From 47e6c2331196eb13e1bbc518db88fc2c0b602020 Mon Sep 17 00:00:00 2001
From: EchoStretch <echostretch@hotmail.com>
Date: Sat, 19 Sep 2026 16:42:37 -0600
Subject: [PATCH] Resolve ShellCore mount hooks from dynamic imports

---
 lib/Makefile                           |   2 +-
 lib/crt-elf-c.c                        |  16 +-
 lib/r0gdb-bootstrap.h                  |   1 +
 lib/shellcore-imports.h                |  33 ++
 ps5-kstuff-ldr/Makefile                |   5 +-
 ps5-kstuff-ldr/src/main.c              |  14 +-
 ps5-kstuff-ldr/src/shellcore_imports.c | 101 +++++
 ps5-kstuff/Makefile                    |   2 +-
 ps5-kstuff/main.c                      | 558 +++++++++----------------
 ps5-kstuff/shellcore_patches/10_00.h   |  11 -
 ps5-kstuff/shellcore_patches/10_01.h   |  11 -
 ps5-kstuff/shellcore_patches/10_20.h   |  11 -
 ps5-kstuff/shellcore_patches/10_40.h   |  11 -
 ps5-kstuff/shellcore_patches/10_60.h   |  11 -
 ps5-kstuff/shellcore_patches/11_00.h   |  11 -
 ps5-kstuff/shellcore_patches/11_20.h   |  11 -
 ps5-kstuff/shellcore_patches/11_40.h   |  11 -
 ps5-kstuff/shellcore_patches/1_00.h    |  11 -
 ps5-kstuff/shellcore_patches/1_01.h    |  11 -
 ps5-kstuff/shellcore_patches/1_02.h    |  11 -
 ps5-kstuff/shellcore_patches/1_12.h    |  11 -
 ps5-kstuff/shellcore_patches/1_14.h    |  11 -
 ps5-kstuff/shellcore_patches/2_00.h    |  11 -
 ps5-kstuff/shellcore_patches/2_20.h    |  11 -
 ps5-kstuff/shellcore_patches/2_25.h    |  11 -
 ps5-kstuff/shellcore_patches/2_26.h    |  11 -
 ps5-kstuff/shellcore_patches/2_30.h    |  11 -
 ps5-kstuff/shellcore_patches/2_50.h    |  14 -
 ps5-kstuff/shellcore_patches/2_70.h    |  11 -
 ps5-kstuff/shellcore_patches/3_00.h    |  11 -
 ps5-kstuff/shellcore_patches/3_10.h    |  11 -
 ps5-kstuff/shellcore_patches/3_20.h    |  11 -
 ps5-kstuff/shellcore_patches/3_21.h    |  11 -
 ps5-kstuff/shellcore_patches/4_00.h    |  11 -
 ps5-kstuff/shellcore_patches/4_02.h    |  11 -
 ps5-kstuff/shellcore_patches/4_03.h    |  11 -
 ps5-kstuff/shellcore_patches/4_50.h    |  11 -
 ps5-kstuff/shellcore_patches/4_51.h    |  11 -
 ps5-kstuff/shellcore_patches/5_00.h    |  11 -
 ps5-kstuff/shellcore_patches/5_02.h    |  11 -
 ps5-kstuff/shellcore_patches/5_10.h    |  11 -
 ps5-kstuff/shellcore_patches/5_50.h    |  11 -
 ps5-kstuff/shellcore_patches/6_00.h    |  11 -
 ps5-kstuff/shellcore_patches/6_02.h    |  11 -
 ps5-kstuff/shellcore_patches/6_50.h    |  11 -
 ps5-kstuff/shellcore_patches/7_00.h    |  11 -
 ps5-kstuff/shellcore_patches/7_01.h    |  11 -
 ps5-kstuff/shellcore_patches/7_20.h    |  11 -
 ps5-kstuff/shellcore_patches/7_40.h    |  11 -
 ps5-kstuff/shellcore_patches/7_60.h    |  11 -
 ps5-kstuff/shellcore_patches/7_61.h    |  11 -
 ps5-kstuff/shellcore_patches/8_00.h    |  11 -
 ps5-kstuff/shellcore_patches/8_20.h    |  11 -
 ps5-kstuff/shellcore_patches/8_40.h    |  11 -
 ps5-kstuff/shellcore_patches/8_60.h    |  11 -
 ps5-kstuff/shellcore_patches/9_00.h    |  11 -
 ps5-kstuff/shellcore_patches/9_05.h    |  11 -
 ps5-kstuff/shellcore_patches/9_20.h    |  11 -
 ps5-kstuff/shellcore_patches/9_40.h    |  11 -
 ps5-kstuff/shellcore_patches/9_60.h    |  11 -
 ps5-kstuff/uelf/fpkg.c                 |  10 +-
 tools/find_shellcore_fpkg_offsets.py   | 132 ++++++
 62 files changed, 493 insertions(+), 945 deletions(-)
 create mode 100644 lib/shellcore-imports.h
 create mode 100644 ps5-kstuff-ldr/src/shellcore_imports.c
 create mode 100644 tools/find_shellcore_fpkg_offsets.py

diff --git a/lib/Makefile b/lib/Makefile
index af3ccd0..445bf3f 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -6,7 +6,7 @@ clean:
 dl.o: dl.c
 	gcc -c -isystem ../freebsd-headers -nostdinc -fno-stack-protector dl.c -o dl.o -fPIE -ffreestanding
 
-crt-elf-c.o: crt-elf-c.c
+crt-elf-c.o: crt-elf-c.c r0gdb-bootstrap.h shellcore-imports.h
 	gcc -c -isystem ../freebsd-headers -nostdinc -fno-stack-protector -O3 crt-elf-c.c -o crt-elf-c.o -fPIE -ffreestanding
 
 crt.o: crt.asm
diff --git a/lib/crt-elf-c.c b/lib/crt-elf-c.c
index bf9e754..4e062b1 100644
--- a/lib/crt-elf-c.c
+++ b/lib/crt-elf-c.c
@@ -1,5 +1,6 @@
 #include <sys/types.h>
 #include "r0gdb-bootstrap.h"
+#include "shellcore-imports.h"
 
 struct specter_args
 {
@@ -13,8 +14,21 @@ struct specter_args
 
 uint64_t _start(void* dlsym, int master, int victim, uint64_t pktopts, uint64_t kdata_base);
 
-void elf_main(struct specter_args* args)
+intptr_t (*kstuff_dynlib_resolve)(int pid, uint32_t handle, const char* nid);
+int (*kstuff_dynlib_handle)(int pid, const char* name, uint32_t* handle);
+kstuff_shellcore_imports_fn kstuff_shellcore_imports;
+
+void elf_main(struct specter_args* args, uint64_t resolver_magic,
+              intptr_t (*resolver)(int, uint32_t, const char*),
+              int (*handle_lookup)(int, const char*, uint32_t*),
+              kstuff_shellcore_imports_fn import_lookup)
 {
+    if(resolver_magic == KSTUFF_DYNLIB_RESOLVER_MAGIC)
+    {
+        kstuff_dynlib_resolve = resolver;
+        kstuff_dynlib_handle = handle_lookup;
+        kstuff_shellcore_imports = import_lookup;
+    }
     struct r0gdb_bootstrap bootstrap = {
         .magic = R0GDB_BOOTSTRAP_MAGIC,
         .rwpipe = {args->pipe[0], args->pipe[1]},
diff --git a/lib/r0gdb-bootstrap.h b/lib/r0gdb-bootstrap.h
index 4b94458..e2f9ecf 100644
--- a/lib/r0gdb-bootstrap.h
+++ b/lib/r0gdb-bootstrap.h
@@ -4,6 +4,7 @@
 #include <stdint.h>
 
 #define R0GDB_BOOTSTRAP_MAGIC UINT64_C(0x5230474442504950)
+#define KSTUFF_DYNLIB_RESOLVER_MAGIC UINT64_C(0x4b53544650524731)
 
 struct r0gdb_bootstrap {
     uint64_t magic;
diff --git a/lib/shellcore-imports.h b/lib/shellcore-imports.h
new file mode 100644
index 0000000..dea914a
--- /dev/null
+++ b/lib/shellcore-imports.h
@@ -0,0 +1,33 @@
+#ifndef KSTUFF_SHELLCORE_IMPORTS_H
+#define KSTUFF_SHELLCORE_IMPORTS_H
+
+#include <stdint.h>
+
+enum {
+    SHELLCORE_IMPORT_CLOSE,
+    SHELLCORE_IMPORT_OPEN,
+    SHELLCORE_IMPORT_PREAD,
+    SHELLCORE_IMPORT_MOUNT_GAME,
+    SHELLCORE_IMPORT_UMOUNT_GAME,
+    SHELLCORE_IMPORT_MOUNT_PPR,
+    SHELLCORE_IMPORT_UMOUNT_PPR,
+    SHELLCORE_IMPORT_COUNT
+};
+
+#define SHELLCORE_IMPORT_BIT(index) (1u << (index))
+
+static const char *const shellcore_import_nids[SHELLCORE_IMPORT_COUNT] = {
+    "bY-PO6JhzhQ", /* close */
+    "wuCroIGjt2g", /* open */
+    "ezv-RSBNKqI", /* pread */
+    "FtGP5aXKFQU", /* sceFsMountGamePkg */
+    "UQTSykySQ40", /* sceFsUmountGamePkg */
+    "MiUxeleLYUc", /* sceFsMountPprPkg */
+    "S5+bpaH0TWk", /* sceFsUmountPprPkg */
+};
+
+typedef int (*kstuff_shellcore_imports_fn)(int pid, uint64_t image_base,
+                                            uint32_t required_mask,
+                                            uint64_t got[SHELLCORE_IMPORT_COUNT]);
+
+#endif
diff --git a/ps5-kstuff-ldr/Makefile b/ps5-kstuff-ldr/Makefile
index 8bdfc0d..7931624 100644
--- a/ps5-kstuff-ldr/Makefile
+++ b/ps5-kstuff-ldr/Makefile
@@ -25,7 +25,7 @@ endif
 
 LOADER_OPT ?= -O2
 CFLAGS += -Wall -Werror
-CPPFLAGS += -Iinclude
+CPPFLAGS += -Iinclude -I$(PS5_PAYLOAD_SDK)/src/crt
 
 LDFLAGS += -lz \
            -lSceSystemService \
@@ -45,7 +45,7 @@ all: kstuff.elf
 ../ps5-kstuff/payload.bin: .FORCE
 	$(MAKE) -C ../ps5-kstuff/
 
-kstuff.elf: ../ps5-kstuff/payload.bin $(SRC)
+kstuff.elf: ../ps5-kstuff/payload.bin $(SRC) ../lib/r0gdb-bootstrap.h ../lib/shellcore-imports.h
 	$(CC) $(CPPFLAGS) $(CFLAGS) $(LOADER_OPT) $(SRC) -o $@ $(LDFLAGS)
 
 clean:
@@ -53,4 +53,3 @@ clean:
 
 test: kstuff.elf
 	$(PS5_DEPLOY) -h $(PS5_HOST) -p $(PS5_PORT) $^
-
diff --git a/ps5-kstuff-ldr/src/main.c b/ps5-kstuff-ldr/src/main.c
index 5a3d730..77f15ce 100644
--- a/ps5-kstuff-ldr/src/main.c
+++ b/ps5-kstuff-ldr/src/main.c
@@ -48,6 +48,8 @@ along with this program; see the file COPYING. If not, see
 #include "mount_helpers.h"
 #include "shellui_patch.h"
 #include "utils.h"
+#include "../../lib/r0gdb-bootstrap.h"
+#include "../../lib/shellcore-imports.h"
 
 asm(".section .rodata\n"
     ".global ___ps5_kstuff_payload_bin\n"
@@ -55,6 +57,8 @@ asm(".section .rodata\n"
     ".incbin \"../../ps5-kstuff/payload.bin\"\n");
 
 extern char ___ps5_kstuff_payload_bin[];
+int shellcore_import_got(int pid, uint64_t image_base, uint32_t required_mask,
+                         uint64_t got[SHELLCORE_IMPORT_COUNT]);
 
 int patch_app_db(void);
 int sceKernelSetProcessName(const char *name);
@@ -414,7 +418,11 @@ int main(void) {
         }
     }
 
-    void (*entry)(payload_args_t*) = base + ehdr->e_entry;
+    void (*entry)(payload_args_t*, uint64_t,
+                  intptr_t (*)(int, uint32_t, const char*),
+                  int (*)(int, const char*, uint32_t*),
+                  kstuff_shellcore_imports_fn) =
+        base + ehdr->e_entry;
     payload_args_t* args = payload_get_args();
 
     // allow dlsym on 5.00+ - https://gist.github.com/TheOfficialFloW/7174351201b5260d7780780f4059bebf#file-exploitnetcontrolimpl-java-L851
@@ -425,7 +433,9 @@ int main(void) {
     kernel_setlong(eboot_segments + 0x08, 0); // addr
     kernel_setlong(eboot_segments + 0x10, 0xFFFFFFFFFFFFFFFFL); // size
 
