From 6dd2d4de4d4e39b52d57454fb5df46b35b1a0276 Mon Sep 17 00:00:00 2001
From: Al Azif <33132478+Al-Azif@users.noreply.github.com>
Date: Fri, 22 Aug 2025 01:34:32 -0700
Subject: [PATCH 1/2] Added built-in work around for blackscreen for 8.00-9.60
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Still feels more like a work around vs a true fix
- 7.xx soon™
---
 src/kpatch/700.c | 12 ++++++++
 src/kpatch/750.c | 12 ++++++++
 src/kpatch/800.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++
 src/kpatch/850.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++
 src/kpatch/900.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++
 src/kpatch/903.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++
 src/kpatch/950.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++
 7 files changed, 404 insertions(+)

diff --git a/src/kpatch/700.c b/src/kpatch/700.c
index 60cfe14..53d214a 100644
--- a/src/kpatch/700.c
+++ b/src/kpatch/700.c
@@ -30,6 +30,7 @@ struct kexec_args {
 };
 
 static inline void restore(void *kbase, struct kexec_args *uap);
+static inline void patch_aio(void *kbase);
 static inline void do_patch(void *kbase);
 
 __attribute__((section (".text.start")))
@@ -38,6 +39,7 @@ int kpatch(void *td, struct kexec_args *uap) {
     void * const kbase = (void *)rdmsr(0xc0000082) - xfast_syscall_off;
 
     do_patch(kbase);
+    patch_aio(kbase);
     restore(kbase, uap);
 
     return 0;
@@ -61,6 +63,16 @@ static inline void restore(void *kbase, struct kexec_args *uap) {
     }
 }
 
+// TODO:
+__attribute__((always_inline))
+static inline void patch_aio(void *kbase) {
+    const u64 aio_off = 0x04a1bb1;
+
+    disable_cr0_wp();
+
+    enable_cr0_wp();
+}
+
 __attribute__((always_inline))
 static inline void do_patch(void *kbase) {
     disable_cr0_wp();
diff --git a/src/kpatch/750.c b/src/kpatch/750.c
index d09fa2f..02d2645 100644
--- a/src/kpatch/750.c
+++ b/src/kpatch/750.c
@@ -30,6 +30,7 @@ struct kexec_args {
 };
 
 static inline void restore(void *kbase, struct kexec_args *uap);
+static inline void patch_aio(void *kbase);
 static inline void do_patch(void *kbase);
 
 __attribute__((section (".text.start")))
@@ -38,6 +39,7 @@ int kpatch(void *td, struct kexec_args *uap) {
     void * const kbase = (void *)rdmsr(0xc0000082) - xfast_syscall_off;
 
     do_patch(kbase);
+    patch_aio(kbase);
     restore(kbase, uap);
 
     return 0;
@@ -61,6 +63,16 @@ static inline void restore(void *kbase, struct kexec_args *uap) {
     }
 }
 
+// TODO:
+__attribute__((always_inline))
+static inline void patch_aio(void *kbase) {
+    const u64 aio_off = 0xb20f5;
+
+    disable_cr0_wp();
+
+    enable_cr0_wp();
+}
+
 __attribute__((always_inline))
 static inline void do_patch(void *kbase) {
     disable_cr0_wp();
diff --git a/src/kpatch/800.c b/src/kpatch/800.c
index 248dfa0..961c031 100644
--- a/src/kpatch/800.c
+++ b/src/kpatch/800.c
@@ -30,6 +30,7 @@ struct kexec_args {
 };
 
 static inline void restore(void *kbase, struct kexec_args *uap);
+static inline void patch_aio(void *kbase);
 static inline void do_patch(void *kbase);
 
 __attribute__((section (".text.start")))
@@ -38,6 +39,7 @@ int kpatch(void *td, struct kexec_args *uap) {
     void * const kbase = (void *)rdmsr(0xc0000082) - xfast_syscall_off;
 
     do_patch(kbase);
+    patch_aio(kbase);
     restore(kbase, uap);
 
     return 0;
@@ -61,6 +63,80 @@ static inline void restore(void *kbase, struct kexec_args *uap) {
     }
 }
 
