diff --git a/build/libraries/fs/ARM7/src/fs_firm.c b/build/libraries/fs/ARM7/src/fs_firm.c
index 8cb8396e..580eba71 100644
--- a/build/libraries/fs/ARM7/src/fs_firm.c
+++ b/build/libraries/fs/ARM7/src/fs_firm.c
@@ -18,6 +18,7 @@
 #include <symbols.h>
 #include <firm.h>
 #include <rtfs.h>
+#include <twl/aes/common/aes.h>
 
 //#define WORKAROUND_NAND_2KB_BUG
 
@@ -29,6 +30,10 @@
 
 static ROM_Header* const rh= (ROM_Header*)HW_TWL_ROM_HEADER_BUF;
 
+static BOOL         aesFlag;
+static AESCounter   aesCounter;
+static u8           aesBuffer[HW_FIRM_LOAD_BUFFER_UNIT_SIZE] ATTRIBUTE_ALIGN(32);
+
 static void ConvertPath( u16* dest, const char* src, u32 max)
 {
     dest[0] = 0;
@@ -112,18 +117,29 @@ int FS_OpenSrl( void )
     return FATFSi_rtfs_po_open((u8*)fatpath, 0, 0);
 }
 
-static void EnableAes( AESCounter* pCounter )   // ドライバAPIと置き換える
-{
-    (void)pCounter;
-}
-static void DisableAes( void )  // ドライバAPIと置き換える
+#define DMA_SEND         2
+#define DMA_RECV         3
+static void CopyWithAes( const void* src, void* dest, u32 size )
 {
+    AESi_Reset();
+    AESi_Reset();
+    AESi_DmaSend( DMA_SEND, src,  size, NULL, NULL );
+    AESi_DmaRecv( DMA_RECV, dest, size, NULL, NULL );
+    AESi_SetCounter( &aesCounter );
+    AESi_Run( AES_MODE_CTR, 0, size / AES_BLOCK_SIZE, NULL, NULL );
+    AES_AddToCounter( &aesCounter, size / AES_BLOCK_SIZE );
+    MI_WaitNDma( DMA_RECV );
 }
 
-static void GetAesCounter( AESCounter* pCounter, u32 offset )
+static void EnableAes( u32 offset )
 {
-    MI_CpuCopy32( rh->s.main_static_digest, pCounter, AES_BLOCK_SIZE );
-    AESi_AddCounter( pCounter, offset - rh->s.aes_target_rom_offset );
+    aesFlag = TRUE;
+    MI_CpuCopy8( rh->s.main_static_digest, &aesCounter, AES_BLOCK_SIZE );
+    AES_AddToCounter( &aesCounter, (offset - rh->s.aes_target_rom_offset) / AES_BLOCK_SIZE );
+}
+static void DisableAes( void )
+{
+    aesFlag = FALSE;
 }
 
 static u32 GetTransferSize( u32 offset, u32 size )
@@ -135,12 +151,10 @@ static u32 GetTransferSize( u32 offset, u32 size )
     {
         if ( offset >= aes_offset && offset < aes_end )
         {
-            AESCounter counter;
             if ( end > aes_end )
             {
                 size = aes_end - offset;
             }
-            AESi_WaitKey();
             if (rh->s.developer_encrypt)
             {
                 AESi_LoadKey( AES_KEY_SLOT_C );
@@ -149,8 +163,7 @@ static u32 GetTransferSize( u32 offset, u32 size )
             {
                 AESi_LoadKey( AES_KEY_SLOT_A );
             }
-            GetAesCounter( &counter, offset );
-            EnableAes( &counter );
+            EnableAes( offset );
         }
         else
         {
@@ -195,7 +208,8 @@ BOOL FS_LoadBuffer( int fd, u32 offset, u32 size )
     }
     while ( size > 0 )
     {
-        u8* dest = (u8*)HW_FIRM_LOAD_BUFFER_BASE + count * HW_FIRM_LOAD_BUFFER_UNIT_SIZE;
+        u8* dest = aesFlag ? aesBuffer :
+                    (u8*)HW_FIRM_LOAD_BUFFER_BASE + count * HW_FIRM_LOAD_BUFFER_UNIT_SIZE;
         u32 unit = size < HW_FIRM_LOAD_BUFFER_UNIT_SIZE ? size : HW_FIRM_LOAD_BUFFER_UNIT_SIZE;
         while ( MI_GetWramBankMaster_B( count ) != MI_WRAM_ARM7 ) // wait to be ready
         {
@@ -221,6 +235,10 @@ BOOL FS_LoadBuffer( int fd, u32 offset, u32 size )
             return FALSE;
         }
 #endif
+        if ( aesFlag )
+        {
+            CopyWithAes( dest, (u8*)HW_FIRM_LOAD_BUFFER_BASE + count * HW_FIRM_LOAD_BUFFER_UNIT_SIZE, unit );
+        }
         PXI_NotifyID( FIRM_PXI_ID_LOAD_PIRIOD );
         count = ( count + 1 ) % HW_FIRM_LOAD_BUFFER_UNIT_NUMS;
         size -= unit;
@@ -277,6 +295,7 @@ BOOL FS_LoadHeader( int fd )
     {
         return FALSE;
     }
+
     return TRUE;
 }
 
diff --git a/build/libraries/fs/ARM9/src/fs_firm.c b/build/libraries/fs/ARM9/src/fs_firm.c
index 4382bbea..8e8a1b1c 100644
--- a/build/libraries/fs/ARM9/src/fs_firm.c
+++ b/build/libraries/fs/ARM9/src/fs_firm.c
@@ -55,6 +55,8 @@ static const u8 defaultKey[ SVC_SHA1_BLOCK_SIZE ] =
     0x87, 0x46, 0x58, 0x24,
 };
 
+static AESKey FSiAesKeySeed;
+
 /*---------------------------------------------------------------------------*
   Name:         FS_InitFIRM
 
@@ -72,6 +74,34 @@ void FS_InitFIRM( void )
     FS_Init( FS_DMA_NOT_USE );
 }
 
+/*---------------------------------------------------------------------------*
+  Name:         FS_GetAesKeySeed
+
+  Description:  retreive aes key seed in the signature
+
+  Arguments:    None
+
+  Returns:      pointer to seed
+ *---------------------------------------------------------------------------*/
+AESKey* const FS_GetAesKeySeed( void )
+{
+    return &FSiAesKeySeed;
+}
+
+/*---------------------------------------------------------------------------*
+  Name:         FS_DeleteAesKeySeed
+
+  Description:  delete aes key seed in the signature
+
+  Arguments:    None
+
+  Returns:      None
+ *---------------------------------------------------------------------------*/
+void FS_DeleteAesKeySeed( void )
+{
+    MI_CpuClear8( &FSiAesKeySeed, sizeof(FSiAesKeySeed) );
+}
+
 /*---------------------------------------------------------------------------*
   Name:         FS_ResolveSrl
 
@@ -344,6 +374,9 @@ BOOL FS_LoadHeader( SVCSignHeapContext* pool, const void* rsa_key )
 
     // ダイジェスト以外のデータのチェックが必要！！
 
+    // 鍵の保存
+    MI_CpuCopy8( (AESKey*)sd.aes_key_seed, &FSiAesKeySeed, sizeof(FSiAesKeySeed) );
+
     MI_CpuClear8( &sd, sizeof(sd) );    // 残り削除 (他に必要なものはない？)
 
     // ROMヘッダのコピー
@@ -397,19 +430,44 @@ BOOL FS_LoadStatic( void )
 /*
     以下、LoadBufferを使わない版 (通常FS APIを使用する)
 */
+#include <twl/aes.h>
 
-static void EnableAes( AESCounter* pCounter )   // ドライバAPIと置き換える
-{
-    (void)pCounter;
-}
-static void DisableAes( void )  // ドライバAPIと置き換える
+static BOOL         aesFlag;
+static AESCounter   aesCounter;
+static u8* const    aesBuffer = (u8*)HW_FIRM_FS_AES_BUFFER; // 0x2ff0000
+
+static void AesCallback( AESResult result, void* arg )
 {
+    BOOL* pFlag = (BOOL*)arg;
+    *pFlag = TRUE;
+    if (result != AES_RESULT_SUCCESS)
+    {
+        OS_TPrintf("Failed to decrypt by AES (%d)\n", result);
+    }
 }
 
