diff --git a/build/buildtools/commondefs.firm b/build/buildtools/commondefs.firm
index 1550717b..2acb2a31 100644
--- a/build/buildtools/commondefs.firm
+++ b/build/buildtools/commondefs.firm
@@ -82,23 +82,19 @@ ifeq	($(CODEGEN_PROC),ARM9)
 
 FIRM_LIBS_BASE	?= \
 			   libos \
-			   libmi \
 			   libpxi \
-#			   libgcd \
-#			   libacsign \
+			   libfs \
+			   libmi \
 
 else #	($(CODEGEN_PROC),ARM7)
 
 FIRM_LIBS_BASE	?= \
 			   libos_sp \
-			   libfatfs_sp \
 			   libpxi_sp \
+			   libfs_sp \
 			   libaes_sp \
 			   libpm_sp \
-#			   libnvram_sp \
-#			   libgcd_sp \
-#			   libacsign_sp \
-#			   libfirmsd_sp \
+			   libfatfs_sp \
 
 endif
 
@@ -127,7 +123,6 @@ GINCLUDES		:= $(FIRM_INCDIR) $(GINCLUDES)
 GLIBRARY_DIRS		:= $(FIRM_LIBDIR) $(GLIBRARY_DIRS)
 GLIBRARIES		:= $(FIRM_LIBS)   $(GLIBRARIES)
 
-
 #----------------------------------------------------------------------------
 #  TWLFIRM_INSTALL_ROOT
 #
diff --git a/build/libraries/Makefile b/build/libraries/Makefile
index ce3488fd..1c268a4e 100644
--- a/build/libraries/Makefile
+++ b/build/libraries/Makefile
@@ -25,18 +25,13 @@ SUBDIRS		= \
 			init \
 			os \
 			pxi \
+			fs \
 			mi \
 			fatfs \
 			aes \
 			pm \
 			gcd \
 
-#			syscall \
-#			nvram \
-#			acsign \
-#			acsign_ecc \
-#			devices \
-
 #----------------------------------------------------------------------------
 
 include	$(TWLIPL_ROOT)/build/buildtools/modulerules
diff --git a/build/libraries/aes/ARM7/aes_init.c b/build/libraries/aes/ARM7/aes_init.c
index 9f37d4c4..8d5c996a 100644
--- a/build/libraries/aes/ARM7/aes_init.c
+++ b/build/libraries/aes/ARM7/aes_init.c
@@ -16,22 +16,23 @@
  *---------------------------------------------------------------------------*/
 
 #include <firm/aes.h>
+#include <firm/pxi.h>
+
+#include <twl/aes/ARM7/lo.h>
 
 /*---------------------------------------------------------------------------*
-  Name:         AESi_InitGameKeys
+  Name:         AESi_InitKeysForApp
 
   Description:  set IDs depending on the application.
                 you SHOULD NOT touch any ID registers after this call.
 
-  Arguments:    u8[4]   game code
+  Arguments:    game_code   game code
 
   Returns:      None
  *---------------------------------------------------------------------------*/
-void AESi_InitGameKeys( u8 game_code[4] )
+void AESi_InitKeysForApp( u8 game_code[4] )
 {
-    while (reg_AES_AES_CNT & REG_AES_AES_CNT_E_MASK)
-    {
-    }
+    AESi_WaitKey();
 
     reg_AES_AES_ID_B2 = AES_IDS_ID0_C(game_code);
     reg_AES_AES_ID_B3 = AES_IDS_ID0_D(game_code);
@@ -70,3 +71,28 @@ void AESi_InitGameKeys( u8 game_code[4] )
     reg_AES_AES_KEY_D2 = 12;
     reg_AES_AES_KEY_D3 = 12;
 }
+
+/*---------------------------------------------------------------------------*
+  Name:         AESi_RecvSeed
+
+  Description:  set SEED/KEY from ARM9 via PXI.
+
+  Arguments:    None
+
+  Returns:      None
+ *---------------------------------------------------------------------------*/
+void AESi_RecvSeed( void )
+{
+    AESKey seed;
+    PXI_RecvDataByFifo( PXI_FIFO_TAG_DATA, &seed, AES_BLOCK_SIZE );
+    AESi_WaitKey();
+    AESi_SetKeySeedA((AESKeySeed*)&seed);    // APP
+    //AESi_WaitKey();
+    //AESi_SetKeySeedB((AESKeySeed*)&seed);    // APP & HARD
+    //AESi_WaitKey();
+    //AESi_SetKeySeedC((AESKeySeed*)&seed);    //
+    //AESi_WaitKey();
+    //AESi_SetKeySeedD((AESKeySeed*)&seed);    // HARD
+    AESi_WaitKey();
+    AESi_SetKeyC(&seed);        // Direct
+}
diff --git a/build/libraries/fatfs/ARM7/src/fatfs_loader.c b/build/libraries/fatfs/ARM7/src/fatfs_loader.c
index dcf917cd..a0e7f5fe 100644
--- a/build/libraries/fatfs/ARM7/src/fatfs_loader.c
+++ b/build/libraries/fatfs/ARM7/src/fatfs_loader.c
@@ -19,6 +19,7 @@
 