+__attribute__((always_inline))
+static inline void patch_aio(void *kbase) {
+    const u64 aio_off = 0x9f141;
+
+    disable_cr0_wp();
+
+    // offset = 0x00
+    // patch = {0xeb, 0x48}
+    write16(kbase, aio_off + 0x00, 0x48eb);
+
+    // offset = 0x42
+    // patch = {0xeb, 0x06}
+    write16(kbase, aio_off + 0x42, 0x06eb);
+
+    // offset = 0x4a
+    // patch = {0x41, 0x83, 0xbf, 0xa0, 0x04, 0x00, 0x00, 0x00}
+    write64(kbase, aio_off + 0x4a, 0x00000004a0bf8341);
+
+    // offset = 0x58
+    // patch = {0x49, 0x8b, 0x87, 0xd0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x58, 0xd0878b49);
+    write16(kbase, aio_off + 0x5c, 0x0004);
+    write8(kbase, aio_off + 0x5e, 0x00);
+
+    // offset = 0x65
+    // patch = {0x49, 0x8b, 0xb7, 0xb0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x65, 0xb0b78b49);
+    write16(kbase, aio_off + 0x69, 0x0004);
+    write8(kbase, aio_off + 0x6b, 0x00);
+
+    // offset = 0x7d
+    // patch = {0x49, 0x8b, 0x87, 0x40, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x7d, 0x40878b49);
+    write16(kbase, aio_off + 0x81, 0x0005);
+    write8(kbase, aio_off + 0x83, 0x00);
+
+    // offset = 0x8a
+    // patch = {0x49, 0x8b, 0xb7, 0x20, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x8a, 0x20b78b49);
+    write16(kbase, aio_off + 0x8e, 0x0005);
+    write8(kbase, aio_off + 0x90, 0x00);
+
+    // offset = 0xa2
+    // patch = {0x49, 0x8d, 0xbf, 0xc0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xa2, 0xc0bf8d49);
+    write16(kbase, aio_off + 0xa6, 0x0000);
+    write8(kbase, aio_off + 0xa8, 0x00);
+
+    // offset = 0xae
+    // patch = {0x49, 0x8d, 0xbf, 0xe0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xae, 0xe0bf8d49);
+    write16(kbase, aio_off + 0xb2, 0x0000);
+    write8(kbase, aio_off + 0xb4, 0x00);
+
+    // offset = 0xc1
+    // patch = {0x49, 0x8d, 0xbf, 0x00, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xc1, 0x00bf8d49);
+    write16(kbase, aio_off + 0xc5, 0x0001);
+    write8(kbase, aio_off + 0xc7, 0x00);
+
+    // offset = 0xcd
+    // patch = {0x49, 0x8d, 0xbf, 0x20, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xcd, 0x20bf8d49);
+    write16(kbase, aio_off + 0xd1, 0x0001);
+    write8(kbase, aio_off + 0xd3, 0x00);
+
+    // offset = 0xde
+    // patch = {0x49, 0x8b, 0xff}
+    write16(kbase, aio_off + 0xde, 0x8b49);
+    write8(kbase, aio_off + 0xe0, 0xff);
+
+    enable_cr0_wp();
+}
+
 __attribute__((always_inline))
 static inline void do_patch(void *kbase) {
     disable_cr0_wp();
diff --git a/src/kpatch/850.c b/src/kpatch/850.c
index 3183349..5c3f10e 100644
--- a/src/kpatch/850.c
+++ b/src/kpatch/850.c
@@ -30,6 +30,7 @@ struct kexec_args {
 };
 
 static inline void restore(void *kbase, struct kexec_args *uap);
+static inline void patch_aio(void *kbase);
 static inline void do_patch(void *kbase);
 
 __attribute__((section (".text.start")))
@@ -38,6 +39,7 @@ int kpatch(void *td, struct kexec_args *uap) {
     void * const kbase = (void *)rdmsr(0xc0000082) - xfast_syscall_off;
 
     do_patch(kbase);
+    patch_aio(kbase);
     restore(kbase, uap);
 
     return 0;
@@ -61,6 +63,80 @@ static inline void restore(void *kbase, struct kexec_args *uap) {
     }
 }
 