-static void GetAesCounter( AESCounter* pCounter, u32 offset )
+static void CopyWithAes( const void* src, void* dest, u32 size )
 {
-    MI_CpuCopy32( rh->s.main_static_digest, pCounter, AES_BLOCK_SIZE );
-    AESi_AddCounter( pCounter, offset - rh->s.aes_target_rom_offset );
+    volatile BOOL aesBusy = TRUE;
+    if ( AES_RESULT_SUCCESS == AES_CtrDecrypt( rh->s.developer_encrypt ? AES_KEY_TYPE_RAW : AES_KEY_TYPE_APP,
+                                        &aesCounter, src, size, dest, AesCallback, (void*)&aesBusy) )
+    {
+        while (aesBusy)
+        {
+        }
+    }
+    AES_AddToCounter( &aesCounter, size / AES_BLOCK_SIZE );
+}
+
+static void EnableAes( u32 offset )
+{
+    aesFlag = TRUE;
+    MI_CpuCopy8( rh->s.main_static_digest, &aesCounter, AES_BLOCK_SIZE );
+    AES_AddToCounter( &aesCounter, (offset - rh->s.aes_target_rom_offset) / AES_BLOCK_SIZE );
+}
+static void DisableAes( void )
+{
+    aesFlag = FALSE;
 }
 
 /*---------------------------------------------------------------------------*
@@ -438,22 +496,23 @@ static u32 GetSrlTransferSize( u32 offset, u32 size )
     {
         if ( offset >= aes_offset && offset < aes_end )
         {
-            AESCounter counter;
             if ( end > aes_end )
             {
                 size = aes_end - offset;
             }
-            //AESi_WaitKey();   // ドライバAPI経由？
+            if ( size >= HW_FIRM_FS_AES_BUFFER_SIZE )
+            {
+                size = HW_FIRM_FS_AES_BUFFER_SIZE;
+            }
             if ( rh->s.developer_encrypt )
             {
-                //AESi_LoadKey( AES_KEY_SLOT_C );   // ドライバAPI経由？
+                AES_SetKey( AES_KEY_TYPE_RAW, FS_GetAesKeySeed() );
             }
             else
             {
-                //AESi_LoadKey( AES_KEY_SLOT_A );   // ドライバAPI経由？
+                AES_SetKey( AES_KEY_TYPE_APP, FS_GetAesKeySeed() );
             }
-            GetAesCounter( &counter, offset );
-            EnableAes( &counter );
+            EnableAes( offset );
         }
         else
         {
@@ -499,9 +558,21 @@ BOOL FS_LoadSrlModule( FSFile *pFile, u8* dest, u32 offset, u32 size, const u8 d
     while ( size > 0 )
     {
         u32 unit = GetSrlTransferSize( offset, size );
-        if ( !FS_ReadFile( pFile, dest, (s32)unit ) )
+        if (aesFlag)
         {
-            return FALSE;
+            if ( !FS_ReadFile( pFile, aesBuffer, (s32)unit ) )
+            {
+                return FALSE;
+            }
+            DC_FlushRange( aesBuffer, unit );
+            CopyWithAes( aesBuffer, dest, unit );
+        }
+        else
+        {
+            if ( !FS_ReadFile( pFile, dest, (s32)unit ) )
+            {
+                return FALSE;
+            }
         }
         dest += unit;
         offset += unit;
@@ -569,6 +640,9 @@ BOOL FS_LoadSrlHeader( FSFile *pFile, SVCSignHeapContext* pool, const void* rsa_
 
     // ダイジェスト以外のデータのチェックが必要！！
 
+    // 鍵の保存
+    MI_CpuCopy8( (AESKey*)sd.aes_key_seed, &FSiAesKeySeed, sizeof(FSiAesKeySeed) );
+
     MI_CpuClear8( &sd, sizeof(sd) );    // 残り削除 (他に必要なものはない？)
     return CheckDigest( md, digest, TRUE, TRUE );
 }
diff --git a/build/libraries/pxi/common/pxi_firm.c b/build/libraries/pxi/common/pxi_firm.c
index 8d75e9ef..da300bc9 100644
--- a/build/libraries/pxi/common/pxi_firm.c
+++ b/build/libraries/pxi/common/pxi_firm.c
@@ -177,11 +177,13 @@ void PXI_NotifyID( FIRMPxiID id )
     while ( 0 > PXI_SendWordByFifo( PXI_FIFO_TAG_USER_1, id, 0 ) )
     {
     }
+#if 0
 #ifdef SDK_ARM9
         OS_TPrintf("[ARM9] Notify: %d\n", (u8)id);
 #else
         OS_TPrintf("[ARM7] Notify: %d\n", (u8)id);
 #endif
+#endif
 }
 
 /*---------------------------------------------------------------------------*
@@ -204,10 +206,12 @@ FIRMPxiID PXI_RecvID( void )
             work.rp = ( work.rp + 1 ) % PXI_FIRM_ID_MAX;
             id = (FIRMPxiID)work.id[work.rp];
             OS_RestoreInterrupts( enabled );
+#if 0
 #ifdef SDK_ARM9
         OS_TPrintf("[ARM9] Received: %d\n", id);
 #else
         OS_TPrintf("[ARM7] Received: %d\n", id);
+#endif
 #endif
             return id;
         }
diff --git a/build/nandfirm/Makefile b/build/nandfirm/Makefile
index ef31ddd5..39fb3ca6 100644
--- a/build/nandfirm/Makefile
+++ b/build/nandfirm/Makefile
@@ -25,6 +25,7 @@ SUBDIRS		= \
 			nandfirm-print \
 			sdmc-launcher \
 			menu-launcher \
+			menu-launcher2 \
 
 #----------------------------------------------------------------------------
 
diff --git a/build/nandfirm/menu-launcher/ARM7/main.c b/build/nandfirm/menu-launcher/ARM7/main.c
index 4574a4e2..2a76020f 100644
--- a/build/nandfirm/menu-launcher/ARM7/main.c
+++ b/build/nandfirm/menu-launcher/ARM7/main.c
@@ -16,7 +16,6 @@
  *---------------------------------------------------------------------------*/
 #include <firm.h>
 #include <twl/mcu.h>
-#include <twl/os/ARM7/debugLED.h>
 
 #define FATFS_HEAP_SIZE     (1024)   // FATFS用ヒープ (サイズ調整必要)
 
@@ -141,14 +140,6 @@ static BOOL FsInit(void)
     return TRUE;
 }
 
-static u32 systemId;
-static void PxiSystemCallback( PXIFifoTag tag, u32 data, BOOL err )
-{
-    (void)tag;
-    (void)err;
-    systemId = data;
-}
-
 static void IdleThread(void* arg)
 {
     OS_EnableInterrupts();
@@ -210,11 +201,6 @@ PXI_RecvID();
 SetDebugLED(0x01);
 PXI_RecvID();
 SetDebugLED(0x02);
-PXI_RecvID();
-SetDebugLED(0x03);
-PXI_RecvID();
-SetDebugLED(0x04);
-
 
     if ( PXI_RecvID() != FIRM_PXI_ID_SET_PATH )
     {
@@ -266,15 +252,24 @@ SetDebugLED(0x04);
 
     PM_BackLightOn( FALSE );
 
+    AESi_InitKeysFIRM();
+    AESi_RecvSeed();
+
+    // 9: after AESi_RecvSeed
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x8b
+
+    PM_BackLightOn( FALSE );
+
     if ( !FS_LoadStatic( fd ) )
     {
         OS_TPrintf("Failed to call FS_LoadStatic().\n");
         goto end;
     }
 