 #include <firm.h>
 #include <twl/os/common/format_rom.h>
+#include <twl/aes/ARM7/lo.h>
 #include <rtfs.h>
 #include <devices/sdif_reg.h>
 
@@ -101,6 +102,22 @@ BOOL FATFS_OpenSpecifiedSrl( const char* menufile )
     return TRUE;
 }
 
+static void OverrideDefaultMountInfo( void )
+{
+    static const OSMountInfo    DefaultSettings[] =
+    {
+        { 'A', OS_MOUNT_DEVICE_SD,   OS_MOUNT_TGT_ROOT, 0, OS_MOUNT_RSC_MMEM, (OS_MOUNT_USR_R|OS_MOUNT_USR_W), 0, 0, "sdmc",    "/" },
+        { 'B', OS_MOUNT_DEVICE_NAND, OS_MOUNT_TGT_ROOT, 0, OS_MOUNT_RSC_WRAM, 0,                               0, 0, "nand",    "/" },   // ユーザーはこのアーカイブを使えない(RW不可)
+        { 'C', OS_MOUNT_DEVICE_NAND, OS_MOUNT_TGT_ROOT, 1, OS_MOUNT_RSC_WRAM, 0,                               0, 0, "nand2",   "/" },   // ユーザーはこのアーカイブを使えない(RW不可)
+        { 'D', OS_MOUNT_DEVICE_NAND, OS_MOUNT_TGT_DIR,  0, OS_MOUNT_RSC_MMEM, (OS_MOUNT_USR_R|OS_MOUNT_USR_W), 0, 0, "shared2", "nand2:/shared2" },
+        { 'E', OS_MOUNT_DEVICE_NAND, OS_MOUNT_TGT_DIR,  0, OS_MOUNT_RSC_MMEM, (OS_MOUNT_USR_R|OS_MOUNT_USR_W), 0, 0, "photo",   "nand2:/photo" },
+        { 'F', OS_MOUNT_DEVICE_NAND, OS_MOUNT_TGT_FILE, 0, OS_MOUNT_RSC_MMEM, (OS_MOUNT_USR_R|OS_MOUNT_USR_W), 0, 0, "dataPrv", NULL },
+        { 'G', OS_MOUNT_DEVICE_NAND, OS_MOUNT_TGT_FILE, 0, OS_MOUNT_RSC_MMEM, (OS_MOUNT_USR_R|OS_MOUNT_USR_W), 0, 0, "dataPub", NULL },
+        { 0, },
+    };
+    MI_CpuCopy8(DefaultSettings, (char*)HW_TWL_FS_MOUNT_INFO_BUF, sizeof(DefaultSettings));
+}
+
 /*---------------------------------------------------------------------------*
   Name:         FATFS_SaveSrlFilename
 
@@ -159,6 +176,7 @@ BOOL FATFS_SaveSrlFilename( FATFSMediaType media, const char* filename )
         else    // \0が連続しているなら終端
         {
             MI_CpuClear8( dest, HW_TWL_ROM_HEADER_BUF - (u32)dest );    // 残りバッファのクリア
+            OverrideDefaultMountInfo(); // デフォルトマウント情報を書いておく
             break;
         }
     }
@@ -169,9 +187,9 @@ BOOL FATFS_SaveSrlFilename( FATFSMediaType media, const char* filename )
 /*---------------------------------------------------------------------------*
   Name:         FATFS_GetSrlDescriptor
 
-  Description:  open specified menu file
+  Description:  retrieve current file descriptor
 
-                任意のファイルをオープンし、ファイルIDをmenu_fdにセットします。
+                menu_fdを返します。
 
   Arguments:    None
 
@@ -182,6 +200,22 @@ int FATFS_GetSrlDescriptor( void )
     return menu_fd;
 }
 
+/*---------------------------------------------------------------------------*
+  Name:         FATFS_SetSrlDescriptor
+
+  Description:  set current file descriptor that was opened outside
+
+                オープン済みのファイルIDをmenu_fdにセットします。
+
+  Arguments:    None
+
+  Returns:      int
+ *---------------------------------------------------------------------------*/
+void FATFS_SetSrlDescriptor( int fd )
+{
+    menu_fd = fd;
+}
+
 #define HEADER_SIZE 0x1000
 #define AUTH_SIZE   ROM_HEADER_SIGN_TARGET_SIZE
 
