22, 0x25, }, // i = 0x34
+    { 0x2A, 0x23, 0x26, }, // i = 0x35
+    { 0x2B, 0x24, 0x27, }, // i = 0x36
+    { 0x2C, 0x25, 0x27, }, // i = 0x37
+    { 0x2D, 0x26, 0x28, }, // i = 0x38
+    { 0x2E, 0x27, 0x29, }, // i = 0x39
+    { 0x2F, 0x28, 0x2A, }, // i = 0x3A
+    { 0x30, 0x29, 0x2B, }, // i = 0x3B
+    { 0x31, 0x2A, 0x2C, }, // i = 0x3C
+    { 0x32, 0x2A, 0x2D, }, // i = 0x3D
+    { 0x33, 0x2B, 0x2E, }, // i = 0x3E
+    { 0x34, 0x2C, 0x2E, }, // i = 0x3F
+    { 0x35, 0x2D, 0x2F, }, // i = 0x40
+    { 0x36, 0x2E, 0x30, }, // i = 0x41
+    { 0x37, 0x2F, 0x31, }, // i = 0x42
+    { 0x38, 0x30, 0x32, }, // i = 0x43
+    { 0x39, 0x31, 0x33, }, // i = 0x44
+    { 0x3A, 0x32, 0x34, }, // i = 0x45
+    { 0x3B, 0x33, 0x35, }, // i = 0x46
+    { 0x3C, 0x34, 0x36, }, // i = 0x47
+    { 0x3D, 0x35, 0x36, }, // i = 0x48
+    { 0x3E, 0x36, 0x37, }, // i = 0x49
+    { 0x3F, 0x37, 0x38, }, // i = 0x4A
+    { 0x40, 0x38, 0x39, }, // i = 0x4B
+    { 0x41, 0x39, 0x3A, }, // i = 0x4C
+    { 0x42, 0x3A, 0x3B, }, // i = 0x4D
+    { 0x43, 0x3B, 0x3C, }, // i = 0x4E
+    { 0x44, 0x3C, 0x3D, }, // i = 0x4F
+    { 0x45, 0x3D, 0x3E, }, // i = 0x50
+    { 0x46, 0x3E, 0x3F, }, // i = 0x51
+    { 0x47, 0x3F, 0x40, }, // i = 0x52
+    { 0x49, 0x40, 0x41, }, // i = 0x53
+    { 0x4A, 0x41, 0x42, }, // i = 0x54
+    { 0x4B, 0x42, 0x42, }, // i = 0x55
+    { 0x4C, 0x43, 0x43, }, // i = 0x56
+    { 0x4D, 0x44, 0x44, }, // i = 0x57
+    { 0x4E, 0x45, 0x45, }, // i = 0x58
+    { 0x4F, 0x46, 0x46, }, // i = 0x59
+    { 0x50, 0x47, 0x47, }, // i = 0x5A
+    { 0x51, 0x48, 0x48, }, // i = 0x5B
+    { 0x52, 0x49, 0x49, }, // i = 0x5C
+    { 0x53, 0x4A, 0x4A, }, // i = 0x5D
+    { 0x54, 0x4B, 0x4B, }, // i = 0x5E
+    { 0x55, 0x4C, 0x4C, }, // i = 0x5F
+    { 0x56, 0x4D, 0x4D, }, // i = 0x60
+    { 0x57, 0x4E, 0x4E, }, // i = 0x61
+    { 0x58, 0x4F, 0x4F, }, // i = 0x62
+    { 0x5A, 0x50, 0x50, }, // i = 0x63
+    { 0x5B, 0x51, 0x51, }, // i = 0x64
+    { 0x5C, 0x52, 0x52, }, // i = 0x65
+    { 0x5D, 0x53, 0x53, }, // i = 0x66
+    { 0x5E, 0x54, 0x54, }, // i = 0x67
+    { 0x5F, 0x55, 0x54, }, // i = 0x68
+    { 0x60, 0x56, 0x55, }, // i = 0x69
+    { 0x61, 0x57, 0x56, }, // i = 0x6A
+    { 0x62, 0x58, 0x57, }, // i = 0x6B
+    { 0x63, 0x59, 0x58, }, // i = 0x6C
+    { 0x64, 0x5B, 0x59, }, // i = 0x6D
+    { 0x65, 0x5C, 0x5A, }, // i = 0x6E
+    { 0x66, 0x5D, 0x5B, }, // i = 0x6F
+    { 0x68, 0x5E, 0x5C, }, // i = 0x70
+    { 0x69, 0x5F, 0x5D, }, // i = 0x71
+    { 0x6A, 0x60, 0x5E, }, // i = 0x72
+    { 0x6B, 0x61, 0x5F, }, // i = 0x73
+    { 0x6C, 0x62, 0x60, }, // i = 0x74
+    { 0x6D, 0x63, 0x61, }, // i = 0x75
+    { 0x6E, 0x64, 0x62, }, // i = 0x76
+    { 0x6F, 0x65, 0x63, }, // i = 0x77
+    { 0x70, 0x66, 0x64, }, // i = 0x78
+    { 0x71, 0x67, 0x65, }, // i = 0x79
+    { 0x72, 0x68, 0x66, }, // i = 0x7A
+    { 0x73, 0x69, 0x67, }, // i = 0x7B
+    { 0x74, 0x6A, 0x68, }, // i = 0x7C
+    { 0x76, 0x6B, 0x69, }, // i = 0x7D
+    { 0x77, 0x6C, 0x6A, }, // i = 0x7E
+    { 0x78, 0x6D, 0x6B, }, // i = 0x7F
+    { 0x79, 0x6E, 0x6C, }, // i = 0x80
+    { 0x7A, 0x70, 0x6D, }, // i = 0x81
+    { 0x7B, 0x71, 0x6E, }, // i = 0x82
+    { 0x7C, 0x72, 0x6F, }, // i = 0x83
+    { 0x7D, 0x73, 0x70, }, // i = 0x84
+    { 0x7E, 0x74, 0x71, }, // i = 0x85
+    { 0x7F, 0x75, 0x72, }, // i = 0x86
+    { 0x80, 0x76, 0x73, }, // i = 0x87
+    { 0x82, 0x77, 0x74, }, // i = 0x88
+    { 0x83, 0x78, 0x75, }, // i = 0x89
+    { 0x84, 0x79, 0x76, }, // i = 0x8A
+    { 0x85, 0x7A, 0x77, }, // i = 0x8B
+    { 0x86, 0x7B, 0x78, }, // i = 0x8C
+    { 0x87, 0x7C, 0x79, }, // i = 0x8D
+    { 0x88, 0x7E, 0x7A, }, // i = 0x8E
+    { 0x89, 0x7F, 0x7B, }, // i = 0x8F
+    { 0x8A, 0x80, 0x7C, }, // i = 0x90
+    { 0x8B, 0x81, 0x7D, }, // i = 0x91
+    { 0x8C, 0x82, 0x7E, }, // i = 0x92
+    { 0x8D, 0x83, 0x7F, }, // i = 0x93
+    { 0x8F, 0x84, 0x80, }, // i = 0x94
+    { 0x90, 0x85, 0x81, }, // i = 0x95
+    { 0x91, 0x86, 0x82, }, // i = 0x96
+    { 0x92, 0x87, 0x84, }, // i = 0x97
+    { 0x93, 0x88, 0x85, }, // i = 0x98
+    { 0x94, 0x8A, 0x86, }, // i = 0x99
+    { 0x95, 0x8B, 0x87, }, // i = 0x9A
+    { 0x96, 0x8C, 0x88, }, // i = 0x9B
+    { 0x97, 0x8D, 0x89, }, // i = 0x9C
+    { 0x98, 0x8E, 0x8A, }, // i = 0x9D
+    { 0x99, 0x8F, 0x8B, }, // i = 0x9E
+    { 0x9B, 0x90, 0x8C, }, // i = 0x9F
+    { 0x9C, 0x91, 0x8D, }, // i = 0xA0
+    { 0x9D, 0x92, 0x8E, }, // i = 0xA1
+    { 0x9E, 0x94, 0x8F, }, // i = 0xA2
+    { 0x9F, 0x95, 0x90, }, // i = 0xA3
+    { 0xA0, 0x96, 0x91, }, // i = 0xA4
+    { 0xA1, 0x97, 0x92, }, // i = 0xA5
+    { 0xA2, 0x98, 0x93, }, // i = 0xA6
+    { 0xA3, 0x99, 0x94, }, // i = 0xA7
+    { 0xA4, 0x9A, 0x95, }, // i = 0xA8
+    { 0xA5, 0x9B, 0x97, }, // i = 0xA9
+    { 0xA7, 0x9C, 0x98, }, // i = 0xAA
+    { 0xA8, 0x9E, 0x99, }, // i = 0xAB
+    { 0xA9, 0x9F, 0x9A, }, // i = 0xAC
+    { 0xAA, 0xA0, 0x9B, }, // i = 0xAD
+    { 0xAB, 0xA1, 0x9C, }, // i = 0xAE
+    { 0xAC, 0xA2, 0x9D, }, // i = 0xAF
+    { 0xAD, 0xA3, 0x9E, }, // i = 0xB0
+    { 0xAE, 0xA4, 0x9F, }, // i = 0xB1
+    { 0xAF, 0xA5, 0xA0, }, // i = 0xB2
+    { 0xB0, 0xA7, 0xA1, }, // i = 0xB3
+    { 0xB1, 0xA8, 0xA3, }, // i = 0xB4
+    { 0xB3, 0xA9, 0xA4, }, // i = 0xB5
+    { 0xB4, 0xAA, 0xA5, }, // i = 0xB6
+    { 0xB5, 0xAB, 0xA6, }, // i = 0xB7
+    { 0xB6, 0xAC, 0xA7, }, // i = 0xB8
+    { 0xB7, 0xAD, 0xA8, }, // i = 0xB9
+    { 0xB8, 0xAF, 0xA9, }, // i = 0xBA
+    { 0xB9, 0xB0, 0xAA, }, // i = 0xBB
+    { 0xBA, 0xB1, 0xAB, }, // i = 0xBC
+    { 0xBB, 0xB2, 0xAD, }, // i = 0xBD
+    { 0xBC, 0xB3, 0xAE, }, // i = 0xBE
+    { 0xBD, 0xB4, 0xAF, }, // i = 0xBF
+    { 0xBE, 0xB5, 0xB0, }, // i = 0xC0
+    { 0xC0, 0xB7, 0xB1, }, // i = 0xC1
+    { 0xC1, 0xB8, 0xB2, }, // i = 0xC2
+    { 0xC2, 0xB9, 0xB3, }, // i = 0xC3
+    { 0xC3, 0xBA, 0xB5, }, // i = 0xC4
+    { 0xC4, 0xBB, 0xB6, }, // i = 0xC5
+    { 0xC5, 0xBC, 0xB7, }, // i = 0xC6
+    { 0xC6, 0xBE, 0xB8, }, // i = 0xC7
+    { 0xC7, 0xBF, 0xB9, }, // i = 0xC8
+    { 0xC8, 0xC0, 0xBA, }, // i = 0xC9
+    { 0xC9, 0xC1, 0xBB, }, // i = 0xCA
+    { 0xCA, 0xC2, 0xBD, }, // i = 0xCB
+    { 0xCC, 0xC3, 0xBE, }, // i = 0xCC
+    { 0xCD, 0xC4, 0xBF, }, // i = 0xCD
+    { 0xCE, 0xC6, 0xC0, }, // i = 0xCE
+    { 0xCF, 0xC7, 0xC1, }, // i = 0xCF
+    { 0xD0, 0xC8, 0xC2, }, // i = 0xD0
+    { 0xD1, 0xC9, 0xC4, }, // i = 0xD1
+    { 0xD2, 0xCA, 0xC5, }, // i = 0xD2
+    { 0xD3, 0xCB, 0xC6, }, // i = 0xD3
+    { 0xD4, 0xCD, 0xC7, }, // i = 0xD4
+    { 0xD5, 0xCE, 0xC8, }, // i = 0xD5
+    { 0xD6, 0xCF, 0xCA, }, // i = 0xD6
+    { 0xD7, 0xD0, 0xCB, }, // i = 0xD7
+    { 0xD8, 0xD1, 0xCC, }, // i = 0xD8
+    { 0xD9, 0xD2, 0xCD, }, // i = 0xD9
+    { 0xDB, 0xD4, 0xCE, }, // i = 0xDA
+    { 0xDC, 0xD5, 0xD0, }, // i = 0xDB
+    { 0xDD, 0xD6, 0xD1, }, // i = 0xDC
+    { 0xDE, 0xD7, 0xD2, }, // i = 0xDD
+    { 0xDF, 0xD8, 0xD3, }, // i = 0xDE
+    { 0xE0, 0xD9, 0xD5, }, // i = 0xDF
+    { 0xE1, 0xDB, 0xD6, }, // i = 0xE0
+    { 0xE2, 0xDC, 0xD7, }, // i = 0xE1
+    { 0xE3, 0xDD, 0xD8, }, // i = 0xE2
+    { 0xE4, 0xDE, 0xDA, }, // i = 0xE3
+    { 0xE5, 0xDF, 0xDB, }, // i = 0xE4
+    { 0xE6, 0xE0, 0xDC, }, // i = 0xE5
+    { 0xE7, 0xE2, 0xDD, }, // i = 0xE6
+    { 0xE8, 0xE3, 0xDF, }, // i = 0xE7
+    { 0xE9, 0xE4, 0xE0, }, // i = 0xE8
+    { 0xEA, 0xE5, 0xE1, }, // i = 0xE9
+    { 0xEB, 0xE6, 0xE3, }, // i = 0xEA
+    { 0xEC, 0xE8, 0xE4, }, // i = 0xEB
+    { 0xED, 0xE9, 0xE5, }, // i = 0xEC
+    { 0xEE, 0xEA, 0xE7, }, // i = 0xED
+    { 0xEF, 0xEB, 0xE8, }, // i = 0xEE
+    { 0xF0, 0xEC, 0xE9, }, // i = 0xEF
+    { 0xF1, 0xED, 0xEB, }, // i = 0xF0
+    { 0xF2, 0xEF, 0xEC, }, // i = 0xF1
+    { 0xF3, 0xF0, 0xED, }, // i = 0xF2
+    { 0xF4, 0xF1, 0xEF, }, // i = 0xF3
+    { 0xF5, 0xF2, 0xF0, }, // i = 0xF4
+    { 0xF6, 0xF3, 0xF1, }, // i = 0xF5
+    { 0xF7, 0xF5, 0xF3, }, // i = 0xF6
+    { 0xF8, 0xF6, 0xF4, }, // i = 0xF7
+    { 0xF9, 0xF7, 0xF6, }, // i = 0xF8
+    { 0xFA, 0xF8, 0xF7, }, // i = 0xF9
+    { 0xFB, 0xFA, 0xF8, }, // i = 0xFA
+    { 0xFC, 0xFB, 0xFA, }, // i = 0xFB
+    { 0xFD, 0xFC, 0xFB, }, // i = 0xFC
+    { 0xFE, 0xFD, 0xFD, }, // i = 0xFD
+    { 0xFE, 0xFE, 0xFE, }, // i = 0xFE
+    { 0xFF, 0xFF, 0xFF, }, // i = 0xFF
+};

