diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3af5927..397fb46 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -316,8 +316,6 @@ jobs:
     - name: Build
       run: |
         gmake palera1n_xcode PLATFORM=iphoneos WITH_STATIC=1 WITH_CIDERRAIN=1 BUILD_TYPE=Release JOBS=$(sysctl -n hw.ncpu)
-        cmake --build build
-        codesign --force --sign - --entitlements resources/entitlements.xml build/Debug-iphoneos/palera1n.app/palera1n
 
     - name: Package
       run: |
diff --git a/CMakeLists.txt b/CMakeLists.txt
index d4b4483..86c01e9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -85,6 +85,14 @@ FetchContent_MakeAvailable(nlohmann_json)
 # MARK: TARGET
 # =========================
 
+message(STATUS "========================")
+message(STATUS "Using XXD on this shit!!!")
+message(STATUS "========================")
+include(cmake/Xxd.cmake)
+if(IOS)
+    include(cmake/AppleHeaders.cmake)
+endif()
+
 file(GLOB_RECURSE SOURCES CONFIGURE_DEPENDS
     "src/*.cpp"
     "src/*.c"
diff --git a/Makefile b/Makefile
index 70e1a6b..220f5a3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,159 +1,73 @@
-.PHONY: apple-include payloads palera1n palera1n_xcode palera1n_mingw clean
+.PHONY: all clean
 
-# TODO: get rid of this makefile, this is too complicated
+# ---------------------------------------------------------------------------
+# Options
+# ---------------------------------------------------------------------------
 
-WITH_GUI ?= 0
-WITH_TUI ?= 0
-WITH_RAMDISK ?= 1
-WITH_BINPACK ?= 1
-WITH_STATIC ?= 0
-WITH_CIDERRAIN ?= 0
-BUILD_TYPE ?= Debug
+WITH_GUI          ?= 0
+WITH_TUI          ?= 0
+WITH_RAMDISK      ?= 1
+WITH_BINPACK      ?= 1
+WITH_STATIC       ?= 0
+WITH_CIDERRAIN    ?= 0
+BUILD_TYPE        ?= Debug
 
-CMAKE_SYSROOT ?=
+CMAKE_SYSROOT     ?=
 CROSS_HOST_TRIPLE ?=
-JOBS ?=
+JOBS              ?= 1
 
 PLATFORM ?= host
 
 UNAME_S := $(shell uname -s)
 
-BUILD_ARGS :=
-ifneq ($(strip $(JOBS)),)
-BUILD_ARGS += --parallel $(JOBS)
-endif
-
-ifeq ($(PLATFORM),ios)
-	PLATFORM := iphoneos
-endif
-TARGET_SYSROOT :=
-MACOSX_SYSROOT := $(shell xcrun --sdk macosx --show-sdk-path)
-CUSTOM_INCLUDE_PATH := apple-include-$(PLATFORM)
-
 ifeq ($(PLATFORM),iphoneos)
-ifneq ($(UNAME_S),Darwin)
-$(error iOS builds require macOS/Xcode)
-endif
-EXTRA_TARGETS = apple-include
-TARGET_SYSROOT := $(shell xcrun --sdk iphoneos --show-sdk-path)
-else ifeq ($(PLATFORM),macos)
-ifneq ($(UNAME_S),Darwin)
-$(error macOS SDK builds require macOS/Xcode)
-endif
-TARGET_SYSROOT := $(shell xcrun --sdk macosx --show-sdk-path)
+	ifneq ($(UNAME_S),Darwin)
+		$(error iOS targets are only supported on macOS)
+	endif
+
+	CMAKE_GENERATOR := -G Xcode
+	APPLE_SYSROOT := $(shell xcrun --sdk iphoneos --show-sdk-path)
+
+	CMAKE_PLATFORM_ARGS := \
+		-DCMAKE_SYSTEM_NAME=iOS \
+		-DCMAKE_OSX_SYSROOT="$(APPLE_SYSROOT)" \
+		-DCMAKE_OSX_ARCHITECTURES=arm64
+
+else ifeq ($(UNAME_S),Windows_NT)
+	CMAKE_GENERATOR := -G "MinGW Makefiles"
+else
+	CMAKE_GENERATOR :=
 endif
 