-    entry(args);
+    entry(args, KSTUFF_DYNLIB_RESOLVER_MAGIC,
+          kernel_dynlib_resolve, kernel_dynlib_handle,
+          shellcore_import_got);
     if(*args->payloadout == 0) {
         puts("patching app.db");
         *args->payloadout = patch_app_db();
diff --git a/ps5-kstuff-ldr/src/shellcore_imports.c b/ps5-kstuff-ldr/src/shellcore_imports.c
new file mode 100644
index 0000000..810066a
--- /dev/null
+++ b/ps5-kstuff-ldr/src/shellcore_imports.c
@@ -0,0 +1,101 @@
+#include <elf.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* The SDK keeps decrypted relocation and symbol tables in the dynlib object. */
+#include <kernel.h>
+
+#include "../../lib/shellcore-imports.h"
+
+enum { SHELLCORE_JUMP_SLOT_RELOCATION = 7 };
+
+_Static_assert(sizeof(Elf64_Rela) == 24 && sizeof(Elf64_Sym) == 24,
+               "unexpected ShellCore relocation ABI");
+
+int shellcore_import_got(int pid, uint64_t image_base, uint32_t required_mask,
+                         uint64_t got[SHELLCORE_IMPORT_COUNT])
+{
+    dynlib_obj_t obj;
+    dynlib_dynsec_t dynsec;
+    unsigned char *tables = NULL;
+    int result = -1;
+    const uint32_t valid_mask = (1u << SHELLCORE_IMPORT_COUNT) - 1;
+
+    if(!got)
+        return -1;
+    memset(got, 0, sizeof(uint64_t) * SHELLCORE_IMPORT_COUNT);
+    if(!required_mask || (required_mask & ~valid_mask))
+        return -1;
+    if(kernel_dynlib_obj(pid, 0, &obj) || obj.mapbase != image_base
+    || !obj.dynsec || kernel_copyout(obj.dynsec, &dynsec, sizeof(dynsec)))
+        return -1;
+
+    if(obj.mapbase < 0x10000
+    || obj.mapbase >= 0x0000800000000000ull
+    || obj.mapsize < sizeof(uint64_t)
+    || obj.mapsize >= 0x0000800000000000ull - obj.mapbase
+    || !dynsec.pltrela || !dynsec.symtab || !dynsec.strtab
+    || !dynsec.pltrelasize || dynsec.pltrelasize > 0x100000
+    || dynsec.pltrelasize % sizeof(Elf64_Rela)
+    || !dynsec.symtabsize || dynsec.symtabsize > 0x100000
+    || dynsec.symtabsize % sizeof(Elf64_Sym)
+    || !dynsec.strtabsize || dynsec.strtabsize > 0x100000)
+        return -1;
+
+    size_t tables_size = dynsec.pltrelasize + dynsec.symtabsize
+                       + dynsec.strtabsize;
+    tables = malloc(tables_size);
+    if(!tables)
+        return -1;
+    Elf64_Rela *rela = (Elf64_Rela *)tables;
+    Elf64_Sym *sym = (Elf64_Sym *)(tables + dynsec.pltrelasize);
+    char *str = (char *)(tables + dynsec.pltrelasize + dynsec.symtabsize);
+    if(kernel_copyout(dynsec.pltrela, rela, dynsec.pltrelasize)
+    || kernel_copyout(dynsec.symtab, sym, dynsec.symtabsize)
+    || kernel_copyout(dynsec.strtab, str, dynsec.strtabsize))
+        goto done;
+
+    size_t sym_count = dynsec.symtabsize / sizeof(*sym);
+    size_t rela_count = dynsec.pltrelasize / sizeof(*rela);
+    for(size_t i = 0; i < rela_count; i++)
+    {
+        if((uint32_t)rela[i].r_info != SHELLCORE_JUMP_SLOT_RELOCATION)
+            continue;
+        size_t sym_index = rela[i].r_info >> 32;
+        if(sym_index >= sym_count)
+            goto done;
+        size_t name_offset = sym[sym_index].st_name;
+        if(name_offset >= dynsec.strtabsize)
+            goto done;
+        if(dynsec.strtabsize - name_offset < 12)
+            continue;
+        const char *name = str + name_offset;
+        for(size_t j = 0; j < SHELLCORE_IMPORT_COUNT; j++)
+        {
+            if(!(required_mask & SHELLCORE_IMPORT_BIT(j))
+            || memcmp(name, shellcore_import_nids[j], 11)
+            || name[11] != '#')
+                continue;
+            if(got[j] || rela[i].r_offset > obj.mapsize - sizeof(uint64_t)
+            || (rela[i].r_offset & (sizeof(uint64_t) - 1)))
+                goto done;
+            got[j] = image_base + rela[i].r_offset;
+        }
+    }
+    for(size_t j = 0; j < SHELLCORE_IMPORT_COUNT; j++)
+    {
+        if((required_mask & SHELLCORE_IMPORT_BIT(j)) && !got[j])
+            goto done;
+        for(size_t previous = 0; previous < j; previous++)
+            if(got[j] && got[j] == got[previous])
+                goto done;
+    }
+    result = 0;
+
+done:
+    free(tables);
+    if(result)
+        memset(got, 0, sizeof(uint64_t) * SHELLCORE_IMPORT_COUNT);
+    return result;
+}
diff --git a/ps5-kstuff/Makefile b/ps5-kstuff/Makefile
index d52a246..f8db23e 100644
--- a/ps5-kstuff/Makefile
+++ b/ps5-kstuff/Makefile
@@ -40,7 +40,7 @@ $(BUILD_CONFIG): FORCE
 structs.inc: structs-ps5.inc
 	cp structs-ps5.inc structs.inc
 
-payload.elf: ../lib/lib-elf-ps5.a ../prosper0gdb/prosper0gdb.o main.c kelf uelf/uelf.bin shellcore_hook/ppr_mount_940_blob.o $(BUILD_CONFIG) shellcore_patches/*
+payload.elf: ../lib/lib-elf-ps5.a ../lib/shellcore-imports.h ../prosper0gdb/prosper0gdb.o main.c kelf uelf/uelf.bin shellcore_hook/ppr_mount_940_blob.o $(BUILD_CONFIG) shellcore_patches/*
 	gcc $(PAYLOAD_OPT) -isystem ../freebsd-headers -nostdinc -nostdlib -fno-stack-protector -static ../lib/lib-elf-ps5.a ../prosper0gdb/prosper0gdb.o shellcore_hook/ppr_mount_940_blob.o $(EXTRA_CFLAGS) -DKSTUFF_OBS=$(KSTUFF_OBS) main.c -DPS5KEK ../prosper0gdb/dbg.c -Wl,-gc-sections -o payload.elf -fPIE -ffreestanding -no-pie -Wl,-z,max-page-size=16384 -Wl,-z,common-page-size=16384
 
 payloa%.bin: payloa%.elf
diff --git a/ps5-kstuff/main.c b/ps5-kstuff/main.c
index 0a00049..bdd2777 100644
--- a/ps5-kstuff/main.c
+++ b/ps5-kstuff/main.c
@@ -15,6 +15,7 @@
 #include "../gdb_stub/dbg.h"
 #include "uelf/structs.h"
 #include "uelf/shared_area.h"
+#include "../lib/shellcore-imports.h"
 
 void* dlsym(void*, const char*);
 void* memcpy(void * __restrict, const void * __restrict, size_t);
@@ -405,7 +406,9 @@ int phys_copyin(uint64_t vaddr, const void* src, uint64_t sz, uint64_t dmap, uin
         size_t chk = phys_end - phys;
         if(sz < chk)
             chk = sz;
-        copyin(dmap+phys, p_src, chk);
+        ssize_t copied = copyin(dmap + phys, p_src, chk);
+        if(copied < 0 || (size_t)copied != chk)
+            return -1;
         vaddr += chk;
         p_src += chk;
         sz -= chk;
@@ -426,7 +429,9 @@ static int phys_copyout(void* dst, uint64_t vaddr, uint64_t sz,
         size_t chk = phys_end - phys;
         if(sz < chk)
             chk = sz;
-        copyout(p_dst, dmap + phys, chk);
+        ssize_t copied = copyout(p_dst, dmap + phys, chk);
+        if(copied < 0 || (size_t)copied != chk)
+            return -1;
         vaddr += chk;
         p_dst += chk;
         sz -= chk;
@@ -550,8 +555,6 @@ static uint64_t remote_syscall(int pid, int nr,
 
 #define SYS_mlock 203
 #define SYS_mdbg_call 573
-#define SYS_dynlib_dlsym 591
-#define SYS_dynlib_get_list 592
 #define SYS_dynlib_get_info_ex 608
 #define SYS_dynlib_load_prx 594
 #define SYS_get_self_auth_info 607
@@ -596,24 +599,6 @@ struct shellcore_patch
     size_t sz;
 };
 
-struct shellcore_fpkg_offsets
-{
-    /* Early ShellCore builds leave the package API GOT slots lazy until the
-     * first game launch.  Those builds use verified direct call sites and a
-     * small executable tail trampoline instead of rewriting unresolved GOT. */
-    uint64_t ppr_call;
-    uint64_t ppr_cave;
-    uint64_t ppr_cave_size;
-    uint64_t close_plt;
-    uint64_t open_plt;
-    uint64_t pread_plt;
-    uint64_t mount_ppr_pkg_plt;
-    uint64_t getpid_plt;
-    uint64_t game_mount_calls[4];
-    uint64_t game_umount_calls[4];
-    uint64_t ppr_umount_call;
-};
-
 /*
  * TODO(FW_PORT): add shellcore_patches/<major>_<minor>.h here after deriving
  * every patch from that exact SceShellCore build.  Patch offsets are relative
@@ -684,69 +669,6 @@ struct shellcore_fpkg_offsets
 #include "shellcore_patches/13_42.h"
 #include "shellcore_patches/13_60.h"
 
-static const struct shellcore_fpkg_offsets* get_shellcore_fpkg_offsets(void)
-{
-    switch(r0gdb_get_fw_version() >> 16)
-    {
-#define SHELLCORE_FPKG_FW(x) \
-        case 0x ## x: return &shellcore_fpkg_offsets_ ## x
-    SHELLCORE_FPKG_FW(100);
-    SHELLCORE_FPKG_FW(101);
-    SHELLCORE_FPKG_FW(102);
-    SHELLCORE_FPKG_FW(112);
-    SHELLCORE_FPKG_FW(114);
-    SHELLCORE_FPKG_FW(200);
-    SHELLCORE_FPKG_FW(220);
-    SHELLCORE_FPKG_FW(225);
-    SHELLCORE_FPKG_FW(226);
-    SHELLCORE_FPKG_FW(230);
-    SHELLCORE_FPKG_FW(250);
-    SHELLCORE_FPKG_FW(270);
-    SHELLCORE_FPKG_FW(300);
-    SHELLCORE_FPKG_FW(310);
-    SHELLCORE_FPKG_FW(320);
-    SHELLCORE_FPKG_FW(321);
-    SHELLCORE_FPKG_FW(400);
-    SHELLCORE_FPKG_FW(402);
-    SHELLCORE_FPKG_FW(403);
-    SHELLCORE_FPKG_FW(450);
-    SHELLCORE_FPKG_FW(451);
-    SHELLCORE_FPKG_FW(500);
-    SHELLCORE_FPKG_FW(502);
-    SHELLCORE_FPKG_FW(510);
-    SHELLCORE_FPKG_FW(550);
-    SHELLCORE_FPKG_FW(600);
-    SHELLCORE_FPKG_FW(602);
-    SHELLCORE_FPKG_FW(650);
-    SHELLCORE_FPKG_FW(700);
-    SHELLCORE_FPKG_FW(701);
-    SHELLCORE_FPKG_FW(720);
-    SHELLCORE_FPKG_FW(740);
-    SHELLCORE_FPKG_FW(760);
-    SHELLCORE_FPKG_FW(761);
-    SHELLCORE_FPKG_FW(800);
-    SHELLCORE_FPKG_FW(820);
-    SHELLCORE_FPKG_FW(840);
-    SHELLCORE_FPKG_FW(860);
-    SHELLCORE_FPKG_FW(900);
-    SHELLCORE_FPKG_FW(905);
-    SHELLCORE_FPKG_FW(920);
-    SHELLCORE_FPKG_FW(940);
-    SHELLCORE_FPKG_FW(960);
-    SHELLCORE_FPKG_FW(1000);
-    SHELLCORE_FPKG_FW(1001);
-    SHELLCORE_FPKG_FW(1020);
-    SHELLCORE_FPKG_FW(1040);
-    SHELLCORE_FPKG_FW(1060);
-    SHELLCORE_FPKG_FW(1100);
-    SHELLCORE_FPKG_FW(1120);
-    SHELLCORE_FPKG_FW(1140);
-    /* Keep 11.60+ PPR/fPKG offset data disconnected from the runtime hook. */
-#undef SHELLCORE_FPKG_FW
-    default: return 0;
-    }
-}
-
 extern char _start[];
 
 static void relocate_shellcore_patches(struct shellcore_patch* patches, size_t n_patches)
@@ -907,6 +829,35 @@ static int shellcore_bytes_equal(const unsigned char* lhs,
     return 1;
 }
 
+static int verify_shellcore_blob(uint64_t address, const unsigned char* blob,
+                                 size_t size, uint64_t dmap, uint64_t cr3)
+{
+    unsigned char readback[0x400];
+    for(size_t offset = 0; offset < size; offset += sizeof(readback))
+    {
+        size_t length = size - offset;
+        if(length > sizeof(readback))
+            length = sizeof(readback);
+        if(phys_copyout(readback, address + offset, length, dmap, cr3)
+        || !shellcore_bytes_equal(readback, blob + offset, length))
+            return -1;
+    }
+    return 0;
+}
+
+extern intptr_t (*kstuff_dynlib_resolve)(int pid, uint32_t handle,
+                                         const char* nid);
+extern int (*kstuff_dynlib_handle)(int pid, const char* name,
+                                   uint32_t* handle);
+extern kstuff_shellcore_imports_fn kstuff_shellcore_imports;
+
+static const unsigned char shellcore_getpid_stub[] = {
+    0x48, 0xc7, 0xc0, 0x14, 0x00, 0x00, 0x00, /* mov eax, SYS_getpid */
+    0x49, 0x89, 0xca,                         /* mov r10, rcx */
+    0x0f, 0x05,                               /* syscall */
+    0x72, 0x01, 0xc3                          /* jc error; ret */
+};
+
 static int find_shellcore_blob_entry(const unsigned char* blob,
                                      size_t blob_size, uint64_t marker,
                                      size_t* entry_offset)
@@ -924,34 +875,31 @@ static int find_shellcore_blob_entry(const unsigned char* blob,
     return count == 1 && *entry_offset < blob_size ? 0 : -1;
 }
 
