diff --git a/cfg/sim6502.cfg b/cfg/sim6502.cfg
index 530787489..546671641 100644
--- a/cfg/sim6502.cfg
+++ b/cfg/sim6502.cfg
@@ -4,7 +4,7 @@ SYMBOLS {
 }
 MEMORY {
     ZP:     file = "",               start = $0000, size = $001B;
-    HEADER: file = %O,               start = $0000, size = $0001;
+    HEADER: file = %O,               start = $0000, size = $0002;
     MAIN:   file = %O, define = yes, start = $0200, size = $FDF0 - __STACKSIZE__;
 }
 SEGMENTS {
diff --git a/cfg/sim65c02.cfg b/cfg/sim65c02.cfg
index 530787489..546671641 100644
--- a/cfg/sim65c02.cfg
+++ b/cfg/sim65c02.cfg
@@ -4,7 +4,7 @@ SYMBOLS {
 }
 MEMORY {
     ZP:     file = "",               start = $0000, size = $001B;
-    HEADER: file = %O,               start = $0000, size = $0001;
+    HEADER: file = %O,               start = $0000, size = $0002;
     MAIN:   file = %O, define = yes, start = $0200, size = $FDF0 - __STACKSIZE__;
 }
 SEGMENTS {
diff --git a/doc/sim65.sgml b/doc/sim65.sgml
index ff66079a1..6f197f518 100644
--- a/doc/sim65.sgml
+++ b/doc/sim65.sgml
@@ -144,8 +144,9 @@ Without using the provided target library, there are some relevant internal deta
 
 <itemize>
 
-<item>The binary input file has a 1 byte header. A value of 0 indicates 6502 simulation,
-and 1 indicates 65C02.
+<item>The binary input file has a 2 byte header. The first byte indicates CPU type:
+ 0 = 6502, 1 = 65C02. The second byte is the address of the C parameter stack pointer
+ <tt/sp/, used by the paravirtualization functions.
 
 <item>The rest of the input file, after the header, will be loaded at <tt/$0200/,
 and execution will begin at <tt/$0200/.
@@ -160,7 +161,7 @@ Jumping to this address will terminate execution with the A register value as an
 <item>The built-in functions are provided by 6 paravirtualization hooks present at
 <tt/$FFF0-$FFF5/. Except for <tt/exit/, a <tt/JSR/ to one of these
 addresses will return immediately after performing a special function,
-intended only for use with the sim65 target C library.
+intended for use with the sim65 target C library.
 
 <item><tt/IRQ/ and <tt/NMI/ events will not be generated, though <tt/BRK/
 can be used if the IRQ vector at <tt/$FFFE/ is manually prepared by the test code.
diff --git a/libsrc/sim6502/exehdr.s b/libsrc/sim6502/exehdr.s
index 865bd6553..d10cf3763 100644
--- a/libsrc/sim6502/exehdr.s
+++ b/libsrc/sim6502/exehdr.s
@@ -1,11 +1,14 @@
 ;
 ; Oliver Schmidt, 2013-05-16
 ;
-; This module supplies a 1 byte header identifying the simulator type
+; This module supplies a 2 byte header identifying the simulator type,
+; and parameter stack pointer sp.
 ;
 
         .export         __EXEHDR__ : absolute = 1       ; Linker referenced
+        .importzp       sp
 
         .segment        "EXEHDR"
 
         .byte   .defined(__SIM65C02__)
+        .byte   sp
diff --git a/src/common/version.c b/src/common/version.c
index 1f1e8093e..c76a39933 100644
--- a/src/common/version.c
+++ b/src/common/version.c
@@ -47,7 +47,7 @@
 
 
 #define VER_MAJOR       2U
-#define VER_MINOR       17U
+#define VER_MINOR       18U
 
 
 
diff --git a/src/sim65/main.c b/src/sim65/main.c
index a1bbc5561..03803a1bf 100644
--- a/src/sim65/main.c
+++ b/src/sim65/main.c
@@ -132,11 +132,12 @@ static void OptQuitXIns (const char* Opt attribute ((unused)),
     MaxCycles = strtoul(Arg, NULL, 0);
 }
 