-CMAKE_COMMON_ARGS := \
+CMAKE_ARGS := \
+	$(CMAKE_GENERATOR) \
 	-DCMAKE_SYSROOT="$(CMAKE_SYSROOT)" \
 	-DCROSS_HOST_TRIPLE="$(CROSS_HOST_TRIPLE)" \
-	-DCMAKE_BUILD_TYPE=$(BUILD_TYPE) \
+	-DCMAKE_BUILD_TYPE="$(BUILD_TYPE)" \
 	-DWITH_GUI=$(WITH_GUI) \
 	-DWITH_TUI=$(WITH_TUI) \
 	-DWITH_RAMDISK=$(WITH_RAMDISK) \
 	-DWITH_BINPACK=$(WITH_BINPACK) \
+	-DWITH_STATIC=$(WITH_STATIC) \
 	-DWITH_CIDERRAIN=$(WITH_CIDERRAIN) \
-	-DWITH_STATIC=$(WITH_STATIC)
+	$(CMAKE_PLATFORM_ARGS)
 
-CMAKE_APPLE_ARGS :=
-
-ifeq ($(PLATFORM),iphoneos)
-
-CMAKE_APPLE_ARGS := \
-	-DCMAKE_SYSTEM_NAME=iOS \
-	-DCMAKE_OSX_SYSROOT="$(TARGET_SYSROOT)" \
-	-DCMAKE_OSX_ARCHITECTURES=arm64 \
-	-DCMAKE_OSX_DEPLOYMENT_TARGET=15.0
-
-endif
-
-ifeq ($(PLATFORM),macos)
-
-CMAKE_APPLE_ARGS := \
-	-DCMAKE_SYSTEM_NAME=Darwin \
-	-DCMAKE_OSX_SYSROOT="$(TARGET_SYSROOT)"
-
-endif
-
-ifeq ($(PLATFORM),iphoneos)
-APPLE_INCLUDE_DEP := apple-include
-else
-APPLE_INCLUDE_DEP :=
+ifneq ($(strip $(JOBS)),)
+	BUILD_ARGS := --parallel $(JOBS)
 endif
 