-    // 9: after FS_LoadStatic
+    // 10: after FS_LoadStatic
     PUSH_PROFILE();
-    SetDebugLED(++step); // 0x8b
+    SetDebugLED(++step); // 0x8c
 
     PM_BackLightOn( FALSE );
 
@@ -284,7 +279,7 @@ SetDebugLED(0x04);
         goto end;
     }
 
-    // 10: after PXI
+    // 11: after PXI
     PUSH_PROFILE();
 #ifdef PROFILE_ENABLE
     {
diff --git a/build/nandfirm/menu-launcher/ARM9/main.c b/build/nandfirm/menu-launcher/ARM9/main.c
index d8402ac6..efbd5ff2 100644
--- a/build/nandfirm/menu-launcher/ARM9/main.c
+++ b/build/nandfirm/menu-launcher/ARM9/main.c
@@ -98,26 +98,16 @@ static void PreInit(void)
 /***************************************************************
     PostInit
 
-    FS_LoadHeader前にかなり(数100msec)時間があるので、可能なら
-    OS_Init後にいろいろ処理したい！
-    メインメモリの初期化
+    各種初期化
 ***************************************************************/
 static void PostInit(void)
 {
-    /*
-     メインメモリ関連
-    */
-    // ARM9領域を全クリア
-    if ( (u8)OS_GetResetParameter() )
-    {
-        MI_CpuClearFast( (void*)HW_FIRM_RESET_BUF_END, HW_TWL_MAIN_MEM_MAIN_END-HW_FIRM_RESET_BUF_END );
-    }
-    else
-    {
-        MI_CpuClearFast( (void*)HW_MAIN_MEM_MAIN, HW_MAIN_MEM_MAIN_SIZE );
-    }
-
-    DC_FlushAll();
+    // RSA用ヒープ設定
+    SVC_InitSignHeap( &acPool, acHeap, sizeof(acHeap) );
+    // HMAC用鍵準備
+    FS_SetDigestKey( NULL );
+    // FS/FATFS初期化
+    FS_InitFIRM();
 }
 
 /***************************************************************
@@ -183,39 +173,25 @@ void TwlMain( void )
     // 1: after PXI
     PUSH_PROFILE();
 PXI_NotifyID( FIRM_PXI_ID_NULL );
-    //PostInit();
+
+    PostInit();
 
     // 2: after PostInit
     PUSH_PROFILE();
 PXI_NotifyID( FIRM_PXI_ID_NULL );
 
-    // RSA用ヒープ設定
-    SVC_InitSignHeap( &acPool, acHeap, sizeof(acHeap) );
-    // HMAC用鍵準備
-    FS_SetDigestKey( NULL );
-
-    // 3: after SVC_InitSignHeap
-    PUSH_PROFILE();
-PXI_NotifyID( FIRM_PXI_ID_NULL );
-
-    FS_InitFIRM();
-
-    // 4: after FS_Init
-    PUSH_PROFILE();
-PXI_NotifyID( FIRM_PXI_ID_NULL );
-
     if ( !FS_ResolveSrl( MENU_TITLE_ID ) )
     {
         OS_TPrintf("Failed to call FS_ResolveSrl( 0x%016llx ).\n", MENU_TITLE_ID);
         goto end;
     }
 
-    // 5: after FS_ResolveSrl
+    // 3: after FS_ResolveSrl
     PUSH_PROFILE();
 
     PXI_NotifyID( FIRM_PXI_ID_SET_PATH );
 
-    // 6: after PXI
+    // 4: after PXI
     PUSH_PROFILE();
 
     if ( !FS_LoadHeader(&acPool, RSA_KEY_ADDR ) || !CheckHeader() )
@@ -224,12 +200,18 @@ PXI_NotifyID( FIRM_PXI_ID_NULL );
         goto end;
     }
 
-    // 7: after FS_LoadHeader
+    // 5: after FS_LoadHeader
     PUSH_PROFILE();
 
     PXI_NotifyID( FIRM_PXI_ID_DONE_HEADER );
 
-    // 8: after PXI
+    // 6: after PXI
+    PUSH_PROFILE();
+
+    AESi_SendSeed( FS_GetAesKeySeed() );
+    FS_DeleteAesKeySeed();
+
+    // 7: after AESi_SendSeed
     PUSH_PROFILE();
 
     if ( !FS_LoadStatic() )
@@ -238,12 +220,12 @@ PXI_NotifyID( FIRM_PXI_ID_NULL );
         goto end;
     }
 
-    // 9: after FS_LoadStatic
+    // 8: after FS_LoadStatic
     PUSH_PROFILE();
 
     PXI_NotifyID( FIRM_PXI_ID_DONE_STATIC );
 