-static int resolve_shellcore_plt(uint64_t shellcore_base,
-                                 uint64_t plt_offset,
+static int read_shellcore_import(int pid, uint64_t shellcore_base,
+                                 uint64_t text_end, uint64_t got,
                                  uint64_t dmap, uint64_t cr3,
-                                 int pid,
                                  struct shellcore_locked_pages* locked,
-                                 uint64_t* got, uint64_t* target)
+                                 uint64_t* target, uint64_t* lazy_plt)
 {
-    unsigned char plt[6];
-    if(!plt_offset
-    || lock_shellcore_range(pid, shellcore_base + plt_offset,
-                            sizeof(plt), locked)
-    || phys_copyout(plt, shellcore_base + plt_offset, sizeof(plt),
-                    dmap, cr3)
-    || plt[0] != 0xff || plt[1] != 0x25)
+    if(!got || lock_shellcore_range(pid, got, sizeof(*target), locked)
+    || phys_copyout(target, got, sizeof(*target), dmap, cr3)
+    || *target < 0x10000 || *target >= 0x0000800000000000ull)
         return -1;
-    int32_t displacement;
-    memcpy(&displacement, plt + 2, sizeof(displacement));
-    uint64_t resolved_got = shellcore_base + plt_offset
-                          + sizeof(plt) + displacement;
-    if(lock_shellcore_range(pid, resolved_got, sizeof(*target), locked)
-    || phys_copyout(target, resolved_got, sizeof(*target), dmap, cr3)
-    || *target < 0x10000 || *target >= 0x0000800000000000ull
-    /* An unresolved lazy slot points back to PLT+6. Redirecting that GOT
-     * entry would let the first resolver pass overwrite our wrapper. */
-    || *target == shellcore_base + plt_offset + sizeof(plt))
-        return -1;
-    if(got)
-        *got = resolved_got;
+    *lazy_plt = 0;
+    if(*target >= shellcore_base + 6 && *target < text_end)
+    {
+        unsigned char plt[6];
+        uint64_t plt_addr = *target - sizeof(plt);
+        if(lock_shellcore_range(pid, plt_addr, sizeof(plt), locked)
+        || phys_copyout(plt, plt_addr, sizeof(plt), dmap, cr3)
+        || plt[0] != 0xff || plt[1] != 0x25)
+            return -1;
+        int32_t displacement;
+        memcpy(&displacement, plt + 2, sizeof(displacement));
+        if(*target + displacement != got)
+            return -1;
+        *lazy_plt = plt_addr;
+    }
     return 0;
 }
 
@@ -959,257 +907,117 @@ static int resolve_shellcore_syscall_trampoline(
     int pid, uint64_t dmap, uint64_t cr3,
     struct shellcore_locked_pages* locked, uint64_t* target)
 {
-    enum { MAX_MODULES = 128 };
-    uint32_t handles[MAX_MODULES];
-    size_t module_count = MAX_MODULES;
-    static const char getpid_name[] = "getpid";
-    static const unsigned char expected[] = {
-        0x48, 0xc7, 0xc0, 0x14, 0x00, 0x00, 0x00, /* mov eax, SYS_getpid */
-        0x49, 0x89, 0xca,                         /* mov r10, rcx */
-        0x0f, 0x05                                /* syscall */
-    };
-
-    if(remote_syscall(pid, SYS_dynlib_get_list, (uint64_t)handles,
-                      MAX_MODULES, (uint64_t)&module_count, 0, 0, 0)
-    || !module_count || module_count > MAX_MODULES)
-        return -1;
-
-    for(size_t i = 0; i < module_count; i++)
+    static const uint32_t libkernel_handles[] = {1, 0x2001};
+    for(size_t i = 0; i < sizeof(libkernel_handles)
+                           / sizeof(libkernel_handles[0]); i++)
     {
-        uint64_t getpid_target = 0;
-        if(remote_syscall(pid, SYS_dynlib_dlsym, handles[i],
-                          (uint64_t)getpid_name,
-                          (uint64_t)&getpid_target, 0, 0, 0)
-        || getpid_target < 0x10000
-        || getpid_target >= 0x0000800000000000ull)
+        uint64_t address = kstuff_dynlib_resolve(
+            pid, libkernel_handles[i], "HoLVWNanBBc"); /* getpid */
+        if(address < 0x10000
+        || address >= 0x0000800000000000ull
+                      - sizeof(shellcore_getpid_stub))
             continue;
-
-        unsigned char code[sizeof(expected)];
-        if(lock_shellcore_range(pid, getpid_target, sizeof(code), locked)
-        || phys_copyout(code, getpid_target, sizeof(code), dmap, cr3)
-        || !shellcore_bytes_equal(code, expected, sizeof(expected)))
+        unsigned char code[sizeof(shellcore_getpid_stub)];
+        if(phys_copyout(code, address, sizeof(code), dmap, cr3)
+        && (lock_shellcore_range(pid, address, sizeof(code), locked)
+            || phys_copyout(code, address, sizeof(code), dmap, cr3)))
             continue;
-
-        *target = getpid_target + 7;
-        return 0;
+        if(shellcore_bytes_equal(code, shellcore_getpid_stub,
+                                 sizeof(code)))
+        {
+            *target = address + 7;
+            return 0;
+        }
     }
     return -1;
 }
 
-struct shellcore_direct_call
-{
-    uint64_t offset;
-    unsigned int api;
-};
-
-static int install_shellcore_direct_fpkg_calls(
-    int pid, uint64_t shellcore_base, uint64_t dmap, uint64_t cr3,
-    const struct shellcore_fpkg_offsets* sc,
-    const uint64_t api_plt[4], const uint64_t api_wrapper[4],
-    struct shellcore_locked_pages* locked)
-{
-    enum { API_COUNT = 4, TRAMPOLINE_SIZE = 16, MAX_CALLS = 10 };
-    struct shellcore_direct_call calls[MAX_CALLS];
-    unsigned char original[MAX_CALLS][5];
-    unsigned char patched[MAX_CALLS][5];
-    unsigned char trampolines[API_COUNT * TRAMPOLINE_SIZE];
-    unsigned char current[sizeof(trampolines)];
-    size_t count = 0;
-
-#define ADD_DIRECT_CALL(which_offset, which_api) do { \
-        if((which_offset) && count < MAX_CALLS) { \
-            calls[count].offset = (which_offset); \
-            calls[count].api = (which_api); \
-            count++; \
-        } \
-    } while(0)
-    for(size_t i = 0; i < 4; i++)
-        ADD_DIRECT_CALL(sc->game_mount_calls[i], 0);
-    for(size_t i = 0; i < 4; i++)
-        ADD_DIRECT_CALL(sc->game_umount_calls[i], 1);
-    ADD_DIRECT_CALL(sc->ppr_call, 2);
-    ADD_DIRECT_CALL(sc->ppr_umount_call, 3);
-#undef ADD_DIRECT_CALL
-
-    if(!sc->ppr_cave || sc->ppr_cave_size < sizeof(trampolines)
-    || !sc->ppr_call || !sc->ppr_umount_call || count < 2)
-        return -1;
-    if(lock_shellcore_range(pid, shellcore_base + sc->ppr_cave,
-                            sizeof(trampolines), locked)
-    || phys_copyout(current, shellcore_base + sc->ppr_cave,
-                    sizeof(trampolines), dmap, cr3))
-        return -1;
-    for(size_t i = 0; i < sizeof(trampolines); i++)
-        if(current[i])
-            return -1;
-
-    for(size_t i = 0; i < sizeof(trampolines); i++)
-        trampolines[i] = 0xcc;
-    for(size_t api = 0; api < API_COUNT; api++)
-    {
-        unsigned char* trampoline = trampolines + api * TRAMPOLINE_SIZE;
-        trampoline[0] = 0x48; /* movabs rax, api_wrapper[api] */
-        trampoline[1] = 0xb8;
-        memcpy(trampoline + 2, &api_wrapper[api], sizeof(api_wrapper[api]));
-        trampoline[10] = 0xff; /* jmp rax */
-        trampoline[11] = 0xe0;
-    }
-
-    /* Validate every call and its original destination before changing code. */
-    for(size_t i = 0; i < count; i++)
-    {
-        if(lock_shellcore_range(pid, shellcore_base + calls[i].offset,
-                                sizeof(original[i]), locked)
-        || phys_copyout(original[i], shellcore_base + calls[i].offset,
-                        sizeof(original[i]), dmap, cr3)
-        || original[i][0] != 0xe8)
-            return -1;
-        int32_t displacement;
-        memcpy(&displacement, original[i] + 1, sizeof(displacement));
-        if(calls[i].offset + sizeof(original[i]) + displacement
-                                                != api_plt[calls[i].api])
-            return -1;
-
-        patched[i][0] = 0xe8;
-        int64_t wide = (int64_t)sc->ppr_cave
-                     + (int64_t)calls[i].api * TRAMPOLINE_SIZE
-                     - (int64_t)(calls[i].offset + sizeof(patched[i]));
-        int32_t relative = (int32_t)wide;
-        if((int64_t)relative != wide)
-            return -1;
-        memcpy(patched[i] + 1, &relative, sizeof(relative));
-    }
-
-    if(phys_copyin(shellcore_base + sc->ppr_cave, trampolines,
-                   sizeof(trampolines), dmap, cr3)
-    || phys_copyout(current, shellcore_base + sc->ppr_cave,
-                    sizeof(trampolines), dmap, cr3)
-    || !shellcore_bytes_equal(current, trampolines, sizeof(trampolines)))
-        return -1;
-
-    size_t installed = 0;
-    for(; installed < count; installed++)
-    {
-        unsigned char verify[sizeof(patched[installed])];
-        if(phys_copyin(shellcore_base + calls[installed].offset,
-                       patched[installed], sizeof(patched[installed]),
-                       dmap, cr3)
-        || phys_copyout(verify, shellcore_base + calls[installed].offset,
-                        sizeof(verify), dmap, cr3)
-        || !shellcore_bytes_equal(verify, patched[installed], sizeof(verify)))
-            break;
-    }
-    if(installed == count)
-        return 0;
-
-    /* A partially reachable wrapper is unsafe. Restore every touched call;
-     * return -2 if a reference may still remain so the RX mapping is kept. */
-    int rollback_failed = 0;
-    size_t touched = installed < count ? installed + 1 : installed;
-    for(size_t i = 0; i < touched; i++)
-    {
-        unsigned char verify[sizeof(original[i])];
-        if(phys_copyin(shellcore_base + calls[i].offset,
-                       original[i], sizeof(original[i]), dmap, cr3)
-        || phys_copyout(verify, shellcore_base + calls[i].offset,
-                        sizeof(verify), dmap, cr3)
-        || !shellcore_bytes_equal(verify, original[i], sizeof(verify)))
-            rollback_failed = 1;
-    }
-    return rollback_failed ? -2 : -1;
-}
-
 static int install_shellcore_ppr_hook(
-    int pid, uint64_t shellcore_base, uint64_t dmap, uint64_t cr3,
-    const struct shellcore_fpkg_offsets* sc,
+    int pid, uint64_t shellcore_base, uint64_t text_end,
+    uint64_t dmap, uint64_t cr3,
     struct shellcore_locked_pages* locked)
 {
     const size_t blob_size = (size_t)(ppr_mount_940_blob_end
                                     - ppr_mount_940_blob_start);
     static unsigned char prepared_blob[SHELLCORE_FPKG_WRAPPER_MAP_SIZE];
-    uint64_t helper_target[3];
-    uint64_t api_got[4], api_target[4];
+    uint64_t helper_target[3] = {0};
+    uint64_t api_got[4] = {0}, api_target[4] = {0};
+    uint64_t import_got[SHELLCORE_IMPORT_COUNT];
+    uint64_t api_original_got[4] = {0};
     uint64_t api_wrapper[4];
+    uint32_t fs_handle = 0;
+    int have_fs_handle = 0;
     size_t game_mount_entry = 0;
     size_t game_umount_entry = 0;
     size_t ppr_umount_entry = 0;
 
-    int direct_calls = sc->ppr_umount_call != 0;
-    if(!sc->close_plt || !sc->open_plt || !sc->pread_plt
-    || !sc->mount_ppr_pkg_plt || (!direct_calls && !sc->getpid_plt))
-        return shellcore_ppr_fail("fpkg scope: missing ShellCore offsets");
+    int game_only = (r0gdb_get_fw_version() >> 16) > 0x1140;
+    size_t api_count = game_only ? 2 : 4;
     if(!blob_size || blob_size > sizeof(prepared_blob))
         return shellcore_ppr_fail("fpkg scope: invalid wrapper blob size");
 