@@ -346,21 +380,8 @@ BOOL FATFS_LoadHeader( void )
 #endif
 
     // set id depends on game_code and seed to use (or all?)
-    {
-        AESKeySeed seed;
-        AESi_InitGameKeys((u8*)rh->s.game_code);
-        PXI_RecvDataByFifo( PXI_FIFO_TAG_DATA, &seed, AES_BLOCK_SIZE );
-        AESi_WaitKey();
-        AESi_SetKeySeedA(&seed);    // APP
-        //AESi_WaitKey();
-        //AESi_SetKeySeedB(&seed);    // APP & HARD
-        //AESi_WaitKey();
-        //AESi_SetKeySeedC(&seed);    //
-        //AESi_WaitKey();
-        //AESi_SetKeySeedD(&seed);    // HARD
-        AESi_WaitKey();
-        AESi_SetKeyC(&seed);        // Direct
-    }
+    AESi_InitKeysForApp((u8*)rh->s.game_code);
+    AESi_RecvSeed();
 
     return TRUE;
 }
diff --git a/build/libraries/mi/ARM9/mi_loader.c b/build/libraries/mi/ARM9/mi_loader.c
index 6160f075..e0356ad3 100644
--- a/build/libraries/mi/ARM9/mi_loader.c
+++ b/build/libraries/mi/ARM9/mi_loader.c
@@ -292,7 +292,7 @@ BOOL MI_LoadHeader( SVCSignHeapContext* pool, const void* rsa_key )
     {
         DC_StoreRange( rh, HW_TWL_ROM_HEADER_BUF_SIZE );
         PXI_NotifyID( FIRM_PXI_ID_AUTH_HEADER );
-        PXI_SendDataByFifo( PXI_FIFO_TAG_DATA, sd.aes_key_seed, AES_BLOCK_SIZE );
+        AESi_SendSeed( (AESKey*)sd.aes_key_seed );
         // DS互換ヘッダコピー
         MI_CpuCopyFast( rh, (void*)HW_ROM_HEADER_BUF, HW_ROM_HEADER_BUF_END-HW_ROM_HEADER_BUF );
     }
diff --git a/build/libraries/os/common/os_boot.c b/build/libraries/os/common/os_boot.c
index 8bfc6b85..a5fe0e43 100644
--- a/build/libraries/os/common/os_boot.c
+++ b/build/libraries/os/common/os_boot.c
@@ -44,6 +44,7 @@ void OS_BootWithRomHeaderFromFIRM( ROM_Header* rom_header )
     void *wram_reg = rom_header->s.main_wram_config_data;
     BOOL scfg = TRUE;   // no touch
     BOOL jtag = FALSE;  // no touch
+    BOOL ds = FALSE;    // TWL mode
     static u32  clr_list[32];
     int i = 0;
 
@@ -54,12 +55,11 @@ void OS_BootWithRomHeaderFromFIRM( ROM_Header* rom_header )
     /* ITCM全クリア */
     clr_list[i++] = (u32)HW_ITCM;
     clr_list[i++] = (u32)HW_ITCM_SIZE;
-    /* FS Parameters領域のクリア (暫定) */
-//    clr_list[i++] = (u32)HW_TWL_FS_MOUNT_INFO_BUF;  // 0x02ffdc00 - 0x02ffddff
-//    clr_list[i++] = (u32)HW_TWL_ROM_HEADER_BUF - (u32)HW_TWL_FS_MOUNT_INFO_BUF;
-    /* PSEG1/RED Reserved領域のクリア (暫定) */
-    clr_list[i++] = (u32)HW_MAIN_MEM_SHARED;        // 0x02fff000 - 0x02fffa7f
-    clr_list[i++] = (u32)HW_PSEG1_RESERVED_1_END - (u32)HW_MAIN_MEM_SHARED;
+    /* PSEG1 Reserved領域のクリア (暫定) */
+    clr_list[i++] = (u32)HW_MAIN_MEM_SHARED;        // 0x02fff000 - 0x02fff7ff
+    clr_list[i++] = (u32)HW_PSEG1_RESERVED_0_END - (u32)HW_MAIN_MEM_SHARED;
+    clr_list[i++] = (u32)HW_PSEG1_RESERVED_1;        // 0x02fffa00 - 0x02fffa7f
+    clr_list[i++] = (u32)HW_PSEG1_RESERVED_1_END - (u32)HW_PSEG1_RESERVED_1;
     /* System Shared領域のクリア (暫定) */
     clr_list[i++] = (u32)HW_BOOT_CHECK_INFO_BUF;    // 0x02fffc00 - 0x02fffc1f
     clr_list[i++] = (u32)HW_BOOT_CHECK_INFO_BUF_END - (u32)HW_BOOT_CHECK_INFO_BUF;
@@ -78,7 +78,7 @@ void OS_BootWithRomHeaderFromFIRM( ROM_Header* rom_header )
     }
 #endif  // SDK_ARM7
     clr_list[i++] = NULL;
-    REBOOT_Execute(entry, wram_reg, clr_list, code_buf, stack_top, scfg, jtag);
+    REBOOT_Execute(entry, wram_reg, clr_list, code_buf, stack_top, scfg, jtag, ds);
     OS_Terminate();
 }
 
diff --git a/build/libraries/os/common/os_init_firm.c b/build/libraries/os/common/os_init_firm.c
index 7359313e..a0c5da1d 100644
--- a/build/libraries/os/common/os_init_firm.c
+++ b/build/libraries/os/common/os_init_firm.c
@@ -89,7 +89,7 @@ void OS_InitFIRM(void)
 
     //---- Init Card
 #ifndef SDK_SMALL_BUILD
-//    CARD_Init();
+    CARD_Init();
 #endif
 
