void *sys_unjail(struct thread *td) {

	struct ucred* cred;
	struct filedesc* fd;

	void* kbase = 0;
	uint8_t* kernel_ptr;
	void** got_prison0;
	void** got_rootvnode;


	fd = td->td_proc->p_fd;
	cred = td->td_proc->p_ucred;

	uint64_t fw_version = 0x999;

	if (!memcmp((char*)(&((uint8_t*)__readmsr(0xC0000082))[-KERN_505_XFAST_SYSCALL]), (char[4]) { 0x7F, 0x45, 0x4C, 0x46 }, 4)) {

		kbase = &((uint8_t*)__readmsr(0xC0000082))[-KERN_505_XFAST_SYSCALL];


		fw_version = 0x505;

	}

	else if (!memcmp((char*)(&((uint8_t*)__readmsr(0xC0000082))[-KERN_455_XFAST_SYSCALL]), (char[4]) { 0x7F, 0x45, 0x4C, 0x46 }, 4)) {

		kbase = &((uint8_t*)__readmsr(0xC0000082))[-KERN_455_XFAST_SYSCALL];

		fw_version = 0x455;
	}

	else if (!memcmp((char*)(&((uint8_t*)__readmsr(0xC0000082))[-KERN_455_XFAST_SYSCALL]), (char[4]) { 0x7F, 0x45, 0x4C, 0x46 }, 4)) {

		kbase = &((uint8_t*)__readmsr(0xC0000082))[-KERN_455_XFAST_SYSCALL];

		fw_version = 0x455;

	}
	else if (!memcmp((char*)(&((uint8_t*)__readmsr(0xC0000082))[-KERN_405_XFAST_SYSCALL]), (char[4]) { 0x7F, 0x45, 0x4C, 0x46 }, 4)) {
		fw_version = 0x405;

	}
	else return -1;

	if (fw_version == 0x505) {

		int(*printfkernel)(const char *fmt, ...) = (void *)(kbase + 0x436040);
		printfkernel("Syscall 9 Unjail invoked\n");
		printfkernel("FW Version 5.05 Detected\n");
	}

	else if (fw_version == 0x405) {

		int(*printfkernel)(const char *fmt, ...) = (void *)(kbase + KERN_405_PRINTF);
		printfkernel("FW Version 4.05 Detected\n");

	}
	else if (fw_version == 0x455) {

		int(*printfkernel)(const char *fmt, ...) = (void *)(kbase + KERN_455_PRINTF);
		printfkernel("Syscall 9 Unjail invoked\n");
		printfkernel("FW Version 4.55 Detected\n");

	}
	else if (fw_version == 0x501) {

		int(*printfkernel)(const char *fmt, ...) = (void *)(kbase + KERN_501_PRINTF);
		printfkernel("Syscall 9 Unjail invoked\n");
		printfkernel("FW Version 5.05 Detected\n");
	}
	else return -1;


	if (fw_version == 0x405) {


		// Kernel pointers resolving

		kernel_ptr = (uint8_t*)kbase;
		got_prison0 = (void**)&kernel_ptr[KERN_405_PRISON_0];
		got_rootvnode = (void**)&kernel_ptr[KERN_405_ROOTVNODE];

	}
	else if (fw_version == 0x455) {

		// Kernel pointers resolving

		kernel_ptr = (uint8_t*)kbase;
		got_prison0 = (void**)&kernel_ptr[KERN_455_PRISON_0];
		got_rootvnode = (void**)&kernel_ptr[KERN_455_ROOTVNODE];

	}
	else if (fw_version == 0x501) {

		// Kernel pointers resolving

		kernel_ptr = (uint8_t*)kbase;
		got_prison0 = (void**)&kernel_ptr[KERN_501_PRISON_0];
		got_rootvnode = (void**)&kernel_ptr[KERN_501_ROOTVNODE];

	}
	else if (fw_version == 0x505) {

		// Kernel pointers resolving

		kernel_ptr = (uint8_t*)kbase;
		got_prison0 = (void**)&kernel_ptr[KERN_505_PRISON_0];
		got_rootvnode = (void**)&kernel_ptr[KERN_505_ROOTVNODE];

	}
	else return -1;

	cred->cr_uid = 0;
	cred->cr_ruid = 0;
	cred->cr_rgid = 0;
	cred->cr_groups[0] = 0;
	cred->cr_prison = *got_prison0;
	fd->fd_rdir = fd->fd_jdir = *got_rootvnode;

