diff --git a/History.txt b/History.txt
index 774d38f..49b78e0 100644
--- a/History.txt
+++ b/History.txt
@@ -2,8 +2,9 @@ NGPDS revision history
 -=-=-=-=-=-=-=-=-=-=-=-
 
 
-V0.4.9 - 2021-09-24 (FluBBa)
-	Much better flash emulation.
+V0.4.9 - 2021-09-28 (FluBBa)
+	Better flash emulation/saving/loading.
+	Fixed save/load state.
 
 V0.4.8 - 2021-09-11 (FluBBa)
 	Added stereo sound.
diff --git a/README.md b/README.md
index 150e9a4..845e720 100644
--- a/README.md
+++ b/README.md
@@ -49,8 +49,8 @@ To select between the tabs use R & L or the touchscreen.
 		Change Batteries: Change to new main batteries (AA/LR6).
 		Change Sub Battery: Change to a new sub battery (CR2032).
 		Cpu speed hacks: Allow speed hacks.
-		Half cpu speed: This is not realy recommended.
-		Bios Settings: Load a real NGP Bios.
+		Half cpu speed: This is not realy recommended anymore.
+		Bios Settings: Load a real NGP Bios, recommended.
 	Settings:
 		Speed: Switch between speed modes.
 			Normal: Game runs at it's normal speed.
diff --git a/source/Cart.h b/source/Cart.h
index 754add8..44e4342 100644
--- a/source/Cart.h
+++ b/source/Cart.h
@@ -15,6 +15,7 @@ extern u8 g_machine;
 extern u8 g_lang;
 extern u8 g_paletteBank;
 
+extern u8 ngpRAM[0x4000];
 extern u8 biosSpace[0x10000];
 extern u8 *romSpacePtr;
 extern void *g_BIOSBASE_COLOR;
diff --git a/source/Cart.s b/source/Cart.s
index 0dfb73c..424a127 100644
--- a/source/Cart.s
+++ b/source/Cart.s
@@ -88,12 +88,10 @@ machineInit: 	;@ Called from C
 	cmp r0,#0
 	beq skipBiosSettings
 
-	bl run
-	bl transferTime
-
-	ldr r1,=fixBiosSettings
-	mov lr,pc
-	bx r1
+	bl run					;@ Settings are cleared when new batteries are inserted.
+	bl transferTime			;@ So set up time
+	ldr r1,=fixBiosSettings	;@ And Bios settings after the first run.
+	blx r1
 skipBiosSettings:
 	ldmfd sp!,{r4-r11,lr}
 	bx lr
@@ -122,8 +120,7 @@ loadCart: 		;@ Called from C:  r0=emuflags
 	bl cpuReset
 	ldr r0,ngpHeader			;@ First argument
 	ldr r1,=resetBios
-	mov lr,pc
-	bx r1
+	blx r1
 skipHWSetup:
 	ldmfd sp!,{r4-r11,lr}
 	bx lr
diff --git a/source/FileHandling.c b/source/FileHandling.c
index 447b3ec..41e5c01 100644
--- a/source/FileHandling.c
+++ b/source/FileHandling.c
@@ -171,8 +171,6 @@ void saveSettings() {
 }
 
 void loadNVRAM_() {
-//	int adr;
-//	int len;
 	void *space;
 	FILE *file;
 	char flashName[FILENAMEMAXLENGTH];
@@ -200,38 +198,80 @@ void loadNVRAM_() {
 	return;
 }
 
-void saveNVRAM_() {
-	int adr = getSaveStartAddress();
-	int len = g_romSize - adr;
-	void *space = romSpacePtr + adr;
-	FILE *file;
+//void loadSaveGameFile()
+void loadNVRAM() {
+	// Find the .fla file and read it in
+	FILE *ngfFile;
+	int i;
+	NgfHeader header;
+	NgfBlock block;
 	char flashName[FILENAMEMAXLENGTH];
-	NgpFlashFile flashHdr;
-
-	flashHdr.magic = NGPF_MAGIC;
-	memcpy(&flashHdr.blocksLOInfo, getFlashLOBlocksAddress(), 35);
-	memcpy(&flashHdr.blocksHIInfo, getFlashHIBlocksAddress(), 35);
-	flashHdr.addressLO = adr;
-	flashHdr.sizeLO = len;
-	flashHdr.addressHI = 0;
-	flashHdr.sizeHI = 0;
+	bool canCopy;
 