+__attribute__((always_inline))
+static inline void patch_aio(void *kbase) {
+    const u64 aio_off = 0x30221;
+
+    disable_cr0_wp();
+
+    // offset = 0x00
+    // patch = {0xeb, 0x48}
+    write16(kbase, aio_off + 0x00, 0x48eb);
+
+    // offset = 0x42
+    // patch = {0xeb, 0x06}
+    write16(kbase, aio_off + 0x42, 0x06eb);
+
+    // offset = 0x4a
+    // patch = {0x41, 0x83, 0xbf, 0xa0, 0x04, 0x00, 0x00, 0x00}
+    write64(kbase, aio_off + 0x4a, 0x00000004a0bf8341);
+
+    // offset = 0x58
+    // patch = {0x49, 0x8b, 0x87, 0xd0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x58, 0xd0878b49);
+    write16(kbase, aio_off + 0x5c, 0x0004);
+    write8(kbase, aio_off + 0x5e, 0x00);
+
+    // offset = 0x65
+    // patch = {0x49, 0x8b, 0xb7, 0xb0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x65, 0xb0b78b49);
+    write16(kbase, aio_off + 0x69, 0x0004);
+    write8(kbase, aio_off + 0x6b, 0x00);
+
+    // offset = 0x7d
+    // patch = {0x49, 0x8b, 0x87, 0x40, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x7d, 0x40878b49);
+    write16(kbase, aio_off + 0x81, 0x0005);
+    write8(kbase, aio_off + 0x83, 0x00);
+
+    // offset = 0x8a
+    // patch = {0x49, 0x8b, 0xb7, 0x20, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x8a, 0x20b78b49);
+    write16(kbase, aio_off + 0x8e, 0x0005);
+    write8(kbase, aio_off + 0x90, 0x00);
+
+    // offset = 0xa2
+    // patch = {0x49, 0x8d, 0xbf, 0xc0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xa2, 0xc0bf8d49);
+    write16(kbase, aio_off + 0xa6, 0x0000);
+    write8(kbase, aio_off + 0xa8, 0x00);
+
+    // offset = 0xae
+    // patch = {0x49, 0x8d, 0xbf, 0xe0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xae, 0xe0bf8d49);
+    write16(kbase, aio_off + 0xb2, 0x0000);
+    write8(kbase, aio_off + 0xb4, 0x00);
+
+    // offset = 0xc1
+    // patch = {0x49, 0x8d, 0xbf, 0x00, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xc1, 0x00bf8d49);
+    write16(kbase, aio_off + 0xc5, 0x0001);
+    write8(kbase, aio_off + 0xc7, 0x00);
+
+    // offset = 0xcd
+    // patch = {0x49, 0x8d, 0xbf, 0x20, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xcd, 0x20bf8d49);
+    write16(kbase, aio_off + 0xd1, 0x0001);
+    write8(kbase, aio_off + 0xd3, 0x00);
+
+    // offset = 0xde
+    // patch = {0x49, 0x8b, 0xff}
+    write16(kbase, aio_off + 0xde, 0x8b49);
+    write8(kbase, aio_off + 0xe0, 0xff);
+
+    enable_cr0_wp();
+}
+
 __attribute__((always_inline))
 static inline void do_patch(void *kbase) {
     disable_cr0_wp();
diff --git a/src/kpatch/900.c b/src/kpatch/900.c
index 1d5600a..c8b86b8 100644
--- a/src/kpatch/900.c
+++ b/src/kpatch/900.c
@@ -30,6 +30,7 @@ struct kexec_args {
 };
 
 static inline void restore(void *kbase, struct kexec_args *uap);
+static inline void patch_aio(void *kbase);
 static inline void do_patch(void *kbase);
 
