diff --git a/Assets/dll/gpgx.wbx.gz b/Assets/dll/gpgx.wbx.gz
index 8804885a88..902984b858 100644
Binary files a/Assets/dll/gpgx.wbx.gz and b/Assets/dll/gpgx.wbx.gz differ
diff --git a/waterbox/gpgx/core/cart_hw/areplay.c b/waterbox/gpgx/core/cart_hw/areplay.c
index bc70e4a457..6dc169b88b 100644
--- a/waterbox/gpgx/core/cart_hw/areplay.c
+++ b/waterbox/gpgx/core/cart_hw/areplay.c
@@ -64,10 +64,10 @@ void areplay_init(void)
   
   memset(&action_replay,0,sizeof(action_replay));
 
-  /* store Action replay ROM (max. 128k) & RAM (64k) above cartridge ROM + SRAM area */
-  if (cart.romsize > 0x810000) return;
-  action_replay.rom = cart.rom + 0x810000;
-  action_replay.ram = cart.rom + 0x830000;
+  /* store Action replay ROM (max. 128KB) & RAM (64KB) above cartridge ROM (max. 8MB) */
+  if (cart.romsize > 0x800000) return;
+  action_replay.rom = cart.rom + 0x800000;
+  action_replay.ram = cart.rom + 0x820000;
 
   /* Open Action Replay ROM */
   f = fopen(AR_ROM,"rb");
diff --git a/waterbox/gpgx/core/cart_hw/ggenie.c b/waterbox/gpgx/core/cart_hw/ggenie.c
index 46128e7732..156864abba 100644
--- a/waterbox/gpgx/core/cart_hw/ggenie.c
+++ b/waterbox/gpgx/core/cart_hw/ggenie.c
@@ -64,9 +64,9 @@ void ggenie_init(void)
   
   memset(&ggenie,0,sizeof(ggenie));
 
-  /* Store Game Genie ROM (32k) above cartridge ROM + SRAM area */
-  if (cart.romsize > 0x810000) return;
-  ggenie.rom = cart.rom + 0x810000;
+    /* Store Game Genie ROM (32KB) above cartridge ROM (max. 8MB) */
+  if (cart.romsize > 0x800000) return;
+  ggenie.rom = cart.rom + 0x800000;
 
   /* Open Game Genie ROM file */
   f = fopen(GG_ROM,"rb");
diff --git a/waterbox/gpgx/core/cart_hw/md_cart.c b/waterbox/gpgx/core/cart_hw/md_cart.c
index 16aefd6100..ae6acb2771 100644
--- a/waterbox/gpgx/core/cart_hw/md_cart.c
+++ b/waterbox/gpgx/core/cart_hw/md_cart.c
@@ -473,39 +473,39 @@ void md_cart_init(void)
 
     case TYPE_SK:
     {
-      /* store S&K ROM above cartridge ROM (and before backup memory) */
-      if (cart.romsize > 0x600000) break;
+      /* store Sonic & Knuckles ROM files after cartridge ROM area */
+      if (cart.romsize > 0x400000) break;
 
-      /* try to load Sonic & Knuckles ROM file (2 MB) */
-      if (load_archive(SK_ROM, cart.rom + 0x600000, 0x200000, NULL) == 0x200000)
+      /* try to load Sonic & Knuckles ROM file (2MB) */
+      if (load_archive(SK_ROM, cart.rom + 0x400000, 0x200000, NULL) == 0x200000)
       {
         /* check ROM header */
-        if (!memcmp(cart.rom + 0x600000 + 0x120, "SONIC & KNUCKLES",16))
+        if (!memcmp(cart.rom + 0x400000 + 0x120, "SONIC & KNUCKLES",16))
         {
-          /* try to load Sonic 2 & Knuckles UPMEM ROM (256 KB) */
-          if (load_archive(SK_UPMEM, cart.rom + 0x900000, 0x40000, NULL) == 0x40000)
+          /* try to load Sonic 2 & Knuckles upmem ROM file (256KB) */
+          if (load_archive(SK_UPMEM, cart.rom + 0x600000, 0x40000, NULL) == 0x40000)
           {
             /* $000000-$1FFFFF is mapped to S&K ROM */
             for (i=0x00; i<0x20; i++)
             {
-              m68k.memory_map[i].base = cart.rom + 0x600000 + (i << 16);
+              m68k.memory_map[i].base = cart.rom + 0x400000 + (i << 16);
             }
 