 	if (findFolder(folderName)) {
 		return;
 	}
 	strlcpy(flashName, currentFilename, sizeof(flashName));
 	strlcat(flashName, ".fla", sizeof(flashName));
-	if ( (file = fopen(flashName, "w")) ) {
-		fwrite(&flashHdr, 1, sizeof(flashHdr), file);
-		fwrite(space, 1, flashHdr.sizeLO, file);
-		if ( flashHdr.sizeHI != 0) {
-			fwrite(space, 1, flashHdr.sizeHI, file);
+	if ( !(ngfFile = fopen(flashName, "r")) ) {
+		infoOutput("Couldn't open flash file:");
+		infoOutput(flashName);
+		return;
+	}
+
+	if (fread(&header, 1, sizeof(NgfHeader), ngfFile) != sizeof(NgfHeader)) {
+		infoOutput("Bad flash file:");
+		infoOutput(flashName);
+		fclose(ngfFile);
+		return;
+	}
+
+	if (header.version != 0x53) {
+		infoOutput("Bad flash file version:");
+		infoOutput(flashName);
+		fclose(ngfFile);
+		return;
+	}
+
+    if (header.blockCount > MAX_BLOCKS) {
+		infoOutput("Too many blocks in flash file:");
+		infoOutput(flashName);
+		fclose(ngfFile);
+		return;
+    }
+
+	// Loop through the blocks and insert them into mainrom
+	for (i=0; i < header.blockCount; i++) {
+		if (fread(&block, 1, sizeof(NgfBlock), ngfFile) != sizeof(NgfBlock)) {
+			infoOutput("Couldn't read correct number of header bytes.");
+			fclose(ngfFile);
+			return;
+		}
+
+		canCopy = false;
+		if ((block.ngpAddr >= 0x800000 && block.ngpAddr < 0xA00000)) {
+			block.ngpAddr -= 0x600000;
+			canCopy = markBlockDirty(1, getBlockFromAddress(block.ngpAddr));
+		}
+		else if ((block.ngpAddr >= 0x200000 && block.ngpAddr < 0x400000)) {
+			block.ngpAddr -= 0x200000;
+			canCopy = markBlockDirty(0, getBlockFromAddress(block.ngpAddr));
+		}
+		if (!canCopy) {
+			fseek(ngfFile, block.len, SEEK_CUR);
+			infoOutput("Invalid block header in flash.");
+            continue;
+        }
+		if (fread(&romSpacePtr[block.ngpAddr], 1, block.len, ngfFile) != block.len) {
+			infoOutput("Couldn't read correct number of block bytes.");
+			fclose(ngfFile);
+			return;
 		}
-		infoOutput("Saved flash.");
-		fclose(file);
 	}
-}
 
+	infoOutput("Loaded flash.");
+	fclose(ngfFile);
+}
 
 //void writeSaveGameFile() {
 void saveNVRAM() {
@@ -317,83 +357,6 @@ void saveNVRAM() {
 	fclose(ngfFile);
 }
 