-    /* These four imports are consecutive pairs in every supported retail
-     * ShellCore. Validate every derived PLT before changing any state. */
-    const uint64_t api_plt[4] = {
-        sc->mount_ppr_pkg_plt - 0x40, /* sceFsMountGamePkg */
-        sc->mount_ppr_pkg_plt - 0x20, /* sceFsUmountGamePkg */
-        sc->mount_ppr_pkg_plt,        /* sceFsMountPprPkg */
-        sc->mount_ppr_pkg_plt + 0x20, /* sceFsUmountPprPkg */
-    };
-    const uint64_t helper_plt[3] = {
-        sc->close_plt, sc->open_plt, sc->pread_plt
-    };
-    if(sc->mount_ppr_pkg_plt < 0x40)
-        return shellcore_ppr_fail("fpkg scope: invalid API PLT layout");
-    for(size_t i = 0; i < 3; i++)
+    uint32_t required_mask = SHELLCORE_IMPORT_BIT(SHELLCORE_IMPORT_MOUNT_GAME)
+                           | SHELLCORE_IMPORT_BIT(SHELLCORE_IMPORT_UMOUNT_GAME);
+    if(!game_only)
+        required_mask |= SHELLCORE_IMPORT_BIT(SHELLCORE_IMPORT_CLOSE)
+                       | SHELLCORE_IMPORT_BIT(SHELLCORE_IMPORT_OPEN)
+                       | SHELLCORE_IMPORT_BIT(SHELLCORE_IMPORT_PREAD)
+                       | SHELLCORE_IMPORT_BIT(SHELLCORE_IMPORT_MOUNT_PPR)
+                       | SHELLCORE_IMPORT_BIT(SHELLCORE_IMPORT_UMOUNT_PPR);
+    if(kstuff_shellcore_imports(pid, shellcore_base, required_mask,
+                                import_got))
+        return shellcore_ppr_fail("fpkg scope: ShellCore imports unavailable");
+    for(size_t i = 0; i < (game_only ? 0 : 3); i++)
     {
-        unsigned char plt[6];
-        if(lock_shellcore_range(pid, shellcore_base + helper_plt[i],
-                                sizeof(plt), locked)
-        || phys_copyout(plt, shellcore_base + helper_plt[i], sizeof(plt),
-                        dmap, cr3)
-        || plt[0] != 0xff || plt[1] != 0x25)
-            return shellcore_ppr_fail("fpkg scope: helper PLT mismatch");
-        /* These GOT entries may also be lazy on early firmware. They are not
-         * redirected, so calling their PLT stubs is resolver-safe. */
-        helper_target[i] = shellcore_base + helper_plt[i];
+        uint64_t lazy_plt;
+        if(read_shellcore_import(pid, shellcore_base, text_end, import_got[i],
+                                 dmap, cr3, locked, &helper_target[i],
+                                 &lazy_plt))
+            return shellcore_ppr_fail("fpkg scope: helper import mismatch");
+        if(lazy_plt)
+            helper_target[i] = lazy_plt;
     }
-    for(size_t i = 0; i < 4; i++)
+    for(size_t i = 0; i < api_count; i++)
     {
-        if(direct_calls)
+        api_got[i] = import_got[SHELLCORE_IMPORT_MOUNT_GAME + i];
+        uint64_t lazy_plt;
+        if(read_shellcore_import(pid, shellcore_base, text_end, api_got[i],
+                                 dmap, cr3, locked, &api_target[i],
+                                 &lazy_plt))
+            return shellcore_ppr_fail(
+                "fpkg scope: package API import mismatch");
+        if(api_got[i] & (sizeof(api_got[i]) - 1))
+            return shellcore_ppr_fail("fpkg scope: unaligned API GOT slot");
+        for(size_t previous = 0; previous < i; previous++)
+            if(api_got[previous] == api_got[i])
+                return shellcore_ppr_fail("fpkg scope: duplicate API GOT slot");
+        api_original_got[i] = api_target[i];
+        if(lazy_plt)
         {
-            unsigned char plt[6];
-            if(lock_shellcore_range(pid, shellcore_base + api_plt[i],
-                                    sizeof(plt), locked)
-            || phys_copyout(plt, shellcore_base + api_plt[i], sizeof(plt),
-                            dmap, cr3)
-            || plt[0] != 0xff || plt[1] != 0x25)
+            if(!have_fs_handle)
+            {
+                if(kstuff_dynlib_handle(pid, "libSceFsInternalForVsh.prx",
+                                         &fs_handle))
+                    return shellcore_ppr_fail(
+                        "fpkg scope: package API module unavailable");
+                have_fs_handle = 1;
+            }
+            uint64_t address = kstuff_dynlib_resolve(pid, fs_handle,
+                shellcore_import_nids[SHELLCORE_IMPORT_MOUNT_GAME + i]);
+            if(address < 0x10000 || address >= 0x0000800000000000ull)
                 return shellcore_ppr_fail(
-                    "fpkg scope: direct API PLT mismatch");
-            api_got[i] = 0;
-            api_target[i] = shellcore_base + api_plt[i];
+                    "fpkg scope: package API export unavailable");
+            api_target[i] = address;
         }
-        else if(resolve_shellcore_plt(shellcore_base, api_plt[i], dmap, cr3,
-                                     pid, locked,
-                                     &api_got[i], &api_target[i]))
-            return shellcore_ppr_fail("fpkg scope: package API PLT mismatch");
     }
 
-    /* Direct syscall instructions outside libkernel are rejected by early
-     * firmware.  Early ShellCore also leaves getpid@GOT lazy, so resolve the
-     * export from its loaded modules and validate the complete syscall stub.
-     * Later builds can keep using their already-resolved import target. */
+    /* A validated libkernel syscall instruction is required; getpid@GOT may
+     * still be lazy on any supported firmware. */
     uint64_t syscall_target;
-    if(direct_calls)
-    {
-        if(resolve_shellcore_syscall_trampoline(pid, dmap, cr3, locked,
-                                                &syscall_target))
-            return shellcore_ppr_fail(
-                "fpkg scope: libkernel syscall trampoline unavailable");
-    }
-    else
-    {
-        uint64_t getpid_target;
-        if(resolve_shellcore_plt(shellcore_base, sc->getpid_plt, dmap, cr3,
-                                 pid, locked, 0, &getpid_target)
-        || getpid_target + 7 < getpid_target)
-            return shellcore_ppr_fail(
-                "fpkg scope: getpid trampoline unavailable");
-        syscall_target = getpid_target + 7;
-    }
+    if(resolve_shellcore_syscall_trampoline(pid, dmap, cr3, locked,
+                                            &syscall_target))
+        return shellcore_ppr_fail(
+            "fpkg scope: libkernel syscall trampoline unavailable");
 
     memcpy(prepared_blob, ppr_mount_940_blob_start, blob_size);
     if(replace_shellcore_blob_u64(prepared_blob, blob_size,
@@ -1260,11 +1068,13 @@ static int install_shellcore_ppr_hook(
                        SHELLCORE_FPKG_WRAPPER_MAP_SIZE, 0, 0, 0, 0);
         return shellcore_ppr_fail("fpkg scope: wrapper mlock failed");
     }
-    if(phys_copyin(wrapper_base, prepared_blob, blob_size, dmap, cr3))
+    if(phys_copyin(wrapper_base, prepared_blob, blob_size, dmap, cr3)
+    || verify_shellcore_blob(wrapper_base, prepared_blob, blob_size,
+                             dmap, cr3))
     {
         remote_syscall(pid, SYS_munmap, wrapper_base,
                        SHELLCORE_FPKG_WRAPPER_MAP_SIZE, 0, 0, 0, 0);
-        return shellcore_ppr_fail("fpkg scope: wrapper write failed");
+        return shellcore_ppr_fail("fpkg scope: wrapper write verification failed");
     }
     if(remote_syscall(pid, SYS_mprotect, wrapper_base,
                       SHELLCORE_FPKG_WRAPPER_MAP_SIZE,
@@ -1279,53 +1089,50 @@ static int install_shellcore_ppr_hook(
     api_wrapper[1] = wrapper_base + game_umount_entry;
     api_wrapper[2] = wrapper_base;
     api_wrapper[3] = wrapper_base + ppr_umount_entry;
-    if(direct_calls)
-    {
-        int result = install_shellcore_direct_fpkg_calls(
-            pid, shellcore_base, dmap, cr3, sc, api_plt, api_wrapper, locked);
-        if(result)
-        {
-            /* -2 means rollback could not prove that no call still reaches
-             * the wrapper, so retain its executable mapping. */
-            if(result != -2)
-                remote_syscall(pid, SYS_munmap, wrapper_base,
-                               SHELLCORE_FPKG_WRAPPER_MAP_SIZE,
-                               0, 0, 0, 0);
-            return shellcore_ppr_fail(
-                result == -2 ? "fpkg scope: direct-call rollback failed"
-                             : "fpkg scope: direct-call install failed");
-        }
-        return 0;
-    }
     size_t installed = 0;
-    for(; installed < 4; installed++)
+    size_t touched = 0;
+    for(; installed < api_count; installed++)
     {
+        uint64_t current;
+        if(phys_copyout(&current, api_got[installed], sizeof(current),
+                        dmap, cr3)
+        || current != api_original_got[installed])
+            break;
+        touched = installed + 1;
         if(phys_copyin(api_got[installed], &api_wrapper[installed],
                        sizeof(api_wrapper[installed]), dmap, cr3))
             break;
-        uint64_t current;
         if(phys_copyout(&current, api_got[installed], sizeof(current),
                         dmap, cr3)
         || current != api_wrapper[installed])
             break;
     }
-    if(installed != 4)
+    if(installed == api_count)
+        for(size_t i = 0; i < api_count; i++)
+        {
+            uint64_t current;
+            if(phys_copyout(&current, api_got[i], sizeof(current), dmap, cr3)
+            || current != api_wrapper[i])
+            {
+                installed = i;
+                break;
+            }
+        }
+    if(installed != api_count)
     {
         int rollback_failed = 0;
-        size_t touched = installed + 1;
-        if(touched > 4)
-            touched = 4;
         for(size_t i = 0; i < touched; i++)
         {
             uint64_t current = 0;
-            if(phys_copyin(api_got[i], &api_target[i],
-                           sizeof(api_target[i]), dmap, cr3)
+            if(phys_copyin(api_got[i], &api_original_got[i],
+                           sizeof(api_original_got[i]), dmap, cr3)
             || phys_copyout(&current, api_got[i], sizeof(current), dmap, cr3)
-            || current != api_target[i])
+            || current != api_original_got[i])
                 rollback_failed = 1;
         }
-        /* Never unmap code while even one GOT slot may still reference it. */
-        if(!rollback_failed)
+        /* A thread may already be executing a wrapper even after its GOT
+         * entry is restored. Keep the mapping once any entry was touched. */
+        if(!touched && !rollback_failed)
             remote_syscall(pid, SYS_munmap, wrapper_base,
                            SHELLCORE_FPKG_WRAPPER_MAP_SIZE, 0, 0, 0, 0);
         return shellcore_ppr_fail(
@@ -1438,13 +1245,29 @@ enum kit_type kit = get_kit_type();
 static int patch_shellcore(const struct shellcore_patch* patches, size_t n_patches, uint64_t eh_frame_offset)
 {
     shellcore_patch_failure = 0;
+    int install_fpkg_hook = get_kit_type() == KIT_RETAIL && patches;
+    if(install_fpkg_hook && (!kstuff_dynlib_handle || !kstuff_dynlib_resolve
+                         || !kstuff_shellcore_imports))
+        return shellcore_ppr_fail("fpkg scope: SDK resolver unavailable");
     int pid = find_proc("SceShellCore");
+    if(pid <= 0)
+        return -1;
     struct module_info_ex mod_info;
     mod_info.st_size = sizeof(mod_info);
     if (remote_syscall(pid, SYS_dynlib_get_info_ex, 0, 0,
                        (uint64_t)&mod_info, 0, 0, 0))
         return -1;
     uint64_t shellcore_base = mod_info.eh_frame_hdr_addr - eh_frame_offset;
+    if(install_fpkg_hook && (shellcore_base < 0x10000
+    || shellcore_base >= 0x0000800000000000ull
+    || !mod_info.segment_count
+    || mod_info.segments[0].addr != shellcore_base
+    || mod_info.segments[0].size < 6
+    || mod_info.segments[0].size >= 0x0000800000000000ull
+                                  - shellcore_base))
+        return shellcore_ppr_fail("fpkg scope: invalid ShellCore text segment");
+    uint64_t text_end = mod_info.segments[0].addr
+                      + mod_info.segments[0].size;
     uint64_t cr3, dmap;
     if(get_proc_cr3(pid, &cr3, &dmap))
         return -1;
@@ -1459,15 +1282,10 @@ static int patch_shellcore(const struct shellcore_patch* patches, size_t n_patch
         if(phys_copyin(shellcore_base + patches[i].offset, patches[i].data, patches[i].sz, dmap, cr3))
             return -1;
     }
-    if(get_kit_type() == KIT_RETAIL)
-    {
-        const struct shellcore_fpkg_offsets* fpkg_offsets =
-            get_shellcore_fpkg_offsets();
-        if(fpkg_offsets
-        && install_shellcore_ppr_hook(pid, shellcore_base, dmap, cr3,
-                                      fpkg_offsets, &locked))
-            return -1;
-    }
+    if(install_fpkg_hook
+    && install_shellcore_ppr_hook(pid, shellcore_base, text_end,
+                                  dmap, cr3, &locked))
+        return -1;
     return 0;
 }
 
