So, I've spent the past 4 or 5 days fiddling with this to get it to work and it finally does, allows you to load a gigantic ELF into JIT, since apparently it's 32MB (and no RPX gets that big, even uncompressed because of the data section), and I just got it working. I've only tested it on my system but it should work on others if you have the ELF in the right place. It's provided as-is, with no warranty, feel free to do as you see fit. I'll get a better ELF documentation/structuring done soon. Technical Explanation If you wanna know how it works, I reused some code from FIX's ELF loader in libwiiu but I had to redo the whole thing because it was giving me lots of problems. It uses the very end of MEM1 (0xF5FFFFE0-FF) to store stuff while it works, then copies the ELF into 0xF5800000 (slightly before that), it might have trouble with bigger stuff so I'd suggest developing file loading using sockets. It uses a catch() function at the start so I can jump to it to recover ROP chains. All the ROP does is copy the loader to the very end of JIT, and then reruns all the ROP to copy sections into the start as needed and then jumps to it. Usage It searches for a URL with /payload, so host it somewhere with a URL like http://192.168.0.7/payload?elfloader, it'll cut off that part and load a file called boot.elf (http://192.168.0.7/boot.elf) Downloads?? Attached is libwiiu source for the ELF loader and the Hello World ELF I used to test. You can grab the code550.bin and host it wherever. It will probably only work on 5.5.X because of the ROP. Also had MrRean help me get this working, so thanks.