-//void loadSaveGameFile()
-void loadNVRAM() {
-	// Find the NGF file and read it in
-	FILE *ngfFile;
-	int i;
-	NgfHeader header;
-	NgfBlock block;
-	char flashName[FILENAMEMAXLENGTH];
-
-	if (findFolder(folderName)) {
-		return;
-	}
-	strlcpy(flashName, currentFilename, sizeof(flashName));
-	strlcat(flashName, ".fla", sizeof(flashName));
-	if ( !(ngfFile = fopen(flashName, "r")) ) {
-		infoOutput("Couldn't open flash file:");
-		infoOutput(flashName);
-		return;
-	}
-
-	if (fread(&header, 1, sizeof(NgfHeader), ngfFile) != sizeof(NgfHeader)) {
-		infoOutput("Bad flash file:");
-		infoOutput(flashName);
-		fclose(ngfFile);
-		return;
-	}
-
-	if (header.version != 0x53) {
-		infoOutput("Bad flash file version:");
-		infoOutput(flashName);
-		fclose(ngfFile);
-		return;
-	}
-
-    if (header.blockCount > MAX_BLOCKS) {
-		infoOutput("Too many blocks in flash file:");
-		infoOutput(flashName);
-		fclose(ngfFile);
-		return;
-    }
-
-	// Loop through the blocks and insert them into mainrom
-	for (i=0; i < header.blockCount; i++) {
-		if (fread(&block, 1, sizeof(NgfBlock), ngfFile) != sizeof(NgfBlock)) {
-			infoOutput("Couldn't read correct number of header bytes.");
-			fclose(ngfFile);
-			return;
-		}
-
-        if (!((block.ngpAddr >= 0x200000 && block.ngpAddr < 0x400000)
-			|| (block.ngpAddr >= 0x800000 && block.ngpAddr < 0xA00000) )) {
-			infoOutput("Invalid block header in flash.");
-			char errAdr[8];
-			int2HexStr(errAdr, block.ngpAddr);
-			infoOutput(errAdr);
-			fclose(ngfFile);
-            return;
-        }
-		if (block.ngpAddr >= 0x800000) {
-			block.ngpAddr -= 0x600000;
-            markBlockDirty(1, getBlockFromAddress(block.ngpAddr-0x200000));
-		}
-		else if (block.ngpAddr >= 0x200000) {
-			block.ngpAddr -= 0x200000;
-            markBlockDirty(0, getBlockFromAddress(block.ngpAddr));
-		}
-		if (fread(&romSpacePtr[block.ngpAddr], 1, block.len, ngfFile) != block.len) {
-			infoOutput("Couldn't read correct number of block bytes.");
-			fclose(ngfFile);
-			return;
-		}
-	}
-
-	infoOutput("Loaded flash.");
-	fclose(ngfFile);
-}
-
 void loadState(void) {
 	u32 *statePtr;
 	FILE *file;
@@ -416,6 +379,7 @@ void loadState(void) {
 		}
 		fclose(file);
 	}
+	return;
 }
 
 void saveState(void) {
@@ -487,12 +451,12 @@ bool loadGame(const char *gameName) {
 			setEmuSpeed(0);
 			loadCart(emuFlags);
 			gameInserted = true;
+			if ( emuSettings & AUTOLOAD_NVRAM ) {
+				loadNVRAM();
+			}
 			if ( emuSettings & AUTOLOAD_STATE ) {
 				loadState();
 			}
-			else if ( emuSettings & AUTOLOAD_NVRAM ) {
-				loadNVRAM();
-			}
 			drawText("     Please wait, power on.", 11, 0);
 			turnPowerOn();
 			closeMenu();
diff --git a/source/Gui.c b/source/Gui.c
index 5531a21..9026329 100644
--- a/source/Gui.c
+++ b/source/Gui.c
@@ -15,7 +15,7 @@
 #include "K2GE/Version.h"
 #include "K2Audio/Version.h"
 
-#define EMUVERSION "V0.4.9 2021-09-24"
+#define EMUVERSION "V0.4.9 2021-09-28"
 
 #define HALF_CPU_SPEED		(1<<16)
 #define ALLOW_SPEED_HACKS	(1<<17)
diff --git a/source/K2GE b/source/K2GE
index 79c2d5a..635753f 160000
--- a/source/K2GE
+++ b/source/K2GE
@@ -1 +1 @@
-Subproject commit 79c2d5af35e3b1965ff5fb969929bf79e4a3db38
+Subproject commit 635753f9260416ec346b0b8e6c97dddb241613d3
diff --git a/source/NGPFlash.h b/source/NGPFlash.h
index 21b342b..5554035 100644
--- a/source/NGPFlash.h
+++ b/source/NGPFlash.h
@@ -10,16 +10,44 @@ extern "C" {
 extern u32 flashSize;
 extern u8 g_paletteBank;
 
+/**
+ * Check if a flash block is modifed compared to original file.
+ * @param  chip: Which chip to check, 0 or 1
+ * @param  block: Which block to check, 0 to 34
+ * @retval True if block is modified.
+ */
 bool isBlockDirty(int chip, int block);
-void markBlockDirty(int chip, int block);
 