 __attribute__((section (".text.start")))
@@ -38,6 +39,7 @@ int kpatch(void *td, struct kexec_args *uap) {
     void * const kbase = (void *)rdmsr(0xc0000082) - xfast_syscall_off;
 
     do_patch(kbase);
+    patch_aio(kbase);
     restore(kbase, uap);
 
     return 0;
@@ -61,6 +63,80 @@ static inline void restore(void *kbase, struct kexec_args *uap) {
     }
 }
 
+__attribute__((always_inline))
+static inline void patch_aio(void *kbase) {
+    const u64 aio_off = 0x415a01;
+
+    disable_cr0_wp();
+
+    // offset = 0x00
+    // patch = {0xeb, 0x48}
+    write16(kbase, aio_off + 0x00, 0x48eb);
+
+    // offset = 0x42
+    // patch = {0xeb, 0x06}
+    write16(kbase, aio_off + 0x42, 0x06eb);
+
+    // offset = 0x4a
+    // patch = {0x41, 0x83, 0xbf, 0xa0, 0x04, 0x00, 0x00, 0x00}
+    write64(kbase, aio_off + 0x4a, 0x00000004a0bf8341);
+
+    // offset = 0x58
+    // patch = {0x49, 0x8b, 0x87, 0xd0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x58, 0xd0878b49);
+    write16(kbase, aio_off + 0x5c, 0x0004);
+    write8(kbase, aio_off + 0x5e, 0x00);
+
+    // offset = 0x65
+    // patch = {0x49, 0x8b, 0xb7, 0xb0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x65, 0xb0b78b49);
+    write16(kbase, aio_off + 0x69, 0x0004);
+    write8(kbase, aio_off + 0x6b, 0x00);
+
+    // offset = 0x7d
+    // patch = {0x49, 0x8b, 0x87, 0x40, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x7d, 0x40878b49);
+    write16(kbase, aio_off + 0x81, 0x0005);
+    write8(kbase, aio_off + 0x83, 0x00);
+
+    // offset = 0x8a
+    // patch = {0x49, 0x8b, 0xb7, 0x20, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x8a, 0x20b78b49);
+    write16(kbase, aio_off + 0x8e, 0x0005);
+    write8(kbase, aio_off + 0x90, 0x00);
+
+    // offset = 0xa2
+    // patch = {0x49, 0x8d, 0xbf, 0xc0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xa2, 0xc0bf8d49);
+    write16(kbase, aio_off + 0xa6, 0x0000);
+    write8(kbase, aio_off + 0xa8, 0x00);
+
+    // offset = 0xae
+    // patch = {0x49, 0x8d, 0xbf, 0xe0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xae, 0xe0bf8d49);
+    write16(kbase, aio_off + 0xb2, 0x0000);
+    write8(kbase, aio_off + 0xb4, 0x00);
+
+    // offset = 0xc1
+    // patch = {0x49, 0x8d, 0xbf, 0x00, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xc1, 0x00bf8d49);
+    write16(kbase, aio_off + 0xc5, 0x0001);
+    write8(kbase, aio_off + 0xc7, 0x00);
+
+    // offset = 0xcd
+    // patch = {0x49, 0x8d, 0xbf, 0x20, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xcd, 0x20bf8d49);
+    write16(kbase, aio_off + 0xd1, 0x0001);
+    write8(kbase, aio_off + 0xd3, 0x00);
+
+    // offset = 0xde
+    // patch = {0x49, 0x8b, 0xff}
+    write16(kbase, aio_off + 0xde, 0x8b49);
+    write8(kbase, aio_off + 0xe0, 0xff);
+
+    enable_cr0_wp();
+}
+
 __attribute__((always_inline))
 static inline void do_patch(void *kbase) {
     disable_cr0_wp();
diff --git a/src/kpatch/903.c b/src/kpatch/903.c
index accb9cc..e5ed9a3 100644
--- a/src/kpatch/903.c
+++ b/src/kpatch/903.c
@@ -30,6 +30,7 @@ struct kexec_args {
 };
 
 static inline void restore(void *kbase, struct kexec_args *uap);
+static inline void patch_aio(void *kbase);
 static inline void do_patch(void *kbase);
 