 all: palera1n
 
-apple-include:
-	mkdir -p $(CUSTOM_INCLUDE_PATH)/{bsm,objc,os/internal,sys,firehose,CoreFoundation,FSEvents,IOSurface,IOKit/kext,libkern,kern,arm,{mach/,}machine,CommonCrypto,Security,CoreSymbolication,Kernel/{kern,IOKit,libkern},rpc,rpcsvc,xpc/private,ktrace,mach-o,dispatch}
-	cp -af $(MACOSX_SYSROOT)/usr/include/{arpa,bsm,hfs,net,xpc,netinet,servers,timeconv.h,launch.h} $(CUSTOM_INCLUDE_PATH)
-	cp -af $(MACOSX_SYSROOT)/usr/include/objc/objc-runtime.h $(CUSTOM_INCLUDE_PATH)/objc
-	cp -af $(MACOSX_SYSROOT)/usr/include/libkern/{OSDebug.h,OSKextLib.h,OSReturn.h,OSThermalNotification.h,OSTypes.h,machine} $(CUSTOM_INCLUDE_PATH)/libkern
-	cp -af $(MACOSX_SYSROOT)/usr/include/kern $(CUSTOM_INCLUDE_PATH)
-	cp -af $(MACOSX_SYSROOT)/usr/include/sys/{tty*,ptrace,kern*,random,reboot,user,vnode,disk,vmmeter,conf}.h $(CUSTOM_INCLUDE_PATH)/sys
-	cp -af $(MACOSX_SYSROOT)/System/Library/Frameworks/Kernel.framework/Versions/Current/Headers/sys/disklabel.h $(CUSTOM_INCLUDE_PATH)/sys
-	cp -af $(MACOSX_SYSROOT)/System/Library/Frameworks/IOKit.framework/Headers/{AppleConvergedIPCKeys.h,IOBSD.h,IOCFBundle.h,IOCFPlugIn.h,IOCFURLAccess.h,IOKitServer.h,IORPC.h,IOSharedLock.h,IOUserServer.h,audio,avc,firewire,graphics,hid,hidsystem,i2c,iokitmig.h,kext,ndrvsupport,network,ps,pwr_mgt,sbp2,scsi,serial,storage,stream,usb,video} $(CUSTOM_INCLUDE_PATH)/IOKit
-	cp -af $(MACOSX_SYSROOT)/System/Library/Frameworks/Security.framework/Headers/{mds_schema,oidsalg,SecKeychainSearch,certextensions,Authorization,eisl,SecDigestTransform,SecKeychainItem,oidscrl,cssmcspi,CSCommon,cssmaci,SecCode,CMSDecoder,oidscert,SecRequirement,AuthSession,SecReadTransform,oids,cssmconfig,cssmkrapi,SecPolicySearch,SecAccess,cssmtpi,SecACL,SecEncryptTransform,cssmapi,cssmcli,mds,x509defs,oidsbase,SecSignVerifyTransform,cssmspi,cssmkrspi,SecTask,cssmdli,SecAsn1Coder,cssm,SecTrustedApplication,SecCodeHost,SecCustomTransform,oidsattr,SecIdentitySearch,cssmtype,SecAsn1Types,emmtype,SecTransform,SecTrustSettings,SecStaticCode,emmspi,SecTransformReadTransform,SecKeychain,SecDecodeTransform,CodeSigning,AuthorizationPlugin,cssmerr,AuthorizationTags,CMSEncoder,SecEncodeTransform,SecureDownload,SecAsn1Templates,AuthorizationDB,SecCertificateOIDs,cssmapple}.h $(CUSTOM_INCLUDE_PATH)/Security
-# 	cp -af $(MACOSX_SYSROOT)/usr/include/{ar,bootstrap,launch,libc,libcharset,localcharset,nlist,NSSystemDirectories,tzfile,vproc}.h $(CUSTOM_INCLUDE_PATH)
-	cp -af $(MACOSX_SYSROOT)/usr/include/mach/{*.defs,{mach_vm,shared_region}.h} $(CUSTOM_INCLUDE_PATH)/mach
-	cp -af $(MACOSX_SYSROOT)/usr/include/mach/machine/*.defs $(CUSTOM_INCLUDE_PATH)/mach/machine
-	cp -af $(MACOSX_SYSROOT)/usr/include/rpc/pmap_clnt.h $(CUSTOM_INCLUDE_PATH)/rpc
-	cp -af $(MACOSX_SYSROOT)/usr/include/rpcsvc/yp{_prot,clnt}.h $(CUSTOM_INCLUDE_PATH)/rpcsvc
-	cp -af $(TARGET_SYSROOT)/usr/include/mach/machine/thread_state.h $(CUSTOM_INCLUDE_PATH)/mach/machine