     //---- Init Power Manager
diff --git a/build/nandfirm/menu-launcher/ARM7/main.c b/build/nandfirm/menu-launcher/ARM7/main.c
index 35abe8f8..4062974b 100644
--- a/build/nandfirm/menu-launcher/ARM7/main.c
+++ b/build/nandfirm/menu-launcher/ARM7/main.c
@@ -18,20 +18,14 @@
 #include <twl/mcu.h>
 #include <twl/os/ARM7/debugLED.h>
 
-#define FATFS_HEAP_SIZE     (64*1024)   // FATFS用ヒープ (サイズ調整必要)
+#define FATFS_HEAP_SIZE     (1024)   // FATFS用ヒープ (サイズ調整必要)
 
-#define BOOT_DEVICE     FATFS_MEDIA_TYPE_NAND
-#define PARTITION_NO    0                       // 対象パーティション
-
-#define DRIVE_LETTER    'A'                     // マウント先ドライブ名
-#define DRIVE_NO        (DRIVE_LETTER - 'A')    // マウント先ドライブ番号
+#define THREAD_PRIO_FS      15
+#define THREAD_PRIO_FATFS   8
+#define FS_DMA_NO           3
 
 static u8 fatfsHeap[FATFS_HEAP_SIZE] __attribute__ ((aligned (32)));
 
-#ifndef SDK_FINALROM
-static u8 step = 0x80;
-#endif
-
 /*
     PROFILE_ENABLE を定義するとある程度のパフォーマンスチェックができます。
     利用するためには、main.cかどこかに、u32 profile[256]; u32 pf_cnt = 0; を
@@ -44,11 +38,15 @@ static u8 step = 0x80;
 #endif
 
 #ifdef PROFILE_ENABLE
-#define PROFILE_MAX  256
+#define PROFILE_MAX  16
 u32 profile[PROFILE_MAX];
 u32 pf_cnt = 0;
 #endif
 
+#ifndef SDK_FINALROM
+static u8 step = 0x80;
+#endif
+
 /***************************************************************
     PreInit
 
@@ -68,6 +66,11 @@ static void PreInit(void)
         リセットパラメータ(1バイト)を共有領域(4バイト)にコピー
     */
     *(u32*)HW_RESET_PARAMETER_BUF = (u32)MCUi_ReadRegister( MCU_REG_TEMP_ADDR );
+    /*
+        バッテリー残量チェック
+    */
+    //if ( MCUi_ReadRegister( MCU_REG_BATTELY ) < 0x02 )
+    //if ( MCUi_ReadRegister( MCU_REG_IRQ ) & MCU_IRQ_NO_BATTELY )
 }
 
 /***************************************************************
@@ -85,37 +88,12 @@ static void EraseAll(void)
 }
 
 /***************************************************************
-    Fatfs4nandInit
+    FsInit
 
-    FATFS周りの初期化 for NAND
+    FS周りの初期化
 ***************************************************************/
-#if 1   /* 0: FATFS正規品利用版 */
-#else
 extern void*   SDNandContext;  /* NAND初期化パラメータ */
-extern BOOL FATFSi_rtfs_init( void );
-extern int  FATFSi_sdmcInit( int dmaNo );
-extern int  FATFSi_nandRtfsAttach( int driveno, int partition );
-static void IdleThreadFunc(void* arg)
-{
-    OSThread* pThread = arg;
-    OS_EnableInterrupts();
-    while (1)
-    {
-        OS_CheckStack(pThread);
-        OS_Halt();
-    }
-}
-static void CreateIdleThread(void)
-{
-    static u32 stack[32];
-    static OSThread idle;
-    OS_EnableIrq();
-    OS_EnableInterrupts();
-    OS_CreateThread(&idle, IdleThreadFunc, &idle, stack + 32, sizeof(stack), 31);
-    OS_WakeupThreadDirect(&idle);
-}
-#endif
-static BOOL Fatfs4nandInit(void)
+static BOOL FsInit(void)
 {
     /* FATFSライブラリ用にカレントヒープに設定 */
     /* WRAM上のfatfsHeapをメインメモリヒープとして登録している */
@@ -123,66 +101,46 @@ static BOOL Fatfs4nandInit(void)
         OSHeapHandle hh;
         u8     *lo = (u8*)fatfsHeap;
         u8     *hi = (u8*)fatfsHeap + FATFS_HEAP_SIZE;
+//MI_CpuFillFast(fatfsHeap, 0xcccccccc, FATFS_HEAP_SIZE);
         lo = OS_InitAlloc(OS_ARENA_MAIN_SUBPRIV, lo, hi, 1);
         OS_SetArenaLo(OS_ARENA_MAIN_SUBPRIV, lo);
         hh = OS_CreateHeap(OS_ARENA_MAIN_SUBPRIV, OS_GetSubPrivArenaLo(), hi);
         OS_SetCurrentHeap(OS_ARENA_MAIN_SUBPRIV, hh);
     }
 
-    OS_SetDebugLED(++step);
+#ifdef PROFILE_ENABLE
+    // 3: after OS_CreateHeap
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+    OS_SetDebugLED(++step); // 0x85
 
