The lv2ldr is used to verify and decrypt the lv2_kernal.self. In the lv2ldr Parameters Layout, the arguments start at 0x3E800 we need to know this so we can load with the different arguments we want to. the arguments end around where the program revoke list address starts, so around this 0x3F000. u8* means read one byte from the address. One of the lv2 arguments are lv2_in* that would mean the address in ram (Where it's located). The other is lv2_out* that's where to decrypt lv2 address in ram(Where decrypts lv2_kernal.self). that would also use u8 because you want to read it by one byte from that address. well with a program made to read the address like how readself works we can know the address where the lv2 lies in the ram and where it is decrypted. once we know the address the real decryption can start. So knowing the decrypted address we can take that offset make a progam like coreos_tool pull the and get the lv2 key all from knowing that decrypted lv2_kernal.self location. exploiting 4.00 with this method would work most likely because I doubt sony changed all the locations where the loaders do there thing, sure there encapsulated in the bootloader but they still pass over into the ram at one point before being fed over to the metldr which loads ldrs.