sysmodules/rosalina/include/menus/sysconfig.h

@@ -43,3 +43,4 @@ void SysConfigMenu_DisableForcedWifiConnection(void);
 void SysConfigMenu_ToggleCardIfPower(void);
 void SysConfigMenu_LoadConfig(void);
 void SysConfigMenu_AdjustVolume(void);
+void SysConfigMenu_ChangeScreenBrightness(void);

sysmodules/rosalina/include/plugin/3gx.h

@@ -23,7 +23,9 @@ typedef struct CTR_PACKED
             u32     compatibility : 2;
             u32     eventsSelfManaged : 1;
             u32     swapNotNeeded : 1;
-            u32     unused : 24;
+            u32     usePrivateMemory : 1;
+            u32     allowHomebrewLoad : 1;
+            u32     unused : 22;
         };
     };
     u32             exeLoadChecksum;

sysmodules/rosalina/include/plugin/plgldr.h

@@ -11,6 +11,7 @@ typedef struct
 {
     bool    noFlash;
     u8      pluginMemoryStrategy;
+    u8      persistent;
     u32     lowTitleId;
     char    path[256];
     u32     config[32];
@@ -55,10 +56,12 @@ typedef struct
     s32*            plgldrEvent; ///< Used for synchronization
     s32*            plgldrReply; ///< Used for synchronization
     u8              notifyHomeEvent;
-    u8              padding[3];
+    u8              padding[7];
-    u32             reserved[23];
+    u64             waitForReplyTimeout;
+    u32             reserved[20];
     u32             config[32];
-}   PluginHeader;
+} PluginHeader;
+_Static_assert(sizeof(PluginHeader) == 0x100, "Invalid PluginHeader size");
 
 typedef void (*OnPlgLdrEventCb_t)(s32 eventType);
 

sysmodules/rosalina/include/plugin/plgloader.h

@@ -34,7 +34,7 @@ u32         saveSwapFunc(void* startAddr, void* endAddr, void* args);
 u32         loadSwapFunc(void* startAddr, void* endAddr, void* args);
 u32		    loadExeFunc(void* startAddr, void* endAddr, void* args);
 
-bool     TryToLoadPlugin(Handle process);
+bool     TryToLoadPlugin(Handle process, bool isHomebrew);
 void    PLG__NotifyEvent(PLG_Event event, bool signal);
 void     PLG__SetConfigMemoryStatus(u32 status);
 u32      PLG__GetConfigMemoryStatus(void);
@@ -93,6 +93,7 @@ typedef struct
     u32             swapLoadChecksum;    
 
     bool            eventsSelfManaged;
+    bool            isMemPrivate;
 }   PluginLoaderContext;
 
 extern PluginLoaderContext PluginLoaderCtx;

sysmodules/rosalina/include/utils.h

@@ -30,6 +30,7 @@
 #include <3ds/srv.h>
 #include <3ds/result.h>
 #include <3ds/ipc.h>
+#include <assert.h>
 #include "csvc.h"
 #include "luma_shared_config.h"
 

sysmodules/rosalina/source/csvc.s

@@ -59,10 +59,13 @@ SVC_BEGIN svcInvalidateEntireInstructionCache
 SVC_END
 
 SVC_BEGIN svcMapProcessMemoryEx
-    str r4, [sp, #-4]!
+    push {r4, r5, r6}
-    ldr r4, [sp, #4]
+    ldr r4, [sp, #12]
+    ldr r5, [sp, #16]
+    mov r6, r0 @ Move the dst handle to r6 to make room for magic value
+    mov r0, #0xFFFFFFF2 @ Set r0 to magic value, which allows for backwards compatibility
     svc 0xA0
-    ldr r4, [sp], #4
+    pop {r4, r5, r6}
     bx lr
 SVC_END
 

sysmodules/rosalina/source/draw.c

@@ -140,7 +140,7 @@ Result Draw_AllocateFramebufferCache(u32 size)
     if (framebufferCache != NULL)
         __builtin_trap();
 
-    Result res = svcControlMemoryEx(&tmp, addr, 0, size, MEMOP_ALLOC, MEMREGION_SYSTEM | MEMPERM_READWRITE, true);
+    Result res = svcControlMemoryEx(&tmp, addr, 0, size, MEMOP_ALLOC | MEMOP_REGION_SYSTEM, MEMPERM_READWRITE, true);
     if (R_FAILED(res))
     {
         framebufferCache = NULL;
@@ -203,7 +203,7 @@ u32 Draw_SetupFramebuffer(void)
     GPU_FB_BOTTOM_ADDR_1 = GPU_FB_BOTTOM_ADDR_2 = FB_BOTTOM_VRAM_PA;
     GPU_FB_BOTTOM_FMT = format;
     GPU_FB_BOTTOM_STRIDE = 240 * 2;
-    
+
     gpuSavedFillColor = LCD_BOT_FILLCOLOR;
     LCD_BOT_FILLCOLOR = 0;
 
@@ -214,7 +214,7 @@ void Draw_RestoreFramebuffer(void)
 {
     memcpy(FB_BOTTOM_VRAM_ADDR, framebufferCache, FB_BOTTOM_SIZE);
     Draw_FlushFramebuffer();
-    
+
     LCD_BOT_FILLCOLOR = gpuSavedFillColor;
     GPU_FB_BOTTOM_ADDR_1 = gpuSavedFramebufferAddr1;
     GPU_FB_BOTTOM_ADDR_2 = gpuSavedFramebufferAddr2;
@@ -268,14 +268,18 @@ static inline void Draw_WriteUnaligned(u8 *dst, u32 tmp, u32 size)
 void Draw_CreateBitmapHeader(u8 *dst, u32 width, u32 heigth)
 {
     static const u8 bmpHeaderTemplate[54] = {
-        0x42, 0x4D, 0xCC, 0xCC, 0xCC, 0xCC, 0x00, 0x00, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x28, 0x00,
+        // BITMAPFILEHEADER
-        0x00, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0x01, 0x00, 0x18, 0x00, 0x00, 0x00,
+        0x42, 0x4D, 0xCC, 0xCC, 0xCC, 0xCC, 0x00, 0x00, 0x00, 0x00, 0x40 /* data offset */, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0x12, 0x0B, 0x00, 0x00, 0x12, 0x0B, 0x00, 0x00, 0x00, 0x00,
+
+        // BITMAPINFOHEADER
+        0x28, 0x00, 0x00, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0x01, 0x00, 0x18, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0x12, 0x0B, 0x00, 0x00, 0x12, 0x0B, 0x00, 0x00, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00
     };
 
     memcpy(dst, bmpHeaderTemplate, 54);
-    Draw_WriteUnaligned(dst + 2, 54 + 3 * width * heigth, 4);
+    memset(dst + 54, 0, 64 - 54);
+    Draw_WriteUnaligned(dst + 2, 64 + 3 * width * heigth, 4);
     Draw_WriteUnaligned(dst + 0x12, width, 4);
     Draw_WriteUnaligned(dst + 0x16, heigth, 4);
     Draw_WriteUnaligned(dst + 0x22, 3 * width * heigth, 4);
@@ -350,6 +354,7 @@ typedef struct FrameBufferConvertArgs {
     u32 width;
     u8 startingLine;
     u8 numLines;
+    u8 scaleFactorY;
     bool top;
     bool left;
 } FrameBufferConvertArgs;
@@ -367,16 +372,19 @@ static void Draw_ConvertFrameBufferLinesKernel(const FrameBufferConvertArgs *arg
 
     for (u32 y = args->startingLine; y < args->startingLine + args->numLines; y++)
     {
-        for(u32 x = 0; x < width; x++)
+        for (u8 i = 0; i < args->scaleFactorY; i++)
         {
-            __builtin_prefetch(addr + x * stride + y * formatSizes[fmt], 0, 3);
+            for(u32 x = 0; x < width; x++)
-            Draw_ConvertPixelToBGR8(args->buf + (x + width * y) * 3 , addr + x * stride + y * formatSizes[fmt], fmt);
+            {
+                __builtin_prefetch(addr + x * stride + y * formatSizes[fmt], 0, 3);
+                Draw_ConvertPixelToBGR8(args->buf + (x + width * (args->scaleFactorY * y + i)) * 3 , addr + x * stride + y * formatSizes[fmt], fmt);
+            }
         }
     }
 }
 
-void Draw_ConvertFrameBufferLines(u8 *buf, u32 width, u32 startingLine, u32 numLines, bool top, bool left)
+void Draw_ConvertFrameBufferLines(u8 *buf, u32 width, u32 startingLine, u32 numLines, u32 scaleFactorY, bool top, bool left)
 {
-    FrameBufferConvertArgs args = { buf, width, (u8)startingLine, (u8)numLines, top, left };
+    FrameBufferConvertArgs args = { buf, width, (u8)startingLine, (u8)numLines, (u8)scaleFactorY, top, left };
     svcCustomBackdoor(Draw_ConvertFrameBufferLinesKernel, &args);
 }

sysmodules/rosalina/source/gdb.c

@@ -28,6 +28,10 @@ void GDB_InitializeContext(GDBContext *ctx)
     ctx->eventToWaitFor = ctx->processAttachedEvent;
     ctx->continueFlags = (DebugFlags)(DBG_SIGNAL_FAULT_EXCEPTION_EVENTS | DBG_INHIBIT_USER_CPU_EXCEPTION_HANDLERS);
 
+#ifdef DEBUG_GDB_COMMUNICATIONS
+    IFile_Open(&ctx->debugFile, ARCHIVE_SDMC, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, "/luma/gdb_debug.txt"), FS_OPEN_READ | FS_OPEN_WRITE | FS_OPEN_CREATE);
+#endif
+
     RecursiveLock_Unlock(&ctx->lock);
 }
 
@@ -40,6 +44,10 @@ void GDB_FinalizeContext(GDBContext *ctx)
     svcCloseHandle(ctx->processAttachedEvent);
     svcCloseHandle(ctx->continuedEvent);
 
+#ifdef DEBUG_GDB_COMMUNICATIONS
+    IFile_Close(&ctx->debugFile);
+#endif
+
     RecursiveLock_Unlock(&ctx->lock);
 }
 

sysmodules/rosalina/source/gdb/net.c

@@ -171,6 +171,17 @@ const char *GDB_ParseHexIntegerList64(u64 *dst, const char *src, u32 nb, char la
     return GDB_ParseIntegerList64(dst, src, nb, ',', lastSep, 16, false);
 }
 
+#ifdef DEBUG_GDB_COMMUNICATIONS
+void GDB_LogPacket(GDBContext *ctx, void* buffer, u32 pLen, bool incoming)
+{
+    u64 written;
+    IFile_Write(&ctx->debugFile, &written, incoming ? "<-\t" : "->\t", 3, 0);
+    IFile_Write(&ctx->debugFile, &written, buffer, pLen, 0);
+    IFile_Write(&ctx->debugFile, &written, "\n", 1, 0);
+    IFile_Flush(&ctx->debugFile);
+}
+#endif
+
 int GDB_ReceivePacket(GDBContext *ctx)
 {
     char backupbuf[GDB_BUF_LEN + 4];
@@ -189,6 +200,9 @@ int GDB_ReceivePacket(GDBContext *ctx)
         r = socRecv(ctx->super.sockfd, ctx->buffer, 1, 0);
         if(r != 1)
             return -1;
+#ifdef DEBUG_GDB_COMMUNICATIONS
+        GDB_LogPacket(ctx, ctx->buffer, r, true);
+#endif
 
         ctx->buffer[0] = 0;
 
@@ -197,9 +211,19 @@ int GDB_ReceivePacket(GDBContext *ctx)
         if(r == -1)
             goto packet_error;
     }
-    else if(ctx->buffer[0] == '-')
+
+#ifdef DEBUG_GDB_COMMUNICATIONS
+        GDB_LogPacket(ctx, ctx->buffer, r, true);
+#endif
+
+    if(ctx->buffer[0] == '-')
     {
         socSend(ctx->super.sockfd, backupbuf, ctx->latestSentPacketSize, 0);
+
+#ifdef DEBUG_GDB_COMMUNICATIONS
+        GDB_LogPacket(ctx, backupbuf, ctx->latestSentPacketSize, false);
+#endif
+
         return 0;
     }
     int maxlen = r > (int)sizeof(ctx->buffer) ? (int)sizeof(ctx->buffer) : r;
@@ -239,6 +263,9 @@ int GDB_ReceivePacket(GDBContext *ctx)
         int r2 = socSend(ctx->super.sockfd, "+", 1, 0);
         if(r2 != 1)
             return -1;
+#ifdef DEBUG_GDB_COMMUNICATIONS
+        GDB_LogPacket(ctx, "+", 1, false);
+#endif
     }
 
     if(ctx->noAckSent)
@@ -255,8 +282,12 @@ packet_error:
         r = socSend(ctx->super.sockfd, "-", 1, 0);
         if(r != 1)
             return -1;
-        else
+        else {
+#ifdef DEBUG_GDB_COMMUNICATIONS
+            GDB_LogPacket(ctx, "-", 1, false);
+#endif
             return 0;
+        }
     }
     else
         return -1;
@@ -265,6 +296,9 @@ packet_error:
 static int GDB_DoSendPacket(GDBContext *ctx, u32 len)
 {
     int r = socSend(ctx->super.sockfd, ctx->buffer, len, 0);
+#ifdef DEBUG_GDB_COMMUNICATIONS
+    GDB_LogPacket(ctx, ctx->buffer, len, false);
+#endif
 
     if(r > 0)
         ctx->latestSentPacketSize = r;

sysmodules/rosalina/source/ifile.c

@@ -49,7 +49,9 @@ Result IFile_OpenFromArchive(IFile *file, FS_Archive archive, FS_Path filePath,
 
