diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index 7148a3e..9e78155 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -110,6 +110,7 @@ def main():
     if _loglisten is not None:
         sys.stdout = _Tee()
     thumb = int(sys.argv[sys.argv.index("--thumb") + 1], 0)
+    _start = [(int(sys.argv[sys.argv.index("--thumb") + 1], 0)) | 1]
     mu = Uc(UC_ARCH_ARM, UC_MODE_THUMB)
     for base, size in RAMS:
         mu.mem_map(base, size)
@@ -777,13 +778,48 @@ def main():
             for pc, a, sz, v in inn[:60]:
                 print(f"  pc={pc:#x} [{a:#x}] sz={sz} val={v:#x}")
         _ax2.register(_dwlo)
+    if "--snapload" in sys.argv:
+        import pickle as _pk
+        _sn = _pk.load(open(sys.argv[sys.argv.index("--snapload") + 1], "rb"))
+        _rr = _sn["regs"]
+        for _i in range(13):
+            mu.reg_write(UC_ARM_REG_R0 + _i, _rr[_i])
+        mu.reg_write(UC_ARM_REG_SP, _rr[13])
+        mu.reg_write(UC_ARM_REG_LR, _rr[14])
+        mu.reg_write(UC_ARM_REG_PC, _rr[15])
+        mu.reg_write(UC_ARM_REG_CPSR, _rr[16])
+        for _b, _d in _sn["mem"].items():
+            mu.mem_write(_b, _d)
+        count[0] = _sn["count"]
+        hist.extend(_sn["hist"])
+        if len(_inrng) == len(_sn["inrng"]):
+            _inrng[:] = _sn["inrng"]
+        _s12in[0] = _sn["s12in"]
+        _ms[:] = [list(_m) for _m in _sn["ms"]]
+        _mio[:] = _sn["mio"]
+        _start[0] = (_rr[15] | 1) if ((_rr[16] >> 5) & 1) else (_rr[15] & ~1)
+        print("snaploaded", _sn["count"], flush=True)
     limit = 2000000
     if "--limit" in sys.argv:
         limit = int(sys.argv[sys.argv.index("--limit") + 1])
+    _snapdump = sys.argv[sys.argv.index("--snapdump") + 1] if "--snapdump" in sys.argv else None
     try:
-        mu.emu_start(thumb | 1, 0xFFFFFFFF, 0, limit)
+        mu.emu_start(_start[0], 0xFFFFFFFF, 0, limit)
     except Exception as e:
         print("EMU-EXC:", str(e)[:120])
+    if _snapdump:
+        import pickle as _pk2
+        _rr = [mu.reg_read(UC_ARM_REG_R0 + _i) for _i in range(13)]
+        _rr += [mu.reg_read(UC_ARM_REG_SP), mu.reg_read(UC_ARM_REG_LR),
+                mu.reg_read(UC_ARM_REG_PC), mu.reg_read(UC_ARM_REG_CPSR)]
+        _mm = {}
+        for _b, _s in RAMS:
+            _mm[_b] = bytes(mu.mem_read(_b, _s))
+        _pk2.dump({"regs": _rr, "mem": _mm, "count": count[0],
+                    "hist": list(hist), "inrng": list(_inrng), 
+                    "s12in": _s12in[0], "ms": [list(_m) for _m in _ms], 
+                    "mio": list(_mio)}, open(_snapdump, "wb"))
+        print("snapdumped", count[0], flush=True)
     print("insns:", count[0], "last-pc:", hex(last[0]))
     print("unmapped:", unmapped["n"], unmapped["first"][:4])
     print("regs:",