	// Escalate ucred privs, needed for userland access to the filesystem e.g mounting & decrypting files

	void *td_ucred = *(void **)(((char *)td) + 304); // p_ucred == td_ucred

	uint64_t *sonyCred = (uint64_t *)(((char *)td_ucred) + 96);
	*sonyCred = 0xffffffffffffffff;

	// sceSblACMgrGetDeviceAccessType
	*(uint64_t *)(td_ucred + 0x60) = 0xFFFFFFFFFFFFFFFF;
	*(uint64_t *)(td_ucred + 0x58) = 0x3801000000000013;
	*(uint64_t *)(td_ucred + 0x68) = 0xFFFFFFFFFFFFFFFF;

	uint64_t *sceProcessAuthorityId = (uint64_t *)(((char *)td_ucred) + 88);
	*sceProcessAuthorityId = 0x3800000000000010; // SceShellcore paid
												 // sceSblACMgrHasSceProcessCapability

	uint64_t *sceProcCap = (uint64_t *)(((char *)td_ucred) + 104);
	*sceProcCap = 0xffffffffffffffff; // Max capability

	if (fw_version == 0x505) {

		// Kernel pointers resolving

		kernel_ptr = (uint8_t*)kbase;
		got_prison0 = (void**)&kernel_ptr[KERN_505_PRISON_0];
		got_rootvnode = (void**)&kernel_ptr[KERN_505_ROOTVNODE];

		int(*copyout)(const void *kaddr, void *uaddr, size_t len);

		copyout = (void *)(kbase + KERN_505_COPYOUT);

		cpu_disable_wp();

		*(uint8_t *)(kbase + 0xFCD48) = 3; // VM_PROT_DEFAULT;
		*(uint8_t *)(kbase + 0xFCD56) = 3; // VM_PROT_DEFAULT;

										   // patch vm_map_protect check
		memcpy((void *)(kbase + 0x1A3C08), "\x90\x90\x90\x90\x90\x90", 6);

		// Disable ptrace check

		kernel_ptr[0x30D9AA] = 0xEB;

		// Disable process aslr
		*(uint16_t*)&kernel_ptr[0x194875] = 0x9090;

		// Allow sys_dynlib_dlsym in all processes.
		*(uint16_t *)(kbase + 0x237F3B) = 0x01C1;
		//*(uint16_t *)(kbase + 0x237F3B) = 0x101C;

		// Don't restrict dynlib information.
		*(uint64_t *)(kbase + 0x2B2620) = 0x9090909090C3C031;

		// Allow usage of mangled symbols in dynlib_do_dlsym().
		*(uint16_t *)(kbase + 0x2AFB47) = 0x9090;
		*(uint16_t *)(kbase + 0x2AFB47 + 2) = 0x9090;
		*(uint16_t *)(kbase + 0x2AFB47 + 4) = 0x9090;

		*(uint32_t *)(kbase + 0x19ECEB0) = 0;

		*(uint8_t*)(kbase + 0x117B0) = 0xB0;
		*(uint8_t*)(kbase + 0x117B1) = 0x01;
		*(uint8_t*)(kbase + 0x117B2) = 0xC3;

		*(uint8_t*)(kbase + 0x117C0) = 0xB0;
		*(uint8_t*)(kbase + 0x117C1) = 0x01;
		*(uint8_t*)(kbase + 0x117C2) = 0xC3;

		*(uint8_t*)(kbase + 0x13F03F) = 0x31;
		*(uint8_t*)(kbase + 0x13F040) = 0xC0;
		*(uint8_t*)(kbase + 0x13F041) = 0x90;
		*(uint8_t*)(kbase + 0x13F042) = 0x90;
		*(uint8_t*)(kbase + 0x13F043) = 0x90;

		cpu_enable_wp();
	}
	else if (fw_version == 0x455) {


		kernel_ptr = (uint8_t*)kbase;
		got_prison0 = (void**)&kernel_ptr[KERN_455_PRISON_0];
		got_rootvnode = (void**)&kernel_ptr[KERN_455_ROOTVNODE];

		int(*copyout)(const void *kaddr, void *uaddr, size_t len);

		copyout = (void *)(kbase + KERN_455_COPYOUT);

		cpu_disable_wp();


		*(uint8_t*)(kbase + 0x143BF2) = 0x90; //0x0F
		*(uint8_t*)(kbase + 0x143BF3) = 0xE9; //0x84
		*(uint8_t*)(kbase + 0x143E0E) = 0x90; //0x74
		*(uint8_t*)(kbase + 0x143E0F) = 0x90; //0x0C

		cpu_enable_wp();

	}

	return 0;

}