 Result IFile_Close(IFile *file)
 {
-  return FSFILE_Close(file->handle);
+  Result res = file->handle != 0 ? FSFILE_Close(file->handle) : 0;
+  file->handle = 0;
+  return res;
 }
 
 Result IFile_GetSize(IFile *file, u64 *size)
@@ -147,3 +149,8 @@ Result IFile_Write(IFile *file, u64 *total, const void *buffer, u32 len, u32 fla
   *total = cur;
   return res;
 }
+
+Result IFile_Flush(IFile *file)
+{
+  return FSFILE_Flush(file->handle);
+}

sysmodules/rosalina/source/input_redirection.c

@@ -223,7 +223,7 @@ static Result InputRedirection_DoUndoIrPatches(Handle processHandle, bool doPatc
     totalSize = (u32)(textTotalRoundedSize + rodataTotalRoundedSize + dataTotalRoundedSize);
 
     svcGetProcessInfo(&startAddress, processHandle, 0x10005);
-    res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize);
+    res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize, 0);
 
     if(R_SUCCEEDED(res) && !patchPrepared)
     {
@@ -356,7 +356,7 @@ static Result InputRedirection_DoUndoHidPatches(Handle processHandle, bool doPat
     totalSize = (u32)(textTotalRoundedSize + rodataTotalRoundedSize + dataTotalRoundedSize);
 
     svcGetProcessInfo(&startAddress, processHandle, 0x10005);
-    res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize);
+    res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize, 0);
 
     if (R_SUCCEEDED(res) && !patchPrepared)
     {

sysmodules/rosalina/source/luma_config.c

@@ -180,6 +180,7 @@ static size_t LumaConfig_SaveLumaIniConfigToStr(char *out, const CfgData *cfg)
         (int)cfg->ntpTzOffetMinutes,
 
         (int)cfg->topScreenFilter.cct, (int)cfg->bottomScreenFilter.cct,
+        (int)cfg->topScreenFilter.colorCurveCorrection, (int)cfg->bottomScreenFilter.colorCurveCorrection,
         topScreenFilterGammaStr, bottomScreenFilterGammaStr,
         topScreenFilterContrastStr, bottomScreenFilterContrastStr,
         topScreenFilterBrightnessStr, bottomScreenFilterBrightnessStr,
@@ -203,7 +204,7 @@ void LumaConfig_RequestSaveSettings(void) {
 
 Result LumaConfig_SaveSettings(void)
 {
-    char inibuf[0x2000];
+    char inibuf[0x2000 + 0x400]; // eyeballed. TODO use #embed
 
     Result res;
 
@@ -258,6 +259,12 @@ Result LumaConfig_SaveSettings(void)
     configData.autobootCtrAppmemtype = autobootCtrAppmemtype;
 
     size_t n = LumaConfig_SaveLumaIniConfigToStr(inibuf, &configData);
+
+    // FIXME: this is UB we should port snprintf sometime (as well as fix other tech debt in Rosalina)
+    if (n + 1 >= sizeof(inibuf)) {
+        __builtin_trap();
+    }
+
     FS_ArchiveID archiveId = isSdMode ? ARCHIVE_SDMC : ARCHIVE_NAND_RW;
     if (n > 0)
         res = IFile_Open(&file, archiveId, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, "/luma/config.ini"), FS_OPEN_CREATE | FS_OPEN_WRITE);

sysmodules/rosalina/source/luminance.c

@@ -104,8 +104,13 @@ u32 getMinLuminancePreset(void)
 
 u32 getMaxLuminancePreset(void)
 {
+    // Unlike SetLuminanceLevel, SetLuminance doesn't
+    // check if preset <= 5, and actually allows the lumiance
+    // levels provisioned for the "brightness boost mode" (brighter
+    // when adapter is plugged in), even when the feature is disabled
+    // (it is disabled for anything but the OG model, iirc)
     readCalibration();
-    return s_blPwmData.luminanceLevels[s_blPwmData.numLevels - 1];
+    return s_blPwmData.luminanceLevels[6];
 }
 
 u32 getCurrentLuminance(bool top)
@@ -114,7 +119,8 @@ u32 getCurrentLuminance(bool top)
 
     readCalibration();
 
-    const float *coeffs = s_blPwmData.coeffs[top ? (isN3DS ? 2 : 1) : 0];
+    bool is3d = (REG32(0x10202000 + 0x000) & 1) != 0;
+    const float *coeffs = s_blPwmData.coeffs[top ? (is3d ? 2 : 1) : 0];
     u32 brightness = REG32(regbase + 0x40);
     float ratio = getPwmRatio(s_blPwmData.brightnessMax, REG32(regbase + 0x44));
 

sysmodules/rosalina/source/main.c

@@ -166,7 +166,7 @@ static void handleShellNotification(u32 notificationId)
 {
     // Quick dirty fix
     Sleep__HandleNotification(notificationId);
-    
+
     if (notificationId == 0x213) {
         // Shell opened
         // Note that this notification is also fired on system init.
@@ -205,6 +205,8 @@ static void handlePreTermNotification(u32 notificationId)
     Draw_Lock();
     if (isHidInitialized)
         hidExit();
+    if (isQtmInitialized)
+        svcCloseHandle(*qtmGetSessionHandle()); // qtmExit();
 
     // Termination request
     menuShouldExit = true;

sysmodules/rosalina/source/menu.c

@@ -40,9 +40,18 @@
 #include "menus/screen_filters.h"
 #include "shell.h"
 
+//#define ROSALINA_MENU_SELF_SCREENSHOT 1 // uncomment this to enable the feature
+
 u32 menuCombo = 0;
 bool isHidInitialized = false;
+bool isQtmInitialized = false;
 u32 mcuFwVersion = 0;
+u8 mcuInfoTable[10] = {0};
+bool mcuInfoTableRead = false;
+
+const char *topScreenType = NULL;
+const char *bottomScreenType = NULL;
+bool areScreenTypesInitialized = false;
 
 // libctru redefinition:
 
@@ -54,10 +63,22 @@ bool hidShouldUseIrrst(void)
 
 static inline u32 convertHidKeys(u32 keys)
 {
-    // Nothing to do yet
+    // No actual conversion done
     return keys;
 }
 
+void scanInputHook(void)
+{
+    hidScanInput();
+
+#ifdef ROSALINA_MENU_SELF_SCREENSHOT
+    // Ugly hack but should work. For self-documentation w/o capture card purposes only.
+    u32 selfScreenshotCombo = KEY_L | KEY_DUP | KEY_SELECT;
+    if ((hidKeysHeld() & selfScreenshotCombo) == selfScreenshotCombo && (hidKeysDown() & selfScreenshotCombo) != 0)
+        menuTakeSelfScreenshot();
+#endif
+}
+
 u32 waitInputWithTimeout(s32 msec)
 {
     s32 n = 0;
@@ -75,7 +96,7 @@ u32 waitInputWithTimeout(s32 msec)
         }
         n++;
 
-        hidScanInput();
+        scanInputHook();
         keys = convertHidKeys(hidKeysDown()) | (convertHidKeys(hidKeysDownRepeat()) & DIRECTIONAL_KEYS);
         Draw_Unlock();
     } while (keys == 0 && !menuShouldExit && isHidInitialized && (msec < 0 || n < msec));
@@ -101,7 +122,7 @@ u32 waitInputWithTimeoutEx(u32 *outHeldKeys, s32 msec)
         }
         n++;
 
-        hidScanInput();
+        scanInputHook();
         keys = convertHidKeys(hidKeysDown()) | (convertHidKeys(hidKeysDownRepeat()) & DIRECTIONAL_KEYS);
         *outHeldKeys = convertHidKeys(hidKeysHeld());
         Draw_Unlock();
@@ -126,7 +147,7 @@ static u32 scanHeldKeys(void)
         keys = 0;
     else
     {
-        hidScanInput();
+        scanInputHook();
         keys = convertHidKeys(hidKeysHeld());
     }
 
@@ -226,10 +247,75 @@ static Result menuUpdateMcuInfo(void)
         mcuFwVersion = SYSTEM_VERSION(major - 0x10, minor, 0);
     }
 
+    if (!mcuInfoTableRead)
+        mcuInfoTableRead = R_SUCCEEDED(MCUHWC_ReadRegister(0x7F, mcuInfoTable, sizeof(mcuInfoTable)));
+
     svcCloseHandle(*mcuHwcHandlePtr);
     return res;
 }
 
+static const char *menuGetScreenTypeStr(u8 vendorId)
+{
+    switch (vendorId)
+    {
+        case 1:  return "IPS"; // SHARP
+        case 12: return "TN";  // JDN
+        default: return "unknown";
+    }
+}
+
+static void menuReadScreenTypes(void)
+{
+    if (areScreenTypesInitialized)
+        return;
+
+    if (!isN3DS)
+    {
+        // Old3DS never have IPS screens and GetVendors is not implemented
+        topScreenType = "TN";
+        bottomScreenType = "TN";
+        areScreenTypesInitialized = true;
+    }
+    else
+    {
+        srvSetBlockingPolicy(false);
+
+        Result res = gspLcdInit();
+        if (R_SUCCEEDED(res))
+        {
+            u8 vendors = 0;
+            if (R_SUCCEEDED(GSPLCD_GetVendors(&vendors)))
+            {
+                topScreenType = menuGetScreenTypeStr(vendors >> 4);
+                bottomScreenType = menuGetScreenTypeStr(vendors & 0xF);
+                areScreenTypesInitialized = true;
+            }
+
+            gspLcdExit();
+        }
+
+        srvSetBlockingPolicy(true);
+    }
+}
+
+static void menuInitializeQtm(void)
+{
+    if (isQtmInitialized)
+        return;
+
+    // Steal QTM handle from GSP, because there is a limit of 3 sessions (or 2 before 9.3) for ALL qtm services
+    Handle qtmHandle = 0;
+    for (int i = 0; i < 30 && !qtmIsInitialized(); i++)
+    {
+        if (R_SUCCEEDED(svcControlService(SERVICEOP_STEAL_CLIENT_SESSION, &qtmHandle, "qtm:sp")))
+            *qtmGetSessionHandle() = qtmHandle;
+        else
+            svcSleepThread(100 * 100 * 1000LL);
+    }
+
+    isQtmInitialized = qtmIsInitialized();
+}
+
 static inline u32 menuAdvanceCursor(u32 pos, u32 numItems, s32 displ)
 {
     return (pos + numItems + displ) % numItems;
@@ -264,17 +350,24 @@ u32 g_blockMenuOpen = 0;
 
 void menuThreadMain(void)
 {
-    if(isN3DS)
+    while (!isServiceUsable("ac:u") || !isServiceUsable("hid:USER") || !isServiceUsable("gsp::Gpu") || !isServiceUsable("gsp::Lcd") || !isServiceUsable("cdc:CHK"))
-        N3DSMenu_UpdateStatus();
-
-    while (!isServiceUsable("ac:u") || !isServiceUsable("hid:USER") || !isServiceUsable("gsp::Gpu") || !isServiceUsable("cdc:CHK"))
         svcSleepThread(250 * 1000 * 1000LL);
 
+    if (isN3DS)
+    {
+        while (!isServiceUsable("qtm:u"))
+            svcSleepThread(250 * 1000 * 1000LL);
+        menuInitializeQtm();
+        N3DSMenu_UpdateStatus();
+    }
+
     handleShellOpened();
 
     hidInit(); // assume this doesn't fail
     isHidInitialized = true;
 
+    menuReadScreenTypes();
+
     while(!preTerminationRequested)
     {
         svcSleepThread(50 * 1000 * 1000LL);
@@ -283,7 +376,9 @@ void menuThreadMain(void)
 
         Cheat_ApplyCheats();
 
-        if(((scanHeldKeys() & menuCombo) == menuCombo) && !g_blockMenuOpen)
+        u32 kHeld = scanHeldKeys();
+
+        if(((kHeld & menuCombo) == menuCombo) && !g_blockMenuOpen)
         {
             menuEnter();
             if(isN3DS) N3DSMenu_UpdateStatus();
@@ -380,6 +475,7 @@ static void menuDraw(Menu *menu, u32 selected)
         int n = sprintf(ipBuffer, "%hhu.%hhu.%hhu.%hhu", addr[0], addr[1], addr[2], addr[3]);
         Draw_DrawString(SCREEN_BOT_WIDTH - 10 - SPACING_X * n, 10, COLOR_WHITE, ipBuffer);
     }
+
     else
         Draw_DrawFormattedString(SCREEN_BOT_WIDTH - 10 - SPACING_X * 15, 10, COLOR_WHITE, "%15s", "");
 