-    // 10: after PXI
+    // 9: after PXI
     PUSH_PROFILE();
 #ifdef PROFILE_ENABLE
     {
diff --git a/build/nandfirm/menu-launcher2/ARM7/Makefile b/build/nandfirm/menu-launcher2/ARM7/Makefile
new file mode 100644
index 00000000..ad1b44c4
--- /dev/null
+++ b/build/nandfirm/menu-launcher2/ARM7/Makefile
@@ -0,0 +1,51 @@
+#! make -f
+#----------------------------------------------------------------------------
+# Project:  TwlFirm - tools - menu-launcher2
+# File:     Makefile
+#
+# Copyright 2007 Nintendo.  All rights reserved.
+#
+# These coded instructions, statements, and computer programs contain
+# proprietary information of Nintendo of America Inc. and/or Nintendo
+# Company Ltd., and are protected by Federal copyright law.  They may
+# not be disclosed to third parties or copied or duplicated in any form,
+# in whole or in part, without the prior written consent of Nintendo.
+#
+# $Date::            $
+# $Rev:$
+# $Author:$
+#----------------------------------------------------------------------------
+
+TWL_PROC       = ARM7
+
+SUBDIRS		=
+
+LINCLUDES	=   ../include
+
+#----------------------------------------------------------------------------
+
+TARGET_BIN	=	menu_launcher2_7.tef
+
+SRCS		=	main.c
+
+CRT0_O		=	crt0_firm.o
+
+#LCFILE_TEMPLATE =	$(FIRM_SPECDIR)/$(TWL_PROC)-$(TWL_PLATFORM)-PARTNER.lcf.template
+
+#SRCDIR		=	# using default
+#LCFILE		=	# using default
+
+include	$(TWL_IPL_RED_ROOT)/build/buildtools/commondefs
+
+LLIBRARIES	+=	libaes_sp$(TWL_LIBSUFFIX).a
+
+MAKELCF_FLAGS	+=	-DADDRESS_LTDWRAM='0x037c0000'
+
+#----------------------------------------------------------------------------
+
+do-build:		$(TARGETS)
+
+
+include	$(TWL_IPL_RED_ROOT)/build/buildtools/modulerules
+
+#===== End of Makefile =====
diff --git a/build/nandfirm/menu-launcher2/ARM7/main.c b/build/nandfirm/menu-launcher2/ARM7/main.c
new file mode 100644
index 00000000..b06b6ac4
--- /dev/null
+++ b/build/nandfirm/menu-launcher2/ARM7/main.c
@@ -0,0 +1,280 @@
+/*---------------------------------------------------------------------------*
+  Project:  TwlFirm - nandfirm - menu-launcher2
+  File:     main.c
+
+  Copyright 2007 Nintendo.  All rights reserved.
+
+  These coded instructions, statements, and computer programs contain
+  proprietary information of Nintendo of America Inc. and/or Nintendo
+  Company Ltd., and are protected by Federal copyright law.  They may
+  not be disclosed to third parties or copied or duplicated in any form,
+  in whole or in part, without the prior written consent of Nintendo.
+
+  $Date::            $
+  $Rev$
+  $Author$
+ *---------------------------------------------------------------------------*/
+#include <firm.h>
+#include <twl/mcu.h>
+#include <twl/aes.h>
+
+#define FATFS_HEAP_SIZE     (1024)   // FATFS用ヒープ (サイズ調整必要)
+
+#define THREAD_PRIO_FS      15
+#define THREAD_PRIO_FATFS   8
+#define FS_DMA_NO           3
+
+static u8 fatfsHeap[FATFS_HEAP_SIZE] __attribute__ ((aligned (32)));
+
+/*
+    PROFILE_ENABLE を定義するとある程度のパフォーマンスチェックができます。
+    利用するためには、main.cかどこかに、u32 profile[256]; u32 pf_cnt = 0; を
+    定義する必要があります。
+*/
+#define PROFILE_ENABLE
+
+/*
+    デバッグLEDをFINALROMとは別にOn/Offできます。
+*/
+#define USE_DEBUG_LED
+
+//#ifdef SDK_FINALROM // FINALROMで無効化
+//#undef PROFILE_ENABLE
+//#endif
+
+#ifdef PROFILE_ENABLE
+#define PROFILE_MAX  16
+u32 profile[PROFILE_MAX];
+u32 pf_cnt = 0;
+#define PUSH_PROFILE()  (profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick()))
+#else
+#define PUSH_PROFILE()  ((void)0)
+#endif
+
+#ifdef USE_DEBUG_LED
+static u8 step = 0x80;
+#define InitDebugLED()          I2Ci_WriteRegister(I2C_SLAVE_DEBUG_LED, 0x03, 0x00)
+#define SetDebugLED(pattern)    I2Ci_WriteRegister(I2C_SLAVE_DEBUG_LED, 0x01, (pattern));
+#else
+#define InitDebugLED()          ((void)0)
+#define SetDebugLED(pattern)    ((void)0)
+#endif
+
+/***************************************************************
+    PreInit
+
+    FromBootの対応＆メインメモリの初期化
+    OS_Init前なので注意 (ARM9によるメインメモリ初期化で消されないように注意)
+***************************************************************/
+static void PreInit(void)
+{
+    /*
+        FromBrom関連
+    */
+    if ( !OSi_FromBromToMenu() )
+    {
+        OS_Terminate();
+    }
+    /*
+        リセットパラメータ(1バイト)を共有領域(4バイト)にコピー
+    */
+#define FIRM_AVAILABLE_BIT  0x80000000UL
+    *(u32*)HW_RESET_PARAMETER_BUF = (u32)MCUi_ReadRegister( MCU_REG_TEMP_ADDR ) | FIRM_AVAILABLE_BIT;
+    /*
+        バッテリー残量チェック
+    */
+    //if ( MCUi_ReadRegister( MCU_REG_BATTELY ) < 0x02 )
+    //if ( MCUi_ReadRegister( MCU_REG_IRQ ) & MCU_IRQ_NO_BATTELY )
+}
+
+/***************************************************************
+    EraseAll
+
+    不正終了しました
+    いろいろ消してください
+    DSモードにして終わるのがよいか？
+***************************************************************/
+static void EraseAll(void)
+{
+#ifdef SDK_FINALROM
+    MI_CpuClearFast( (void*)HW_TWL_ROM_HEADER_BUF, HW_TWL_ROM_HEADER_BUF_SIZE );
+    OS_BootFromFIRM();
+#endif
+}
+
+/***************************************************************
+    FsInit
+
+    FS周りの初期化
+***************************************************************/
+extern void*   SDNandContext;  /* NAND初期化パラメータ */
+static BOOL FsInit(void)
+{
+    /* FATFSライブラリ用にカレントヒープに設定 */
+    /* WRAM上のfatfsHeapをメインメモリヒープとして登録している */
+    {
+        OSHeapHandle hh;
+        u8     *lo = (u8*)fatfsHeap;
+        u8     *hi = (u8*)fatfsHeap + FATFS_HEAP_SIZE;
+        lo = OS_InitAlloc(OS_ARENA_MAIN_SUBPRIV, lo, hi, 1);
+        OS_SetArenaLo(OS_ARENA_MAIN_SUBPRIV, lo);
+        hh = OS_CreateHeap(OS_ARENA_MAIN_SUBPRIV, OS_GetSubPrivArenaLo(), hi);
+        OS_SetCurrentHeap(OS_ARENA_MAIN_SUBPRIV, hh);
+    }
+
+    // 3: after OS_CreateHeap
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x85
+
+    SDNandContext = &OSi_GetFromFirmAddr()->SDNandContext;
+
+    //FS_Init( FS_DMA_NO ); // just CARD_Init
+    //FS_CreateReadServerThread( THREAD_PRIO_FS );  // just CARD_SetThreadPriority
+
+    if ( !FATFS_Init( FATFS_DMA_NOT_USE, THREAD_PRIO_FATFS ) )
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
+
+void TwlSpMain( void )
+{
+    InitDebugLED();
+    SetDebugLED(++step);  // 0x81
+
+    PreInit();
+
+    // 0: before PXI
+    PUSH_PROFILE();
+    SetDebugLED(++step);  // 0x82
+
+    OS_InitFIRM();
+    OS_EnableIrq();
+    OS_EnableInterrupts();
+
+    // 1: after PXI
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x83
+
+    PM_InitFIRM();
+    AES_Init();
+
+    // 2: after PM_InitFIRM
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x84
+
+    PM_BackLightOn( FALSE );
+
+    if ( !FsInit() )
+    {
+        OS_TPrintf("Failed to call FsInit().\n");
+        goto end;
+    }
+
+    // 4: after FS_Init
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x86
+
+    PM_BackLightOn( FALSE );
+
+PXI_RecvID();
+SetDebugLED(0x01);
+PXI_RecvID();
+SetDebugLED(0x02);
+
+    // 5:
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x87
+
+    //PM_BackLightOn( FALSE );
+
+    // 6:
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x88