 /**
- * Get the offset of the block in the flash chip memory.
+ * Mark a flash block as modified compared to original file.
+ * @param  chip: Which chip to mark, 0 or 1.
+ * @param  block: Which block to mark, 0 to 34.
+ * @retval True if block could be marked as modified.
+ */
+bool markBlockDirty(int chip, int block);
+
+/**
+ * Get the offset of a block in the flash chip.
+ * @param  block: Block nr, 0 to 34.
+ * @retval Offset of block in bytes in flash chip memory.
  */
 int getBlockOffset(int block);
+
+/**
+ * Get the size of a block in the flash chip.
+ * @param  block: Block nr, 0 to 34.
+ * @retval Size of block in bytes in flash chip memory.
+ */
 int getBlockSize(int block);
+
+/**
+ * Get block number from an address/offset in the flash chip.
+ * @param  address: The address to convert to block number.
+ * @retval The block corresponding to the specified address.
+ */
 int getBlockFromAddress(int address);
-int getSaveStartAddress(void);
+
+
 void *getFlashLOBlocksAddress(void);
 void *getFlashHIBlocksAddress(void);
 
diff --git a/source/NGPFlash.s b/source/NGPFlash.s
index 8ed143b..7b51cc4 100644
--- a/source/NGPFlash.s
+++ b/source/NGPFlash.s
@@ -8,7 +8,6 @@
 	.global ngpFlashReset
 	.global FlashWriteLO
 	.global FlashWriteHI
-	.global getSaveStartAddress
 	.global getFlashLOBlocksAddress
 	.global getFlashHIBlocksAddress
 	.global isBlockDirty
@@ -32,6 +31,7 @@ ngpFlashInit:			;@ Only need to be called once
 ngpFlashReset:			;@ r0=flash size in bytes, r1 = flash mem ptr, r12=fptr
 ;@----------------------------------------------------------------------------
 	stmfd sp!,{r4,lr}
+	str r0,flashSize
 	str r1,flashMemory
 	mov r1,#0x2F			;@ flashId 16Mbit
 	mov r2,#0x1F			;@ sizeMask 16Mbit
@@ -43,28 +43,31 @@ ngpFlashReset:			;@ r0=flash size in bytes, r1 = flash mem ptr, r12=fptr
 	cmp r0,#0x80000
 	moveq r1,#0xAB			;@ flashId 4Mbit
 	moveq r2,#0x07			;@ sizeMask 4Mbit
-	str r0,flashSize
 	strb r1,flashSizeId
 	strb r2,flashSizeMask
 	add r4,r2,#3			;@ Last block is split into 4 parts.
 	strb r4,lastBlock
 
 	ldr r0,=flashBlocks
-	mov r1,#2				;@ Write enabled
+	mov r1,#0				;@ Read only
 	mov r2,#MAX_BLOCKS
 	bl memset
 
 	ldr r0,=flashBlocks2
-	mov r1,#2				;@ Write enabled
+	mov r1,#0				;@ Read only
 	mov r2,#MAX_BLOCKS
 	bl memset
 
-//	ldr r0,=flashBlocks
-//	add r0,r0,r4
-//	sub r0,r0,#11			;@ Number of blocks that should be writable
-//	mov r1,#2
-//	mov r2,#12
-//	bl memset
+	ldr r0,=flashBlocks+6	;@ Block 6 is the first writable block in any released game.
+	mov r1,#2				;@ Write enabled
+	sub r2,r4,#5
+	bl memset
+
+	ldr r0,flashSize
+	cmp r0,#0x400000		;@ Only enable on 4MB games.
+	ldreq r0,=flashBlocks2
+	moveq r1,#2				;@ Write enabled
+	strbeq r1,[r0,#34]		;@ Only last block is write enabled on second chip.
 