@@ -489,17 +585,12 @@ void menuShow(Menu *root)
             else
                 break;
         }
-        else if(pressed & KEY_DOWN)
+        else if(pressed & (KEY_DOWN | KEY_UP))
         {
-            selectedItem = menuAdvanceCursor(selectedItem, numItems, 1);
+            s32 n = (pressed & KEY_DOWN) != 0 ? 1 : -1;
-            if (menuItemIsHidden(&currentMenu->items[selectedItem]))
+            do {
-                selectedItem = menuAdvanceCursor(selectedItem, numItems, 1);
+                selectedItem = menuAdvanceCursor(selectedItem, numItems, n);
-        }
+            } while (menuItemIsHidden(&currentMenu->items[selectedItem])); // assume at least one item is visible
-        else if(pressed & KEY_UP)
-        {
-            selectedItem = menuAdvanceCursor(selectedItem, numItems, -1);
-            if (menuItemIsHidden(&currentMenu->items[selectedItem]))
-                selectedItem = menuAdvanceCursor(selectedItem, numItems, -1);
         }
 
         Draw_Lock();

sysmodules/rosalina/source/menus.c

@@ -40,25 +40,24 @@
 #include "memory.h"
 #include "fmt.h"
 #include "process_patches.h"
-#include "luminance.h"
 #include "luma_config.h"
 
 Menu rosalinaMenu = {
     "Rosalina menu",
     {
         { "Take screenshot", METHOD, .method = &RosalinaMenu_TakeScreenshot },
-        { "Change screen brightness", METHOD, .method = &RosalinaMenu_ChangeScreenBrightness },
+        { "Screen filters...", MENU, .menu = &screenFiltersMenu },
         { "Cheats...", METHOD, .method = &RosalinaMenu_Cheats },
         { "", METHOD, .method = PluginLoader__MenuCallback},
+        { "New 3DS menu...", MENU, .menu = &N3DSMenu, .visibility = &menuCheckN3ds },
         { "Process list", METHOD, .method = &RosalinaMenu_ProcessList },
         { "Debugger options...", MENU, .menu = &debuggerMenu },
         { "System configuration...", MENU, .menu = &sysconfigMenu },
-        { "Screen filters...", MENU, .menu = &screenFiltersMenu },
-        { "New 3DS menu...", MENU, .menu = &N3DSMenu, .visibility = &menuCheckN3ds },
         { "Miscellaneous options...", MENU, .menu = &miscellaneousMenu },
         { "Save settings", METHOD, .method = &RosalinaMenu_SaveSettings },
-        { "Power off", METHOD, .method = &RosalinaMenu_PowerOff },
+        { "Return To Home Menu", METHOD, .method = &RosalinaMenu_ReturnToHomeMenu },
-        { "Reboot", METHOD, .method = &RosalinaMenu_Reboot },
+        { "Power off / reboot", METHOD, .method = &RosalinaMenu_PowerOffOrReboot },
+        { "System info", METHOD, .method = &RosalinaMenu_ShowSystemInfo },
         { "Credits", METHOD, .method = &RosalinaMenu_ShowCredits },
         { "Debug info", METHOD, .method = &RosalinaMenu_ShowDebugInfo, .visibility = &rosalinaMenuShouldShowDebugInfo },
         {},
@@ -96,6 +95,73 @@ void RosalinaMenu_SaveSettings(void)
     while(!(waitInput() & KEY_B) && !menuShouldExit);
 }
 
+void RosalinaMenu_PowerOffOrReboot(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    do
+    {
+        Draw_Lock();
+        Draw_DrawString(10, 10, COLOR_TITLE, "Power Off / Reboot");
+        Draw_DrawString(10, 30, COLOR_WHITE, "Press A to power off.\nPress Y to reboot.\nPress B to go back.");
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+
+        u32 pressed = waitInputWithTimeout(1000);
+
+        if(pressed & KEY_Y)
+        {
+            menuLeave();
+            APT_HardwareResetAsync();
+            return;
+        }
+        else if(pressed & KEY_A)
+        {
+            // Soft shutdown
+            menuLeave();
+            srvPublishToSubscriber(0x203, 0);
+            return;
+        }
+        else if(pressed & KEY_B)
+            return;
+    }
+    while(!menuShouldExit);
+}
+
+void RosalinaMenu_ShowSystemInfo(void)
+{
+    u32 kver = osGetKernelVersion();
+
+    do
+    {
+        Draw_Lock();
+        Draw_DrawString(10, 10, COLOR_TITLE, "Rosalina -- System info");
+
+        u32 posY = 30;
+
+        if (areScreenTypesInitialized)
+        {
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Top screen type:    %s\n", topScreenType);
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Bottom screen type: %s\n\n", bottomScreenType);
+        }
+
+        posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Kernel version:     %lu.%lu-%lu\n\n", GET_VERSION_MAJOR(kver), GET_VERSION_MINOR(kver), GET_VERSION_REVISION(kver));
+        if (mcuFwVersion != 0 && mcuInfoTableRead)
+        {
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "MCU FW version:     %lu.%lu\n", GET_VERSION_MAJOR(mcuFwVersion), GET_VERSION_MINOR(mcuFwVersion));
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "PMIC vendor:        %hhu\n", mcuInfoTable[1]);
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Battery vendor:     %hhu\n\n", mcuInfoTable[2]);
+        }
+
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+    }
+    while(!(waitInput() & KEY_B) && !menuShouldExit);
+}
+
 void RosalinaMenu_ShowDebugInfo(void)
 {
     Draw_Lock();
@@ -111,7 +177,6 @@ void RosalinaMenu_ShowDebugInfo(void)
     u32 kextPa = (u32)((u64)kextAddrSize >> 32);
     u32 kextSize = (u32)kextAddrSize;
 
-    u32 kernelVer = osGetKernelVersion();
     FS_SdMmcSpeedInfo speedInfo;
 
     do
@@ -119,20 +184,10 @@ void RosalinaMenu_ShowDebugInfo(void)
         Draw_Lock();
         Draw_DrawString(10, 10, COLOR_TITLE, "Rosalina -- Debug info");
 
-        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, memoryMap);
+        u32 posY = 30;
-        posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Kernel ext PA: %08lx - %08lx\n\n", kextPa, kextPa + kextSize);
-        posY = Draw_DrawFormattedString(
-            10, posY, COLOR_WHITE, "Kernel version: %lu.%lu-%lu\n",
-            GET_VERSION_MAJOR(kernelVer), GET_VERSION_MINOR(kernelVer), GET_VERSION_REVISION(kernelVer)
-        );
-        if (mcuFwVersion != 0)
-        {
-            posY = Draw_DrawFormattedString(
-                10, posY, COLOR_WHITE, "MCU FW version: %lu.%lu\n",
-                GET_VERSION_MAJOR(mcuFwVersion), GET_VERSION_MINOR(mcuFwVersion)
-            );
-        }
 
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, memoryMap);
+        posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Kernel ext PA: %08lx - %08lx\n\n", kextPa, kextPa + kextSize);
         if (R_SUCCEEDED(FSUSER_GetSdmcSpeedInfo(&speedInfo)))
         {
             u32 clkDiv = 1 << (1 + (speedInfo.sdClkCtrl & 0xFF));
@@ -173,7 +228,7 @@ void RosalinaMenu_ShowCredits(void)
         Draw_Lock();
         Draw_DrawString(10, 10, COLOR_TITLE, "Rosalina -- Luma3DS credits");
 
-        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Luma3DS (c) 2016-2024 AuroraWright, TuxSH") + SPACING_Y;
+        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Luma3DS (c) 2016-2025 AuroraWright, TuxSH") + SPACING_Y;
 
         posY = Draw_DrawString(10, posY + SPACING_Y, COLOR_WHITE, "3DSX loading code by fincs");
         posY = Draw_DrawString(10, posY + SPACING_Y, COLOR_WHITE, "Networking code & basic GDB functionality by Stary");
@@ -195,163 +250,6 @@ void RosalinaMenu_ShowCredits(void)
     while(!(waitInput() & KEY_B) && !menuShouldExit);
 }
 
-void RosalinaMenu_Reboot(void)
-{
-    Draw_Lock();
-    Draw_ClearFramebuffer();
-    Draw_FlushFramebuffer();
-    Draw_Unlock();
-
-    do
-    {
-        Draw_Lock();
-        Draw_DrawString(10, 10, COLOR_TITLE, "Reboot");
-        Draw_DrawString(10, 30, COLOR_WHITE, "Press A to reboot, press B to go back.");
-        Draw_FlushFramebuffer();
-        Draw_Unlock();
-
-        u32 pressed = waitInputWithTimeout(1000);
-
-        if(pressed & KEY_A)
-        {
-            menuLeave();
-            APT_HardwareResetAsync();
-            return;
-        } else if(pressed & KEY_B)
-            return;
-    }
-    while(!menuShouldExit);
-}
-
-void RosalinaMenu_ChangeScreenBrightness(void)
-{
-    Draw_Lock();
-    Draw_ClearFramebuffer();
-    Draw_FlushFramebuffer();
-    Draw_Unlock();
-
-    // gsp:LCD GetLuminance is stubbed on O3DS so we have to implement it ourselves... damn it.
-    // Assume top and bottom screen luminances are the same (should be; if not, we'll set them to the same values).
-    u32 luminance = getCurrentLuminance(false);
-    u32 minLum = getMinLuminancePreset();
-    u32 maxLum = getMaxLuminancePreset();
-
-    do
-    {
-        Draw_Lock();
-        Draw_DrawString(10, 10, COLOR_TITLE, "Screen brightness");
-        u32 posY = 30;
-        posY = Draw_DrawFormattedString(
-            10,
-            posY,
-            COLOR_WHITE,
-            "Current luminance: %lu (min. %lu, max. %lu)\n\n",
-            luminance,
-            minLum,
-            maxLum
-        );
-        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Controls: Up/Down for +-1, Right/Left for +-10.\n");
-        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Press A to start, B to exit.\n\n");
-
-        posY = Draw_DrawString(10, posY, COLOR_RED, "WARNING: \n");
-        posY = Draw_DrawString(10, posY, COLOR_WHITE, "  * value will be limited by the presets.\n");
-        posY = Draw_DrawString(10, posY, COLOR_WHITE, "  * bottom framebuffer will be restored until\nyou exit.");
-        Draw_FlushFramebuffer();
-        Draw_Unlock();
-
-        u32 pressed = waitInputWithTimeout(1000);
-
-        if (pressed & KEY_A)
-            break;
-
-        if (pressed & KEY_B)
-            return;
-    }
-    while (!menuShouldExit);
-
-    Draw_Lock();
-
-    Draw_RestoreFramebuffer();
-    Draw_FreeFramebufferCache();
-
-    svcKernelSetState(0x10000, 2); // unblock gsp
-    gspLcdInit(); // assume it doesn't fail. If it does, brightness won't change, anyway.
-
-    // gsp:LCD will normalize the brightness between top/bottom screen, handle PWM, etc.
-
-    s32 lum = (s32)luminance;
-
-    do
-    {
-        u32 pressed = waitInputWithTimeout(1000);
-        if (pressed & DIRECTIONAL_KEYS)
-        {
-            if (pressed & KEY_UP)
-                lum += 1;
-            else if (pressed & KEY_DOWN)
-                lum -= 1;
-            else if (pressed & KEY_RIGHT)
-                lum += 10;
-            else if (pressed & KEY_LEFT)
-                lum -= 10;
-
-            lum = lum < (s32)minLum ? (s32)minLum : lum;
-            lum = lum > (s32)maxLum ? (s32)maxLum : lum;
-
-            // We need to call gsp here because updating the active duty LUT is a bit tedious (plus, GSP has internal state).
-            // This is actually SetLuminance:
-            GSPLCD_SetBrightnessRaw(BIT(GSP_SCREEN_TOP) | BIT(GSP_SCREEN_BOTTOM), lum);
-        }
-
-        if (pressed & KEY_B)
-            break;
-    }
-    while (!menuShouldExit);
-
-    gspLcdExit();
-    svcKernelSetState(0x10000, 2); // block gsp again
-
-    if (R_FAILED(Draw_AllocateFramebufferCache(FB_BOTTOM_SIZE)))
-    {
-        // Shouldn't happen
-        __builtin_trap();
-    }
-    else
-        Draw_SetupFramebuffer();
-
-    Draw_Unlock();
-}
-
-void RosalinaMenu_PowerOff(void) // Soft shutdown.
-{
-    Draw_Lock();
-    Draw_ClearFramebuffer();
-    Draw_FlushFramebuffer();
-    Draw_Unlock();
-
-    do
-    {
-        Draw_Lock();
-        Draw_DrawString(10, 10, COLOR_TITLE, "Power off");
-        Draw_DrawString(10, 30, COLOR_WHITE, "Press A to power off, press B to go back.");
-        Draw_FlushFramebuffer();
-        Draw_Unlock();
-
-        u32 pressed = waitInputWithTimeout(1000);
-
-        if(pressed & KEY_A)
-        {
-            menuLeave();
-            srvPublishToSubscriber(0x203, 0);
-            return;
-        }
-        else if(pressed & KEY_B)
-            return;
-    }
-    while(!menuShouldExit);
-}
-
-
 #define TRY(expr) if(R_FAILED(res = (expr))) goto end;
 
 static s64 timeSpentConvertingScreenshot = 0;
@@ -362,7 +260,12 @@ static Result RosalinaMenu_WriteScreenshot(IFile *file, u32 width, bool top, boo
     u64 total;
     Result res = 0;
     u32 lineSize = 3 * width;
-    u32 remaining = lineSize * 240;
+
+    // When dealing with 800px mode (800x240 with half-width pixels), duplicate each line
+    // to restore aspect ratio and obtain faithful 800x480 screenshots
+    u32 scaleFactorY = width > 400 ? 2 : 1;
+    u32 numLinesScaled = 240 * scaleFactorY;
+    u32 remaining = lineSize * numLinesScaled;
 
     TRY(Draw_AllocateFramebufferCacheForScreenshot(remaining));
 