-#if 1   /* 0: FATFS正規品利用版 */
-    if ( !FATFS_InitFIRM( &(OSi_GetFromFirmAddr()->SDNandContext) ) )
-#else
     SDNandContext = &OSi_GetFromFirmAddr()->SDNandContext;
-    CreateIdleThread();
-    /* RTFSライブラリを初期化 */
-    /* SDドライバ初期化 */
-    if( !FATFSi_rtfs_init() || FATFSi_sdmcInit(1) != 0)
-#endif
+
+    FS_Init( FS_DMA_NO );
+    FS_CreateReadServerThread( THREAD_PRIO_FS );
+
+    if ( !FATFS_Init( FATFS_DMA_NOT_USE, THREAD_PRIO_FATFS ) )
     {
         return FALSE;
     }
 
-#ifdef PROFILE_ENABLE
-    // 3: after FATFS
-    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
-#endif
-    OS_SetDebugLED(++step);
-#if 1   /* 0: FATFS正規品利用版 */
-    if ( !FATFS_MountDriveFIRM( DRIVE_NO, BOOT_DEVICE, PARTITION_NO ) )
-#else
-    if ( !FATFSi_nandRtfsAttach( DRIVE_NO, PARTITION_NO ) )
-#endif
-    {
-        return FALSE;
-    }
-#ifdef PROFILE_ENABLE
-    // 4: after Mount
-    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
-#endif
-    OS_SetDebugLED(++step);
-    PM_BackLightOn( FALSE );
-
-    if ( !FATFS_OpenRecentMenu( DRIVE_NO ) )
-    {
-        return FALSE;
-    }
     return TRUE;
 }
 
 void TwlSpMain( void )
 {
+    int fd; // menu file descriptor
+
     // OS_InitDebugLED and OS_SetDebugLED are able to call after OS_Init
 #ifndef SDK_FINALROM
     I2Ci_WriteRegister(I2C_SLAVE_DEBUG_LED, 0x03, 0x00);
-    I2Ci_WriteRegister(I2C_SLAVE_DEBUG_LED, 0x01, ++step);
+    I2Ci_WriteRegister(I2C_SLAVE_DEBUG_LED, 0x01, ++step);  // 0x81
 #endif
 
     PreInit();
 
 #ifndef SDK_FINALROM
-    I2Ci_WriteRegister(I2C_SLAVE_DEBUG_LED, 0x01, ++step);
+    I2Ci_WriteRegister(I2C_SLAVE_DEBUG_LED, 0x01, ++step);  // 0x82
 #endif
 #ifdef PROFILE_ENABLE
     // 0: before PXI
@@ -190,42 +148,103 @@ void TwlSpMain( void )
 #endif
 
     OS_InitFIRM();
+    OS_EnableIrq();
+    OS_EnableInterrupts();
 
 #ifdef PROFILE_ENABLE
     // 1: after PXI
     profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
 #endif
-
-    OS_SetDebugLED(++step);
+    OS_SetDebugLED(++step); // 0x83
 
     PM_InitFIRM();
-    PM_BackLightOn( FALSE );
 
 #ifdef PROFILE_ENABLE
-    // 2: after PM
+    // 2: after PM_InitFIRM
     profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
 #endif
+    OS_SetDebugLED(++step); // 0x84
+    PM_BackLightOn( FALSE );
 
-    if ( !Fatfs4nandInit() )
+    if ( !FsInit() )
     {
         goto end;
     }
 
 #ifdef PROFILE_ENABLE
-    // 5: after Open
+    // 4: after FS_Init
     profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
 #endif
-    OS_SetDebugLED(++step);
-
+    OS_SetDebugLED(++step); // 0x86
     PM_BackLightOn( FALSE );
 
-    if ( !FATFS_LoadHeader() || !FATFS_LoadStatic() )
+    if ( PXI_RecvID() != FIRM_PXI_ID_SET_PATH )
     {
         goto end;
     }
 
 #ifdef PROFILE_ENABLE
-    // 127: before Boot
+    // 5: after PXI
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+    OS_SetDebugLED(++step); // 0x87
+    PM_BackLightOn( FALSE );
+
+    if ( (fd = FS_OpenSrl()) < 0 )
+    {
+        goto end;
+    }
+
+#ifdef PROFILE_ENABLE
+    // 6: after FS_OpenSrl
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+    OS_SetDebugLED(++step); // 0x88
+    PM_BackLightOn( FALSE );
+
+    if ( !FS_LoadHeader( fd ) )
+    {
+        goto end;
+    }
+
+#ifdef PROFILE_ENABLE
+    // 7: after FS_LoadHeader
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+    OS_SetDebugLED(++step); // 0x89
+    PM_BackLightOn( FALSE );
+
+    if ( PXI_RecvID() != FIRM_PXI_ID_DONE_HEADER )
+    {
+        goto end;
+    }
+
+#ifdef PROFILE_ENABLE
+    // 8: after PXI
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+    OS_SetDebugLED(++step); // 0x8a
+    PM_BackLightOn( FALSE );
+
+    if ( !FS_LoadStatic( fd ) )
+    {
+        goto end;
+    }
+
+#ifdef PROFILE_ENABLE
+    // 9: after FS_LoadStatic
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+    OS_SetDebugLED(++step); // 0x8b
+    PM_BackLightOn( FALSE );
+
+    if ( PXI_RecvID() != FIRM_PXI_ID_DONE_STATIC )
+    {
+        goto end;
+    }
+
+#ifdef PROFILE_ENABLE
+    // 15: after PXI
     pf_cnt = PROFILE_MAX-1;
     profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
     {
@@ -239,8 +258,7 @@ void TwlSpMain( void )
         OS_TPrintf("\n[ARM7] End\n");
     }
 #endif
-    OS_SetDebugLED(++step);
-
+    OS_SetDebugLED(++step); // 0x8c
     PM_BackLightOn( TRUE ); // last chance
 