 	ldmfd sp!,{r4,lr}
 	bx lr
@@ -119,36 +122,19 @@ isBlockDirty:				;@ In r0=chip, r1=block. Out r0=true/false
 	and r0,r0,#0x80			;@ Check modified.
 	bx lr
 ;@----------------------------------------------------------------------------
-markBlockDirty:				;@ In r0=chip, r1=block.
+markBlockDirty:			;@ In r0=chip, r1=block.
 	.type   markBlockDirty STT_FUNC
 ;@----------------------------------------------------------------------------
 	cmp r0,#0
 	ldreq r2,=flashBlocks
 	ldrne r2,=flashBlocks2
 	ldrb r0,[r2,r1]
-	orr r0,r0,#0x80			;@ Mark modified.
-	strb r0,[r2,r1]
-	bx lr
-;@----------------------------------------------------------------------------
-getSaveStartAddress:
-	.type   getSaveStartAddress STT_FUNC
-;@----------------------------------------------------------------------------
-	ldrb r3,lastBlock
-	mov r0,#0
-saveSLoop:
-	ldr r2,=flashBlocks
-	ldrb r1,[r2,r0]
-	tst r1,#0x80			;@ Check modified.
-	bne saveFound
-	add r0,r0,#1
-	cmp r0,r3
-	ble saveSLoop
-	mov r0,#0
+	ands r0,r0,#0x02		;@ Protect bit
+	orrne r0,r0,#0x80		;@ Mark modified.
+	strbne r0,[r2,r1]
 	bx lr
-saveFound:
-//	b getBlockOffset
 ;@----------------------------------------------------------------------------
-getBlockOffset:		;@ In r0=blockNr. Out r0=offset
+getBlockOffset:			;@ In r0=blockNr. Out r0=offset
 	.type   getBlockOffset STT_FUNC
 ;@----------------------------------------------------------------------------
 	ldrb r2,flashSizeMask
@@ -394,12 +380,12 @@ flashSizeMask:
 	.byte 0
 flashSizeId:
 	.byte 0
+lastBlock:
+	.byte 0
 currentWriteCycle:
 	.byte 0
 currentCommand:
 	.byte 0
-lastBlock:
-	.byte 0
 
 flashBlocks:		;@ Bit 1=write neabled, bit 7=modified.
 	.space MAX_BLOCKS
@@ -409,11 +395,5 @@ flashBlocks2:		;@ Bit 1=write neabled, bit 7=modified.
 	.align 2
 
 
-gameFlashInfo:
-	.short 0x0082	// Game id
-	.byte 3			// Number of unprotected blocks
-	.byte 7
-	.byte 8
-	.byte 10
 ;@----------------------------------------------------------------------------
 #endif // #ifdef __arm__
diff --git a/source/NeoGeoPocket.c b/source/NeoGeoPocket.c
index e371313..0918953 100644
--- a/source/NeoGeoPocket.c
+++ b/source/NeoGeoPocket.c
@@ -1,8 +1,10 @@
 #include <nds.h>
 
 #include "NeoGeoPocket.h"
+#include "Cart.h"
 #include "Gfx.h"
 #include "Sound.h"
+#include "io.h"
 #include "K2Audio/SN76496.h"
 #include "K2GE/K2GE.h"
 #include "TLCS900H/TLCS900H.h"
@@ -11,6 +13,9 @@
 
 int packState(void *statePtr) {
 	int size = 0;
+	memcpy(statePtr+size, ngpRAM, sizeof(ngpRAM));
+	size += sizeof(ngpRAM);
+	size += ioSaveState(statePtr+size);
 	size += sn76496SaveState(statePtr+size, &k2Audio_0);
 	size += k2GESaveState(statePtr+size, &k2GE_0);
 	size += Z80SaveState(statePtr+size, &Z80OpTable);
@@ -20,6 +25,9 @@ int packState(void *statePtr) {
 
 void unpackState(const void *statePtr) {
 	int size = 0;
+	memcpy(ngpRAM, statePtr+size, sizeof(ngpRAM));
+	size += sizeof(ngpRAM);
+	size += ioLoadState(statePtr+size);
 	size += sn76496LoadState(&k2Audio_0, statePtr+size);
 	size += k2GELoadState(&k2GE_0, statePtr+size);
 	size += Z80LoadState(&Z80OpTable, statePtr+size);
@@ -28,6 +36,8 @@ void unpackState(const void *statePtr) {
 