@@ -370,8 +273,9 @@ static Result RosalinaMenu_WriteScreenshot(IFile *file, u32 width, bool top, boo
     u8 *framebufferCacheEnd = framebufferCache + Draw_GetFramebufferCacheSize();
 
     u8 *buf = framebufferCache;
-    Draw_CreateBitmapHeader(framebufferCache, width, 240);
+    Draw_CreateBitmapHeader(framebufferCache, width, numLinesScaled);
-    buf += 54;
+    const u32 headerSize = 0x40;
+    buf += headerSize;
 
     u32 y = 0;
     // Our buffer might be smaller than the size of the screenshot...
@@ -380,16 +284,16 @@ static Result RosalinaMenu_WriteScreenshot(IFile *file, u32 width, bool top, boo
         s64 t0 = svcGetSystemTick();
         u32 available = (u32)(framebufferCacheEnd - buf);
         u32 size = available < remaining ? available : remaining;
-        u32 nlines = size / lineSize;
+        u32 nlines = size / (lineSize * scaleFactorY);
-        Draw_ConvertFrameBufferLines(buf, width, y, nlines, top, left);
+        Draw_ConvertFrameBufferLines(buf, width, y, nlines, scaleFactorY, top, left);
 
         s64 t1 = svcGetSystemTick();
         timeSpentConvertingScreenshot += t1 - t0;
-        TRY(IFile_Write(file, &total, framebufferCache, (y == 0 ? 54 : 0) + lineSize * nlines, 0)); // don't forget to write the header
+        TRY(IFile_Write(file, &total, framebufferCache, (y == 0 ? headerSize : 0) + lineSize * nlines * scaleFactorY, 0)); // don't forget to write the header
         timeSpentWritingScreenshot += svcGetSystemTick() - t1;
 
         y += nlines;
-        remaining -= lineSize * nlines;
+        remaining -= lineSize * nlines * scaleFactorY;
         buf = framebufferCache;
     }
     end:
@@ -398,9 +302,38 @@ static Result RosalinaMenu_WriteScreenshot(IFile *file, u32 width, bool top, boo
     return res;
 }
 
+void RosalinaMenu_ReturnToHomeMenu(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    do
+    {
+        Draw_Lock();
+        Draw_DrawString(10, 10, COLOR_TITLE, "Return to Home Menu");
+        Draw_DrawString(10, 30, COLOR_WHITE, "Press A to confirm.\nPress B to go back.");
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+
+        u32 pressed = waitInputWithTimeout(1000);
+
+        if(pressed & KEY_A)
+        {
+            menuLeave();
+            srvPublishToSubscriber(0x204, 0);
+            return;
+        }
+        else if(pressed & KEY_B)
+            return;
+    }
+    while(!menuShouldExit);
+}
+
 void RosalinaMenu_TakeScreenshot(void)
 {
-    IFile file;
+    IFile file = {0};
     Result res = 0;
 
     char filename[64];
@@ -438,6 +371,11 @@ void RosalinaMenu_TakeScreenshot(void)
             res = 0;
         FSUSER_CloseArchive(archive);
     }
+    else
+    {
+        archive = 0;
+        goto end;
+    }
 
     dateTimeToString(dateTimeStr, osGetTime(), true);
 
@@ -462,6 +400,9 @@ void RosalinaMenu_TakeScreenshot(void)
 end:
     IFile_Close(&file);
 
+    if (archive != 0)
+        FSUSER_CloseArchive(archive);
+
     if (R_FAILED(Draw_AllocateFramebufferCache(FB_BOTTOM_SIZE)))
         __builtin_trap(); // We're f***ed if this happens
 
@@ -489,6 +430,91 @@ end:
         Draw_Unlock();
     }
     while(!(waitInput() & KEY_B) && !menuShouldExit);
+}
+
+static Result menuWriteSelfScreenshot(IFile *file)
+{
+    u64 total;
+    Result res = 0;
+
+    u32 width = 320;
+    u32 lineSize = 3 * width;
+
+    u32 scaleFactorY = 1;
+    u32 numLinesScaled = 240 * scaleFactorY;
+
+    u32 addr = 0x0D800000; // keep this in check
+    u32 tmp;
+
+    u32 size = ((54 + lineSize * numLinesScaled * scaleFactorY) + 0xFFF) >> 12 << 12; // round-up
+    u8 *buffer = NULL;
+
+    TRY(svcControlMemoryEx(&tmp, addr, 0, size, MEMOP_ALLOC | MEMOP_REGION_SYSTEM, MEMPERM_READWRITE, true));
+    buffer = (u8 *)addr;
+
+    Draw_CreateBitmapHeader(buffer, width, numLinesScaled);
+
+    Draw_ConvertFrameBufferLines(buffer + 54, width, 0, numLinesScaled, scaleFactorY, false, false);
+    TRY(IFile_Write(file, &total, buffer, 54 + lineSize * numLinesScaled * scaleFactorY, 0)); // don't forget to write the header
+
+end:
+    if (buffer)
+        svcControlMemoryEx(&tmp, addr, 0, size, MEMOP_FREE, MEMPERM_DONTCARE, false);
+
+    return res;
+}
+
+void menuTakeSelfScreenshot(void)
+{
+    // Optimized for N3DS. May fail due to OOM.
+
+    IFile file = {0};
+    Result res = 0;
+
+    char filename[100];
+    char dateTimeStr[64];
+
+    FS_Archive archive;
+    FS_ArchiveID archiveId;
+    s64 out;
+    bool isSdMode;
+
+    timeSpentConvertingScreenshot = 0;
+    timeSpentWritingScreenshot = 0;
+
+    if(R_FAILED(svcGetSystemInfo(&out, 0x10000, 0x203))) svcBreak(USERBREAK_ASSERT);
+    isSdMode = (bool)out;
+
+    archiveId = isSdMode ? ARCHIVE_SDMC : ARCHIVE_NAND_RW;
+    Draw_Lock();
+    svcFlushEntireDataCache();
+
+    res = FSUSER_OpenArchive(&archive, archiveId, fsMakePath(PATH_EMPTY, ""));
+    if(R_SUCCEEDED(res))
+    {
+        res = FSUSER_CreateDirectory(archive, fsMakePath(PATH_ASCII, "/luma/screenshots"), 0);
+        if((u32)res == 0xC82044BE) // directory already exists
+            res = 0;
+        FSUSER_CloseArchive(archive);
+    }
+    else
+    {
+        archive = 0;
+        goto end;
+    }
+
+    dateTimeToString(dateTimeStr, osGetTime(), true);
+
+    sprintf(filename, "/luma/screenshots/rosalina_menu_%s.bmp", dateTimeStr);
+
+    TRY(IFile_Open(&file, archiveId, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, filename), FS_OPEN_CREATE | FS_OPEN_WRITE));
+    TRY(menuWriteSelfScreenshot(&file));
+
+end:
+    IFile_Close(&file);
+
+    if (archive != 0)
+        FSUSER_CloseArchive(archive);
+}
 
 #undef TRY
-}

sysmodules/rosalina/source/menus/miscellaneous.c

@@ -321,6 +321,12 @@ void MiscellaneousMenu_UpdateTimeDateNtp(void)
     int utcOffset = dt / 60;
     int utcOffsetMinute = dt%60;
     int absOffset;
+
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
     do
     {
         Draw_Lock();
@@ -331,14 +337,14 @@ void MiscellaneousMenu_UpdateTimeDateNtp(void)
         posY = Draw_DrawFormattedString(10, 30, COLOR_WHITE, "Current UTC offset:  %c%02d%02d", utcOffset < 12 ? '-' : '+', absOffset, utcOffsetMinute);
         posY = Draw_DrawFormattedString(10, posY + SPACING_Y, COLOR_WHITE, "Use DPAD Left/Right to change hour offset.\nUse DPAD Up/Down to change minute offset.\nPress A when done.") + SPACING_Y;
 
-        input = waitInput();
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
 
+        input = waitInput();
         if(input & KEY_LEFT) utcOffset = (27 + utcOffset - 1) % 27; // ensure utcOffset >= 0
         if(input & KEY_RIGHT) utcOffset = (utcOffset + 1) % 27;
         if(input & KEY_UP) utcOffsetMinute = (utcOffsetMinute + 1) % 60;
         if(input & KEY_DOWN) utcOffsetMinute = (60 + utcOffsetMinute - 1) % 60;
-        Draw_FlushFramebuffer();
-        Draw_Unlock();
     }
     while(!(input & (KEY_A | KEY_B)) && !menuShouldExit);
 
@@ -376,13 +382,10 @@ void MiscellaneousMenu_UpdateTimeDateNtp(void)
         else
             Draw_DrawFormattedString(10, posY + 2 * SPACING_Y, COLOR_WHITE, "Time/date updated successfully.") + SPACING_Y;
 
-        input = waitInput();
-
         Draw_FlushFramebuffer();
         Draw_Unlock();
     }
-    while(!(input & KEY_B) && !menuShouldExit);
+    while(!(waitInput() & KEY_B) && !menuShouldExit);
-
 }
 
 void MiscellaneousMenu_NullifyUserTimeOffset(void)

sysmodules/rosalina/source/menus/n3ds.c

@@ -25,23 +25,40 @@
 */
 
 #include <3ds.h>
+#include <math.h>
 #include "fmt.h"
 #include "menus/n3ds.h"
 #include "memory.h"
 #include "menu.h"
+#include "n3ds.h"
+#include "draw.h"
 
 static char clkRateBuf[128 + 1];
 
+static QtmCalibrationData lastQtmCal = {0};
+static bool qtmCalRead = false;
+
 Menu N3DSMenu = {
     "New 3DS menu",
     {
         { "Enable L2 cache", METHOD, .method = &N3DSMenu_EnableDisableL2Cache },
         { clkRateBuf, METHOD, .method = &N3DSMenu_ChangeClockRate },
+        { "Temporarily disable Super-Stable 3D", METHOD, .method = &N3DSMenu_ToggleSs3d, .visibility = &N3DSMenu_CheckNotN2dsXl },
+        { "Test parallax barrier positions", METHOD, .method = &N3DSMenu_TestBarrierPositions, .visibility = &N3DSMenu_CheckNotN2dsXl },
+        { "Super-Stable 3D calibration", METHOD, .method = &N3DSMenu_Ss3dCalibration, .visibility = &N3DSMenu_CheckNotN2dsXl },
         {},
     }
 };
 
 static s64 clkRate = 0, higherClkRate = 0, L2CacheEnabled = 0;
+static bool qtmUnavailableAndNotBlacklisted = false; // true on N2DSXL, though we check MCU system model data first
+static QtmStatus lastUpdatedQtmStatus;
+
+bool N3DSMenu_CheckNotN2dsXl(void)
+{
+    // Also check if qtm could be initialized
+    return isQtmInitialized && mcuInfoTableRead && mcuInfoTable[9] < 5 && !qtmUnavailableAndNotBlacklisted;
+}
 
 void N3DSMenu_UpdateStatus(void)
 {
@@ -51,6 +68,26 @@ void N3DSMenu_UpdateStatus(void)
 
     N3DSMenu.items[0].title = L2CacheEnabled ? "Disable L2 cache" : "Enable L2 cache";
     sprintf(clkRateBuf, "Set clock rate to %luMHz", clkRate != 268 ? 268 : (u32)higherClkRate);
+
+    if (N3DSMenu_CheckNotN2dsXl())
+    {
+        bool blacklisted = false;
+
+        // Read status
+        if (R_FAILED(QTMS_GetQtmStatus(&lastUpdatedQtmStatus)))
+            qtmUnavailableAndNotBlacklisted = true; // stop showing QTM options if unavailable but not blacklisted
+
+        else if (lastUpdatedQtmStatus == QTM_STATUS_UNAVAILABLE)
+            qtmUnavailableAndNotBlacklisted = R_FAILED(QTMU_IsCurrentAppBlacklisted(&blacklisted)) || !blacklisted;
+
+
+        MenuItem *item = &N3DSMenu.items[2];
+
+        if (lastUpdatedQtmStatus == QTM_STATUS_ENABLED)
+            item->title = "Temporarily disable Super-Stable 3D";
+        else
+            item->title = "Temporarily enable Super-Stable 3D";
+    }
 }
 
 void N3DSMenu_ChangeClockRate(void)
@@ -72,3 +109,184 @@ void N3DSMenu_EnableDisableL2Cache(void)
 