 #ifdef LSB_FIRST
             for (i=0; i<0x200000; i+=2)
             {
               /* Byteswap ROM */
-              uint8 temp = cart.rom[i + 0x600000];
-              cart.rom[i + 0x600000] = cart.rom[i + 0x600000 + 1];
-              cart.rom[i + 0x600000 + 1] = temp;
+              uint8 temp = cart.rom[i + 0x400000];
+              cart.rom[i + 0x400000] = cart.rom[i + 0x400000 + 1];
+              cart.rom[i + 0x400000 + 1] = temp;
             }
 
             for (i=0; i<0x40000; i+=2)
             {
               /* Byteswap ROM */
-              uint8 temp = cart.rom[i + 0x900000];
-              cart.rom[i + 0x900000] = cart.rom[i + 0x900000 + 1];
-              cart.rom[i + 0x900000 + 1] = temp;
+              uint8 temp = cart.rom[i + 0x600000];
+              cart.rom[i + 0x600000] = cart.rom[i + 0x600000 + 1];
+              cart.rom[i + 0x600000 + 1] = temp;
             }
 #endif
             cart.special |= HW_LOCK_ON;
@@ -564,16 +564,16 @@ void md_cart_init(void)
   /* Realtec mapper */
   if (cart.hw.realtec)
   {
-    /* 8k BOOT ROM */
+    /* copy 8KB Boot ROM after cartridge ROM area */
     for (i=0; i<8; i++)
     {
-      memcpy(cart.rom + 0x900000 + i*0x2000, cart.rom + 0x7e000, 0x2000);
+      memcpy(cart.rom + 0x400000 + i*0x2000, cart.rom + 0x7e000, 0x2000);
     }
 
-    /* BOOT ROM is mapped to $000000-$3FFFFF */
+    /* Boot ROM (8KB mirrored) is mapped to $000000-$3FFFFF */
     for (i=0x00; i<0x40; i++)
     {
-      m68k.memory_map[i].base = cart.rom + 0x900000;
+      m68k.memory_map[i].base = cart.rom + 0x400000;
     }
   }
 
@@ -845,12 +845,12 @@ static void mapper_sega_w(uint32 data)
     }
 
     /* S&K lock-on chip */
-    if ((cart.special & HW_LOCK_ON) && (config.lock_on == TYPE_SK))
+     if (cart.special & HW_LOCK_ON)
     {
-      /* S2K upmem chip mapped to $300000-$3fffff (256K mirrored) */
+      /* S2K upmem chip mapped to $300000-$3fffff (256KB mirrored) */
       for (i=0x30; i<0x40; i++)
       {
-        m68k.memory_map[i].base = (cart.rom + 0x900000) + ((i & 3) << 16);
+        m68k.memory_map[i].base = (cart.rom + 0x600000) + ((i & 3) << 16);
       }
     }
   }
diff --git a/waterbox/gpgx/core/cart_hw/sram.c b/waterbox/gpgx/core/cart_hw/sram.c
index d6b419ebcc..ca1b66d69a 100644
--- a/waterbox/gpgx/core/cart_hw/sram.c
+++ b/waterbox/gpgx/core/cart_hw/sram.c
@@ -66,11 +66,8 @@ extern int cinterface_force_sram;
  ****************************************************************************/
 void sram_init()
 {
-  memset(&sram, 0, sizeof (T_SRAM));
-
-  /* backup RAM data is stored above cartridge ROM area, at $800000-$80FFFF (max. 64K) */
-  if (cart.romsize > 0x800000) return;
-  sram.sram = malloc(0x10000);
+ /* disable Backup RAM by default */
+  sram.detected = sram.on = sram.custom = sram.start = sram.end = 0;
 
   /* initialize Backup RAM */
   memset(sram.sram, 0xFF, 0x10000);
diff --git a/waterbox/gpgx/core/cart_hw/sram.h b/waterbox/gpgx/core/cart_hw/sram.h
index cc03c1ce03..02fca8581b 100644
--- a/waterbox/gpgx/core/cart_hw/sram.h
+++ b/waterbox/gpgx/core/cart_hw/sram.h
@@ -47,7 +47,7 @@ typedef struct
   uint32 start;
   uint32 end;
   //uint32 crc;
-  uint8 *sram;
+  uint8 sram[0x10000];
 } T_SRAM;
 
 /* Function prototypes */