 __attribute__((section (".text.start")))
@@ -38,6 +39,7 @@ int kpatch(void *td, struct kexec_args *uap) {
     void * const kbase = (void *)rdmsr(0xc0000082) - xfast_syscall_off;
 
     do_patch(kbase);
+    patch_aio(kbase);
     restore(kbase, uap);
 
     return 0;
@@ -61,6 +63,80 @@ static inline void restore(void *kbase, struct kexec_args *uap) {
     }
 }
 
+__attribute__((always_inline))
+static inline void patch_aio(void *kbase) {
+    const u64 aio_off = 0x413971;
+
+    disable_cr0_wp();
+
+    // offset = 0x00
+    // patch = {0xeb, 0x48}
+    write16(kbase, aio_off + 0x00, 0x48eb);
+
+    // offset = 0x42
+    // patch = {0xeb, 0x06}
+    write16(kbase, aio_off + 0x42, 0x06eb);
+
+    // offset = 0x4a
+    // patch = {0x41, 0x83, 0xbf, 0xa0, 0x04, 0x00, 0x00, 0x00}
+    write64(kbase, aio_off + 0x4a, 0x00000004a0bf8341);
+
+    // offset = 0x58
+    // patch = {0x49, 0x8b, 0x87, 0xd0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x58, 0xd0878b49);
+    write16(kbase, aio_off + 0x5c, 0x0004);
+    write8(kbase, aio_off + 0x5e, 0x00);
+
+    // offset = 0x65
+    // patch = {0x49, 0x8b, 0xb7, 0xb0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x65, 0xb0b78b49);
+    write16(kbase, aio_off + 0x69, 0x0004);
+    write8(kbase, aio_off + 0x6b, 0x00);
+
+    // offset = 0x7d
+    // patch = {0x49, 0x8b, 0x87, 0x40, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x7d, 0x40878b49);
+    write16(kbase, aio_off + 0x81, 0x0005);
+    write8(kbase, aio_off + 0x83, 0x00);
+
+    // offset = 0x8a
+    // patch = {0x49, 0x8b, 0xb7, 0x20, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x8a, 0x20b78b49);
+    write16(kbase, aio_off + 0x8e, 0x0005);
+    write8(kbase, aio_off + 0x90, 0x00);
+
+    // offset = 0xa2
+    // patch = {0x49, 0x8d, 0xbf, 0xc0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xa2, 0xc0bf8d49);
+    write16(kbase, aio_off + 0xa6, 0x0000);
+    write8(kbase, aio_off + 0xa8, 0x00);
+
+    // offset = 0xae
+    // patch = {0x49, 0x8d, 0xbf, 0xe0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xae, 0xe0bf8d49);
+    write16(kbase, aio_off + 0xb2, 0x0000);
+    write8(kbase, aio_off + 0xb4, 0x00);
+
+    // offset = 0xc1
+    // patch = {0x49, 0x8d, 0xbf, 0x00, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xc1, 0x00bf8d49);
+    write16(kbase, aio_off + 0xc5, 0x0001);
+    write8(kbase, aio_off + 0xc7, 0x00);
+
+    // offset = 0xcd
+    // patch = {0x49, 0x8d, 0xbf, 0x20, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xcd, 0x20bf8d49);
+    write16(kbase, aio_off + 0xd1, 0x0001);
+    write8(kbase, aio_off + 0xd3, 0x00);
+
+    // offset = 0xde
+    // patch = {0x49, 0x8b, 0xff}
+    write16(kbase, aio_off + 0xde, 0x8b49);
+    write8(kbase, aio_off + 0xe0, 0xff);
+
+    enable_cr0_wp();
+}
+
 __attribute__((always_inline))
 static inline void do_patch(void *kbase) {
     disable_cr0_wp();
diff --git a/src/kpatch/950.c b/src/kpatch/950.c
index ff81420..8f60add 100644
--- a/src/kpatch/950.c
+++ b/src/kpatch/950.c
@@ -30,6 +30,7 @@ struct kexec_args {
 };
 
 static inline void restore(void *kbase, struct kexec_args *uap);
+static inline void patch_aio(void *kbase);
 static inline void do_patch(void *kbase);
 