+
+    //PM_BackLightOn( FALSE );
+
+    // 7:
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x89
+
+    //PM_BackLightOn( FALSE );
+
+    if ( PXI_RecvID() != FIRM_PXI_ID_DONE_HEADER )
+    {
+        OS_TPrintf("PXI_RecvID() was received invalid value (!=FIRM_PXI_ID_DONE_HEADER).\n");
+        goto end;
+    }
+
+    // 8: after PXI
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x8a
+
+    PM_BackLightOn( FALSE );
+
+    AESi_InitKeysFIRM();
+    AESi_RecvSeed();
+
+    // 9: after AESi_RecvSeed
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x8b
+
+    PM_BackLightOn( FALSE );
+
+    // 10:
+    PUSH_PROFILE();
+    SetDebugLED(++step); // 0x8c
+
+    //PM_BackLightOn( FALSE );
+
+    if ( PXI_RecvID() != FIRM_PXI_ID_DONE_STATIC )
+    {
+        OS_TPrintf("PXI_RecvID() was received invalid value (!=FIRM_PXI_ID_DONE_STATIC).\n");
+        goto end;
+    }
+
+    // 11: after PXI
+    PUSH_PROFILE();
+#ifdef PROFILE_ENABLE
+    {
+        int i;
+        MI_CpuCopy8( profile, (void*)0x02000080, sizeof(profile) );
+        PXI_RecvID();
+        OS_TPrintf("\n[ARM7] Begin\n");
+        for (i = 0; i < PROFILE_MAX; i++)
+        {
+//            OS_TPrintf("0x%08X\n", profile[i]);
+            if ( !profile[i] ) break;
+            OS_TPrintf("%2d: %7d usec", i, profile[i]);
+            if (i)
+            {
+                OS_TPrintf(" ( %7d usec )\n", profile[i]-profile[i-1]);
+            }
+            else
+            {
+                OS_TPrintf("\n");
+            }
+        }
+        OS_TPrintf("\n[ARM7] End\n");
+    }
+#endif
+    SetDebugLED( 0 );
+    PM_BackLightOn( TRUE ); // last chance
+
+    OS_BootFromFIRM();
+
+end:
+    SetDebugLED( (u8)(0xF0 | step));
+
+    EraseAll();
+
+    // failed
+//    while (1)
+    {
+        PXI_NotifyID( FIRM_PXI_ID_ERR );
+    }
+    OS_Terminate();
+}
+
diff --git a/build/nandfirm/menu-launcher2/ARM9/Makefile b/build/nandfirm/menu-launcher2/ARM9/Makefile
new file mode 100644
index 00000000..9dd3ac33
--- /dev/null
+++ b/build/nandfirm/menu-launcher2/ARM9/Makefile
@@ -0,0 +1,55 @@
+#! make -f
+#----------------------------------------------------------------------------
+# Project:  TwlFirm - nandfirm - menu-launcher2
+# File:     Makefile
+#
+# Copyright 2007 Nintendo.  All rights reserved.
+#
+# These coded instructions, statements, and computer programs contain
+# proprietary information of Nintendo of America Inc. and/or Nintendo
+# Company Ltd., and are protected by Federal copyright law.  They may
+# not be disclosed to third parties or copied or duplicated in any form,
+# in whole or in part, without the prior written consent of Nintendo.
+#
+# $Date::            $
+# $Rev:$
+# $Author:$
+#----------------------------------------------------------------------------
+
+SUBDIRS		=
+
+LINCLUDES	=   ../include
+
+#----------------------------------------------------------------------------
+
+TARGET_BIN	=	menu_launcher2_9.srl
+
+SRCS		=	main.c
+
+CRT0_O		=	crt0_firm.o
+
+MAKEROM_ARM7		=	../ARM7/bin/$(TWL_BUILDTYPE_ARM7)/menu_launcher2_7.tef
+MAKEROM_ARM7_BASE       =       $(basename $(MAKEROM_ARM7))
+
+#LCFILE_TEMPLATE =	$(FIRM_SPECDIR)/$(TWL_PROC)-$(TWL_PLATFORM)-PARTNER.lcf.template
+
+#SRCDIR		=	# using default
+#LCFILE		=	# using default
+
+
+include	$(TWL_IPL_RED_ROOT)/build/buildtools/commondefs
+
+# no thumb version
+
+#LLIBRARIES	+=	libese$(TWL_LIBSUFFIX).a
+LLIBRARIES	+=	libese.TWL$(ARCHGEN_TYPE).a
+
+#----------------------------------------------------------------------------
+
+do-build:		$(TARGETS)
+
+
+include	$(TWL_IPL_RED_ROOT)/build/buildtools/modulerules
+
+
+#===== End of Makefile =====
diff --git a/build/nandfirm/menu-launcher2/ARM9/main.c b/build/nandfirm/menu-launcher2/ARM9/main.c
new file mode 100644
index 00000000..ae7749ad
--- /dev/null
+++ b/build/nandfirm/menu-launcher2/ARM9/main.c
@@ -0,0 +1,273 @@
+/*---------------------------------------------------------------------------*
+  Project:  TwlFirm - nandfirm - menu-launcher2
+  File:     main.c
+
+  Copyright 2007 Nintendo.  All rights reserved.
+
+  These coded instructions, statements, and computer programs contain
+  proprietary information of Nintendo of America Inc. and/or Nintendo
+  Company Ltd., and are protected by Federal copyright law.  They may
+  not be disclosed to third parties or copied or duplicated in any form,
+  in whole or in part, without the prior written consent of Nintendo.
+
+  $Date::            $
+  $Rev$
+  $Author$
+ *---------------------------------------------------------------------------*/
+#include <firm.h>
+#include <twl/aes.h>
+
+/* 鍵はどこへ？ */
+#if 0
+#define RSA_KEY_ADDR    OSi_GetFromFirmAddr()->rsa_pubkey[7]
+#else
+#define RSA_KEY_ADDR    rsa_key
+static const u8 rsa_key[128] =
+{
+    0xdf, 0x56, 0x30,
+    0xc9, 0xae, 0x05, 0x55, 0xe8, 0xdf, 0xbe, 0xe6, 0xb9, 0x30, 0xb9, 0x76, 0x93, 0xb4, 0xc2, 0x20,
+    0xe7, 0xae, 0x4c, 0x3e, 0xc3, 0xed, 0x27, 0xcf, 0x5d, 0x4f, 0xb5, 0x7d, 0xde, 0x38, 0xbc, 0xfe,
+    0x25, 0x32, 0xd8, 0x23, 0x98, 0x52, 0xb5, 0xda, 0xf7, 0x39, 0xdc, 0xb3, 0x0a, 0x94, 0x7a, 0x2b,
+    0x79, 0xe6, 0xe0, 0x4c, 0xbc, 0x21, 0xbd, 0x59, 0xb2, 0xc7, 0xf1, 0xc0, 0xf1, 0xfb, 0x29, 0x75,
+    0xa1, 0x21, 0x93, 0x01, 0x29, 0x1c, 0x9a, 0xe1, 0x2d, 0x55, 0xfc, 0x7b, 0xb8, 0xcb, 0x07, 0x33,
+    0xc5, 0x91, 0x0d, 0xc8, 0x45, 0x59, 0xef, 0xbe, 0x58, 0xc7, 0xc1, 0x1d, 0xd5, 0xf2, 0xcf, 0x1f,
+    0xe0, 0x6d, 0x21, 0x00, 0xcd, 0x42, 0xd8, 0x84, 0x85, 0xe3, 0xb2, 0x02, 0x1a, 0xa5, 0x89, 0x02,
+    0xa1, 0x96, 0xc6, 0xf7, 0x61, 0x68, 0x66, 0xe6, 0x65, 0x12, 0xb7, 0xf1, 0x49
+};
+#endif
+
+#define RSA_HEAP_SIZE   (4*1024)    // RSA用ヒープサイズ (サイズ調整必要)
+
+static u8 acHeap[RSA_HEAP_SIZE] __attribute__ ((aligned (32)));
+static SVCSignHeapContext acPool;
+
+#define MENU_TITLE_ID 0x0001000152434e4cULL
+
+/*
+    PROFILE_ENABLE を定義するとある程度のパフォーマンスチェックができます。
+    利用するためには、main.cかどこかに、u32 profile[256]; u32 pf_cnt = 0; を
+    定義する必要があります。
+*/
+#define PROFILE_ENABLE
+
+//#ifdef SDK_FINALROM // FINALROMで無効化
+//#undef PROFILE_ENABLE
+//#endif
+
+#ifdef PROFILE_ENABLE
+#define PROFILE_MAX  16
+u32 profile[PROFILE_MAX];
+u32 pf_cnt = 0;
+#define PUSH_PROFILE()  (profile[pf_cnt++] = (u32)OS_TicksToMicroSeconds(OS_GetTick()))
+#else
+#define PUSH_PROFILE()  ((void)0)
+#endif
+
+/***************************************************************
+    PreInit
+
+    FromBootの対応＆OS_Init前に必要なメインメモリの初期化
+***************************************************************/
+static void PreInit(void)
+{
+    static const OSMountInfo    firmSettings[] =
+    {
+        { 'F', OS_MOUNT_DEVICE_NAND, OS_MOUNT_TGT_ROOT, 0, OS_MOUNT_RSC_WRAM, (OS_MOUNT_USR_R|OS_MOUNT_USR_W), 0, 0, "nand",    "/" },
+        { 0 }
+    };
+    /*
+     メインメモリ関連
+    */
+    // SHARED領域クリア
+    MI_CpuClearFast((void *)HW_WRAM_EX_LOCK_BUF,        (HW_WRAM_EX_LOCK_BUF_END - HW_WRAM_EX_LOCK_BUF));
+    MI_CpuClearFast((void *)HW_BIOS_EXCP_STACK_MAIN,    (HW_REAL_TIME_CLOCK_BUF - HW_BIOS_EXCP_STACK_MAIN));