-static void ReadProgramFile (void)
+static unsigned char ReadProgramFile (void)
 /* Load program into memory */
 {
     int Val;
     unsigned Addr = 0x0200;
+    unsigned char SPAddr = 0x0000;
 
     /* Open the file */
     FILE* F = fopen (ProgramFile, "rb");
@@ -152,6 +153,11 @@ static void ReadProgramFile (void)
         CPU = Val;
     }
 
+    /* Get the address of sp from the file header */
+    if ((Val = fgetc(F)) != EOF) {
+        SPAddr = Val;
+    }
+
     /* Read the file body into memory */
     while ((Val = fgetc(F)) != EOF) {
         if (Addr == 0xFF00) {
@@ -169,6 +175,8 @@ static void ReadProgramFile (void)
     fclose (F);
 
     Print (stderr, 1, "Loaded '%s' at $0200-$%04X\n", ProgramFile, Addr - 1);
+
+    return SPAddr;
 }
 
 
@@ -184,6 +192,7 @@ int main (int argc, char* argv[])
     };
 
     unsigned I;
+    unsigned char SPAddr;
 
     /* Initialize the cmdline module */
     InitCmdLine (&argc, &argv, "sim65");
@@ -243,11 +252,11 @@ int main (int argc, char* argv[])
         AbEnd ("No program file");
     }
 
-    ParaVirtInit (I);
-
     MemInit ();
 
-    ReadProgramFile ();
+    SPAddr = ReadProgramFile ();
+
+    ParaVirtInit (I, SPAddr);
 
     Reset ();
 
diff --git a/src/sim65/paravirt.c b/src/sim65/paravirt.c
index 55caeeb94..b03767c5a 100644
--- a/src/sim65/paravirt.c
+++ b/src/sim65/paravirt.c
@@ -77,6 +77,7 @@
 typedef void (*PVFunc) (CPURegs* Regs);
 
 static unsigned ArgStart;
+static unsigned char SPAddr;
 
 
 
@@ -120,9 +121,9 @@ static unsigned char Pop (CPURegs* Regs)
 
 static unsigned PopParam (unsigned char Incr)
 {
-    unsigned SP = MemReadZPWord (0x00);
+    unsigned SP = MemReadZPWord (SPAddr);
     unsigned Val = MemReadWord (SP);
-    MemWriteWord (0x0000, SP + Incr);
+    MemWriteWord (SPAddr, SP + Incr);
     return Val;
 }
 
@@ -132,7 +133,7 @@ static void PVArgs (CPURegs* Regs)
 {
     unsigned ArgC = ArgCount - ArgStart;
     unsigned ArgV = GetAX (Regs);
-    unsigned SP   = MemReadZPWord (0x00);
+    unsigned SP   = MemReadZPWord (SPAddr);
     unsigned Args = SP - (ArgC + 1) * 2;
 
     Print (stderr, 2, "PVArgs ($%04X)\n", ArgV);
@@ -152,9 +153,9 @@ static void PVArgs (CPURegs* Regs)
         MemWriteWord (Args, SP);
         Args += 2;
     }
-    MemWriteWord (Args, 0x0000);
+    MemWriteWord (Args, SPAddr);
 
-    MemWriteWord (0x0000, SP);
+    MemWriteWord (SPAddr, SP);
     SetAX (Regs, ArgC);
 }
 
@@ -313,10 +314,11 @@ static const PVFunc Hooks[] = {
 
 
 
-void ParaVirtInit (unsigned aArgStart)
+void ParaVirtInit (unsigned aArgStart, unsigned char aSPAddr)
 /* Initialize the paravirtualization subsystem */
 {
     ArgStart = aArgStart;
+    SPAddr = aSPAddr;
 };
 
 
diff --git a/src/sim65/paravirt.h b/src/sim65/paravirt.h
index 34317b49f..cd4915398 100644
--- a/src/sim65/paravirt.h
+++ b/src/sim65/paravirt.h
@@ -44,7 +44,7 @@
 
 
 
-void ParaVirtInit (unsigned aArgStart);
+void ParaVirtInit (unsigned aArgStart, unsigned char aSPAddr);
 /* Initialize the paravirtualization subsystem */
 
 void ParaVirtHooks (CPURegs* Regs);