 __attribute__((section (".text.start")))
@@ -38,6 +39,7 @@ int kpatch(void *td, struct kexec_args *uap) {
     void * const kbase = (void *)rdmsr(0xc0000082) - xfast_syscall_off;
 
     do_patch(kbase);
+    patch_aio(kbase);
     restore(kbase, uap);
 
     return 0;
@@ -61,6 +63,80 @@ static inline void restore(void *kbase, struct kexec_args *uap) {
     }
 }
 
+__attribute__((always_inline))
+static inline void patch_aio(void *kbase) {
+    const u64 aio_off = 0xd7771;
+
+    disable_cr0_wp();
+
+    // offset = 0x00
+    // patch = {0xeb, 0x48}
+    write16(kbase, aio_off + 0x00, 0x48eb);
+
+    // offset = 0x42
+    // patch = {0xeb, 0x06}
+    write16(kbase, aio_off + 0x42, 0x06eb);
+
+    // offset = 0x4a
+    // patch = {0x41, 0x83, 0xbf, 0xa0, 0x04, 0x00, 0x00, 0x00}
+    write64(kbase, aio_off + 0x4a, 0x00000004a0bf8341);
+
+    // offset = 0x58
+    // patch = {0x49, 0x8b, 0x87, 0xd0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x58, 0xd0878b49);
+    write16(kbase, aio_off + 0x5c, 0x0004);
+    write8(kbase, aio_off + 0x5e, 0x00);
+
+    // offset = 0x65
+    // patch = {0x49, 0x8b, 0xb7, 0xb0, 0x04, 0x00, 0x00}
+    write32(kbase, aio_off + 0x65, 0xb0b78b49);
+    write16(kbase, aio_off + 0x69, 0x0004);
+    write8(kbase, aio_off + 0x6b, 0x00);
+
+    // offset = 0x7d
+    // patch = {0x49, 0x8b, 0x87, 0x40, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x7d, 0x40878b49);
+    write16(kbase, aio_off + 0x81, 0x0005);
+    write8(kbase, aio_off + 0x83, 0x00);
+
+    // offset = 0x8a
+    // patch = {0x49, 0x8b, 0xb7, 0x20, 0x05, 0x00, 0x00}
+    write32(kbase, aio_off + 0x8a, 0x20b78b49);
+    write16(kbase, aio_off + 0x8e, 0x0005);
+    write8(kbase, aio_off + 0x90, 0x00);
+
+    // offset = 0xa2
+    // patch = {0x49, 0x8d, 0xbf, 0xc0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xa2, 0xc0bf8d49);
+    write16(kbase, aio_off + 0xa6, 0x0000);
+    write8(kbase, aio_off + 0xa8, 0x00);
+
+    // offset = 0xae
+    // patch = {0x49, 0x8d, 0xbf, 0xe0, 0x00, 0x00, 0x00}
+    write32(kbase, aio_off + 0xae, 0xe0bf8d49);
+    write16(kbase, aio_off + 0xb2, 0x0000);
+    write8(kbase, aio_off + 0xb4, 0x00);
+
+    // offset = 0xc1
+    // patch = {0x49, 0x8d, 0xbf, 0x00, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xc1, 0x00bf8d49);
+    write16(kbase, aio_off + 0xc5, 0x0001);
+    write8(kbase, aio_off + 0xc7, 0x00);
+
+    // offset = 0xcd
+    // patch = {0x49, 0x8d, 0xbf, 0x20, 0x01, 0x00, 0x00}
+    write32(kbase, aio_off + 0xcd, 0x20bf8d49);
+    write16(kbase, aio_off + 0xd1, 0x0001);
+    write8(kbase, aio_off + 0xd3, 0x00);
+
+    // offset = 0xde
+    // patch = {0x49, 0x8b, 0xff}
+    write16(kbase, aio_off + 0xde, 0x8b49);
+    write8(kbase, aio_off + 0xe0, 0xff);
+
+    enable_cr0_wp();
+}
+
 __attribute__((always_inline))
 static inline void do_patch(void *kbase) {
     disable_cr0_wp();