-	cp -af $(TARGET_SYSROOT)/usr/include/mach/arm $(CUSTOM_INCLUDE_PATH)/mach
-	cp -af $(MACOSX_SYSROOT)/System/Library/Frameworks/IOKit.framework/Headers/* $(CUSTOM_INCLUDE_PATH)/IOKit
-# 	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/stdlib.h > $(CUSTOM_INCLUDE_PATH)/stdlib.h
-	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/time.h > $(CUSTOM_INCLUDE_PATH)/time.h
-	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/unistd.h > $(CUSTOM_INCLUDE_PATH)/unistd.h
-	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/mach/task.h > $(CUSTOM_INCLUDE_PATH)/mach/task.h
-	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/mach/mach_host.h > $(CUSTOM_INCLUDE_PATH)/mach/mach_host.h
-	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/ucontext.h > $(CUSTOM_INCLUDE_PATH)/ucontext.h
-#	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/signal.h > $(CUSTOM_INCLUDE_PATH)/signal.h
-	gsed -E s/'__IOS_PROHIBITED|__TVOS_PROHIBITED|__WATCHOS_PROHIBITED'//g < $(TARGET_SYSROOT)/usr/include/spawn.h > $(CUSTOM_INCLUDE_PATH)/spawn.h
-	gsed -E /'__API_UNAVAILABLE'/d < $(TARGET_SYSROOT)/usr/include/pthread.h > $(CUSTOM_INCLUDE_PATH)/pthread.h
-	gsed -i -E s/'__API_UNAVAILABLE\(.*\)'// $(CUSTOM_INCLUDE_PATH)/IOKit/IOKitLib.h
-	gsed -i -E s/'__API_UNAVAILABLE\(.*\)'// $(CUSTOM_INCLUDE_PATH)/spawn.h
-	gsed -i -E s/'API_UNAVAILABLE\(.*\)'// $(CUSTOM_INCLUDE_PATH)/xpc/*.h
-	gsed -i 's|// __XPC_INDIRECT__|\n#include "$(TARGET_SYSROOT)/usr/include/bsm/audit.h"\n|' $(CUSTOM_INCLUDE_PATH)/xpc/connection.h
-
-payloads:
-	mkdir -p src/gen/embedded
-
-	xz --format=lzma -vfc6ekT 0 embedded/ramdisk.dmg > embedded/ramdisk-compressed.lzma
-	xz --format=lzma -vfc6ekT 0 embedded/checkra1n-kpf-pongo > embedded/checkra1n-kpf-pongo-compressed.lzma
-	jq -c . embedded/DFUHelperDeviceInfo.json > embedded/DFUHelperDeviceInfo-minified.json
-
-	@for file in embedded/*; do \
-		name=$$(basename "$$file"); \
-		name=$${name%.*}; \
-		echo " XXD    $$file"; \
-		echo "#pragma once" > "src/gen/embedded/$$name.h"; \
-		xxd -i "$$file" \
-		| sed 's/unsigned char/static const unsigned char/g' \
-		| sed 's/unsigned int/static const size_t/g' \
-		>> "src/gen/embedded/$$name.h"; \
-	done
-
-palera1n: payloads $(EXTRA_TARGETS)
-	@cmake -S . -B build \
-		$(CMAKE_COMMON_ARGS) \
-		$(CMAKE_APPLE_ARGS) && \
-	cmake --build build $(BUILD_ARGS)
-
-palera1n_xcode: $(APPLE_INCLUDE_DEP) payloads
-	@cmake -S . -B build \
-		-G Xcode \
-		$(CMAKE_COMMON_ARGS) \
-		$(CMAKE_APPLE_ARGS)
-
-palera1n_mingw: payloads
-	@cmake -S . -B build \
-		-G "MinGW Makefiles" \
-		$(CMAKE_COMMON_ARGS) && \
-	cmake --build build $(BUILD_ARGS)
+palera1n:
+	@cmake -S . -B build $(CMAKE_ARGS)
+	@cmake --build build $(BUILD_ARGS)
+ifeq ($(PLATFORM),iphoneos)
+	@codesign --force --sign - --entitlements resources/entitlements.xml build/Debug-iphoneos/palera1n.app/palera1n
+endif
 