 int getStateSize() {
 	int size = 0;
+	size += sizeof(ngpRAM);
+	size += ioGetStateSize();
 	size += sn76496GetStateSize();
 	size += k2GEGetStateSize();
 	size += Z80GetStateSize();
diff --git a/source/Sound.s b/source/Sound.s
index 52d7bcf..958e486 100644
--- a/source/Sound.s
+++ b/source/Sound.s
@@ -7,6 +7,7 @@
 	.global VblSound2
 	.global setMuteSoundGUI
 	.global setMuteSoundChip
+	.global setMuteT6W28
 	.global T6W28_L_W
 	.global T6W28_R_W
 	.global k2Audio_0
@@ -49,6 +50,13 @@ setMuteSoundGUI:
 	strb r0,muteSoundGUI
 	bx lr
 ;@----------------------------------------------------------------------------
+setMuteT6W28:
+;@----------------------------------------------------------------------------
+	cmp r0,#0xAA
+	cmpne r0,#0x55
+	bxne lr
+	and r0,r0,#0xAA
+;@----------------------------------------------------------------------------
 setMuteSoundChip:
 ;@----------------------------------------------------------------------------
 	strb r0,muteSoundChip
diff --git a/source/TLCS900H b/source/TLCS900H
index 7b456e6..71be649 160000
--- a/source/TLCS900H
+++ b/source/TLCS900H
@@ -1 +1 @@
-Subproject commit 7b456e68d304069f8fe6ac113ef8d0a112d9ecb3
+Subproject commit 71be64926de4914785826e2bdb461df426782e34
diff --git a/source/bios.c b/source/bios.c
index ed91950..59f2820 100644
--- a/source/bios.c
+++ b/source/bios.c
@@ -404,6 +404,9 @@ void resetBios(NgpHeader *ngpHeader)
 		t9StoreB(snkLogo[i], 0xA1C0 + i);
 	}
 
+	// Enable sound
+	t9StoreB(0x55, 0xB8);
+
 	// Do some setup for the interrupt priorities.
 	BIOSHLE_Reset();
 }
diff --git a/source/io.h b/source/io.h
index 5036cee..db76e6e 100644
--- a/source/io.h
+++ b/source/io.h
@@ -15,6 +15,26 @@ extern u32 batteryLevel;
  */
 void transferTime(void);
 
+/**
+ * Saves the state of io to the destination.
+ * @param  *destination: Where to save the state.
+ * @return The size of the state.
+ */
+int ioSaveState(void *destination);
+
+/**
+ * Loads the state of io from the source.
+ * @param  *source: Where to load the state from.
+ * @return The size of the state.
+ */
+int ioLoadState(const void *source);
+
+/**
+ * Gets the state size of an io state.
+ * @return The size of the state.
+ */
+int ioGetStateSize(void);
+
 /**
  * Reads a byte from the other system. If no data is available or no
  * high-level communications have been established, then return FALSE.
diff --git a/source/io.s b/source/io.s
index 1556bd8..7b88b05 100644
--- a/source/io.s
+++ b/source/io.s
@@ -8,6 +8,9 @@
 	.global Z80In
 	.global Z80Out
 	.global refreshEMUjoypads
+	.global ioSaveState
+	.global ioLoadState
+	.global ioGetStateSize
 
 	.global joyCfg
 	.global EMUinput
@@ -34,20 +37,55 @@
 ;@----------------------------------------------------------------------------
 ioReset:
 ;@----------------------------------------------------------------------------
-	stmfd sp!,{r4,lr}
-
-	ldr r3,=SysMemDefault
-	mov r4,#0xFF
-ioResetLoop:
-	ldrb r0,[r3,r4]
-	mov r1,r4
-	bl t9StoreB
-	subs r4,r4,#1
-	bpl ioResetLoop
+	stmfd sp!,{lr}
 