From b96c9d9930900e56057b76216aa639972a591193 Mon Sep 17 00:00:00 2001
From: ArabPixel <yamanosman1st@gmail.com>
Date: Fri, 22 Aug 2025 15:30:35 +0200
Subject: [PATCH 2/2] update bins

---
 src/kpatch/700.bin | Bin 450 -> 474 bytes
 src/kpatch/750.bin | Bin 450 -> 474 bytes
 src/kpatch/800.bin | Bin 434 -> 754 bytes
 src/kpatch/850.bin | Bin 434 -> 754 bytes
 src/kpatch/900.bin | Bin 434 -> 754 bytes
 src/kpatch/903.bin | Bin 434 -> 754 bytes
 src/kpatch/950.bin | Bin 434 -> 754 bytes
 7 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/src/kpatch/700.bin b/src/kpatch/700.bin
index f566930527974469073f2fbec253176e58fbd1b2..0fa47ba757d2a6b56c399114793bda318130e68e 100644
GIT binary patch
delta 24
gcmX@ae2aO5EF%xU!T}G}|NsB}=T|x~S&(rf0CxEb8vp<R

delta 11
Scmcb`e2962EaPNT#-#umh6CRK

diff --git a/src/kpatch/750.bin b/src/kpatch/750.bin
index 04096233f1209be669a49e1591eef14b72bd1b39..04927ccbbe61d67d2c1c87c7d12f7e0a9fd34930 100644
GIT binary patch
delta 24
gcmX@ae2aO5EF%xU!T}G}|NsB}=T|x~S&(rf0CxEb8vp<R

delta 11
Scmcb`e2962EaPNT#-#umh6CRK

diff --git a/src/kpatch/800.bin b/src/kpatch/800.bin
index b36c143fb96ebafa2433c6774c3f3581970f6f5a..bf57db181333733ff8cc8e1111e1f09788eee7a4 100644
GIT binary patch
delta 342
zcmdnQ{E2mgFk?Nx!T}G}|NsB}=T|zg<Fy9^!!A|^1_r}#u7(HFIvX87ax(0A&Bnms
zxRVhm?6?a=0>ztw;*PsLyZ`_9*x}f`e*p_n*rT(t8>Ae>1}d40#9jqrgUmhNI1|Y9
z>~6nstZ_b&#ZZ5|aT!=-`-WqUYd|8$8}~t!H~<Yf1Y{m-JOU9v4Hn<7kk&czJXri9
zMEo&Gym$YBw9bvs!Qw9=;_o5i57JyZ8$W|3zCt9JK7lnb03}R1*?^p5jT}G{Xf+>1
zMgb@@Q3xy{0+Il7XUc=Qia_%JWOl|GqWtm<{M!s1I!u^6nh!8~S{^9<@VX5EvFeH-

delta 31
ncmeywx`}y%FyrJvrXJx5{M!s1I!u^6nh!8~S{^9<@VWy4uOJK`

diff --git a/src/kpatch/850.bin b/src/kpatch/850.bin
index e129c5561e3f28950266f641f5be62da17119f91..11f2e1003d464ae5b32b50a17fe41288140d06a7 100644
GIT binary patch
delta 342
zcmdnQ{E2mgFk?Nx!T}G}|NsB}=T|zg<Fy9^!!A|^1_r}#u7(HFIvW+4m>G7wW@BJ*
z+{p+OcH9Lbf#S(PamU@B-T(i4>~L(}zkmfO?9thn4N?wb1C`VwvAaNQkh#YjD}hYU
z?)D4E8tZ{9hWg`;ZD5h@8;&*hfJBZr&Vwj%02;Cg$UN4#1R}l~EWTYKt#jgfu=qxZ
z_+gNE@BRa6og0sX#ZN-S&qKr?q`7o9UIt5Cg-AStNH72;Ogf)|WnMsJ-a%v(fHD(5
vfhE3xB!JwR|G`{FW@d)}li3+(i1N!b@NYA4=rCdOXg<K`X?dXZ!|OHxL7H*6