     N3DSMenu_UpdateStatus();
 }
+
+void N3DSMenu_ToggleSs3d(void)
+{
+    if (qtmUnavailableAndNotBlacklisted)
+        return;
+
+    if (lastUpdatedQtmStatus == QTM_STATUS_ENABLED)
+        QTMS_SetQtmStatus(QTM_STATUS_SS3D_DISABLED);
+    else // both SS3D disabled and unavailable/blacklisted states
+        QTMS_SetQtmStatus(QTM_STATUS_ENABLED);
+
+    N3DSMenu_UpdateStatus();
+}
+
+void N3DSMenu_TestBarrierPositions(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    u8 pos = 0;
+    QTMS_DisableAutoBarrierControl(); // assume it doesn't fail
+    QTMS_GetCurrentBarrierPosition(&pos);
+
+    u32 pressed = 0;
+
+    do
+    {
+        Draw_Lock();
+
+        Draw_DrawString(10, 10, COLOR_TITLE, "New 3DS menu");
+        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Use left/right to adjust the barrier's position.\n\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Each position corresponds to 5.2mm horizontal eye\nmovement (assuming ideal viewing conditions).\n\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Once you figure out the ideal central position, you\ncan then use it in the calibration submenu.\n\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Auto-barrier adjustment behavior is restored on\nexit.\n\n");
+
+        posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Barrier position: %2hhu\n", pos);
+
+        Draw_FlushFramebuffer();
+        pressed = waitInputWithTimeout(1000);
+
+        if (pressed & KEY_LEFT)
+        {
+            pos = pos > 11 ? 11 : pos; // pos is 13 when SS3D is disabled/camera is in use
+            pos = (12 + pos - 1) % 12;
+            QTMS_SetBarrierPosition(pos);
+        }
+        else if (pressed & KEY_RIGHT)
+        {
+            pos = pos > 11 ? 11 : pos; // pos is 13 when SS3D is disabled/camera is in use
+            pos = (pos + 1) % 12;
+            QTMS_SetBarrierPosition(pos);
+        }
+
+        Draw_Unlock();
+    } while(!menuShouldExit && !(pressed & KEY_B));
+
+    QTMS_EnableAutoBarrierControl();
+}
+
+void N3DSMenu_Ss3dCalibration(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    u8 currentPos;
+    QtmTrackingData trackingData = {0};
+
+    if (R_FAILED(QTMS_GetCurrentBarrierPosition(&currentPos)))
+        currentPos = 13;
+
+    bool calReadFailed = false;
+
+    if (!qtmCalRead)
+    {
+        cfguInit();
+        calReadFailed =  R_FAILED(CFG_GetConfigInfoBlk8(sizeof(QtmCalibrationData), QTM_CAL_CFG_BLK_ID, &lastQtmCal));
+        cfguExit();
+        if (!calReadFailed)
+            qtmCalRead = true;
+    }
+
+    bool trackingDisabled = currentPos == 13;
+
+    if (currentPos < 12)
+        QTMS_EnableAutoBarrierControl(); // assume this doesn't fail
+
+    u32 pressed = 0;
+    do
+    {
+        if (!trackingDisabled)
+        {
+            QTMS_GetCurrentBarrierPosition(&currentPos);
+            QTMU_GetTrackingData(&trackingData);
+        }
+
+        Draw_Lock();
+
+        Draw_DrawString(10, 10, COLOR_TITLE, "New 3DS menu");
+        u32 posY = 30;
+
+        if (trackingDisabled)
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "SS3D disabled or camera in use.\nPress B to exit this menu.\n");
+        else if (calReadFailed)
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "Failed to read calibration data.\nPress B to exit this menu.\n");
+        else
+        {
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "Right/Left:  +- 1\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "Up/Down:     +- 0.1\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "R/L:         +- 0.01\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "A:           save to system config\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "Y:           reload last saved calibration\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "B:           exit this menu\n\n");
+
+            char calStr[16];
+            floatToString(calStr, lastQtmCal.centerBarrierPosition, 2, true);
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Center position:          %-5s\n\n", calStr);
+
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Current barrier position: %-2hhu\n", currentPos);
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Current eye distance:     %-2d cm\n", (int)roundf(qtmEstimateEyeToCameraDistance(&trackingData) / 10.0f));
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Optimal eye distance:     %-2d cm\n", (int)roundf(lastQtmCal.viewingDistance / 10.0f));
+        }
+
+        Draw_FlushFramebuffer();
+        pressed = waitInputWithTimeout(15);
+
+        if (!calReadFailed)
+        {
+            if (pressed & KEY_LEFT)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(12.0f + lastQtmCal.centerBarrierPosition - 1.0f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+            else if (pressed & KEY_RIGHT)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(lastQtmCal.centerBarrierPosition + 1.0f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+
+            if (pressed & KEY_DOWN)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(12.0f + lastQtmCal.centerBarrierPosition - 0.1f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+            else if (pressed & KEY_UP)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(lastQtmCal.centerBarrierPosition + 0.1f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+
+            if (pressed & KEY_L)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(12.0f + lastQtmCal.centerBarrierPosition - 0.01f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+            else if (pressed & KEY_R)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(lastQtmCal.centerBarrierPosition + 0.01f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+
+            if (pressed & KEY_A)
+                QTMS_SetCalibrationData(&lastQtmCal, true);
+
+            if (pressed & KEY_Y)
+            {
+                cfguInit();
+                calReadFailed =  R_FAILED(CFG_GetConfigInfoBlk8(sizeof(QtmCalibrationData), QTM_CAL_CFG_BLK_ID, &lastQtmCal));
+                cfguExit();
+                qtmCalRead = !calReadFailed;
+                if (qtmCalRead)
+                    QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+        }
+
+        Draw_Unlock();
+    } while(!menuShouldExit && !(pressed & KEY_B));
+}

sysmodules/rosalina/source/menus/process_list.c

@@ -245,8 +245,8 @@ static void ProcessListMenu_MemoryViewer(const ProcessInfo *info)
         svcQueryProcessMemory(&mem, &out, processHandle, heapStartAddress);
         heapTotalSize = mem.size;
 
-        Result codeRes = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, codeDestAddress, processHandle, codeStartAddress, codeTotalSize);
+        Result codeRes = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, codeDestAddress, processHandle, codeStartAddress, codeTotalSize, 0);
-        Result heapRes = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, heapDestAddress, processHandle, heapStartAddress, heapTotalSize);
+        Result heapRes = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, heapDestAddress, processHandle, heapStartAddress, heapTotalSize, 0);
 
         bool codeAvailable = R_SUCCEEDED(codeRes);
         bool heapAvailable = R_SUCCEEDED(heapRes);

sysmodules/rosalina/source/menus/screen_filters.c

@@ -29,6 +29,7 @@
 #include "memory.h"
 #include "menu.h"
 #include "menus/screen_filters.h"
+#include "menus/screen_filters_srgb_tables.h"
 #include "draw.h"
 #include "redshift/colorramp.h"
 
@@ -53,6 +54,7 @@ static inline bool ScreenFiltersMenu_IsDefaultSettingsFilter(const ScreenFilter
     ok = ok && filter->gamma == 1.0f;
     ok = ok && filter->contrast == 1.0f;
     ok = ok && filter->brightness == 0.0f;
+    ok = ok && filter->colorCurveCorrection == 0;
     return ok;
 }
 
@@ -89,7 +91,7 @@ static u8 ScreenFilterMenu_CalculatePolynomialColorLutComponent(const float coef
     return (u8)CLAMP(levelInt, 0, 255); // clamp again just to be sure
 }
 
-static void ScreenFilterMenu_WritePolynomialColorLut(bool top, const float coeffs[][3], bool invert, float gamma, u32 dim)
+static void ScreenFilterMenu_WritePolynomialColorLut(bool top, u8 curveCorrection, const float coeffs[][3], bool invert, float gamma, u32 dim)
 {
     if (top)
         GPU_FB_TOP_COL_LUT_INDEX = 0;
@@ -99,9 +101,15 @@ static void ScreenFilterMenu_WritePolynomialColorLut(bool top, const float coeff
     for (int i = 0; i <= 255; i++) {
         Pixel px;
         int inLevel = invert ? 255 - i : i;
-        px.r = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 0, gamma, dim, inLevel);
+        const u8 (*tbl)[3] = curveCorrection == 2 ? ctrToSrgbTableBottom : ctrToSrgbTableTop;
-        px.g = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 1, gamma, dim, inLevel);
+
-        px.b = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 2, gamma, dim, inLevel);
+        u8 inLevelR = curveCorrection > 0 ? tbl[inLevel][0] : inLevel;
+        u8 inLevelG = curveCorrection > 0 ? tbl[inLevel][1] : inLevel;
+        u8 inLevelB = curveCorrection > 0 ? tbl[inLevel][2] : inLevel;
+
+        px.r = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 0, gamma, dim, inLevelR);
+        px.g = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 1, gamma, dim, inLevelG);
+        px.b = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 2, gamma, dim, inLevelB);
         px.z = 0;
 
         if (top)
@@ -127,7 +135,7 @@ static void ScreenFiltersMenu_ApplyColorSettings(bool top)
         { a * wp[0], a * wp[1], a * wp[2] },    // x^1
     };
 
-    ScreenFilterMenu_WritePolynomialColorLut(top, poly, inv, g, 1);
+    ScreenFilterMenu_WritePolynomialColorLut(top, filter->colorCurveCorrection, poly, inv, g, 1);
 }
 
 static void ScreenFiltersMenu_SetCct(u16 cct)
@@ -138,6 +146,41 @@ static void ScreenFiltersMenu_SetCct(u16 cct)
     ScreenFiltersMenu_ApplyColorSettings(false);
 }
 
+static void ScreenFiltersMenu_UpdateEntries(void)
+{
+    if (topScreenFilter.colorCurveCorrection == 0)
+    {
+        screenFiltersMenu.items[10].title = "[IPS recommended] Enhance top screen colors";
+        screenFiltersMenu.items[10].method = &ScreenFiltersMenu_SetTopScreenSrgbColorCurve;
+    }
+    else
+    {
+        screenFiltersMenu.items[10].title = "Restore top screen color curve";
+        screenFiltersMenu.items[10].method = &ScreenFiltersMenu_RestoreTopScreenColorCurve;
+    }
+
+    if (bottomScreenFilter.colorCurveCorrection == 0)
+    {
+        screenFiltersMenu.items[11].title = "[IPS recommended] Enhance bottom screen colors";
+        screenFiltersMenu.items[11].method = &ScreenFiltersMenu_SetBottomScreenSrgbColorCurve;
+    }
+    else
+    {
+        screenFiltersMenu.items[11].title = "Restore bottom screen color curve";
+        screenFiltersMenu.items[11].method = &ScreenFiltersMenu_RestoreBottomScreenColorCurve;
+    }
+}
+static void ScreenFiltersMenu_SetColorCurveCorrection(bool top, u8 colorCurveCorrection)
+{
+    if (top)
+        topScreenFilter.colorCurveCorrection = colorCurveCorrection;
+    else
+        bottomScreenFilter.colorCurveCorrection = colorCurveCorrection;
+
+    ScreenFiltersMenu_ApplyColorSettings(top);
+    ScreenFiltersMenu_UpdateEntries();
+}
+
 Menu screenFiltersMenu = {
     "Screen filters menu",
     {
@@ -151,7 +194,9 @@ Menu screenFiltersMenu = {
         { "[2300K] Warm Incandescent", METHOD, .method = &ScreenFiltersMenu_SetWarmIncandescent },
         { "[1900K] Candle", METHOD, .method = &ScreenFiltersMenu_SetCandle },
         { "[1200K] Ember", METHOD, .method = &ScreenFiltersMenu_SetEmber },
-        { "Advanced configuration", METHOD, .method = &ScreenFiltersMenu_AdvancedConfiguration },
+        { "[IPS recommended] Enhance top screen colors", METHOD, .method = &ScreenFiltersMenu_SetTopScreenSrgbColorCurve },
+        { "[IPS recommended] Enhance bottom screen colors", METHOD, .method = &ScreenFiltersMenu_SetTopScreenSrgbColorCurve },
+        { "Advanced configuration...", METHOD, .method = &ScreenFiltersMenu_AdvancedConfiguration },
         {},
     }
 };
@@ -162,6 +207,12 @@ void ScreenFiltersMenu_Set##name(void)\
     ScreenFiltersMenu_SetCct(temp);\
 }
 
+#define DEF_SRGB_SETTER(top, profile, name)\
+void ScreenFiltersMenu_##name(void)\
+{\
+    ScreenFiltersMenu_SetColorCurveCorrection(top, profile);\
+}
+
 void ScreenFiltersMenu_RestoreSettings(void)
 {
     // Precondition: menu has not been entered
@@ -214,6 +265,9 @@ void ScreenFiltersMenu_LoadConfig(void)
     svcGetSystemInfo(&out, 0x10000, 0x107);
     topScreenFilter.invert = (bool)out;
 
+    svcGetSystemInfo(&out, 0x10000, 0x10D);
+    topScreenFilter.colorCurveCorrection = (u8)out;
+
     svcGetSystemInfo(&out, 0x10000, 0x108);
     bottomScreenFilter.cct = (u16)out;
     if (bottomScreenFilter.cct < 1000 || bottomScreenFilter.cct > 25100)
@@ -236,6 +290,11 @@ void ScreenFiltersMenu_LoadConfig(void)
 
     svcGetSystemInfo(&out, 0x10000, 0x10C);
     bottomScreenFilter.invert = (bool)out;
+
+    svcGetSystemInfo(&out, 0x10000, 0x10E);
+    bottomScreenFilter.colorCurveCorrection = (u8)out;
+
+    ScreenFiltersMenu_UpdateEntries();
 }
 
 DEF_CCT_SETTER(6500, Default)
@@ -250,6 +309,26 @@ DEF_CCT_SETTER(2300, WarmIncandescent)
 DEF_CCT_SETTER(1900, Candle)
 DEF_CCT_SETTER(1200, Ember)
 
+void ScreenFiltersMenu_SetTopScreenSrgbColorCurve(void)
+{
+    ScreenFiltersMenu_SetColorCurveCorrection(true, 1);
+}
+
+void ScreenFiltersMenu_RestoreTopScreenColorCurve(void)
+{
+    ScreenFiltersMenu_SetColorCurveCorrection(true, 0);
+}
+
+void ScreenFiltersMenu_SetBottomScreenSrgbColorCurve(void)
+{
+    ScreenFiltersMenu_SetColorCurveCorrection(false, 2);
+}
+
+void ScreenFiltersMenu_RestoreBottomScreenColorCurve(void)
+{
+    ScreenFiltersMenu_SetColorCurveCorrection(false, 0);
+}
+
 static void ScreenFiltersMenu_ClampFilter(ScreenFilter *filter)
 {
     filter->cct = CLAMP(filter->cct, 1000, 25100);

sysmodules/rosalina/source/menus/sysconfig.c

@@ -32,6 +32,7 @@
 #include "fmt.h"
 #include "utils.h"
 #include "ifile.h"
+#include "luminance.h"
 