diff --git a/ps5-kstuff/shellcore_patches/10_00.h b/ps5-kstuff/shellcore_patches/10_00.h
index 6ab9e3b..734b09a 100644
--- a/ps5-kstuff/shellcore_patches/10_00.h
+++ b/ps5-kstuff/shellcore_patches/10_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_10_00
 #define SHELLCORE_PATCHES_10_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_1000 = {
-    .ppr_call = 0x75a3a7,
-    .ppr_cave = 0x17db610,
-    .ppr_cave_size = 0x9f0,
-    .close_plt = 0x17d27f0,
-    .open_plt = 0x17d3940,
-    .pread_plt = 0x17d3ac0,
-    .mount_ppr_pkg_plt = 0x17d5da0,
-    .getpid_plt = 0x17d2500,
-};
-
 static struct shellcore_patch shellcore_patches_1000_retail[] = {
     {0xC03AC3, "\x52\xeb\xe2", 3}, //push rdx; jmp 0xC03AA8
     {0xC03AA8, "\xe8\x33\xf8\xff\xff\x58\xc3", 7}, //call 0xC032E0; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/10_01.h b/ps5-kstuff/shellcore_patches/10_01.h
index 2f1718f..1855f92 100644
--- a/ps5-kstuff/shellcore_patches/10_01.h
+++ b/ps5-kstuff/shellcore_patches/10_01.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_10_01
 #define SHELLCORE_PATCHES_10_01
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_1001 = {
-    .ppr_call = 0x75a3a7,
-    .ppr_cave = 0x17db610,
-    .ppr_cave_size = 0x9f0,
-    .close_plt = 0x17d27f0,
-    .open_plt = 0x17d3940,
-    .pread_plt = 0x17d3ac0,
-    .mount_ppr_pkg_plt = 0x17d5da0,
-    .getpid_plt = 0x17d2500,
-};
-
 static struct shellcore_patch shellcore_patches_1001_retail[] = {
     {0xC03AC3, "\x52\xeb\xe2", 3}, //push rdx; jmp 0xC03AA8
     {0xC03AA8, "\xe8\x33\xf8\xff\xff\x58\xc3", 7}, //call 0xC032E0; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/10_20.h b/ps5-kstuff/shellcore_patches/10_20.h
index de0156f..9d1b65a 100644
--- a/ps5-kstuff/shellcore_patches/10_20.h
+++ b/ps5-kstuff/shellcore_patches/10_20.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_10_20
 #define SHELLCORE_PATCHES_10_20
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_1020 = {
-    .ppr_call = 0x75a3a7,
-    .ppr_cave = 0x17df8e0,
-    .ppr_cave_size = 0x720,
-    .close_plt = 0x17d6ab0,
-    .open_plt = 0x17d7c00,
-    .pread_plt = 0x17d7d80,
-    .mount_ppr_pkg_plt = 0x17da060,
-    .getpid_plt = 0x17d67c0,
-};
-
 static struct shellcore_patch shellcore_patches_1020_retail[] = {
     {0xC07D93, "\x52\xeb\xe2", 3}, //push rdx; jmp 0xC07D78
     {0xC07D78, "\xe8\x33\xf8\xff\xff\x58\xc3", 7}, //call 0xC075B0; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/10_40.h b/ps5-kstuff/shellcore_patches/10_40.h
index 77b370b..f35c52e 100644
--- a/ps5-kstuff/shellcore_patches/10_40.h
+++ b/ps5-kstuff/shellcore_patches/10_40.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_10_40
 #define SHELLCORE_PATCHES_10_40
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_1040 = {
-    .ppr_call = 0x75a2f7,
-    .ppr_cave = 0x17df900,
-    .ppr_cave_size = 0x700,
-    .close_plt = 0x17d6ad0,
-    .open_plt = 0x17d7c20,
-    .pread_plt = 0x17d7da0,
-    .mount_ppr_pkg_plt = 0x17da080,
-    .getpid_plt = 0x17d67e0,
-};
-
 static struct shellcore_patch shellcore_patches_1040_retail[] = {
     {0xC07DB3, "\x52\xeb\xe2", 3}, // push rdx; jmp 0xC07D98
     {0xC07D98, "\xe8\x33\xf8\xff\xff\x58\xc3", 7}, // call 0xC075D0; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/10_60.h b/ps5-kstuff/shellcore_patches/10_60.h
index d1a6429..0b5a00c 100644
--- a/ps5-kstuff/shellcore_patches/10_60.h
+++ b/ps5-kstuff/shellcore_patches/10_60.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_10_60
 #define SHELLCORE_PATCHES_10_60
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_1060 = {
-    .ppr_call = 0x75bb87,
-    .ppr_cave = 0x17e1180,
-    .ppr_cave_size = 0x2e80,
-    .close_plt = 0x17d8350,
-    .open_plt = 0x17d94c0,
-    .pread_plt = 0x17d9640,
-    .mount_ppr_pkg_plt = 0x17db910,
-    .getpid_plt = 0x17d8060,
-};
-
 static struct shellcore_patch shellcore_patches_1060_retail[] = {
     {0xC09643, "\x52\xeb\xe2", 3}, // push rdx; jmp 0xC09628
     {0xC09628, "\xe8\x33\xf8\xff\xff\x58\xc3", 7}, // call 0xC08E60; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/11_00.h b/ps5-kstuff/shellcore_patches/11_00.h
index 6419410..dffd77d 100644
--- a/ps5-kstuff/shellcore_patches/11_00.h
+++ b/ps5-kstuff/shellcore_patches/11_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_11_00
 #define SHELLCORE_PATCHES_11_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_1100 = {
-    .ppr_call = 0x7bd458,
-    .ppr_cave = 0x18685a0,
-    .ppr_cave_size = 0x3a60,
-    .close_plt = 0x185f460,
-    .open_plt = 0x1860620,
-    .pread_plt = 0x18607a0,
-    .mount_ppr_pkg_plt = 0x1862b40,
-    .getpid_plt = 0x185f120,
-};
-
 static struct shellcore_patch shellcore_patches_1100_retail[] = {
     {0xC57953, "\xE9\xC1\x01\x00\x00", 5}, // jmp 0xC57B19
     {0xC57B19, "\x52\xE9\x53\x06\x00\x00", 6}, // push rdx; jmp 0xC58172
diff --git a/ps5-kstuff/shellcore_patches/11_20.h b/ps5-kstuff/shellcore_patches/11_20.h
index ba83b87..b68b412 100644
--- a/ps5-kstuff/shellcore_patches/11_20.h
+++ b/ps5-kstuff/shellcore_patches/11_20.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_11_20
 #define SHELLCORE_PATCHES_11_20
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_1120 = {
-    .ppr_call = 0x7bd5c8,
-    .ppr_cave = 0x18689a0,
-    .ppr_cave_size = 0x3660,
-    .close_plt = 0x185f860,
-    .open_plt = 0x1860a20,
-    .pread_plt = 0x1860ba0,
-    .mount_ppr_pkg_plt = 0x1862f40,
-    .getpid_plt = 0x185f520,
-};
-
 static struct shellcore_patch shellcore_patches_1120_retail[] = {
     {0xC57CE3, "\xE9\xC1\x01\x00\x00", 5}, // jmp 0xC57EA9
     {0xC57EA9, "\x52\xE9\x53\x06\x00\x00", 6}, // push rdx; jmp 0xC58502
diff --git a/ps5-kstuff/shellcore_patches/11_40.h b/ps5-kstuff/shellcore_patches/11_40.h
index 3073171..58d5811 100644
--- a/ps5-kstuff/shellcore_patches/11_40.h
+++ b/ps5-kstuff/shellcore_patches/11_40.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_11_40
 #define SHELLCORE_PATCHES_11_40
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_1140 = {
-    .ppr_call = 0x7becf8,
-    .ppr_cave = 0x186ace0,
-    .ppr_cave_size = 0x1320,
-    .close_plt = 0x1861ba0,
-    .open_plt = 0x1862d70,
-    .pread_plt = 0x1862ef0,
-    .mount_ppr_pkg_plt = 0x1865280,
-    .getpid_plt = 0x1861860,
-};
-
 static struct shellcore_patch shellcore_patches_1140_retail[] = {
     {0xC59893, "\xE9\xC1\x01\x00\x00", 5}, // jmp 0xC59A59
     {0xC59A59, "\x52\xE9\x53\x06\x00\x00", 6}, // push rdx; jmp 0xC5A0B2
diff --git a/ps5-kstuff/shellcore_patches/1_00.h b/ps5-kstuff/shellcore_patches/1_00.h
index 04f8c4e..250e350 100644
--- a/ps5-kstuff/shellcore_patches/1_00.h
+++ b/ps5-kstuff/shellcore_patches/1_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_1_00
 #define SHELLCORE_PATCHES_1_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_100 = {
-    .ppr_call = 0x463461,
-    .ppr_cave = 0x1127640,
-    .ppr_cave_size = 0x9c0,
-    .close_plt = 0x111fa90,
-    .open_plt = 0x1120870,
-    .pread_plt = 0x11209e0,
-    .mount_ppr_pkg_plt = 0x1122620,
-    .getpid_plt = 0x111f790,
-};
-
 static struct shellcore_patch shellcore_patches_100_retail[] = {
     {0x7e06bf, "\x31\xc0\x50\xeb\x00", 5},
     {0x7e06c4, "\xe8\x77\x1a\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/1_01.h b/ps5-kstuff/shellcore_patches/1_01.h
index 84baa67..d0f1178 100644
--- a/ps5-kstuff/shellcore_patches/1_01.h
+++ b/ps5-kstuff/shellcore_patches/1_01.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_1_01
 #define SHELLCORE_PATCHES_1_01
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_101 = {
-    .ppr_call = 0x463461,
-    .ppr_cave = 0x1127640,
-    .ppr_cave_size = 0x9c0,
-    .close_plt = 0x111fa90,
-    .open_plt = 0x1120870,
-    .pread_plt = 0x11209e0,
-    .mount_ppr_pkg_plt = 0x1122620,
-    .getpid_plt = 0x111f790,
-};
-
 static struct shellcore_patch shellcore_patches_101_retail[] = {
     {0x7e06bf, "\x31\xc0\x50\xeb\x00", 5},
     {0x7e06c4, "\xe8\x77\x1a\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/1_02.h b/ps5-kstuff/shellcore_patches/1_02.h
index 12ba462..908c507 100644
--- a/ps5-kstuff/shellcore_patches/1_02.h
+++ b/ps5-kstuff/shellcore_patches/1_02.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_1_02
 #define SHELLCORE_PATCHES_1_02
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_102 = {
-    .ppr_call = 0x463461,
-    .ppr_cave = 0x1127640,
-    .ppr_cave_size = 0x9c0,
-    .close_plt = 0x111fa90,
-    .open_plt = 0x1120870,
-    .pread_plt = 0x11209e0,
-    .mount_ppr_pkg_plt = 0x1122620,
-    .getpid_plt = 0x111f790,
-};
-
 static struct shellcore_patch shellcore_patches_102_retail[] = {
     {0x7e06bf, "\x31\xc0\x50\xeb\x00", 5},
     {0x7e06c4, "\xe8\x77\x1a\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/1_12.h b/ps5-kstuff/shellcore_patches/1_12.h
index e47ef7e..6903196 100644
--- a/ps5-kstuff/shellcore_patches/1_12.h
+++ b/ps5-kstuff/shellcore_patches/1_12.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_1_12
 #define SHELLCORE_PATCHES_1_12
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_112 = {
-    .ppr_call = 0x4638f1,
-    .ppr_cave = 0x11281d0,
-    .ppr_cave_size = 0x3e30,
-    .close_plt = 0x1120610,
-    .open_plt = 0x11213f0,
-    .pread_plt = 0x1121560,
-    .mount_ppr_pkg_plt = 0x11231c0,
-    .getpid_plt = 0x1120310,
-};
-
 static struct shellcore_patch shellcore_patches_112_retail[] = {
     {0x7e0ccf, "\x31\xc0\x50\xeb\x00", 5},
     {0x7e0cd4, "\xe8\x77\x1a\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/1_14.h b/ps5-kstuff/shellcore_patches/1_14.h
index 3a6f02d..0afb709 100644
--- a/ps5-kstuff/shellcore_patches/1_14.h
+++ b/ps5-kstuff/shellcore_patches/1_14.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_1_14
 #define SHELLCORE_PATCHES_1_14
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_114 = {
-    .ppr_call = 0x463af1,
-    .ppr_cave = 0x11285f0,
-    .ppr_cave_size = 0x3a10,
-    .close_plt = 0x1120a30,
-    .open_plt = 0x1121810,
-    .pread_plt = 0x1121980,
-    .mount_ppr_pkg_plt = 0x11235e0,
-    .getpid_plt = 0x1120730,
-};
-
 static struct shellcore_patch shellcore_patches_114_retail[] = {
     {0x7e0ecf, "\x31\xc0\x50\xeb\x00", 5},
     {0x7e0ed4, "\xe8\x77\x1a\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/2_00.h b/ps5-kstuff/shellcore_patches/2_00.h
index 4568acd..01c666a 100644
--- a/ps5-kstuff/shellcore_patches/2_00.h
+++ b/ps5-kstuff/shellcore_patches/2_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_2_00
 #define SHELLCORE_PATCHES_2_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_200 = {
-    .ppr_call = 0x4cfa61,
-    .ppr_cave = 0x12a3cf0,
-    .ppr_cave_size = 0x310,
-    .close_plt = 0x129bea0,
-    .open_plt = 0x129ce50,
-    .pread_plt = 0x129cf40,
-    .mount_ppr_pkg_plt = 0x129eb30,
-    .getpid_plt = 0x129bb70,
-};
-
 static struct shellcore_patch shellcore_patches_200_retail[] = {
     {0x8835dc, "\x31\xc0\x50\xeb\x08", 5},
     {0x8835e9, "\xe8\x02\x1e\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/2_20.h b/ps5-kstuff/shellcore_patches/2_20.h
index ef71b3b..808e3da 100644
--- a/ps5-kstuff/shellcore_patches/2_20.h
+++ b/ps5-kstuff/shellcore_patches/2_20.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_2_20
 #define SHELLCORE_PATCHES_2_20
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_220 = {
-    .ppr_call = 0x4cfdb1,
-    .ppr_cave = 0x12a4160,
-    .ppr_cave_size = 0x3ea0,
-    .close_plt = 0x129c310,
-    .open_plt = 0x129d2c0,
-    .pread_plt = 0x129d3b0,
-    .mount_ppr_pkg_plt = 0x129efa0,
-    .getpid_plt = 0x129bfe0,
-};
-
 static struct shellcore_patch shellcore_patches_220_retail[] = {
     {0x88392c, "\x31\xc0\x50\xeb\x08", 5},
     {0x883939, "\xe8\x02\x1e\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/2_25.h b/ps5-kstuff/shellcore_patches/2_25.h
index 869afe0..26c86fe 100644
--- a/ps5-kstuff/shellcore_patches/2_25.h
+++ b/ps5-kstuff/shellcore_patches/2_25.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_2_25
 #define SHELLCORE_PATCHES_2_25
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_225 = {
-    .ppr_call = 0x4d0301,
-    .ppr_cave = 0x12a5070,
-    .ppr_cave_size = 0x2f90,
-    .close_plt = 0x129d220,
-    .open_plt = 0x129e1d0,
-    .pread_plt = 0x129e2c0,
-    .mount_ppr_pkg_plt = 0x129feb0,
-    .getpid_plt = 0x129cef0,
-};
-
 static struct shellcore_patch shellcore_patches_225_retail[] = {
     {0x883e7c, "\x31\xc0\x50\xeb\x08", 5},
     {0x883e89, "\xe8\x02\x1e\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/2_26.h b/ps5-kstuff/shellcore_patches/2_26.h
index caf39ea..54acc3b 100644
--- a/ps5-kstuff/shellcore_patches/2_26.h
+++ b/ps5-kstuff/shellcore_patches/2_26.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_2_26
 #define SHELLCORE_PATCHES_2_26
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_226 = {
-    .ppr_call = 0x4d1ab1,
-    .ppr_cave = 0x12a6a00,
-    .ppr_cave_size = 0x1600,
-    .close_plt = 0x129ebb0,
