diff --git a/jit_shellcode/dlsym_test/dlsym.c b/jit_shellcode/dlsym_test/dlsym.c
index b0f1428..372faec 100644
--- a/jit_shellcode/dlsym_test/dlsym.c
+++ b/jit_shellcode/dlsym_test/dlsym.c
@@ -11,15 +11,17 @@ static u64 eboot_wrap(void* gadget, void* fn,
                       u64 a4, u64 a5, u64 a6)
 {
     __asm__ (
+        "push rbx\n\t"            // save caller's rbx; rsp -= 8
         "mov rbx, rsi\n\t"        // rbx = fn
         "mov rax, rdi\n\t"        // rax = gadget
         "mov rdi, rdx\n\t"        // a1
         "mov rsi, rcx\n\t"        // a2
         "mov rdx, r8\n\t"         // a3
         "mov rcx, r9\n\t"         // a4
-        "mov r8,  [rsp + 8]\n\t"  // a5
-        "mov r9,  [rsp + 16]\n\t" // a6
+        "mov r8,  [rsp + 16]\n\t" // a5 (was +8, now +16 due to push)
+        "mov r9,  [rsp + 24]\n\t" // a6 (was +16, now +24 due to push)
         "call rax\n\t"
+        "pop rbx\n\t"             // restore caller's rbx
         "ret"
     );
 }
diff --git a/payloads/shellcode_test3.lua b/payloads/shellcode_test3.lua
index 34a69aa..bc08d97 100644
--- a/payloads/shellcode_test3.lua
+++ b/payloads/shellcode_test3.lua
@@ -1,6 +1,6 @@
 
 -- dlsym_test shellcode
-local shellcode = "4883EC184531C94881C7A91A0300BA0120000048C744240800000000488D0D3E0000006A006A004C8D442418E80F000000488B4424184883C428C30F1F4400004889F34889F84889D74889CE4C89C24C89C94C8B4424084C8B4C2410FFD0C30F0B7265616400"
+local shellcode = "4883EC184531C94881C7A91A0300BA0120000048C744240800000000488D0D400000006A006A004C8D442418E80F000000488B4424184883C428C30F1F440000534889F34889F84889D74889CE4C89C24C89C94C8B4424104C8B4C2418FFD05BC30F0B7265616400"
 
 if not sceKernelDlsym then
     init_dlsym()