     OS_BootFromFIRM();
@@ -253,7 +271,7 @@ end:
     // failed
     while (1)
     {
-        PXI_NotifyID( FIRM_PXI_ID_NULL );
+        PXI_NotifyID( FIRM_PXI_ID_ERR );
     }
 }
 
diff --git a/build/nandfirm/menu-launcher/ARM9/Makefile b/build/nandfirm/menu-launcher/ARM9/Makefile
index 6f7bd38f..140c5c8b 100644
--- a/build/nandfirm/menu-launcher/ARM9/Makefile
+++ b/build/nandfirm/menu-launcher/ARM9/Makefile
@@ -40,6 +40,7 @@ MAKEROM_FLAGS		+=	-F
 
 include	$(TWLIPL_ROOT)/build/buildtools/commondefs
 
+LLIBRARIES	+=	libese$(TWL_LIBSUFFIX).a
 
 #----------------------------------------------------------------------------
 
diff --git a/build/nandfirm/menu-launcher/ARM9/main.c b/build/nandfirm/menu-launcher/ARM9/main.c
index faa944f2..49e91524 100644
--- a/build/nandfirm/menu-launcher/ARM9/main.c
+++ b/build/nandfirm/menu-launcher/ARM9/main.c
@@ -40,6 +40,8 @@ static const u8 rsa_key[128] =
 static u8 acHeap[RSA_HEAP_SIZE] __attribute__ ((aligned (32)));
 static SVCSignHeapContext acPool;
 
+#define MENU_TITLE_ID 0x0001000152434e4cULL
+
 /*
     PROFILE_ENABLE を定義するとある程度のパフォーマンスチェックができます。
     利用するためには、main.cかどこかに、u32 profile[256]; u32 pf_cnt = 0; を
@@ -52,7 +54,7 @@ static SVCSignHeapContext acPool;
 #endif
 
 #ifdef PROFILE_ENABLE
-#define PROFILE_MAX  256
+#define PROFILE_MAX  16
 u32 profile[PROFILE_MAX];
 u32 pf_cnt = 0;
 #endif
@@ -64,11 +66,18 @@ u32 pf_cnt = 0;
 ***************************************************************/
 static void PreInit(void)
 {
+    static const OSMountInfo    firmSettings[] =
+    {
+        { 'A', OS_MOUNT_DEVICE_NAND, OS_MOUNT_TGT_ROOT, 0, OS_MOUNT_RSC_WRAM, (OS_MOUNT_USR_R|OS_MOUNT_USR_W), 0, 0, "nand",    "/" },
+        { 0 }
+    };
     /*
      メインメモリ関連
     */
     // SHARED領域クリア (ここだけでOK?)
     MIi_CpuClearFast( 0, (void*)HW_PXI_SIGNAL_PARAM_ARM9, HW_MMEMCHECKER_MAIN-HW_PXI_SIGNAL_PARAM_ARM9 );
+    // FS_MOUNT領域の初期化
+    MI_CpuCopy8(firmSettings, (char*)HW_TWL_FS_MOUNT_INFO_BUF, sizeof(firmSettings));
 
     /*
         FromBrom関連
@@ -82,7 +91,7 @@ static void PreInit(void)
 /***************************************************************
     PostInit
 
-    MI_LoadHeader前にかなり(数100msec)時間があるので、可能なら
+    FS_LoadHeader前にかなり(数100msec)時間があるので、可能なら
     OS_Init後にいろいろ処理したい！
     メインメモリの初期化
 ***************************************************************/
@@ -140,15 +149,15 @@ void TwlMain( void )
 #endif
 
     OS_InitFIRM();
-#ifdef PROFILE_ENABLE
     OS_EnableIrq();
+    OS_EnableInterrupts();
+
+#ifdef PROFILE_ENABLE
     OS_InitTick();
     // 1: after PXI
     profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
 #endif
 
-    SVC_InitSignHeap( &acPool, acHeap, sizeof(acHeap) );
-
     PostInit();
 
 #ifdef PROFILE_ENABLE
@@ -156,34 +165,94 @@ void TwlMain( void )
     profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
 #endif
 