-    .open_plt = 0x129fb60,
-    .pread_plt = 0x129fc50,
-    .mount_ppr_pkg_plt = 0x12a1840,
-    .getpid_plt = 0x129e880,
-};
-
 static struct shellcore_patch shellcore_patches_226_retail[] = {
     {0x88562c, "\x31\xc0\x50\xeb\x08", 5},
     {0x885639, "\xe8\x02\x1e\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/2_30.h b/ps5-kstuff/shellcore_patches/2_30.h
index 0afd10e..e817abb 100644
--- a/ps5-kstuff/shellcore_patches/2_30.h
+++ b/ps5-kstuff/shellcore_patches/2_30.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_2_30
 #define SHELLCORE_PATCHES_2_30
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_230 = {
-    .ppr_call = 0x4d2251,
-    .ppr_cave = 0x12a7880,
-    .ppr_cave_size = 0x780,
-    .close_plt = 0x129fa30,
-    .open_plt = 0x12a09e0,
-    .pread_plt = 0x12a0ad0,
-    .mount_ppr_pkg_plt = 0x12a26c0,
-    .getpid_plt = 0x129f700,
-};
-
 static struct shellcore_patch shellcore_patches_230_retail[] = {
     {0x8861cc, "\x31\xc0\x50\xeb\x08", 5},
     {0x8861d9, "\xe8\x02\x1e\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/2_50.h b/ps5-kstuff/shellcore_patches/2_50.h
index 454c37b..cdc220f 100644
--- a/ps5-kstuff/shellcore_patches/2_50.h
+++ b/ps5-kstuff/shellcore_patches/2_50.h
@@ -1,20 +1,6 @@
 #ifndef SHELLCORE_PATCHES_2_50
 #define SHELLCORE_PATCHES_2_50
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_250 = {
-    .ppr_call = 0x4d3601,
-    .ppr_cave = 0x12aa7c0,
-    .ppr_cave_size = 0x1840,
-    .close_plt = 0x12a2970,
-    .open_plt = 0x12a3920,
-    .pread_plt = 0x12a3a10,
-    .mount_ppr_pkg_plt = 0x12a5610,
-    .getpid_plt = 0x12a2640,
-    .game_mount_calls = {0x4cff43, 0x4d2929, 0x4d2bce},
-    .game_umount_calls = {0x4d2ff3, 0x4d3150},
-    .ppr_umount_call = 0x4d3da0,
-};
-
 static struct shellcore_patch shellcore_patches_250_retail[] = {
     /* ScePreorder/security wrapper: 3.00 sub_9D1CA0/sub_9D18A0. */
     {0x88757c, "\x31\xc0\x50\xeb\x08", 5}, // 3.00 0x9d18b1 (selector 1): call sub_889390, force a zero return
diff --git a/ps5-kstuff/shellcore_patches/2_70.h b/ps5-kstuff/shellcore_patches/2_70.h
index c78d331..26dfe11 100644
--- a/ps5-kstuff/shellcore_patches/2_70.h
+++ b/ps5-kstuff/shellcore_patches/2_70.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_2_70
 #define SHELLCORE_PATCHES_2_70
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_270 = {
-    .ppr_call = 0x4d3601,
-    .ppr_cave = 0x12aa7c0,
-    .ppr_cave_size = 0x1840,
-    .close_plt = 0x12a2970,
-    .open_plt = 0x12a3920,
-    .pread_plt = 0x12a3a10,
-    .mount_ppr_pkg_plt = 0x12a5610,
-    .getpid_plt = 0x12a2640,
-};
-
 static struct shellcore_patch shellcore_patches_270_retail[] = {
     {0x88757c, "\x31\xc0\x50\xeb\x08", 5},
     {0x887589, "\xe8\x02\x1e\x00\x00\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/3_00.h b/ps5-kstuff/shellcore_patches/3_00.h
index 681b40e..23ffbee 100644
--- a/ps5-kstuff/shellcore_patches/3_00.h
+++ b/ps5-kstuff/shellcore_patches/3_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_3_00
 #define SHELLCORE_PATCHES_3_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_300 = {
-    .ppr_call = 0x52c2da,
-    .ppr_cave = 0x142c990,
-    .ppr_cave_size = 0x3670,
-    .close_plt = 0x1424a20,
-    .open_plt = 0x1425a30,
-    .pread_plt = 0x1425b20,
-    .mount_ppr_pkg_plt = 0x1427830,
-    .getpid_plt = 0x14246f0,
-};
-
 static struct shellcore_patch shellcore_patches_300_retail[] = {
     {0x9d1cae, "\x52\xeb\x08", 3},
     {0x9d1cb9, "\xe8\x02\xfc\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/3_10.h b/ps5-kstuff/shellcore_patches/3_10.h
index b86514d..329019d 100644
--- a/ps5-kstuff/shellcore_patches/3_10.h
+++ b/ps5-kstuff/shellcore_patches/3_10.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_3_10
 #define SHELLCORE_PATCHES_3_10
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_310 = {
-    .ppr_call = 0x52c31a,
-    .ppr_cave = 0x142c9d0,
-    .ppr_cave_size = 0x3630,
-    .close_plt = 0x1424a60,
-    .open_plt = 0x1425a70,
-    .pread_plt = 0x1425b60,
-    .mount_ppr_pkg_plt = 0x1427870,
-    .getpid_plt = 0x1424730,
-};
-
 static struct shellcore_patch shellcore_patches_310_retail[] = {
     {0x9d1cee, "\x52\xeb\x08", 3},
     {0x9d1cf9, "\xe8\x02\xfc\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/3_20.h b/ps5-kstuff/shellcore_patches/3_20.h
index 65178c6..ac8a6e7 100644
--- a/ps5-kstuff/shellcore_patches/3_20.h
+++ b/ps5-kstuff/shellcore_patches/3_20.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_3_20
 #define SHELLCORE_PATCHES_3_20
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_320 = {
-    .ppr_call = 0x52c5ca,
-    .ppr_cave = 0x142ce20,
-    .ppr_cave_size = 0x31e0,
-    .close_plt = 0x1424eb0,
-    .open_plt = 0x1425ec0,
-    .pread_plt = 0x1425fb0,
-    .mount_ppr_pkg_plt = 0x1427cc0,
-    .getpid_plt = 0x1424b80,
-};
-
 static struct shellcore_patch shellcore_patches_320_retail[] = {
     {0x9d1f9e, "\x52\xeb\x08", 3},
     {0x9d1fa9, "\xe8\x02\xfc\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/3_21.h b/ps5-kstuff/shellcore_patches/3_21.h
index 4bd6e4b..5095726 100644
--- a/ps5-kstuff/shellcore_patches/3_21.h
+++ b/ps5-kstuff/shellcore_patches/3_21.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_3_21
 #define SHELLCORE_PATCHES_3_21
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_321 = {
-    .ppr_call = 0x52c5ca,
-    .ppr_cave = 0x142ce20,
-    .ppr_cave_size = 0x31e0,
-    .close_plt = 0x1424eb0,
-    .open_plt = 0x1425ec0,
-    .pread_plt = 0x1425fb0,
-    .mount_ppr_pkg_plt = 0x1427cc0,
-    .getpid_plt = 0x1424b80,
-};
-
 static struct shellcore_patch shellcore_patches_321_retail[] = {
     {0x9d1f9e, "\x52\xeb\x08", 3},
     {0x9d1fa9, "\xe8\x02\xfc\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/4_00.h b/ps5-kstuff/shellcore_patches/4_00.h
index 568d1dd..e315249 100644
--- a/ps5-kstuff/shellcore_patches/4_00.h
+++ b/ps5-kstuff/shellcore_patches/4_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_4_00
 #define SHELLCORE_PATCHES_4_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_400 = {
-    .ppr_call = 0x57dafe,
-    .ppr_cave = 0x13bf980,
-    .ppr_cave_size = 0x680,
-    .close_plt = 0x13b7870,
-    .open_plt = 0x13b88e0,
-    .pread_plt = 0x13b89d0,
-    .mount_ppr_pkg_plt = 0x13ba840,
-    .getpid_plt = 0x13b7530,
-};
-
 static struct shellcore_patch shellcore_patches_400_retail[] = {
     {0x974fee, "\x52\xeb\x08", 3},
     {0x974ff9, "\xe8\xd2\xfb\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/4_02.h b/ps5-kstuff/shellcore_patches/4_02.h
index a50572a..987c737 100644
--- a/ps5-kstuff/shellcore_patches/4_02.h
+++ b/ps5-kstuff/shellcore_patches/4_02.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_4_02
 #define SHELLCORE_PATCHES_4_02
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_402 = {
-    .ppr_call = 0x57dafe,
-    .ppr_cave = 0x13bf980,
-    .ppr_cave_size = 0x680,
-    .close_plt = 0x13b7870,
-    .open_plt = 0x13b88e0,
-    .pread_plt = 0x13b89d0,
-    .mount_ppr_pkg_plt = 0x13ba840,
-    .getpid_plt = 0x13b7530,
-};
-
 static struct shellcore_patch shellcore_patches_402_retail[] = {
     {0x974fee, "\x52\xeb\x08", 3},
     {0x974ff9, "\xe8\xd2\xfb\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/4_03.h b/ps5-kstuff/shellcore_patches/4_03.h
index 92b6b3b..fd4723b 100644
--- a/ps5-kstuff/shellcore_patches/4_03.h
+++ b/ps5-kstuff/shellcore_patches/4_03.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_4_03
 #define SHELLCORE_PATCHES_4_03
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_403 = {
-    .ppr_call = 0x57dafe,
-    .ppr_cave = 0x13bf990,
-    .ppr_cave_size = 0x670,
-    .close_plt = 0x13b7880,
-    .open_plt = 0x13b88f0,
-    .pread_plt = 0x13b89e0,
-    .mount_ppr_pkg_plt = 0x13ba850,
-    .getpid_plt = 0x13b7540,
-};
-
 static struct shellcore_patch shellcore_patches_403_retail[] = {
     {0x974fee, "\x52\xeb\x08", 3},
     {0x974ff9, "\xe8\xd2\xfb\xff\xff\x58\xc3", 7}, //call 0x974bd0; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/4_50.h b/ps5-kstuff/shellcore_patches/4_50.h
index 74f7753..a2612d6 100644
--- a/ps5-kstuff/shellcore_patches/4_50.h
+++ b/ps5-kstuff/shellcore_patches/4_50.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_4_50
 #define SHELLCORE_PATCHES_4_50
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_450 = {
-    .ppr_call = 0x57e46e,
-    .ppr_cave = 0x13cb950,
-    .ppr_cave_size = 0x6b0,
-    .close_plt = 0x13c3840,
-    .open_plt = 0x13c48c0,
-    .pread_plt = 0x13c49b0,
-    .mount_ppr_pkg_plt = 0x13c6820,
-    .getpid_plt = 0x13c3500,
-};
-
 static struct shellcore_patch shellcore_patches_450_retail[] = {
     {0x97595e, "\x52\xeb\x08", 3},
     {0x975969, "\xe8\xd2\xfb\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/4_51.h b/ps5-kstuff/shellcore_patches/4_51.h
index 2f8f678..42d7a5b 100644
--- a/ps5-kstuff/shellcore_patches/4_51.h
+++ b/ps5-kstuff/shellcore_patches/4_51.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_4_51
 #define SHELLCORE_PATCHES_4_51
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_451 = {
-    .ppr_call = 0x57e47e,
-    .ppr_cave = 0x13cb950,
-    .ppr_cave_size = 0x6b0,
-    .close_plt = 0x13c3840,
-    .open_plt = 0x13c48c0,
-    .pread_plt = 0x13c49b0,
-    .mount_ppr_pkg_plt = 0x13c6820,
-    .getpid_plt = 0x13c3500,
-};
-
 static struct shellcore_patch shellcore_patches_451_retail[] = {
     {0x97596e, "\x52\xeb\x08", 3},
     {0x975979, "\xe8\xd2\xfb\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/5_00.h b/ps5-kstuff/shellcore_patches/5_00.h
index 388f5b7..b695797 100644
--- a/ps5-kstuff/shellcore_patches/5_00.h
+++ b/ps5-kstuff/shellcore_patches/5_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_5_00
 #define SHELLCORE_PATCHES_5_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_500 = {
-    .ppr_call = 0x5e67cc,
-    .ppr_cave = 0x14893f0,
-    .ppr_cave_size = 0x2c10,
-    .close_plt = 0x14810e0,
-    .open_plt = 0x1482020,
-    .pread_plt = 0x1482110,
-    .mount_ppr_pkg_plt = 0x1483f80,
-    .getpid_plt = 0x1480df0,
-};
-
 static struct shellcore_patch shellcore_patches_500_retail[] = {
     {0xa2e62e, "\x52\xeb\x08", 3},
     {0xa2e639, "\xe8\x22\xfb\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/5_02.h b/ps5-kstuff/shellcore_patches/5_02.h
index a3767b9..68b51ad 100644
--- a/ps5-kstuff/shellcore_patches/5_02.h
+++ b/ps5-kstuff/shellcore_patches/5_02.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_5_02
 #define SHELLCORE_PATCHES_5_02
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_502 = {
-    .ppr_call = 0x5e67bc,
-    .ppr_cave = 0x14893d0,
-    .ppr_cave_size = 0x2c30,
-    .close_plt = 0x14810c0,
-    .open_plt = 0x1482000,
-    .pread_plt = 0x14820f0,
-    .mount_ppr_pkg_plt = 0x1483f60,
-    .getpid_plt = 0x1480dd0,
-};
-
 static struct shellcore_patch shellcore_patches_502_retail[] = {
     {0xa2e61e, "\x52\xeb\x08", 3},
     {0xa2e629, "\xe8\x22\xfb\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/5_10.h b/ps5-kstuff/shellcore_patches/5_10.h
index 021203a..8041ffd 100644
--- a/ps5-kstuff/shellcore_patches/5_10.h
+++ b/ps5-kstuff/shellcore_patches/5_10.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_5_10
 #define SHELLCORE_PATCHES_5_10
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_510 = {
-    .ppr_call = 0x5e928c,
-    .ppr_cave = 0x148c510,
-    .ppr_cave_size = 0x3af0,
-    .close_plt = 0x14841f0,
-    .open_plt = 0x1485130,
-    .pread_plt = 0x1485220,
-    .mount_ppr_pkg_plt = 0x14870b0,
-    .getpid_plt = 0x1483f00,
-};
-
 static struct shellcore_patch shellcore_patches_510_retail[] = {
     {0xa30fde, "\x52\xeb\x08", 3},
     {0xa30fe9, "\xe8\x22\xfb\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/5_50.h b/ps5-kstuff/shellcore_patches/5_50.h
index cf8ace6..7453ff0 100644
--- a/ps5-kstuff/shellcore_patches/5_50.h
+++ b/ps5-kstuff/shellcore_patches/5_50.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_5_50
 #define SHELLCORE_PATCHES_5_50
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_550 = {
-    .ppr_call = 0x5e928c,
-    .ppr_cave = 0x1490b70,
-    .ppr_cave_size = 0x3490,
-    .close_plt = 0x1488850,
-    .open_plt = 0x14897a0,
-    .pread_plt = 0x1489890,
-    .mount_ppr_pkg_plt = 0x148b720,
-    .getpid_plt = 0x1488560,
-};
-
 static struct shellcore_patch shellcore_patches_550_retail[] = {
     {0xa319ee, "\x52\xeb\x08", 3},
     {0xa319f9, "\xe8\x22\xfb\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/6_00.h b/ps5-kstuff/shellcore_patches/6_00.h
index 8bdcdd9..d4207f2 100644
--- a/ps5-kstuff/shellcore_patches/6_00.h
+++ b/ps5-kstuff/shellcore_patches/6_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_6_00
 #define SHELLCORE_PATCHES_6_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_600 = {
-    .ppr_call = 0x61ca0d,
-    .ppr_cave = 0x1526ac0,
-    .ppr_cave_size = 0x1540,
-    .close_plt = 0x151e550,
-    .open_plt = 0x151f4f0,
