diff --git a/README.md b/README.md
index 81982c7..13330f7 100644
--- a/README.md
+++ b/README.md
@@ -83,6 +83,7 @@ You can find a template [Here](./res/hekate_ipl_template.ini)
 | kip1={SD folder}/*     | Loads every .kip/.kip1 inside a folder. Compatible with single kip1 keys. |
 | fss0={SD path}         | Takes a fusee-secondary binary and `extracts` all needed parts from it. kips, exosphere, warmboot and sept. |
 | fss0experimental=1     | Enables loading of experimental content from a FSS0 storage |
+| exofatal={SD path}     | Replaces the exosphere fatal binary for Mariko             |
 | kip1patch=patchname    | Enables a kip1 patch. Specify with multiple lines and/or as CSV. If not found, an error will show up |
 | fullsvcperm=1          | Disables SVC verification (full services permission)       |
 | debugmode=1            | Enables Debug mode. Obsolete when used with exosphere as secmon. |
diff --git a/bootloader/hos/fss.c b/bootloader/hos/fss.c
index 0fb04a9..84fa965 100644
--- a/bootloader/hos/fss.c
+++ b/bootloader/hos/fss.c
@@ -49,6 +49,7 @@ extern bool is_ipl_updated(void *buf, char *path, bool force);
 #define CNT_TYPE_EMC 8
 #define CNT_TYPE_KLD 9  // Kernel Loader.
 #define CNT_TYPE_KRN 10 // Kernel.
+#define CNT_TYPE_EXF 11 // Exosphere Mariko fatal payload.
 
 // FSS0 Content Flags.
 #define CNT_FLAG0_EXPERIMENTAL BIT(0)
@@ -197,6 +198,11 @@ int parse_fss(launch_ctxt_t *ctxt, const char *path, fss0_sept_t *sept_ctxt)
 					ctxt->secmon = content;
 					break;
 
+				case CNT_TYPE_EXF:
+					ctxt->exofatal_size = curr_fss_cnt[i].size;
+					ctxt->exofatal = content;
+					break;
+
 				case CNT_TYPE_WBT:
 					if (h_cfg.t210b01)
 						continue;
diff --git a/bootloader/hos/hos_config.c b/bootloader/hos/hos_config.c
index 038d3ee..a1a4ce9 100644
--- a/bootloader/hos/hos_config.c
+++ b/bootloader/hos/hos_config.c
@@ -261,6 +261,15 @@ static int _config_fss(launch_ctxt_t *ctxt, const char *value)
 	return parse_fss(ctxt, value, NULL);
 }
 
+static int _config_exo_fatal_payload(launch_ctxt_t *ctxt, const char *value)
+{
+	ctxt->exofatal = sd_file_read(value, &ctxt->exofatal_size);
+	if (!ctxt->exofatal)
+		return 0;
+
+	return 1;
+}
+
 typedef struct _cfg_handler_t
 {
 	const char *key;
@@ -278,6 +287,7 @@ static const cfg_handler_t _config_handlers[] = {
 	{ "stock", _config_stock },
 	{ "atmosphere", _config_atmosphere },
 	{ "fss0", _config_fss },
+	{ "exofatal", _config_exo_fatal_payload},
 	{ "emummcforce", _config_emummc_forced },
 	{ "nouserexceptions", _config_dis_exo_user_exceptions },
 	{ "userpmu", _config_exo_user_pmu_access },
diff --git a/bootloader/hos/secmon_exo.c b/bootloader/hos/secmon_exo.c
index e96a5e9..518955d 100644
--- a/bootloader/hos/secmon_exo.c
+++ b/bootloader/hos/secmon_exo.c
@@ -80,8 +80,10 @@ typedef struct _exo_cfg_t
 {
 	u32 magic;
 	u32 fwno;
-	u32 flags;
-	u32 reserved[5];
+	u32 flags[2];
+	u16 display_id;
+	u16 rsvd0;
+	u32 rsvd1[3];
 	exo_emummc_config_t emummc_cfg;
 } exo_cfg_t;
 
@@ -126,6 +128,9 @@ typedef struct _atm_fatal_error_ctx
 #define ATM_FATAL_ERR_CTX_ADDR 0x4003E000
 #define  ATM_FATAL_MAGIC       0x30454641 // AFE0
 
+#define ATM_EXO_FATAL_ADDR     0x80020000
+#define  ATM_EXO_FATAL_SIZE    0x20000
+
 #define ATM_WB_HEADER_OFF      0x244
 #define  ATM_WB_MAGIC          0x30544257 // WBT0
 
@@ -281,7 +286,8 @@ void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base, bool exo_new)
 	// Set mailbox values.
 	exo_cfg->magic = EXO_MAGIC_VAL;
 	exo_cfg->fwno = exoFwNo;
-	exo_cfg->flags = exoFlags;
+	exo_cfg->flags[0] = exoFlags;
+	exo_cfg->flags[1] = 0;
 
 	// If warmboot is lp0fw, add in RSA modulus.
 	volatile wb_cfg_t *wb_cfg = (wb_cfg_t *)(warmboot_base + ATM_WB_HEADER_OFF);
@@ -324,6 +330,17 @@ void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base, bool exo_new)
 		else
 			exo_cfg->emummc_cfg.nintendo_path[0] = 0;
 	}
+
+	// Copy over exosphere fatal for Mariko.
+	if (h_cfg.t210b01)
+	{
+		memset((void *)ATM_EXO_FATAL_ADDR, 0, ATM_EXO_FATAL_SIZE);
+		if (ctxt->exofatal)
+			memcpy((void *)ATM_EXO_FATAL_ADDR, ctxt->exofatal, ctxt->exofatal_size);
+	}
+
+	// Set display id.
+	exo_cfg->display_id = display_get_decoded_lcd_id();
 }
 
 static const char *get_error_desc(u32 error_desc)