-    // load menu
-    if ( MI_LoadHeader( &acPool, RSA_KEY_ADDR ) && CheckHeader() && MI_LoadStatic() )
-    {
+    // RSA用ヒープ設定
+    SVC_InitSignHeap( &acPool, acHeap, sizeof(acHeap) );
+    // HMAC用鍵準備
+    FS_SetDigestKey( NULL );
+
 #ifdef PROFILE_ENABLE
-        // 127: before Boot
-        pf_cnt = PROFILE_MAX-1;
-        profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
-        {
-            int i;
-            OS_TPrintf("\n[ARM9] Begin\n");
-            for (i = 0; i < PROFILE_MAX; i++)
-            {
-                OS_TPrintf("0x%08X\n", profile[i]);
-            }
-            OS_TPrintf("\n[ARM9] End\n");
-            PXI_NotifyID( FIRM_PXI_ID_NULL );
-        }
+    // 3: after SVC_InitSignHeap
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
 #endif
 
-        OS_BootFromFIRM();
+    FS_Init(FS_DMA_NOT_USE);
+
+#ifdef PROFILE_ENABLE
+    // 4: after FS_Init
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+
+    if ( !FS_ResolveSrl( MENU_TITLE_ID ) )
+    {
+        goto end;
     }
 
+#ifdef PROFILE_ENABLE
+    // 5: after FS_ResolveSrl
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+
+    PXI_NotifyID( FIRM_PXI_ID_SET_PATH );
+
+#ifdef PROFILE_ENABLE
+    // 6: after PXI
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+
+    if ( !FS_LoadHeader(&acPool, RSA_KEY_ADDR ) && CheckHeader() )
+    {
+        goto end;
+    }
+
+#ifdef PROFILE_ENABLE
+    // 7: after FS_LoadHeader
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+
+    PXI_NotifyID( FIRM_PXI_ID_DONE_HEADER );
+
+#ifdef PROFILE_ENABLE
+    // 8: after PXI
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+
+    if ( !FS_LoadStatic() )
+    {
+        goto end;
+    }
+
+#ifdef PROFILE_ENABLE
+    // 9: after FS_LoadStatic
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+#endif
+
+    PXI_NotifyID( FIRM_PXI_ID_DONE_STATIC );
+
+#ifdef PROFILE_ENABLE
+    // 15: after PXI
+    pf_cnt = PROFILE_MAX-1;
+    profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick());
+    {
+        int i;
+        OS_TPrintf("\n[ARM9] Begin\n");
+        for (i = 0; i < PROFILE_MAX; i++)
+        {
+            OS_TPrintf("0x%08X\n", profile[i]);
+        }
+        OS_TPrintf("\n[ARM9] End\n");
+        PXI_NotifyID( FIRM_PXI_ID_NULL );
+    }
+#endif
+
+    OS_BootFromFIRM();
+
+end:
     EraseAll();
 
     // failed
     while (1)
     {
-        PXI_NotifyID( FIRM_PXI_ID_NULL );
+        PXI_NotifyID( FIRM_PXI_ID_ERR );
     }
 }
 
diff --git a/build/nandfirm/sdmc-launcher/ARM9/main.c b/build/nandfirm/sdmc-launcher/ARM9/main.c
index da297e1a..7de0c8ab 100644
--- a/build/nandfirm/sdmc-launcher/ARM9/main.c
+++ b/build/nandfirm/sdmc-launcher/ARM9/main.c
@@ -56,6 +56,7 @@ static void PreInit(void)
     */
     // SHARED領域クリア (ここだけでOK?)
     MIi_CpuClearFast( 0, (void*)HW_PXI_SIGNAL_PARAM_ARM9, HW_MMEMCHECKER_MAIN-HW_PXI_SIGNAL_PARAM_ARM9 );
+    MIi_CpuClearFast( 0, (void*)HW_TWL_FS_MOUNT_INFO_BUF, HW_TWL_ROM_HEADER_BUF-HW_TWL_FS_MOUNT_INFO_BUF );
 
     /*
         FromBrom関連
diff --git a/include/firm.h b/include/firm.h
index 37ccbcab..c2005e7a 100644
--- a/include/firm.h
+++ b/include/firm.h
@@ -26,10 +26,7 @@
 #include <firm/pm.h>
 #include <firm/aes.h>
 #include <firm/fatfs.h>
-/*
-#include <firm/nvram.h>
-#include <firm/gcd.h>
-*/
+#include <firm/fs.h>
 
 /* FIRM_H_ */
 #endif
diff --git a/include/firm/aes.h b/include/firm/aes.h
index 0f479d20..ee9ef406 100644
--- a/include/firm/aes.h
+++ b/include/firm/aes.h
@@ -17,12 +17,17 @@
 #ifndef FIRM_AES_H_
 #define FIRM_AES_H_
 