-    .pread_plt = 0x151f620,
-    .mount_ppr_pkg_plt = 0x15215b0,
-    .getpid_plt = 0x151dd70,
-};
-
 static struct shellcore_patch shellcore_patches_600_retail[] = {
     {0xa7d30e, "\x52\xeb\x08", 3},
     {0xa7d319, "\xe8\x82\xfa\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/6_02.h b/ps5-kstuff/shellcore_patches/6_02.h
index f08c0f0..1d41429 100644
--- a/ps5-kstuff/shellcore_patches/6_02.h
+++ b/ps5-kstuff/shellcore_patches/6_02.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_6_02
 #define SHELLCORE_PATCHES_6_02
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_602 = {
-    .ppr_call = 0x61c9ad,
-    .ppr_cave = 0x1526ed0,
-    .ppr_cave_size = 0x1130,
-    .close_plt = 0x151e950,
-    .open_plt = 0x151f8f0,
-    .pread_plt = 0x151fa20,
-    .mount_ppr_pkg_plt = 0x15219b0,
-    .getpid_plt = 0x151e170,
-};
-
 static struct shellcore_patch shellcore_patches_602_retail[] = {
     {0xa7d2ae, "\x52\xeb\x08", 3},
     {0xa7d2b9, "\xe8\x82\xfa\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/6_50.h b/ps5-kstuff/shellcore_patches/6_50.h
index 7c8c372..3350350 100644
--- a/ps5-kstuff/shellcore_patches/6_50.h
+++ b/ps5-kstuff/shellcore_patches/6_50.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_6_50
 #define SHELLCORE_PATCHES_6_50
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_650 = {
-    .ppr_call = 0x61ca1d,
-    .ppr_cave = 0x1527440,
-    .ppr_cave_size = 0xbc0,
-    .close_plt = 0x151eec0,
-    .open_plt = 0x151fe60,
-    .pread_plt = 0x151ff90,
-    .mount_ppr_pkg_plt = 0x1521f20,
-    .getpid_plt = 0x151e6e0,
-};
-
 static struct shellcore_patch shellcore_patches_650_retail[] = {
     {0xa7dade, "\x52\xeb\x08", 3},
     {0xa7dae9, "\xe8\x82\xfa\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/7_00.h b/ps5-kstuff/shellcore_patches/7_00.h
index 0c10e94..fbf93e5 100644
--- a/ps5-kstuff/shellcore_patches/7_00.h
+++ b/ps5-kstuff/shellcore_patches/7_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_7_00
 #define SHELLCORE_PATCHES_7_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_700 = {
-    .ppr_call = 0x6d6682,
-    .ppr_cave = 0x16a8350,
-    .ppr_cave_size = 0x3cb0,
-    .close_plt = 0x169fa00,
-    .open_plt = 0x16a0ad0,
-    .pread_plt = 0x16a0c40,
-    .mount_ppr_pkg_plt = 0x16a2c10,
-    .getpid_plt = 0x169f710,
-};
-
 static struct shellcore_patch shellcore_patches_700_retail[] = {
     {0xb424de, "\x52\xeb\x08", 3},
     {0xb424e9, "\xe8\xd2\xf9\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/7_01.h b/ps5-kstuff/shellcore_patches/7_01.h
index eb92d8b..43c4c58 100644
--- a/ps5-kstuff/shellcore_patches/7_01.h
+++ b/ps5-kstuff/shellcore_patches/7_01.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_7_01
 #define SHELLCORE_PATCHES_7_01
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_701 = {
-    .ppr_call = 0x6d6682,
-    .ppr_cave = 0x16a8350,
-    .ppr_cave_size = 0x3cb0,
-    .close_plt = 0x169fa00,
-    .open_plt = 0x16a0ad0,
-    .pread_plt = 0x16a0c40,
-    .mount_ppr_pkg_plt = 0x16a2c10,
-    .getpid_plt = 0x169f710,
-};
-
 static struct shellcore_patch shellcore_patches_701_retail[] = {
     {0xb424de, "\x52\xeb\x08", 3},
     {0xb424e9, "\xe8\xd2\xf9\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/7_20.h b/ps5-kstuff/shellcore_patches/7_20.h
index 27423e5..013b9f2 100644
--- a/ps5-kstuff/shellcore_patches/7_20.h
+++ b/ps5-kstuff/shellcore_patches/7_20.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_7_20
 #define SHELLCORE_PATCHES_7_20
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_720 = {
-    .ppr_call = 0x6d66a2,
-    .ppr_cave = 0x16a8cf0,
-    .ppr_cave_size = 0x3310,
-    .close_plt = 0x16a03a0,
-    .open_plt = 0x16a1470,
-    .pread_plt = 0x16a15e0,
-    .mount_ppr_pkg_plt = 0x16a35b0,
-    .getpid_plt = 0x16a00b0,
-};
-
 static struct shellcore_patch shellcore_patches_720_retail[] = {
     {0xb42dbe, "\x52\xeb\x08", 3},
     {0xb42dc9, "\xe8\xd2\xf9\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/7_40.h b/ps5-kstuff/shellcore_patches/7_40.h
index 2875f35..454b219 100644
--- a/ps5-kstuff/shellcore_patches/7_40.h
+++ b/ps5-kstuff/shellcore_patches/7_40.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_7_40
 #define SHELLCORE_PATCHES_7_40
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_740 = {
-    .ppr_call = 0x6db192,
-    .ppr_cave = 0x16b6790,
-    .ppr_cave_size = 0x1870,
-    .close_plt = 0x16ade40,
-    .open_plt = 0x16aef10,
-    .pread_plt = 0x16af080,
-    .mount_ppr_pkg_plt = 0x16b1050,
-    .getpid_plt = 0x16adb50,
-};
-
 static struct shellcore_patch shellcore_patches_740_retail[] = {
     {0xb4e4ae, "\x52\xeb\x08", 3},
     {0xb4e4b9, "\xe8\xD2\xf9\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/7_60.h b/ps5-kstuff/shellcore_patches/7_60.h
index 27a0b85..4410fe4 100644
--- a/ps5-kstuff/shellcore_patches/7_60.h
+++ b/ps5-kstuff/shellcore_patches/7_60.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_7_60
 #define SHELLCORE_PATCHES_7_60
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_760 = {
-    .ppr_call = 0x6db192,
-    .ppr_cave = 0x16b9d90,
-    .ppr_cave_size = 0x2270,
-    .close_plt = 0x16b1420,
-    .open_plt = 0x16b24f0,
-    .pread_plt = 0x16b2660,
-    .mount_ppr_pkg_plt = 0x16b4630,
-    .getpid_plt = 0x16b1130,
-};
-
 static struct shellcore_patch shellcore_patches_760_retail[] = {
     {0xb51a8e, "\x52\xeb\x08", 3},
     {0xb51a99, "\xe8\xd2\xf9\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/7_61.h b/ps5-kstuff/shellcore_patches/7_61.h
index 2238d93..efbce86 100644
--- a/ps5-kstuff/shellcore_patches/7_61.h
+++ b/ps5-kstuff/shellcore_patches/7_61.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_7_61
 #define SHELLCORE_PATCHES_7_61
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_761 = {
-    .ppr_call = 0x6db192,
-    .ppr_cave = 0x16b9d90,
-    .ppr_cave_size = 0x2270,
-    .close_plt = 0x16b1420,
-    .open_plt = 0x16b24f0,
-    .pread_plt = 0x16b2660,
-    .mount_ppr_pkg_plt = 0x16b4630,
-    .getpid_plt = 0x16b1130,
-};
-
 static struct shellcore_patch shellcore_patches_761_retail[] = {
     {0xb51a8e, "\x52\xeb\x08", 3},
     {0xb51a99, "\xe8\xd2\xf9\xff\xff\x58\xc3", 7},
diff --git a/ps5-kstuff/shellcore_patches/8_00.h b/ps5-kstuff/shellcore_patches/8_00.h
index 40bd222..8c6e14f 100644
--- a/ps5-kstuff/shellcore_patches/8_00.h
+++ b/ps5-kstuff/shellcore_patches/8_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_8_00
 #define SHELLCORE_PATCHES_8_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_800 = {
-    .ppr_call = 0x70260d,
-    .ppr_cave = 0x1732a90,
-    .ppr_cave_size = 0x1570,
-    .close_plt = 0x1729e80,
-    .open_plt = 0x172af90,
-    .pread_plt = 0x172b100,
-    .mount_ppr_pkg_plt = 0x172d2e0,
-    .getpid_plt = 0x1729b90,
-};
-
 static struct shellcore_patch shellcore_patches_800_retail[] = {
     {0xba85ce, "\x52\xeb\x08", 3}, //push rdx; jmp 0xBA85D9
     {0xba85d9, "\xe8\xe2\xf6\xff\xff\x58\xc3", 7}, //call 0xBA7CC0; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/8_20.h b/ps5-kstuff/shellcore_patches/8_20.h
index a5d99dc..6302240 100644
--- a/ps5-kstuff/shellcore_patches/8_20.h
+++ b/ps5-kstuff/shellcore_patches/8_20.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_8_20
 #define SHELLCORE_PATCHES_8_20
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_820 = {
-    .ppr_call = 0x70558d,
-    .ppr_cave = 0x173ee50,
-    .ppr_cave_size = 0x11b0,
-    .close_plt = 0x1736230,
-    .open_plt = 0x1737350,
-    .pread_plt = 0x17374c0,
-    .mount_ppr_pkg_plt = 0x17396a0,
-    .getpid_plt = 0x1735f40,
-};
-
 static struct shellcore_patch shellcore_patches_820_retail[] = {
     {0xBAF83E, "\x52\xeb\x08", 3}, //push rdx; jmp 0xBAF849 **
     {0xBAF849, "\xe8\xe2\xf8\xff\xff\x58\xc3", 7}, //call 0xBAF130; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/8_40.h b/ps5-kstuff/shellcore_patches/8_40.h
index 2d3854d..8fc6c87 100644
--- a/ps5-kstuff/shellcore_patches/8_40.h
+++ b/ps5-kstuff/shellcore_patches/8_40.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_8_40
 #define SHELLCORE_PATCHES_8_40
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_840 = {
-    .ppr_call = 0x70558d,
-    .ppr_cave = 0x173ee50,
-    .ppr_cave_size = 0x11b0,
-    .close_plt = 0x1736230,
-    .open_plt = 0x1737350,
-    .pread_plt = 0x17374c0,
-    .mount_ppr_pkg_plt = 0x17396a0,
-    .getpid_plt = 0x1735f40,
-};
-
 static struct shellcore_patch shellcore_patches_840_retail[] = {
     {0xBAF83E, "\x52\xeb\x08", 3}, //push rdx; jmp 0xBAF849 **
     {0xBAF849, "\xe8\xe2\xf8\xff\xff\x58\xc3", 7}, //call 0xBAF130; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/8_60.h b/ps5-kstuff/shellcore_patches/8_60.h
index fa75a62..64782d5 100644
--- a/ps5-kstuff/shellcore_patches/8_60.h
+++ b/ps5-kstuff/shellcore_patches/8_60.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_8_60
 #define SHELLCORE_PATCHES_8_60
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_860 = {
-    .ppr_call = 0x70541d,
-    .ppr_cave = 0x17411b0,
-    .ppr_cave_size = 0x2e50,
-    .close_plt = 0x1738590,
-    .open_plt = 0x17396b0,
-    .pread_plt = 0x1739820,
-    .mount_ppr_pkg_plt = 0x173ba10,
-    .getpid_plt = 0x17382a0,
-};
-
 static struct shellcore_patch shellcore_patches_860_retail[] = {
     {0xBAF84E, "\x52\xeb\x08", 3}, //push rdx; jmp 0xBAF859 **
     {0xBAF859, "\xe8\xe2\xf8\xff\xff\x58\xc3", 7}, //call 0xBAF140; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/9_00.h b/ps5-kstuff/shellcore_patches/9_00.h
index fa6efcc..def5ca9 100644
--- a/ps5-kstuff/shellcore_patches/9_00.h
+++ b/ps5-kstuff/shellcore_patches/9_00.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_9_00
 #define SHELLCORE_PATCHES_9_00
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_900 = {
-    .ppr_call = 0x7488fd,
-    .ppr_cave = 0x17ddca0,
-    .ppr_cave_size = 0x2360,
-    .close_plt = 0x17d4f40,
-    .open_plt = 0x17d6050,
-    .pread_plt = 0x17d61a0,
-    .mount_ppr_pkg_plt = 0x17d8430,
-    .getpid_plt = 0x17d4c50,
-};
-
 static struct shellcore_patch shellcore_patches_900_retail[] = {
     {0xC0F813, "\x52\xeb\xe2", 3}, //push rdx; jmp 0xC0F7F8
     {0xC0F7F8, "\xe8\xe3\xf8\xff\xff\x58\xc3", 7}, //call 0xC0F0E0; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/9_05.h b/ps5-kstuff/shellcore_patches/9_05.h
index 8abd947..a8dd158 100644
--- a/ps5-kstuff/shellcore_patches/9_05.h
+++ b/ps5-kstuff/shellcore_patches/9_05.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_9_05
 #define SHELLCORE_PATCHES_9_05
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_905 = {
-    .ppr_call = 0x7488fd,
-    .ppr_cave = 0x17ddca0,
-    .ppr_cave_size = 0x2360,
-    .close_plt = 0x17d4f40,
-    .open_plt = 0x17d6050,
-    .pread_plt = 0x17d61a0,
-    .mount_ppr_pkg_plt = 0x17d8430,
-    .getpid_plt = 0x17d4c50,
-};
-
 static struct shellcore_patch shellcore_patches_905_retail[] = {
     {0xC0F813, "\x52\xeb\xe2", 3}, //push rdx; jmp 0xC0F7F8
     {0xC0F7F8, "\xe8\xe3\xf8\xff\xff\x58\xc3", 7}, //call 0xC0F0E0; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/9_20.h b/ps5-kstuff/shellcore_patches/9_20.h
index 8424b71..5d41c3a 100644
--- a/ps5-kstuff/shellcore_patches/9_20.h
+++ b/ps5-kstuff/shellcore_patches/9_20.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_9_20
 #define SHELLCORE_PATCHES_9_20
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_920 = {
-    .ppr_call = 0x74863d,
-    .ppr_cave = 0x17de380,
-    .ppr_cave_size = 0x1c80,
-    .close_plt = 0x17d5620,
-    .open_plt = 0x17d6730,
-    .pread_plt = 0x17d6880,
-    .mount_ppr_pkg_plt = 0x17d8b10,
-    .getpid_plt = 0x17d5330,
-};
-
 static struct shellcore_patch shellcore_patches_920_retail[] = {
     {0xC0F553, "\x52\xeb\xe2", 3}, //push rdx; jmp 0xC0F538
     {0xC0F538, "\xe8\xe3\xf8\xff\xff\x58\xc3", 7}, //call 0xC0EE20; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/9_40.h b/ps5-kstuff/shellcore_patches/9_40.h
index b667384..9e15bf5 100644
--- a/ps5-kstuff/shellcore_patches/9_40.h
+++ b/ps5-kstuff/shellcore_patches/9_40.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_9_40
 #define SHELLCORE_PATCHES_9_40
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_940 = {
-    .ppr_call = 0x748d0d,
-    .ppr_cave = 0x17deb50,
-    .ppr_cave_size = 0x14b0,
-    .close_plt = 0x17d5de0,
-    .open_plt = 0x17d6f00,
-    .pread_plt = 0x17d7050,
-    .mount_ppr_pkg_plt = 0x17d92e0,
-    .getpid_plt = 0x17d5af0,
-};
-
 static struct shellcore_patch shellcore_patches_940_retail[] = {
     {0xC0FCA3, "\x52\xeb\xe2", 3}, //push rdx; jmp 0xC0FC88
     {0xC0FC88, "\xe8\xe3\xf8\xff\xff\x58\xc3", 7}, //call 0xC0F570; pop rax; ret
diff --git a/ps5-kstuff/shellcore_patches/9_60.h b/ps5-kstuff/shellcore_patches/9_60.h
index 672955f..513fa50 100644
--- a/ps5-kstuff/shellcore_patches/9_60.h
+++ b/ps5-kstuff/shellcore_patches/9_60.h
@@ -1,17 +1,6 @@
 #ifndef SHELLCORE_PATCHES_9_60
 #define SHELLCORE_PATCHES_9_60
 