delta 31
ncmeywx`}y%FyrJvrXJx5{M!s1I!u^6nh!8~S{^9<@VWy4uOJK`

diff --git a/src/kpatch/900.bin b/src/kpatch/900.bin
index f705aa71398bc6ad279399494cdbbc924d00fbf9..9fa8389f776a4a6efdc2ba5dcc54ab939588bb36 100644
GIT binary patch
delta 342
zcmdnQ{E2mgFk?Nx!T}G}|NsB}=T|zg<Fy9^!!A|^1_r}#u7(HFIvW|I92s`JW@BJ*
z+{p+OcH9Lbf#S|UamU@B-T(i4>~L(}zkmfO?9tii4N?wb1C_)gv9myIkh#YjBY{lM
z?)D4E8smX1hWg`;X<(7<8;&*RfJBZr)<Kjw01asZGLJR3K*YPj;@cI{Iw$sn#V10<
z7lXum_a8{>+_)Spz7it79wPoA&84$(Ggx9PMB)%cf&nOD(s>Lla{?lB4kDufl$m%5
tEO7-S0p!lS59U4ulK&^OGtLm@muKMLX5i3a!sO9>fYH<PK<S6qZ2%6=fE54$

delta 31
ncmeywx`}y%FyrJvrXJx5{M!s1I!u^6nh!8~S{^9<@VWy4uOJK`

diff --git a/src/kpatch/903.bin b/src/kpatch/903.bin
index 2e75b692358fe081459e701b8820966858d41855..f0f7dfc8954d460c12de20d316abf6d1e3a3b321 100644
GIT binary patch
delta 342
zcmdnQ{E2mgFk?Nx!T}G}|NsB}=T|zg<Fy9^!!A|^1_r}#u7(HFIvWcu9T|4KW@BJ*
z+{p+OcH9Lbf#REi;*PsLyZ`_9*x}f`e*p_n*rT&?H%K{%4ODU#iG2&i2AO-j@g$Jx
z+1-BOSmSvhi=qB_<2A6z_6^4x?|?*(H@<@?aR3_f3CKLw_yr>V8!WzEA+2-bf3P^C
z6<ED6kn-%^e;}=Mqd1UxtWgpoE)NlZkml0as0@}+g-94dBp84aCY@$r84HMv9YjU}
xC^OLsEa3u@0CH#ggSmk~^8aLZ#u=jg@(ldj3>-R4m^_*fFnU@ZDE;ud4FDz8dKUly

delta 31
ncmeywx`}y%FyrJvrXJx5{M!s1I!u^6nh!8~S{^9<@VWy4uOJK`

diff --git a/src/kpatch/950.bin b/src/kpatch/950.bin
index 757929a90e5ffdeff12a4bb9fbbda744e1b8983f..be8e0514fa23ab93dc13d4186e1e3528bc147db8 100644
GIT binary patch
delta 342
zcmdnQ{E2mgFk?Nx!T}G}|NsB}=T|zg<Fy9^!!A|^1_r}#u7(HFIvWeic^P)RW@BJ*
z+{p+OcH9Lbf#REi;*PsLyZ`_9*x}f`e*p_n*rT&?H%K{%4ODU#iG2&i2AO-j@g$Jx
z+1-BOSmSvhi=qB_<2A6z_6^4x?|?*(H@<@?aR3_f3CKLw_yr>V8!WzEA+2-bf3P@X
z1z5c>kn-%^e;}=Mqd1UxtWgpoE)NlZkml0as0@}+g-94dBp84aCY@$r84HMv9YjU}
xC^OLsEa3u@0CH#ggSmk~^8aLZ#u=jg@(ldj3>-R4m^_*fFnU@ZDE;ud4FJ<QdpQ6A

delta 31
ncmeywx`}y%FyrJvrXJx5{M!s1I!u^6nh!8~S{^9<@VWy4uOJK`