+	ldr r0,=SysMemDefault
+	bl initSysMem
 	bl transferTime
 
-	ldmfd sp!,{r4,lr}
+	ldmfd sp!,{pc}
+;@----------------------------------------------------------------------------
+initSysMem:					;@ In r0=values ptr.
+;@----------------------------------------------------------------------------
+	stmfd sp!,{r4-r5,lr}
+
+	mov r4,r0
+	mov r5,#0xFF
+initMemLoop:
+	ldrb r0,[r4,r5]
+	mov r1,r5
+	bl t9StoreB_Low
+	subs r5,r5,#1
+	bpl initMemLoop
+
+	ldmfd sp!,{r4-r5,pc}
+;@----------------------------------------------------------------------------
+ioSaveState:			;@ In r0=destination. Out r0=size.
+	.type   ioSaveState STT_FUNC
+;@----------------------------------------------------------------------------
+	stmfd sp!,{lr}
+
+	ldr r1,=systemMemory
+	mov r2,#0x100
+	bl memcpy
+
+	ldmfd sp!,{lr}
+	mov r0,#0x100
+	bx lr
+;@----------------------------------------------------------------------------
+ioLoadState:			;@ In r0=source. Out r0=size.
+	.type   ioLoadState STT_FUNC
+;@----------------------------------------------------------------------------
+	stmfd sp!,{lr}
+
+	bl initSysMem
+
+	ldmfd sp!,{lr}
+;@----------------------------------------------------------------------------
+ioGetStateSize:		;@ Out r0=state size.
+	.type   ioGetStateSize STT_FUNC
+;@----------------------------------------------------------------------------
+	mov r0,#0x100
 	bx lr
 ;@----------------------------------------------------------------------------
 transferTime:
@@ -120,23 +158,15 @@ refreshEMUjoypads:			;@ Call every frame
 joyCfg: .long 0x00ff01ff	;@ byte0=auto mask, byte1=(saves R), byte2=R auto mask
 							;@ bit 31=single/multi, 30,29=1P/2P, 27=(multi) link active, 24=reset signal received
 playerCount:.long 0			;@ Number of players in multilink.
-joySerial:	.byte 0
-joy0State:	.byte 0
-joy1State:	.byte 0
-joy2State:	.byte 0
+			.byte 0
+			.byte 0
+			.byte 0
+			.byte 0
 rlud2lrud:		.byte 0x00,0x08,0x04,0x0C, 0x01,0x09,0x05,0x0D, 0x02,0x0A,0x06,0x0E, 0x03,0x0B,0x07,0x0F
 
 EMUinput:			;@ This label here for main.c to use
 	.long 0			;@ EMUjoypad (this is what Emu sees)
 
-;@----------------------------------------------------------------------------
-input0_R:		;@ Player 1
-;@----------------------------------------------------------------------------
-;@	mov r11,r11					;@ No$GBA breakpoint
-	ldrb r0,joy0State
-	eor r0,r0,#0xFF
-	bx lr
-
 ;@----------------------------------------------------------------------------
 z80ReadLatch:
 ;@----------------------------------------------------------------------------
@@ -174,7 +204,22 @@ updateSlowIO:				;@ Call once every frame, updates rtc and battery levels.
 	strb r0,rtcTimer
 	bxpl lr
 
+	ldr r0,batteryLevel
+	subs r0,r0,#1
+	movmi r0,#1
+	str r0,batteryLevel
+
+	ldr r1,=g_subBatteryLevel
+	ldr r0,[r1]
+	subs r0,r0,#0x00000100
+	movmi r0,#0x00001000
+	str r0,[r1]
+
 	ldr r2,=systemMemory
+	ldrb r0,[r2,#0x90]			;@ RTC control
+	tst r0,#1					;@ Enabled?
+	bxeq lr
+
 	ldrb r0,[r2,#0x96]			;@ Seconds
 	add r0,r0,#0x01
 	and r1,r0,#0x0F
@@ -183,36 +228,48 @@ updateSlowIO:				;@ Call once every frame, updates rtc and battery levels.
 	cmp r0,#0x60
 	movpl r0,#0
 	strb r0,[r2,#0x96]			;@ Seconds
-	
+	bmi checkForAlarm
+
 	ldrb r0,[r2,#0x95]			;@ Minutes
-	addpl r0,r0,#0x01
+	add r0,r0,#0x01
 	and r1,r0,#0x0F
 	cmp r1,#0x0A
 	addpl r0,r0,#0x06
 	cmp r0,#0x60
 	movpl r0,#0
 	strb r0,[r2,#0x95]			;@ Minutes
-	
+	bmi checkForAlarm
+
 	ldrb r0,[r2,#0x94]			;@ Hours
-	addpl r0,r0,#0x01
+	add r0,r0,#0x01
 	and r1,r0,#0x0F
 	cmp r1,#0x0A
 	addpl r0,r0,#0x06
 	cmp r0,#0x24
 	movpl r0,#0
 	strb r0,[r2,#0x94]			;@ Hours
+	bmi checkForAlarm
 
 	ldrb r0,[r2,#0x93]			;@ Days
-	addpl r0,r0,#0x01
+	add r0,r0,#0x01
 	and r1,r0,#0x0F
 	cmp r1,#0x0A
 	addpl r0,r0,#0x06
 	cmp r0,#0x32
 	movpl r0,#0
 	strb r0,[r2,#0x93]			;@ Days
+	bmi checkForAlarm
 