 Menu sysconfigMenu = {
     "System configuration menu",
@@ -42,6 +43,7 @@ Menu sysconfigMenu = {
         { "Toggle Wireless", METHOD, .method = &SysConfigMenu_ToggleWireless },
         { "Toggle Power Button", METHOD, .method=&SysConfigMenu_TogglePowerButton },
         { "Toggle power to card slot", METHOD, .method=&SysConfigMenu_ToggleCardIfPower},
+        { "Change screen brightness", METHOD, .method = &SysConfigMenu_ChangeScreenBrightness },
         {},
     }
 };
@@ -134,7 +136,7 @@ void SysConfigMenu_ToggleWireless(void)
 
 void SysConfigMenu_UpdateStatus(bool control)
 {
-    MenuItem *item = &sysconfigMenu.items[0];
+    MenuItem *item = &sysconfigMenu.items[1];
 
     if(control)
     {
@@ -267,9 +269,10 @@ void SysConfigMenu_ControlWifi(void)
     Result resInit = acInit();
     for (u32 i = 0; i < 3; i++)
     {
-        // ssid[0] = '\0' if result is an error here
+        if (R_SUCCEEDED(ACI_LoadNetworkSetting(i)))
-        ACI_LoadNetworkSetting(i);
+            ACI_GetNetworkWirelessEssidSecuritySsid(ssids[i]);
-        ACI_GetNetworkWirelessEssidSecuritySsid(ssids[i]);
+        else
+            strcpy(ssids[i], "(not configured)");
     }
     if (R_SUCCEEDED(resInit))
         acExit();
@@ -386,24 +389,77 @@ void SysConfigMenu_ToggleCardIfPower(void)
 
 static Result SysConfigMenu_ApplyVolumeOverride(void)
 {
-    // Credit: profi200
+    // This feature repurposes the functionality used for the camera shutter sound.
-    u8 tmp;
+    // As such, it interferes with it:
+    //     - shutter volume is set to the override instead of its default 100% value
+    //     - due to implementation details, having the shutter sound effect play will
+    //       make this feature stop working until the volume override is reapplied by
+    //       going back to this menu
+
+    // Original credit: profi200
+
+    u8 i2s1Mux;
+    u8 i2s2Mux;
     Result res = cdcChkInit();
 
-    if (R_SUCCEEDED(res)) res = CDCCHK_ReadRegisters2(0, 116, &tmp, 1); // CDC_REG_VOL_MICDET_PIN_SAR_ADC
+    if (R_SUCCEEDED(res)) res = CDCCHK_ReadRegisters2(0,  116, &i2s1Mux, 1); // used for shutter sound in TWL mode, and all GBA/DSi/3DS application
-    if (currVolumeSliderOverride >= 0)
+    if (R_SUCCEEDED(res)) res = CDCCHK_ReadRegisters2(100, 49, &i2s2Mux, 1); // used for shutter sound in CTR mode and CTR mode library applets
-        tmp &= ~0x80;
-    else
-        tmp |= 0x80;
-    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(0, 116, &tmp, 1);
 
-    if (currVolumeSliderOverride >= 0) {
+    if (currVolumeSliderOverride >= 0)
-        s8 calculated = -128 + (((float)currVolumeSliderOverride/100.f) * 108);
+    {
-        if (calculated > -20)
+        i2s1Mux &= ~0x80;
-            res = -1; // Just in case
+        i2s2Mux |=  0x20;
-        s8 volumes[2] = {calculated, calculated}; // Volume in 0.5 dB steps. -128 (muted) to 48. Do not go above -20 (100%).
-        if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(0, 65, volumes, 2); // CDC_REG_DAC_L_VOLUME_CTRL, CDC_REG_DAC_R_VOLUME_CTRL
     }
+    else
+    {
+        i2s1Mux |=  0x80;
+        i2s2Mux &= ~0x20;
+    }
+
+    s8 i2s1Volume;
+    s8 i2s2Volume;
+    if (currVolumeSliderOverride >= 0)
+    {
+        // Considering I found this table inside MCU fw bin (at around offset 0x1200 in the raw bin):
+        // 127, 126, 125, ... 56
+        // which corresponds to round(127 - 71 * (i/63)) modulo some rounding error, it is certain
+        // that the MCU writes to "Page 0/Register 117: VOL/MICDET-Pin Gain" using linear interpolation
+        // to map the slider position (0..63) to the raw gain values, using 127 ("reserved") as "mute".
+        // Indeed, the value used in all calibration data for shutter volume is -10 dB, which maps to 56.
+
+        // However, if you look at the definition of reg 0,117 closely, you will notice that the mapping
+        // to the 7-bit value is piecewise, with half the resolution (double the slope) for values mapping
+        // to -28 dB or lower, which means that the slider increases volume twice as fast below 50% position.
+
+        // LERP like MCU does, round to nearest integer
+        u8 rawPinGain = 127 - (71 * currVolumeSliderOverride + 50) / 100;
+        s8 volume;
+
+        if (rawPinGain <= 90)
+            volume = 36 - rawPinGain;
+        else if (rawPinGain >= 91 && rawPinGain <= 126)
+            volume = 126 - 2 * rawPinGain;
+        else
+            volume = -128; // mute
+
+        i2s1Volume = volume;
+        i2s2Volume = volume;
+    }
+    else
+    {
+        // Restore shutter sound volumes. This sould be sourced from cfg,
+        // however the values are the same everwhere
+        i2s1Volume =  -3; // -1.5 dB (115.7%, only used by TWL applications when taking photos)
+        i2s2Volume = -20; // -10 dB  (100%)
+    }
+
+    // Write volume overrides values before writing to the pinmux registers
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(0, 65, &i2s1Volume, 1); // CDC_REG_DAC_L_VOLUME_CTRL
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(0, 66, &i2s1Volume, 1); // CDC_REG_DAC_R_VOLUME_CTRL
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(100, 123, &i2s2Volume, 1);
+
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(0, 116, &i2s1Mux, 1);
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(100, 49, &i2s2Mux, 1);
 
     cdcChkExit();
     return res;
@@ -434,7 +490,7 @@ void SysConfigMenu_AdjustVolume(void)
     {
         Draw_Lock();
         Draw_DrawString(10, 10, COLOR_TITLE, "System configuration menu");
-        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Y: Toggle volume slider override.\nDPAD: Adjust the volume level.\nA: Apply\nB: Go back\n\n");
+        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Y: Toggle volume slider override.\nDPAD/CPAD: Adjust the volume level.\nA: Apply\nB: Go back\n\n");
         Draw_DrawString(10, posY, COLOR_WHITE, "Current status:");
         posY = Draw_DrawString(100, posY, (tempVolumeOverride == -1) ? COLOR_RED : COLOR_GREEN, (tempVolumeOverride == -1) ? " DISABLED" : " ENABLED ");
         if (tempVolumeOverride != -1) {
@@ -444,8 +500,12 @@ void SysConfigMenu_AdjustVolume(void)
         }
 
         Draw_FlushFramebuffer();
+        Draw_Unlock();
+
         u32 pressed = waitInputWithTimeout(1000);
 
+        Draw_Lock();
+
         if(pressed & KEY_A)
         {
             currVolumeSliderOverride = tempVolumeOverride;
@@ -468,16 +528,16 @@ void SysConfigMenu_AdjustVolume(void)
                 tempVolumeOverride = -1;
             }
         }
-        else if ((pressed & (KEY_DUP | KEY_DDOWN | KEY_DLEFT | KEY_DRIGHT)) && tempVolumeOverride != -1)
+        else if ((pressed & (KEY_UP | KEY_DOWN | KEY_LEFT | KEY_RIGHT)) && tempVolumeOverride != -1)
         {
             Draw_DrawString(10, posY, COLOR_WHITE, "\n                 ");
-            if (pressed & KEY_DUP)
+            if (pressed & KEY_UP)
                 tempVolumeOverride++;
-            else if (pressed & KEY_DDOWN)
+            else if (pressed & KEY_DOWN)
                 tempVolumeOverride--;
-            else if (pressed & KEY_DRIGHT)
+            else if (pressed & KEY_RIGHT)
                 tempVolumeOverride+=10;
-            else if (pressed & KEY_DLEFT)
+            else if (pressed & KEY_LEFT)
                 tempVolumeOverride-=10;
 
             if (tempVolumeOverride < 0)
@@ -485,5 +545,107 @@ void SysConfigMenu_AdjustVolume(void)
             if (tempVolumeOverride > 100)
                 tempVolumeOverride = 100;
         }
+
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
     } while(!menuShouldExit);
 }
+
+void SysConfigMenu_ChangeScreenBrightness(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    // gsp:LCD GetLuminance is stubbed on O3DS so we have to implement it ourselves... damn it.
+    // Assume top and bottom screen luminances are the same (should be; if not, we'll set them to the same values).
+    u32 luminance = getCurrentLuminance(false);
+    u32 minLum = getMinLuminancePreset();
+    u32 maxLum = getMaxLuminancePreset();
+
+    do
+    {
+        Draw_Lock();
+        Draw_DrawString(10, 10, COLOR_TITLE, "Screen brightness");
+        u32 posY = 30;
+        posY = Draw_DrawFormattedString(
+            10,
+            posY,
+            COLOR_WHITE,
+            "Current luminance: %lu (min. %lu, max. %lu)\n\n",
+            luminance,
+            minLum,
+            maxLum
+        );
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Controls: Up/Down for +-1, Right/Left for +-10.\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Press A to start, B to exit.\n\n");
+
+        posY = Draw_DrawString(10, posY, COLOR_RED, "WARNING: \n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "  * value will be limited by calibration.\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "  * bottom framebuffer will be restored until\nyou exit.");
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+
+        u32 pressed = waitInputWithTimeout(1000);
+
+        if (pressed & KEY_A)
+            break;
+
+        if (pressed & KEY_B)
+            return;
+    }
+    while (!menuShouldExit);
+
+    Draw_Lock();
+
+    Draw_RestoreFramebuffer();
+    Draw_FreeFramebufferCache();
+
+    svcKernelSetState(0x10000, 2); // unblock gsp
+    gspLcdInit(); // assume it doesn't fail. If it does, brightness won't change, anyway.
+
+    // gsp:LCD will normalize the brightness between top/bottom screen, handle PWM, etc.
+
+    s32 lum = (s32)luminance;
+
+    do
+    {
+        u32 pressed = waitInputWithTimeout(1000);
+        if (pressed & DIRECTIONAL_KEYS)
+        {
+            if (pressed & KEY_UP)
+                lum += 1;
+            else if (pressed & KEY_DOWN)
+                lum -= 1;
+            else if (pressed & KEY_RIGHT)
+                lum += 10;
+            else if (pressed & KEY_LEFT)
+                lum -= 10;
+
+            lum = lum < (s32)minLum ? (s32)minLum : lum;
+            lum = lum > (s32)maxLum ? (s32)maxLum : lum;
+
+            // We need to call gsp here because updating the active duty LUT is a bit tedious (plus, GSP has internal state).
+            // This is actually SetLuminance:
+            GSPLCD_SetBrightnessRaw(BIT(GSP_SCREEN_TOP) | BIT(GSP_SCREEN_BOTTOM), lum);
+        }
+
+        if (pressed & KEY_B)
+            break;
+    }
+    while (!menuShouldExit);
+
+    gspLcdExit();
+    svcKernelSetState(0x10000, 2); // block gsp again
+
+    if (R_FAILED(Draw_AllocateFramebufferCache(FB_BOTTOM_SIZE)))
+    {
+        // Shouldn't happen
+        __builtin_trap();
+    }
+    else
+        Draw_SetupFramebuffer();
+
+    Draw_Unlock();
+}

sysmodules/rosalina/source/minisoc.c

@@ -110,7 +110,7 @@ Result miniSocInit(void)
     ret = srvGetServiceHandle(&miniSocHandle, "soc:U");
     if(ret != 0) goto cleanup;
 
-    ret = svcControlMemoryEx(&tmp, socContextAddr, 0, socContextSize, MEMOP_ALLOC, MEMREGION_SYSTEM | MEMPERM_READ | MEMPERM_WRITE, true);
+    ret = svcControlMemoryEx(&tmp, socContextAddr, 0, socContextSize, MEMOP_ALLOC | MEMOP_REGION_SYSTEM, MEMPERM_READ | MEMPERM_WRITE, true);
     if(ret != 0) goto cleanup;
 
     socContextAddr = tmp;

sysmodules/rosalina/source/plugin/file_loader.c

@@ -142,7 +142,7 @@ static Result   CheckPluginCompatibility(_3gx_Header *header, u32 processTitle)
     return -1;
 }
 
-bool     TryToLoadPlugin(Handle process)
+bool     TryToLoadPlugin(Handle process, bool isHomebrew)
 {
     u64             tid;
     u64             fileSize;
@@ -168,9 +168,9 @@ bool     TryToLoadPlugin(Handle process)
     pluginHeader->magic = HeaderMagic;
 
     // Try to open plugin file
-    if (ctx->useUserLoadParameters && (u32)tid == ctx->userLoadParameters.lowTitleId)
+    if (ctx->useUserLoadParameters && (ctx->userLoadParameters.lowTitleId == 0 || (u32)tid == ctx->userLoadParameters.lowTitleId))
     {
-        ctx->useUserLoadParameters = false;
+        if (!ctx->userLoadParameters.persistent) ctx->useUserLoadParameters = false;
         ctx->pluginMemoryStrategy = ctx->userLoadParameters.pluginMemoryStrategy;
         if (OpenFile(&plugin, ctx->userLoadParameters.path))
             return false;
@@ -208,12 +208,20 @@ bool     TryToLoadPlugin(Handle process)
     // Check compatibility
     if (!res && fileHeader.infos.compatibility == PLG_COMPAT_EMULATOR) {
         ctx->error.message = "Plugin is only compatible with emulators";
-        return false;
+        res = -1;
+    }
+
+    // Check if plugin can load on homebrew
+    if (!res && (isHomebrew && !fileHeader.infos.allowHomebrewLoad)) {
+        // Do not display message as this is a common case
+        ctx->error.message = NULL;
+        res = -1;
     }
 
     // Flags
     if (!res) {
         ctx->eventsSelfManaged = fileHeader.infos.eventsSelfManaged;
+        ctx->isMemPrivate = fileHeader.infos.usePrivateMemory;
         if (ctx->pluginMemoryStrategy == PLG_STRATEGY_SWAP && fileHeader.infos.swapNotNeeded)
             ctx->pluginMemoryStrategy = PLG_STRATEGY_NONE;
     }
@@ -262,6 +270,7 @@ bool     TryToLoadPlugin(Handle process)
     }
 
     pluginHeader->version = header->version;
+    pluginHeader->waitForReplyTimeout = 10000000000ULL;
     // Code size must be page aligned
     exeHdr = &header->executable;
     pluginHeader->exeSize = (sizeof(PluginHeader) + exeHdr->codeSize + exeHdr->rodataSize + exeHdr->dataSize + exeHdr->bssSize + 0x1000) & ~0xFFF;
@@ -292,7 +301,7 @@ bool     TryToLoadPlugin(Handle process)
 
         extern u32  g_savedGameInstr[2];
 