 clean:
-	@rm -rf build src/gen
-	@rm -rf apple-include-*
-	@if [ -d 1stparty/libciderra1n ]; then $(MAKE) -C 1stparty/libciderra1n clean; fi
+	@rm -rf build src/gen apple-include-*
+	@if [ -d 1stparty/libciderra1n ]; then \
+		$(MAKE) -C 1stparty/libciderra1n clean; \
+	fi
 	@$(MAKE) -C 1stparty/libopenra1n clean
-
-.PHONY: palera1n palera1n_xcode palera1n_mingw payloads clean
diff --git a/cmake/AppleHeaders.cmake b/cmake/AppleHeaders.cmake
new file mode 100644
index 0000000..216c4dd
--- /dev/null
+++ b/cmake/AppleHeaders.cmake
@@ -0,0 +1,9 @@
+find_program(BASH_EXECUTABLE bash REQUIRED)
+find_program(_GSED gsed REQUIRED)
+
+execute_process(
+    COMMAND "${BASH_EXECUTABLE}"
+        "${CMAKE_CURRENT_SOURCE_DIR}/cmake/apple-headers.sh"
+    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+    COMMAND_ERROR_IS_FATAL ANY
+)
diff --git a/cmake/Xxd.cmake b/cmake/Xxd.cmake
new file mode 100644
index 0000000..ef47528
--- /dev/null
+++ b/cmake/Xxd.cmake
@@ -0,0 +1,10 @@
+find_program(BASH_EXECUTABLE bash REQUIRED)
+find_program(_XXD xxd REQUIRED)
+find_program(_JQ jq REQUIRED)
+find_program(_XZ xz REQUIRED)
+
+execute_process(
+    COMMAND "${BASH_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/cmake/xxd.sh"
+    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+    COMMAND_ERROR_IS_FATAL ANY
+)
diff --git a/cmake/Xxd.sh b/cmake/Xxd.sh
new file mode 100644
index 0000000..91280bb
--- /dev/null
+++ b/cmake/Xxd.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+mkdir -p "$ROOT_DIR/src/gen/embedded"
+
+cd "$ROOT_DIR"
+
+mkdir -p src/gen/embedded
+
+xz --format=lzma -vfc6ekT 0 $ROOT_DIR/embedded/ramdisk.dmg > $ROOT_DIR/embedded/ramdisk-compressed.lzma
+xz --format=lzma -vfc6ekT 0 $ROOT_DIR/embedded/checkra1n-kpf-pongo > $ROOT_DIR/embedded/checkra1n-kpf-pongo-compressed.lzma
+jq -c . $ROOT_DIR/embedded/DFUHelperDeviceInfo.json > $ROOT_DIR/embedded/DFUHelperDeviceInfo-minified.json
+
+for file in embedded/*; do
+    name=$(basename "$file")
+    symbol="embedded_${name//[^a-zA-Z0-9_]/_}"
+
+    echo " XXD    $file"
+
+    xxd -i "$file" \
+        | sed -E \
+            -e "s/^unsigned char .*\[\] =/static const unsigned char ${symbol}[] =/" \
+            -e "s/^unsigned int .*_len =/static const size_t ${symbol}_len =/" \
+        > "src/gen/embedded/${name%.*}.h"
+done
diff --git a/cmake/apple-headers.sh b/cmake/apple-headers.sh
new file mode 100644
index 0000000..d182bd1
--- /dev/null
+++ b/cmake/apple-headers.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+PLATFORM="${1:-iphoneos}"
+
+case "$PLATFORM" in
+    iphoneos)
+        TARGET_SDK="iphoneos"
+        ;;
+    *)
+        echo "error: unsupported platform: $PLATFORM" >&2
+        exit 1
+        ;;
+esac
+
+if [[ "$(uname -s)" != "Darwin" ]]; then
+    echo "error: Apple SDK builds require macOS/Xcode" >&2
+    exit 1
+fi
+
+MACOSX_SYSROOT="$(xcrun --sdk macosx --show-sdk-path)"
+TARGET_SYSROOT="$(xcrun --sdk "$TARGET_SDK" --show-sdk-path)"
+CUSTOM_INCLUDE_PATH="$ROOT_DIR/apple-include-$PLATFORM"
+
+mkdir -p "$CUSTOM_INCLUDE_PATH"/IOKit/kext
+cp -af "$MACOSX_SYSROOT"/System/Library/Frameworks/IOKit.framework/Headers/{AppleConvergedIPCKeys.h,IOBSD.h,IOCFBundle.h,IOCFPlugIn.h,IOCFURLAccess.h,IOKitServer.h,IORPC.h,IOSharedLock.h,IOUserServer.h,audio,avc,firewire,graphics,hid,hidsystem,i2c,iokitmig.h,kext,ndrvsupport,network,ps,pwr_mgt,sbp2,scsi,serial,storage,stream,usb,video} "$CUSTOM_INCLUDE_PATH/IOKit"
+cp -af "$MACOSX_SYSROOT"/System/Library/Frameworks/IOKit.framework/Headers/* "$CUSTOM_INCLUDE_PATH/IOKit"
+gsed -i -E s/'__API_UNAVAILABLE\(.*\)'// "$CUSTOM_INCLUDE_PATH/IOKit/IOKitLib.h"
+