+	ldrb r0,[r2,#0x92]			;@ Months
+	add r0,r0,#0x01
+	and r1,r0,#0x0F
+	cmp r1,#0x0A
+	addpl r0,r0,#0x06
+	cmp r0,#0x13
+	movpl r0,#1
+	strb r0,[r2,#0x92]			;@ Months
 
-								;@ Check for Alarm
+checkForAlarm:
 	ldrb r0,[r2,#0x96]			;@ Seconds
 	cmp r0,#0x00
 	ldrbeq r0,[r2,#0x95]		;@ RTC Minutes
@@ -226,23 +283,15 @@ updateSlowIO:				;@ Call once every frame, updates rtc and battery levels.
 	moveq r0,#0x0A
 	beq TestIntHDMA_External
 
-	ldr r0,batteryLevel
-	subs r0,r0,#1
-	movmi r0,#1
-	str r0,batteryLevel
-
-	ldr r1,=g_subBatteryLevel
-	ldr r0,[r1]
-	subs r0,r0,#0x00000100
-	movmi r0,#0x00001000
-	str r0,[r1]
-
 	bx lr
 
 ;@----------------------------------------------------------------------------
 t9StoreB_Low:
 ;@----------------------------------------------------------------------------
 	ldr t9optbl,=tlcs900HState	;@ !!!This should not be needed when called from asm.
+	ldr r2,=systemMemory
+	strb r0,[r2,r1]
+
 	cmp r1,#0x50				;@ Serial channel 0 buffer.
 	strbeq r0,sc0Buf
 	bxeq lr
@@ -253,8 +302,7 @@ t9StoreB_Low:
 	bxeq lr
 
 	cmp r1,#0xB8				;@ Soundchip enable/disable, 0x55 On 0xAA Off.
-	andeq r0,r0,#2
-	beq setMuteSoundChip
+	beq setMuteT6W28
 
 	cmp r1,#0xB9				;@ Z80 enable/disable, 0x55 On 0xAA Off.
 	beq Z80_SetEnable
@@ -288,25 +336,11 @@ t9StoreB_Low:
 	cmp r2,#0x20
 	beq timer_write8
 
-	cmp r2,#0x90
-	beq rtc_write8
-
 	and r0,r0,#0xFF
 	cmp r2,#0x70
 	beq int_write8
 
-	cmp r1,#0xB3				;@ Power button NMI on/off.
-//	beq lowW_cont
-
-//	bx lr
-lowW_cont:
-	ldr r2,=systemMemory
-	strb r0,[r2,r1]
-	bx lr
-
-rtc_write8:
-	ldr r2,=systemMemory
-	strb r0,[r2,r1]
+//	cmp r1,#0xB3				;@ Power button NMI on/off.
 	bx lr
 
 ;@----------------------------------------------------------------------------
@@ -344,12 +378,9 @@ t9LoadB_Low:
 	cmp r1,#0x70
 	beq int_read8
 
-	cmp r1,#0x90
-	beq rtc_read8
-
 	cmp r1,#0x20
 	beq timer_read8
-lowR_cont:
+
 	cmp r0,#0x50				;@ Serial channel 0 buffer.
 	ldrbeq r0,sc0Buf
 	bxeq lr
@@ -358,17 +389,13 @@ lowR_cont:
 	ldrbeq r0,commByte
 	bxeq lr
 
-rtc_read8:
-lowR_end:
 	ldr r2,=systemMemory
 	ldrb r0,[r2,r0]
 	bx lr
 
 ;@----------------------------------------------------------------------------
 systemMemory:
-;@	% 0x80
-;@g_cpuSpeed:
-;@	% 0x80
+	.space 0x100
 
 
 SysMemDefault:
@@ -388,7 +415,6 @@ SysMemDefault:
 	.byte 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	0x17, 0x17, 0x03, 0x03, 0x02, 0x00, 0x10, 0x4E
 	;@ 0x70													;@ 0x78
 	.byte 0x02, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-g_cpuSpeed:
 	;@ 0x80													;@ 0x88
 	.byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 	;@ 0x90													;@ 0x98