-#ifdef SDK_ARM7
+#define PXI_FIFO_TAG_DATA   PXI_FIFO_TAG_USER_0
+
 #include <twl/aes/common/type.h>
+
+#ifdef SDK_ARM7
 #include <firm/aes/ARM7/aes_init.h>
 #include <firm/aes/ARM7/aes_util.h>
 #include <firm/aes/ARM7/aes_ids.h>
-#endif // SDK_ARM7
+#else // !SDK_ARM7
+#include <firm/aes/ARM9/aes_init.h>
+#endif // !SDK_ARM7
 
 /* FIRM_AES_H_ */
 #endif
diff --git a/include/firm/aes/ARM7/aes_init.h b/include/firm/aes/ARM7/aes_init.h
index 00150c7c..9ac381ac 100644
--- a/include/firm/aes/ARM7/aes_init.h
+++ b/include/firm/aes/ARM7/aes_init.h
@@ -25,7 +25,28 @@ extern "C" {
 /*---------------------------------------------------------------------------*
     関数定義
  *---------------------------------------------------------------------------*/
-void AESi_InitGameKeys( u8 game_code[4] );
+/*---------------------------------------------------------------------------*
+  Name:         AESi_InitKeysForApp
+
+  Description:  set IDs depending on the application.
+                you SHOULD NOT touch any ID registers after this call.
+
+  Arguments:    game_code   game code
+
+  Returns:      None
+ *---------------------------------------------------------------------------*/
+void AESi_InitKeysForApp( u8 game_code[4] );
+
+/*---------------------------------------------------------------------------*
+  Name:         AESi_RecvSeed
+
+  Description:  set SEED/KEY from ARM9 via PXI.
+
+  Arguments:    None
+
+  Returns:      None
+ *---------------------------------------------------------------------------*/
+void AESi_RecvSeed( void );
 
 #ifdef __cplusplus
 } /* extern "C" */
diff --git a/include/firm/fatfs/ARM7/fatfs_loader.h b/include/firm/fatfs/ARM7/fatfs_loader.h
index bb9c44a3..0df8c70d 100644
--- a/include/firm/fatfs/ARM7/fatfs_loader.h
+++ b/include/firm/fatfs/ARM7/fatfs_loader.h
@@ -74,6 +74,19 @@ BOOL FATFS_SaveSrlFilename( FATFSMediaType media, const char* filename );
  *---------------------------------------------------------------------------*/
 int FATFS_GetSrlDescriptor( void );
 
+/*---------------------------------------------------------------------------*
+  Name:         FATFS_SetSrlDescriptor
+
+  Description:  set current file descriptor that was opened outside
+
+                オープン済みのファイルIDをmenu_fdにセットします。
+
+  Arguments:    None
+
+  Returns:      int
+ *---------------------------------------------------------------------------*/
+void FATFS_SetSrlDescriptor( int fd );
+
 /*---------------------------------------------------------------------------*
   Name:         FATFS_LoadBuffer
 
diff --git a/include/firm/pxi/common/misc.h b/include/firm/pxi/common/misc.h
index 36c740b1..fa3cb6bf 100644
--- a/include/firm/pxi/common/misc.h
+++ b/include/firm/pxi/common/misc.h
@@ -28,20 +28,27 @@ extern "C" {
 typedef enum
 {
     // from ARM7
-    FIRM_PXI_ID_COLDBOOT = 1,
-    FIRM_PXI_ID_WARMBOOT = 2,
+    FIRM_PXI_ID_COLDBOOT = 1,   // _start
+    FIRM_PXI_ID_WARMBOOT = 2,   // _start
 
-    FIRM_PXI_ID_INIT_ARM7 = 7,
-    FIRM_PXI_ID_LOAD_HEADER = 6,
-    FIRM_PXI_ID_LOAD_STATIC = 5,
+    FIRM_PXI_ID_INIT_ARM7 = 7,  // PXI_InitFifoFIRM
 
-    // *_Loader用 (ARM7→ARM9)
-    FIRM_PXI_ID_LOAD_PIRIOD = 1,
+    FIRM_PXI_ID_LOAD_HEADER = 6,    // FATFS_LoadHeader
+    FIRM_PXI_ID_LOAD_STATIC = 5,    // FATFS_LoadStatic
+
+    FIRM_PXI_ID_LOAD_PIRIOD = 1,    // *_LoadBuffer
 
     // from ARM9
-    FIRM_PXI_ID_INIT_ARM9 = 9,
-    FIRM_PXI_ID_AUTH_HEADER = 10,
-    FIRM_PXI_ID_AUTH_STATIC = 11,
+    FIRM_PXI_ID_INIT_MMEM = 3,  // _start
+
+    FIRM_PXI_ID_INIT_ARM9 = 9,  // PXI_InitFifoFIRM
+
+    FIRM_PXI_ID_AUTH_HEADER = 10,   // MI_LoadHeader
+    FIRM_PXI_ID_AUTH_STATIC = 11,   // MI_LoadStatic
+
+    FIRM_PXI_ID_SET_PATH = 4,       // main (nandfirm)
+    FIRM_PXI_ID_DONE_HEADER = 5,    // main (nandfirm)
+    FIRM_PXI_ID_DONE_STATIC = 6,    // main (nandfirm)
 
     // from both of ARM9 and ARM7
     FIRM_PXI_ID_NULL = 0,