-        if (R_FAILED((res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, procStart, process, procStart, 0x1000))))
+        if (R_FAILED((res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, procStart, process, procStart, 0x1000, 0))))
         {
             ctx->error.message = "Couldn't map process";
             ctx->error.code = res;

sysmodules/rosalina/source/plugin/memoryblock.c

@@ -205,11 +205,12 @@ Result     MemoryBlock__MountInProcess(void)
     Error           *error = &PluginLoaderCtx.error;
     PluginHeader    *header = &PluginLoaderCtx.header;
     MemoryBlock     *memblock = &PluginLoaderCtx.memblock;
+    bool            isPrivate = PluginLoaderCtx.isMemPrivate;
 
     Result       res = 0;
 
     // Executable
-    if (R_FAILED((res = svcMapProcessMemoryEx(target, 0x07000000, CUR_PROCESS_HANDLE, (u32)memblock->memblock, header->exeSize))))
+    if (R_FAILED((res = svcMapProcessMemoryEx(target, 0x07000000, CUR_PROCESS_HANDLE, (u32) memblock->memblock, header->exeSize, isPrivate ? MAPEXFLAGS_PRIVATE : 0))))
     {
         error->message = "Couldn't map exe memory block";
         error->code = res;
@@ -217,7 +218,7 @@ Result     MemoryBlock__MountInProcess(void)
     }
 
     // Heap (to be used by the plugin)
-    if (R_FAILED((res = svcMapProcessMemoryEx(target, header->heapVA, CUR_PROCESS_HANDLE, (u32)memblock->memblock + header->exeSize, header->heapSize))))
+    if (R_FAILED((res = svcMapProcessMemoryEx(target, header->heapVA, CUR_PROCESS_HANDLE, (u32) memblock->memblock + header->exeSize, header->heapSize, isPrivate ? MAPEXFLAGS_PRIVATE : 0))))
     {
         error->message = "Couldn't map heap memory block";
         error->code = res;
@@ -233,7 +234,7 @@ Result     MemoryBlock__UnmountFromProcess(void)
 
     Result  res = 0;
 
-    res = svcUnmapProcessMemoryEx(target, 0x07000000, header->exeSize);
+    res |= svcUnmapProcessMemoryEx(target, 0x07000000, header->exeSize);
     res |= svcUnmapProcessMemoryEx(target, header->heapVA, header->heapSize);
 
     return res;

sysmodules/rosalina/source/plugin/plgldr.c

@@ -113,7 +113,7 @@ Result  PLGLDR__SetPluginLoadParameters(PluginLoadParameters *parameters)
     }
     return res;
 }
-void     Flash(u32 color);
+
 Result  PLGLDR__DisplayMenu(PluginMenu *menu)
 {
     Result res = 0;
@@ -136,7 +136,6 @@ Result  PLGLDR__DisplayMenu(PluginMenu *menu)
     {
         res = cmdbuf[1];
     }
-    else Flash(0xFF0000);
 
     return res;
 }

sysmodules/rosalina/source/plugin/plgloader.c

@@ -10,17 +10,16 @@
 #include "sleep.h"
 #include "task_runner.h"
 
-#define PLGLDR_VERSION (SYSTEM_VERSION(1, 0, 1))
+#define PLGLDR_VERSION (SYSTEM_VERSION(1, 0, 2))
 
 #define THREADVARS_MAGIC  0x21545624 // !TV$
 
+#define PERS_USER_FILE_MAGIC 0x53524550 // PERS
+
 static const char *g_title = "Plugin loader";
 PluginLoaderContext PluginLoaderCtx;
 extern u32 g_blockMenuOpen;
 
-void        IR__Patch(void);
-void        IR__Unpatch(void);
-
 void        PluginLoader__Init(void)
 {
     PluginLoaderContext *ctx = &PluginLoaderCtx;
@@ -43,6 +42,24 @@ void        PluginLoader__Init(void)
     assertSuccess(svcCreateEvent(&ctx->kernelEvent, RESET_ONESHOT));
 
     svcKernelSetState(0x10007, ctx->kernelEvent, 0, 0);
+
+    IFile file;
+    if (R_SUCCEEDED(IFile_Open(&file, ARCHIVE_SDMC, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, "/luma/plugins/user_param.bin"), FS_OPEN_READ)))
+    {
+        PluginLoadParameters *params = &ctx->userLoadParameters;
+        u64 temp_read;
+        u32 magic = 0;
+        if (R_SUCCEEDED(IFile_Read(&file, &temp_read, &magic, sizeof(magic))) && temp_read == sizeof(magic) && magic == PERS_USER_FILE_MAGIC
+            && R_SUCCEEDED(IFile_Read(&file, &temp_read, params, sizeof(PluginLoadParameters))) && temp_read == sizeof(PluginLoadParameters))
+        {
+            ctx->useUserLoadParameters = true;
+        }
+        else
+        {
+            memset(params, 0, sizeof(PluginLoadParameters));
+        }
+        IFile_Close(&file);
+    }
 }
 
 void    PluginLoader__Error(const char *message, Result res)
@@ -76,7 +93,7 @@ void        PluginLoader__UpdateMenu(void)
 static ControlApplicationMemoryModeOverrideConfig g_memorymodeoverridebackup = { 0 };
 Result  PluginLoader__SetMode3AppMode(bool enable)
 {
-	Handle loaderHandle;
+    Handle loaderHandle;
     Result res = srvGetServiceHandle(&loaderHandle, "Loader");
 
     if (R_FAILED(res)) return res;
@@ -85,7 +102,7 @@ Result  PluginLoader__SetMode3AppMode(bool enable)
 
     if (enable) {
         ControlApplicationMemoryModeOverrideConfig* mode = (ControlApplicationMemoryModeOverrideConfig*)&cmdbuf[1];
-        
+
         memset(mode, 0, sizeof(ControlApplicationMemoryModeOverrideConfig));
         mode->query = true;
         cmdbuf[0] = IPC_MakeHeader(0x101, 1, 0); // ControlApplicationMemoryModeOverride
@@ -110,16 +127,12 @@ Result  PluginLoader__SetMode3AppMode(bool enable)
             res = cmdbuf[1];
         }
     }
-    
+
-	svcCloseHandle(loaderHandle);
+    svcCloseHandle(loaderHandle);
     return res;
 }
 static void j_PluginLoader__SetMode3AppMode(void* arg) {(void)arg; PluginLoader__SetMode3AppMode(false);}
 
-void CheckMemory(void);
-
-void    PLG__NotifyEvent(PLG_Event event, bool signal);
-
 void     PluginLoader__HandleCommands(void *_ctx)
 {
     (void)_ctx;
@@ -131,7 +144,7 @@ void     PluginLoader__HandleCommands(void *_ctx)
     {
         case 1: // Load plugin
         {
-            if (cmdbuf[0] != IPC_MakeHeader(1, 1, 0))
+            if (cmdbuf[0] != IPC_MakeHeader(1, 2, 0))
             {
                 error(cmdbuf, 0xD9001830);
                 break;
@@ -144,7 +157,7 @@ void     PluginLoader__HandleCommands(void *_ctx)
                 TaskRunner_RunTask(j_PluginLoader__SetMode3AppMode, NULL, 0);
 
             bool flash = !(ctx->useUserLoadParameters && ctx->userLoadParameters.noFlash);
-            if (ctx->isEnabled && TryToLoadPlugin(ctx->target))
+            if (ctx->isEnabled && TryToLoadPlugin(ctx->target, cmdbuf[2]))
             {
                 if (flash)
                 {
@@ -156,8 +169,6 @@ void     PluginLoader__HandleCommands(void *_ctx)
                     }
                     REG32(0x10202204) = 0;
                 }
-                //if (!ctx->userLoadParameters.noIRPatch)
-                //    IR__Patch();
                 PLG__SetConfigMemoryStatus(PLG_CFG_RUNNING);
             }
             else
@@ -218,11 +229,25 @@ void     PluginLoader__HandleCommands(void *_ctx)
             ctx->useUserLoadParameters = true;
             params->noFlash = cmdbuf[1] & 0xFF;
             params->pluginMemoryStrategy = (cmdbuf[1] >> 8) & 0xFF;
+            params->persistent = (cmdbuf[1] >> 16) & 0x1;
             params->lowTitleId = cmdbuf[2];
-            
+
             strncpy(params->path, (const char *)cmdbuf[4], 255);
             memcpy(params->config, (void *)cmdbuf[6], 32 * sizeof(u32));
 
+            if (params->persistent)
+            {
+                IFile file;
+                if (R_SUCCEEDED(IFile_Open(&file, ARCHIVE_SDMC, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, "/luma/plugins/user_param.bin"),
+                                           FS_OPEN_CREATE | FS_OPEN_READ | FS_OPEN_WRITE))) {
+                    u64 tempWritten;
+                    u32 magic = PERS_USER_FILE_MAGIC;
+                    IFile_Write(&file, &tempWritten, &magic, sizeof(magic), 0);
+                    IFile_Write(&file, &tempWritten, params, sizeof(PluginLoadParameters), 0);
+                    IFile_Close(&file);
+                }
+            }
+
             if (params->pluginMemoryStrategy == PLG_STRATEGY_MODE3)
                 cmdbuf[1] = PluginLoader__SetMode3AppMode(true);
             else
@@ -342,9 +367,9 @@ void     PluginLoader__HandleCommands(void *_ctx)
                 error(cmdbuf, 0xD9001830);
                 break;
             }
-            
+
             g_blockMenuOpen = cmdbuf[1];
-            
+
             cmdbuf[0] = IPC_MakeHeader(11, 1, 0);
             cmdbuf[1] = 0;
             break;
@@ -408,7 +433,7 @@ void     PluginLoader__HandleCommands(void *_ctx)
                 Reset_3gx_LoadParams();
                 break;
             }
-            
+
             ctx->isExeLoadFunctionset = true;
 
             svcInvalidateEntireInstructionCache(); // Could use the range one
@@ -417,6 +442,28 @@ void     PluginLoader__HandleCommands(void *_ctx)
             break;
         }
 
+        case 14: // Clear user load parameters
+        {
+            if (cmdbuf[0] != IPC_MakeHeader(14, 0, 0))
+            {
+                error(cmdbuf, 0xD9001830);
+                break;
+            }
+
+            ctx->useUserLoadParameters = false;
+            memset(&ctx->userLoadParameters, 0, sizeof(PluginLoadParameters));
+
+            FS_Archive sd;
+            if(R_SUCCEEDED(FSUSER_OpenArchive(&sd, ARCHIVE_SDMC, fsMakePath(PATH_EMPTY, ""))))
+            {
+                FSUSER_DeleteFile(sd, fsMakePath(PATH_ASCII, "/luma/plugins/user_param.bin"));
+                FSUSER_CloseArchive(sd);
+            }
+
+            cmdbuf[1] = 0;
+            break;
+        }
+
         default: // Unknown command
         {
             error(cmdbuf, 0xD900182F);
@@ -460,7 +507,7 @@ void    PLG__WaitForReply(void)
 {
     if (PluginLoaderCtx.eventsSelfManaged) return;
     __strex__(PluginLoaderCtx.plgReplyPA, PLG_WAIT);
-    svcArbitrateAddress(PluginLoaderCtx.arbiter, (u32)PluginLoaderCtx.plgReplyPA, ARBITRATION_WAIT_IF_LESS_THAN_TIMEOUT, PLG_OK, 10000000000ULL);
+    svcArbitrateAddress(PluginLoaderCtx.arbiter, (u32)PluginLoaderCtx.plgReplyPA, ARBITRATION_WAIT_IF_LESS_THAN_TIMEOUT, PLG_OK, MemoryBlock__GetMappedPluginHeader()->waitForReplyTimeout);
 }
 
 void     PLG__SetConfigMemoryStatus(u32 status)
@@ -485,7 +532,7 @@ static void WaitForProcessTerminated(void *arg)
 
     // Wait until all threads of the process have finished (svcWaitSynchronization == 0) or 2.5 seconds have passed.
     for (u32 i = 0; svcWaitSynchronization(ctx->target, 0) != 0 && i < 50; i++) svcSleepThread(50000000); // 50ms
-    
+
     // Unmap plugin's memory before closing the process
     if (!ctx->pluginIsSwapped) {
         MemoryBlock__UnmountFromProcess();
@@ -502,10 +549,9 @@ static void WaitForProcessTerminated(void *arg)
     ctx->isSwapFunctionset = false;
     ctx->pluginMemoryStrategy = PLG_STRATEGY_SWAP;
     ctx->eventsSelfManaged = false;
+    ctx->isMemPrivate = false;
     g_blockMenuOpen = 0;
     MemoryBlock__ResetSwapSettings();
-    //if (!ctx->userLoadParameters.noIRPatch)
-    //    IR__Unpatch();
 }
 
 void    PluginLoader__HandleKernelEvent(u32 notifId)
@@ -586,12 +632,11 @@ void    PluginLoader__HandleKernelEvent(u32 notifId)
                     PLG__NotifyEvent(PLG_HOME_ENTER, false);
                     // Wait for plugin reply
                     PLG__WaitForReply();
-                }                
+                }
                 PLG__SetConfigMemoryStatus(PLG_CFG_INHOME);
             }
             ctx->pluginIsHome = !ctx->pluginIsHome;
         }
-        
     }
     srvPublishToSubscriber(0x1002, 0);
 }

sysmodules/rosalina/source/process_patches.c

@@ -77,7 +77,7 @@ Result OperateOnProcessByName(const char *name, OperateOnProcessCb func)
 
     // NOTE: we suppose .text, .rodata, .data+.bss are contiguous & in that order
     u32 totalSize = (u32)(textSize + roSize + rwSize);
-    if (R_FAILED(res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize)))
+    if (R_FAILED(res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize, 0)))
     {
         svcCloseHandle(processHandle);
         return res;