+    MI_CpuClearFast((void *)HW_PXI_SIGNAL_PARAM_ARM9,   (HW_MMEMCHECKER_MAIN - HW_PXI_SIGNAL_PARAM_ARM9));
+    MI_CpuClearFast((void*)HW_ROM_HEADER_BUF,           (HW_ROM_HEADER_BUF_END-HW_ROM_HEADER_BUF));
+
+    // FS_MOUNT領域の初期化
+    MI_CpuCopy8(firmSettings, (char*)HW_TWL_FS_MOUNT_INFO_BUF, sizeof(firmSettings));
+
+    /*
+        FromBrom関連
+    */
+    if ( !OSi_FromBromToMenu() )
+    {
+        OS_Terminate();
+    }
+}
+
+/***************************************************************
+    PostInit
+
+    各種初期化
+***************************************************************/
+static void PostInit(void)
+{
+    AES_Init();
+    // RSA用ヒープ設定
+    SVC_InitSignHeap( &acPool, acHeap, sizeof(acHeap) );
+    // HMAC用鍵準備
+    FS_SetDigestKey( NULL );
+    // FS/FATFS初期化
+    FS_InitFIRM();
+}
+
+/***************************************************************
+    CheckHeader
+
+    ヘッダがシステムメニューとして問題ないかチェック
+    先頭32Bは固定値と思われ (リマスターバージョンは違うかな)
+***************************************************************/
+static BOOL CheckHeader(void)
+{
+    static ROM_Header_Short* const rhs = (ROM_Header_Short*)HW_TWL_ROM_HEADER_BUF;
+    // TODO
+    // イニシャルコード
+    OS_TPrintf("Initial Code        : %08X\n", rhs->game_code);
+    // エントリポイント
+    OS_TPrintf("ARM9 Entry point    : %08X\n", rhs->main_entry_address);
+    OS_TPrintf("ARM7 Entry point    : %08X\n", rhs->sub_entry_address);
+    // ロード範囲
+    OS_TPrintf("ARM9 ROM address    : %08X\n", rhs->main_rom_offset);
+    OS_TPrintf("ARM9 RAM address    : %08X\n", rhs->main_ram_address);
+    OS_TPrintf("ARM9 size           : %08X\n", rhs->main_size);
+    OS_TPrintf("ARM7 ROM address    : %08X\n", rhs->sub_rom_offset);
+    OS_TPrintf("ARM7 RAM address    : %08X\n", rhs->sub_ram_address);
+    OS_TPrintf("ARM7 size           : %08X\n", rhs->sub_size);
+    OS_TPrintf("ARM9 LTD ROM address: %08X\n", rhs->main_ltd_rom_offset);
+    OS_TPrintf("ARM9 LTD RAM address: %08X\n", rhs->main_ltd_ram_address);
+    OS_TPrintf("ARM9 LTD size       : %08X\n", rhs->main_ltd_size);
+    OS_TPrintf("ARM7 LTD ROM address: %08X\n", rhs->sub_ltd_rom_offset);
+    OS_TPrintf("ARM7 LTD RAM address: %08X\n", rhs->sub_ltd_ram_address);
+    OS_TPrintf("ARM7 LTD size       : %08X\n", rhs->sub_ltd_size);
+    return TRUE;
+}
+
+/***************************************************************
+    EraseAll
+
+    不正終了しました
+    いろいろ消してください
+    DSモードにして終わるのがよいか？
+***************************************************************/
+static void EraseAll(void)
+{
+#ifdef SDK_FINALROM
+    MI_CpuClearFast( (void*)HW_TWL_ROM_HEADER_BUF, HW_TWL_ROM_HEADER_BUF_SIZE );
+    OS_BootFromFIRM();
+#endif
+}
+
+void TwlMain( void )
+{
+    FSFile file;
+
+    PreInit();
+
+    // 0: before PXI
+    PUSH_PROFILE();
+
+    OS_InitFIRM();
+    OS_EnableIrq();
+    OS_EnableInterrupts();
+
+#ifdef PROFILE_ENABLE
+    OS_InitTick();
+#endif
+    // 1: after PXI
+    PUSH_PROFILE();
+PXI_NotifyID( FIRM_PXI_ID_NULL );
+
+    PostInit();
+
+    // 2: after PostInit
+    PUSH_PROFILE();
+PXI_NotifyID( FIRM_PXI_ID_NULL );
+
+    if ( !FS_ResolveSrl( MENU_TITLE_ID ) )
+    {
+        OS_TPrintf("Failed to call FS_ResolveSrl( 0x%016llx ).\n", MENU_TITLE_ID);
+        goto end;
+    }
+
+    // 3: after FS_ResolveSrl
+    PUSH_PROFILE();
+
+    if ( !FS_OpenSrl( &file ) )
+    {
+        OS_TPrintf("Failed to call FS_OpenSrl().\n");
+        goto end;
+    }
+
+    // 4: after FS_OpenSrl
+    PUSH_PROFILE();
+
+    if ( !FS_LoadSrlHeader( &file, &acPool, RSA_KEY_ADDR ) || !CheckHeader() )
+    {
+        OS_TPrintf("Failed to call FS_LoadSrlHeader() and/or CheckHeader().\n");
+        goto end;
+    }
+
+    // 5: after FS_LoadSrlHeader
+    PUSH_PROFILE();
+
+    PXI_NotifyID( FIRM_PXI_ID_DONE_HEADER );
+
+    // 6: after PXI
+    PUSH_PROFILE();
+
+    AESi_SendSeed( FS_GetAesKeySeed() );
+
+    // 7: after AESi_SendSeed
+    PUSH_PROFILE();
+
+    if ( !FS_LoadSrlStatic( &file ) )
+    {
+        OS_TPrintf("Failed to call FS_LoadSrlStatic().\n");
+        goto end;
+    }
+
+    // 8: after FS_LoadSrlStatic
+    PUSH_PROFILE();
+
+    PXI_NotifyID( FIRM_PXI_ID_DONE_STATIC );
+
+    // 9: after PXI
+    PUSH_PROFILE();
+#ifdef PROFILE_ENABLE
+    {
+        int i;
+        OS_TPrintf("\n[ARM9] Begin\n");
+        for (i = 0; i < PROFILE_MAX; i++)
+        {
+//            OS_TPrintf("0x%08X\n", profile[i]);
+            if ( !profile[i] ) break;
+            OS_TPrintf("%2d: %7d usec", i, profile[i]);
+            if (i)
+            {
+                OS_TPrintf(" ( %7d usec )\n", profile[i]-profile[i-1]);
+            }
+            else
+            {
+                OS_TPrintf("\n");
+            }
+        }
+        OS_TPrintf("\n[ARM9] End\n");
+        MI_CpuCopy8( profile, (void*)0x02000000, sizeof(profile) );
+        PXI_NotifyID( FIRM_PXI_ID_NULL );
+    }
+#endif
+
+    OS_BootFromFIRM();
+
+end:
+    EraseAll();
+
+    // failed
+//    while (1)
+    {
+        PXI_NotifyID( FIRM_PXI_ID_ERR );
+    }
+    OS_Terminate();
+}
+
diff --git a/build/nandfirm/menu-launcher2/Makefile b/build/nandfirm/menu-launcher2/Makefile
new file mode 100644
index 00000000..d911835d
--- /dev/null
+++ b/build/nandfirm/menu-launcher2/Makefile
@@ -0,0 +1,52 @@
+#! make -f
+#----------------------------------------------------------------------------
+# Project:  TwlFirm - nandfirm - menu-launcher2
+# File:     Makefile
+#
+# Copyright 2007 Nintendo.  All rights reserved.
+#
+# These coded instructions, statements, and computer programs contain
+# proprietary information of Nintendo of America Inc. and/or Nintendo
+# Company Ltd., and are protected by Federal copyright law.  They may
+# not be disclosed to third parties or copied or duplicated in any form,
+# in whole or in part, without the prior written consent of Nintendo.
+#
+# $Date::            $
+# $Rev:$
+# $Author:$
+#----------------------------------------------------------------------------
+
+
+# if you have valid keys, set environment value like below
+#export TWL_KEYSDIR='$(FIRM_ROOT)/../twl_firmware/bootrom/build/keys'
+
+
+#----------------------------------------------------------------------------
+
+SUBDIRS =	\
+            wram_regs \
+            ARM7 \
+            ARM9 \
+
+TARGET_FIRM_BIN		=	menu_launcher2-$(TWL_BUILD_TYPE)$(CODEGEN_ARCH).nand
+BINDIR			=	.
+MAKEFIRM_ARM9		=	ARM9/bin/$(TWL_BUILDTYPE_ARM9)/menu_launcher2_9.tef
+MAKEFIRM_ARM7		=	ARM7/bin/$(TWL_BUILDTYPE_ARM7)/menu_launcher2_7.tef
+MAKEFIRM_RSA_PRVKEY	=	$(TWL_KEYSDIR)/rsa/private_nand.der
+LDEPENDS_BIN		+=	wram_regs/wram_regs.rbin
+
+MAKEFIRM_FLAGS		+=	-p
+FIRM_SPEC		=	nandfirm.nandsf
+
+LDIRT_CLEAN		+=	$(TARGETS) \
+				rsa_public.sbin \
+
+include	$(TWL_IPL_RED_ROOT)/build/buildtools/commondefs
+
+#----------------------------------------------------------------------------
+
+do-build:	$(TARGET_BIN)
+
+include	$(TWL_IPL_RED_ROOT)/build/buildtools/modulerules
+
+#===== End of Makefile =====
diff --git a/build/nandfirm/menu-launcher2/nandfirm.nandsf b/build/nandfirm/menu-launcher2/nandfirm.nandsf