-static const struct shellcore_fpkg_offsets shellcore_fpkg_offsets_960 = {
-    .ppr_call = 0x748d7d,
-    .ppr_cave = 0x17e6f20,
-    .ppr_cave_size = 0x10e0,
-    .close_plt = 0x17de1b0,
-    .open_plt = 0x17df2d0,
-    .pread_plt = 0x17df420,
-    .mount_ppr_pkg_plt = 0x17e16b0,
-    .getpid_plt = 0x17ddec0,
-};
-
 static struct shellcore_patch shellcore_patches_960_retail[] = {
     {0xC18073, "\x52\xeb\xe2", 3}, //push rdx; jmp 0xC18058
     {0xC18058, "\xe8\xe3\xf8\xff\xff\x58\xc3", 7}, //call 0xC17940; pop rax; ret
diff --git a/ps5-kstuff/uelf/fpkg.c b/ps5-kstuff/uelf/fpkg.c
index 800962c..3f44831 100644
--- a/ps5-kstuff/uelf/fpkg.c
+++ b/ps5-kstuff/uelf/fpkg.c
@@ -703,12 +703,12 @@ int control_ppr_plaintext_request(uint64_t magic, uint64_t mode,
                                   uint64_t* result)
 {
     /*
-     * "PPRPLAIN", protocol v8. No user pointer is dereferenced: WRITE carries
+     * "PPRPLAIN". No user pointer is dereferenced: WRITE carries
      * 16 snapshot bytes in R8/R9. R10 is deliberately unused because the
      * established kekcall fast snapshot ends at RAX and includes R8/R9.
      */
     *result = 0;
-    if(!get_ppr_profile() || magic != 0x505052504c41494eull)
+    if(magic != 0x505052504c41494eull)
         return EINVAL;
     if(mode == PPR_CONTROL_TRACE)
     {
@@ -743,6 +743,10 @@ int control_ppr_plaintext_request(uint64_t magic, uint64_t mode,
     if((fpkg_scope_for_thread(td) & FPKG_SCOPE_KIND_MASK)
                                       != KSTUFF_FPKG_SCOPE_PPR_MOUNT)
         return EPERM;
+    /* Mount scope tracking also covers firmware without a validated
+     * PLAINTEXT_NOAUTH interception profile. */
+    if(!get_ppr_profile())
+        return EINVAL;
     if(mode == 0)
     {
         if(arg0 != PPR_PLAINTEXT_PROTOCOL_VERSION)
@@ -1471,7 +1475,7 @@ int try_handle_fpkg_mailbox(uint64_t* regs, uint64_t lr)
          * and both completed read sizes. sm_pfs normally uses the vnode/FIH
          * context in request qwords 10/11 to read and fill a 0x1000-byte FIH
          * buffer plus a 0x5a0-byte verified superblock. Calling VFS from the
-         * debug exception is unsafe, so protocol v8 snapshots both file ranges
+         * debug exception is unsafe, so snapshots both file ranges
          * before nmount and this trap supplies the same output buffers.
          * registerMountKey indexes a global RB tree by handle alone.  The
          * emulated result therefore jumps past both key registrations and the
diff --git a/tools/find_shellcore_fpkg_offsets.py b/tools/find_shellcore_fpkg_offsets.py
new file mode 100644
index 0000000..8d1681c
--- /dev/null
+++ b/tools/find_shellcore_fpkg_offsets.py
@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+"""Audit ShellCore import NIDs and GOT slots in unpacked ELF images.
+
+This mirrors the loader's NID-to-JMP_SLOT lookup. PLT stubs and lazy GOT
+initializers are checked to catch a changed import ABI before deployment.
+"""
+
+import argparse
+import hashlib
+import struct
+from pathlib import Path
+
+
+IMPORTS = {
+    "close": "bY-PO6JhzhQ",
+    "open": "wuCroIGjt2g",
+    "pread": "ezv-RSBNKqI",
+    "mount_game": "FtGP5aXKFQU",
+    "umount_game": "UQTSykySQ40",
+    "mount_ppr": "MiUxeleLYUc",
+    "umount_ppr": "S5+bpaH0TWk",
+}
+DT_PLTRELSZ = 2
+DT_STRTAB = 5
+DT_SYMTAB = 6
+DT_RELAENT = 9
+DT_STRSZ = 10
+DT_SYMENT = 11
+DT_PLTREL = 20
+DT_JMPREL = 23
+DT_RELA = 7
+PT_LOAD = 1
+PT_DYNAMIC = 2
+R_X86_64_JUMP_SLOT = 7
+
+
+def derive(path: Path):
+    image = path.read_bytes()
+    if image[:4] != b"\x7fELF" or image[4:6] != b"\x02\x01":
+        raise ValueError("expected an unpacked little-endian ELF64 image")
+    phoff = struct.unpack_from("<Q", image, 32)[0]
+    phentsize, phnum = struct.unpack_from("<HH", image, 54)
+    if phentsize != 56 or not 0 < phnum <= 64:
+        raise ValueError("unexpected program-header layout")
+    segments = [struct.unpack_from("<IIQQQQQQ", image, phoff + i * phentsize)
+                for i in range(phnum)]
+
+    def file_offset(vaddr, size):
+        for kind, _, offset, start, _, filesz, _, _ in segments:
+            if kind == PT_LOAD and start <= vaddr and size <= filesz - (vaddr - start):
+                return offset + vaddr - start
+        raise ValueError(f"unmapped ELF data at {vaddr:#x}, size {size:#x}")
+
+    dynamics = [segment for segment in segments if segment[0] == PT_DYNAMIC]
+    if len(dynamics) != 1:
+        raise ValueError("expected one PT_DYNAMIC")
+    _, _, dynoff, _, _, dynsize, _, _ = dynamics[0]
+    tags = {}
+    for off in range(dynoff, dynoff + dynsize, 16):
+        tag, value = struct.unpack_from("<QQ", image, off)
+        if tag == 0:
+            break
+        tags[tag] = value
+    if (tags.get(DT_PLTREL) != DT_RELA
+            or tags.get(DT_RELAENT) != 24
+            or tags.get(DT_SYMENT) != 24):
+        raise ValueError("unexpected relocation or symbol ABI")
+    size = tags[DT_PLTRELSZ]
+    if size % 24:
+        raise ValueError("JMPREL size is not a multiple of Elf64_Rela")
+    reloc_offset = file_offset(tags[DT_JMPREL], size)
+    string_offset = file_offset(tags[DT_STRTAB], tags[DT_STRSZ])
+    strings = image[string_offset:string_offset + tags[DT_STRSZ]]
+    slots = {}
+    for off in range(reloc_offset, reloc_offset + size, 24):
+        r_offset, r_info, _ = struct.unpack_from("<QQq", image, off)
+        if r_info & 0xffffffff != R_X86_64_JUMP_SLOT:
+            continue
+        symbol = r_info >> 32
+        symoff = file_offset(tags[DT_SYMTAB] + 24 * symbol, 24)
+        nameoff = struct.unpack_from("<I", image, symoff)[0]
+        if nameoff >= len(strings):
+            raise ValueError("symbol name outside DT_STRTAB")
+        name = strings[nameoff:].split(b"\0", 1)[0].decode("ascii")
+        for label, nid in IMPORTS.items():
+            if name.startswith(nid + "#"):
+                if label in slots:
+                    raise ValueError(f"duplicate {label} JMP_SLOT")
+                slots[label] = r_offset
+    missing = IMPORTS.keys() - slots.keys()
+    if missing:
+        raise ValueError(f"missing JMP_SLOT imports: {', '.join(sorted(missing))}")
+
+    stubs = {label: [] for label in IMPORTS}
+    slots_to_names = {value: name for name, value in slots.items()}
+    for kind, flags, offset, start, _, filesz, _, _ in segments:
+        if kind != PT_LOAD or not flags & 1:
+            continue
+        code = image[offset:offset + filesz]
+        cursor = 0
+        while (cursor := code.find(b"\xff\x25", cursor)) != -1:
+            if cursor + 6 > len(code):
+                break
+            displacement = struct.unpack_from("<i", code, cursor + 2)[0]
+            target = start + cursor + 6 + displacement
+            if target in slots_to_names:
+                stubs[slots_to_names[target]].append(start + cursor)
+            cursor += 2
+    for label, addresses in stubs.items():
+        if len(addresses) != 1:
+            raise ValueError(f"{label}: expected one PLT stub, got {addresses}")
+    plt = {name: addresses[0] for name, addresses in stubs.items()}
+    for label, got in slots.items():
+        initial = struct.unpack_from("<Q", image, file_offset(got, 8))[0]
+        if initial != plt[label] + 6:
+            raise ValueError(f"{label}: unexpected lazy GOT initializer {initial:#x}")
+    return plt, slots, hashlib.sha256(image).hexdigest()
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("images", type=Path, nargs="+")
+    args = parser.parse_args()
+    for path in args.images:
+        plt, slots, digest = derive(path)
+        print(f"{path.name} sha256={digest}")
+        for name, value in slots.items():
+            print(f"    {name}: GOT={value:#x} lazy_PLT={plt[name]:#x}")
+
+
+if __name__ == "__main__":
+    main()