new file mode 100644
index 00000000..cdea8b16
--- /dev/null
+++ b/build/nandfirm/menu-launcher2/nandfirm.nandsf
@@ -0,0 +1,24 @@
+#NANDSF ---  Nandfirm Spec File
+
+VERSION :		GENERATE
+
+RSA_KEY :		$(MAKEFIRM_RSA_PRVKEY)
+OUT_KEY :		rsa_public.sbin
+
+WRAM_RBIN:		./wram_regs/wram_regs.rbin
+
+MIRROR_OFS:		0x100000
+
+DECOMP_PROC :	ARM9  # ARM9 or ARM7
+
+ARM9_COMP :		FALSE  # TRUE or FALSE, should be before ARM9_SBIN
+ARM9_SBIN :		$(MAKEFIRM_ARM9).TWL.FLX.sbin
+ARM9_ELF :		$(MAKEFIRM_ARM9).tef
+
+ARM7_COMP :		FALSE  # TRUE or FALSE, should be before ARM7_SBIN
+ARM7_SBIN :		$(MAKEFIRM_ARM7).TWL.FLX.sbin
+ARM7_ELF :		$(MAKEFIRM_ARM7).tef
+
+ARM9_X2 :		TRUE   # TRUE or FALSE
+
+NCD_ROMOFS :	0x0f00
diff --git a/build/nandfirm/menu-launcher2/wram_regs/Makefile b/build/nandfirm/menu-launcher2/wram_regs/Makefile
new file mode 100644
index 00000000..cdd48383
--- /dev/null
+++ b/build/nandfirm/menu-launcher2/wram_regs/Makefile
@@ -0,0 +1,57 @@
+#! make -f
+#----------------------------------------------------------------------------
+# Project:  TwlFirm - nandfirm - menu-launcher2
+# File:     Makefile
+#
+# Copyright 2007 Nintendo.  All rights reserved.
+#
+# These coded instructions, statements, and computer programs contain
+# proprietary information of Nintendo of America Inc. and/or Nintendo
+# Company Ltd., and are protected by Federal copyright law.  They may
+# not be disclosed to third parties or copied or duplicated in any form,
+# in whole or in part, without the prior written consent of Nintendo.
+#
+# $Date::            $
+# $Rev:$
+# $Author:$
+#----------------------------------------------------------------------------
+
+override TARGET_PLATFORM	:= TWL
+override TARGET_CODEGEN		:= ARM
+override TWL_ARCHGEN		:= LIMITED
+
+override TARGET_FINALROM	:= TRUE
+override TARGET_RELEASE		:=
+override TARGET_DEBUG		:=
+
+SUBDIRS		=
+
+LINCLUDES	=   ../include
+
+
+#----------------------------------------------------------------------------
+
+TARGET_BIN	=	wram_regs.rbin
+
+SRCS		=	\
+                wram_regs.c \
+
+#SRCDIR		=	# using default
+#LCFILE		=	# using default
+
+
+include	$(TWL_IPL_RED_ROOT)/build/buildtools/commondefs
+
+INSTALL_DIR	= .
+INSTALL_TARGETS	= $(BINDIR)/$(TARGET_BIN)
+
+
+#----------------------------------------------------------------------------
+
+do-build:		$(TARGETS)
+
+
+include	$(TWL_IPL_RED_ROOT)/build/buildtools/modulerules
+
+
+#===== End of Makefile =====
diff --git a/build/nandfirm/menu-launcher2/wram_regs/wram_regs.c b/build/nandfirm/menu-launcher2/wram_regs/wram_regs.c
new file mode 100644
index 00000000..2454b302
--- /dev/null
+++ b/build/nandfirm/menu-launcher2/wram_regs/wram_regs.c
@@ -0,0 +1,91 @@
+/*---------------------------------------------------------------------------*
+  Project:  TwlFirm - tools - nandfirm
+  File:     wram_regs.c
+
+  Copyright 2007 Nintendo.  All rights reserved.
+
+  These coded instructions, statements, and computer programs contain
+  proprietary information of Nintendo of America Inc. and/or Nintendo
+  Company Ltd., and are protected by Federal copyright law.  They may
+  not be disclosed to third parties or copied or duplicated in any form,
+  in whole or in part, without the prior written consent of Nintendo.
+
+  $Date::            $
+  $Rev$
+  $Author$
+ *---------------------------------------------------------------------------*/
+#include <twl/mi.h>
+#include <firm/format/wram_regs.h>
+
+MIHeader_WramRegs wram_regs_init =
+{
+    // ARM9
+    {
+        REG_MI_MBK_A0_FIELD( 1, MI_WRAM_A_OFFSET_0KB  , MI_WRAM_ARM9 ),
+        REG_MI_MBK_A1_FIELD( 1, MI_WRAM_A_OFFSET_64KB , MI_WRAM_ARM9 ),
+        REG_MI_MBK_A2_FIELD( 1, MI_WRAM_A_OFFSET_128KB, MI_WRAM_ARM9 ),
+        REG_MI_MBK_A3_FIELD( 1, MI_WRAM_A_OFFSET_192KB, MI_WRAM_ARM9 ),
+    },
+    {
+        REG_MI_MBK_B0_FIELD( 1, MI_WRAM_BC_OFFSET_0KB  , MI_WRAM_ARM7 ),
+        REG_MI_MBK_B1_FIELD( 1, MI_WRAM_BC_OFFSET_32KB , MI_WRAM_ARM7 ),
+        REG_MI_MBK_B2_FIELD( 1, MI_WRAM_BC_OFFSET_64KB , MI_WRAM_ARM7 ),
+        REG_MI_MBK_B3_FIELD( 1, MI_WRAM_BC_OFFSET_96KB , MI_WRAM_ARM7 ),
+        REG_MI_MBK_B4_FIELD( 1, MI_WRAM_BC_OFFSET_128KB, MI_WRAM_ARM7 ),
+        REG_MI_MBK_B5_FIELD( 1, MI_WRAM_BC_OFFSET_160KB, MI_WRAM_ARM7 ),
+        REG_MI_MBK_B6_FIELD( 1, MI_WRAM_BC_OFFSET_192KB, MI_WRAM_ARM7 ),
+        REG_MI_MBK_B7_FIELD( 1, MI_WRAM_BC_OFFSET_224KB, MI_WRAM_ARM7 ),
+    },
+    {
+        REG_MI_MBK_C0_FIELD( 1, MI_WRAM_BC_OFFSET_0KB  , MI_WRAM_ARM7 ),
+        REG_MI_MBK_C1_FIELD( 1, MI_WRAM_BC_OFFSET_32KB , MI_WRAM_ARM7 ),
+        REG_MI_MBK_C2_FIELD( 1, MI_WRAM_BC_OFFSET_64KB , MI_WRAM_ARM7 ),
+        REG_MI_MBK_C3_FIELD( 1, MI_WRAM_BC_OFFSET_96KB , MI_WRAM_ARM7 ),
+        REG_MI_MBK_C4_FIELD( 1, MI_WRAM_BC_OFFSET_128KB, MI_WRAM_ARM7 ),
+        REG_MI_MBK_C5_FIELD( 1, MI_WRAM_BC_OFFSET_160KB, MI_WRAM_ARM7 ),
+        REG_MI_MBK_C6_FIELD( 1, MI_WRAM_BC_OFFSET_192KB, MI_WRAM_ARM7 ),
+        REG_MI_MBK_C7_FIELD( 1, MI_WRAM_BC_OFFSET_224KB, MI_WRAM_ARM7 ),
+    },
+    REG_MI_MBK6_FIELD(  REG_WRAM_MAP_CONV_ADDR( 6, A, EADDR, HW_WRAM_AREA_HALF ),
+                        MI_WRAM_IMAGE_256KB,
+                        REG_WRAM_MAP_CONV_ADDR( 6, A, SADDR, HW_WRAM_AREA_HALF - HW_WRAM_A_SIZE )
+                        ),
+    REG_MI_MBK7_FIELD(  REG_WRAM_MAP_CONV_ADDR( 7, B, EADDR, HW_WRAM_AREA + HW_WRAM_B_SIZE ),
+                        MI_WRAM_IMAGE_256KB,
+                        REG_WRAM_MAP_CONV_ADDR( 7, B, SADDR, HW_WRAM_AREA )
+                        ),
+    REG_MI_MBK8_FIELD(  REG_WRAM_MAP_CONV_ADDR( 8, C, EADDR, MI_WRAM_MAP_NULL ),
+                        MI_WRAM_IMAGE_256KB,
+                        REG_WRAM_MAP_CONV_ADDR( 8, C, SADDR, MI_WRAM_MAP_NULL )
+                        ),
+
+    // ARM7
+    REG_MI_MBK6_FIELD(  REG_WRAM_MAP_CONV_ADDR( 6, A, EADDR, MI_WRAM_MAP_NULL ),
+                        MI_WRAM_IMAGE_256KB,
+                        REG_WRAM_MAP_CONV_ADDR( 6, A, SADDR, MI_WRAM_MAP_NULL )
+                        ),
+    REG_MI_MBK7_FIELD(  REG_WRAM_MAP_CONV_ADDR( 7, B, EADDR, HW_WRAM_AREA + HW_WRAM_B_SIZE ),
+                        MI_WRAM_IMAGE_256KB,
+                        REG_WRAM_MAP_CONV_ADDR( 7, B, SADDR, HW_WRAM_AREA )
+                        ),
+    REG_MI_MBK8_FIELD(  REG_WRAM_MAP_CONV_ADDR( 8, C, EADDR, HW_WRAM_AREA_HALF - HW_WRAM_SIZE ),
+                        MI_WRAM_IMAGE_256KB,
+                        REG_WRAM_MAP_CONV_ADDR( 8, C, SADDR, HW_WRAM_AREA_HALF - HW_WRAM_SIZE - HW_WRAM_C_SIZE )
+                        ),
+
+    // WRAM Lock
+    {
+        0,
+        0,
+        0,
+    },
+
+    // WRAM-0/1
+    3,
+
+    // VRAM-C
+    7,
+    // VRAM-D
+    7,
+};
+
diff --git a/include/firm/aes/ARM7/aes_init.h b/include/firm/aes/ARM7/aes_init.h
index 9ac381ac..aab67345 100644
--- a/include/firm/aes/ARM7/aes_init.h
+++ b/include/firm/aes/ARM7/aes_init.h
@@ -18,6 +18,8 @@
 #ifndef TWL_AES_AES_INIT_H_
 #define TWL_AES_AES_INIT_H_
 
+#include <twl/os/common/format_rom.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -37,6 +39,21 @@ extern "C" {
  *---------------------------------------------------------------------------*/
 void AESi_InitKeysForApp( u8 game_code[4] );
 
+/*---------------------------------------------------------------------------*
+  Name:         AESi_InitKeysFIRM
+
+  Description:  set IDs depending on the application.
+                you SHOULD NOT touch any ID registers after this call.
+
+  Arguments:    game_code   game code
+
+  Returns:      None
+ *---------------------------------------------------------------------------*/
+static inline void AESi_InitKeysFIRM( void )
+{
+    AESi_InitKeysForApp( (u8*)((ROM_Header_Short*)HW_TWL_ROM_HEADER_BUF)->game_code );
+}
+
 /*---------------------------------------------------------------------------*
   Name:         AESi_RecvSeed
 
diff --git a/include/firm/aes/ARM9/aes_init.h b/include/firm/aes/ARM9/aes_init.h
index eb2ea0cf..8d3cfbe7 100644
--- a/include/firm/aes/ARM9/aes_init.h
+++ b/include/firm/aes/ARM9/aes_init.h
@@ -37,9 +37,8 @@ extern "C" {
 
   Returns:      None
  *---------------------------------------------------------------------------*/
-static inline void AESi_SendSeed( AESKey *pSeed )
+static inline void AESi_SendSeed( const AESKey *pSeed )
 {
-//    PXI_SendDataByFifo( PXI_FIFO_TAG_DATA, pSeed, AES_BLOCK_SIZE );
     PXI_SendStream( pSeed, AES_BLOCK_SIZE );
 }
 
diff --git a/include/firm/fs/ARM9/fs_firm.h b/include/firm/fs/ARM9/fs_firm.h
index 196e1e19..d7599812 100644
--- a/include/firm/fs/ARM9/fs_firm.h
+++ b/include/firm/fs/ARM9/fs_firm.h
@@ -35,6 +35,28 @@ extern "C" {
  *---------------------------------------------------------------------------*/
 void FS_InitFIRM( void );
 
+/*---------------------------------------------------------------------------*
+  Name:         FS_GetAesKeySeed
+
+  Description:  retreive aes key seed in the signature
+
+  Arguments:    None
+
+  Returns:      pointer to seed
+ *---------------------------------------------------------------------------*/
+AESKey* const FS_GetAesKeySeed( void );
+
+/*---------------------------------------------------------------------------*
+  Name:         FS_DeleteAesKeySeed
+
+  Description:  delete aes key seed in the signature
+
+  Arguments:    None
+
+  Returns:      None
+ *---------------------------------------------------------------------------*/
+void FS_DeleteAesKeySeed( void );
+
 /*---------------------------------------------------------------------------*
   Name:         FS_ResolveSrl
 
diff --git a/include/firm/hw/common/mmap_firm.h b/include/firm/hw/common/mmap_firm.h
index 4e3e0c05..b0635bd6 100644
--- a/include/firm/hw/common/mmap_firm.h
+++ b/include/firm/hw/common/mmap_firm.h
@@ -32,6 +32,10 @@ extern "C" {
 #define HW_FIRM_LOAD_BUFFER_END         (HW_FIRM_LOAD_BUFFER_BASE + HW_FIRM_LOAD_BUFFER_SIZE)
 
 //------------------------------------- FS/FATFS
+#define HW_FIRM_FS_AES_BUFFER               0x2ff0000
+#define HW_FIRM_FS_AES_BUFFER_SIZE          (HW_FIRM_FS_AES_BUFFER_END - HW_FIRM_FS_AES_BUFFER)
+#define HW_FIRM_FS_AES_BUFFER_END           HW_FIRM_FATFS_COMMAND_BUFFER_END
+
 #define HW_FIRM_FATFS_COMMAND_BUFFER        (HW_FIRM_FATFS_COMMAND_BUFFER_END - HW_FIRM_FATFS_COMMAND_BUFFER_SIZE)
 #define HW_FIRM_FATFS_COMMAND_BUFFER_SIZE   FATFS_COMMAND_BUFFER_MAX    // 0x800
 #define HW_FIRM_FATFS_COMMAND_BUFFER_END    HW_FIRM_FS_TWMP_BUFFER      // 0x02ff8000