
*** CRT - CaRTridge Files (from the CCS64 emulator)
*** Document revision 1.3

  Cartridge files were introduced in the CCS64  emulator,  written  by  Per
Hakan Sundell, and use the ".CRT" file extension. This format  was  created
to handle the various ROM cartridges that exist, such as Action Replay, the
Power cartridge, and the Final Cartridge.

  Typically, normal game cartridges would load into one  of  two  specified
memory ranges ($8000 or $E000), but newer utility  and  freezer  cartridges
were less intrusive, hiding themselves until called upon. Because  of  this
"stealthing" method, a special cartridge format was necessary, to  let  the
emulator know where the cartridge should reside, as  well  as  any  special
hardware features it uses.

  Here is a dump of a cartridge "Attack Of The Mutant Camels"...

      00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F        ASCII
      -----------------------------------------------   ----------------
0000: 43 36 34 20 43 41 52 54 52 49 44 47 45 20 20 20   C64CARTRIDGE
0010: 00 00 00 40 01 00 00 00 00 01 00 00 00 00 00 00   @
0020: 41 54 54 41 43 4B 20 4F 46 20 54 48 45 20 4D 55   ATTACKOFTHEMU
0030: 54 41 4E 54 20 43 41 4D 45 4C 53 00 00 00 00 00   TANTCAMELS
0040: 43 48 49 50 00 00 20 10 00 00 00 00 80 00 20 00   CHIP
0050: D3 9B BC FE C3 C2 CD 38 30 EA EA EA A9 01 85 13   ӛ80
0060: 4C B3 9B A9 08 85 5A 88 D0 FD C6 5A D0 F9 60 D0   LZZ`

  Bytes:$0000-000F - 16-byte cartridge signature  "C64  CARTRIDGE"  (padded
                     with space characters)
         0010-0013 - File header  length  ($00000040,  in  high/low  format,
                     calculated from offset $0000). Default value is $40
         0014-0015 - Cartridge version (high/low, presently 01.00)
         0016-0017 - Cartridge hardware type ($0000)
                       0 - Normal cartridge
                       1 - Action Replay
                       2 - KCS Power Cartridge
                       3 - Final Cartridge III
                       4 - Simons Basic
                       5 - Ocean type 1 (128K and 256K)*
                       6 - Expert Cartridge
                       7 - Fun Play
                       8 - Super Games
                       9 - Atomic Power
                      10 - Epyx Fastload
                      11 - Westermann
                      12 - Rex
                      13 - Final Cartridge I
              0018 - Cartridge port EXROM line status
                      0 - inactive
                      1 - active
              0019 - Cartridge port GAME line status
                      0 - inactive
                      1 - active
         001A-001F - Reserved for future use
         0020-003F - 32-byte cartridge  name  "CCSMON"  (padded  with  null
                     characters)
         0040-xxxx - Cartridge contents (called CHIP PACKETS, as there  can
                     be more than one  per  CRT  file).  See  below  for  a
                     breakdown of the CHIP format.

  (*Note: Ocean type 1 includes Navy Seals, Robocop 2, Shadow of the Beast,
Toki, and likely more)



  The following is the contents of the CHIP packet, from position $0040  on
in the CRT file. Note I have re-adjusted the starting address to be  $0000,
since we are now looking at a file contained in the .CRT file, and all size
references are from where it starts.

      00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F        ASCII
      -----------------------------------------------   ----------------
0000: 43 48 49 50 00 00 20 10 00 00 00 00 80 00 20 00   CHIP
0010: D3 9B BC FE C3 C2 CD 38 30 EA EA EA A9 01 85 13   ӛ80
0020: 4C B3 9B A9 08 85 5A 88 D0 FD C6 5A D0 F9 60 D0   LZZ`
0030: F2 60 A9 04 85 49 A9 00 85 48 A2 00 A5 48 9D 40   `IHH@
0040: 03 A5 49 9D 60 03 A5 48 18 69 28 85 48 A5 49 69   I`Hi(HIi
0050: 00 85 49 E8 E0 18 D0 E4 60 A6 03 A4 02 BD 40 03   I`@

  Bytes:$0000-0003 - Contained ROM image signature "CHIP" (note  there  can
                     be more than one image in a .CRT file)
         0004-0007 - Total packet length ($00002010,  ROM  image  size  and
                     header combined) (high/low format)
         0008-0009 - Chip type
                      0 - ROM
                      1 - RAM, no ROM data
         000A-000B - Bank location ($0000 - normal cartridge)
         000C-000D - Load address range (high/low format)
         000E-000F - ROM image size (high/low format,  typically  $2000  or
                     $4000)
         0010-xxxx - ROM data





Cartridge Specifics
-------------------

1. OCEAN cartridges

Here is a list of the four known OCEAN cartridges:

Shadow of the Beast (256 kB)
Robocop 2 (256 kB)
Navy Seals (128 kB)
Toki (128 kB)

  Memory is divided into 0x2000 banks. For the lower 128kB memory is always
banked into  $8000-$A000,  for  the  upper  128kB  memory  is  banked  into
$A000-$C000. The banking destination is accordingly given  in  the  address
word of the Chip Packet header.

  Bank switching is done by writing to $de00. The lower five bits give  the
bank number (ranging from 0-31). Bit 8 in this  selection  word  is  always
set.



2. FUN PLAY cartridge

  The FUN PLAY Cartridge uses $de00 for  bank  selection,  and  uses  $2000
banks at $8000-$a000. There are 16 banks of ROM memory and  are  referenced
by the following values:

0x00 -> Bank 0
0x08 -> Bank 1
0x10 -> Bank 2
0x18 -> Bank 3
0x20 -> Bank 4
0x28 -> Bank 5
0x30 -> Bank 6
0x38 -> Bank 7
0x01 -> Bank 8
0x09 -> Bank 9
0x11 -> Bank 10
0x19 -> Bank 11
0x21 -> Bank 12
0x29 -> Bank 13
0x31 -> Bank 14
0x39 -> Bank 15

  The bank field in the chip headers is set according to the value  written
to $de00.

  After copying memory from the ROM banks the selection  program  writes  a
value of 0x86 to $de00. This seems either to reset or disable the cartridge
ROM.



3. SUPER GAMES cartridge

  The SUPER GAMES cartridge uses 4 $4000 banks ($8000-$c000) of ROM memory.
Bank selecting is done by writing to $df00.

Values for $df00:

0x00 -> Bank 0
0x01 -> Bank 1 (also value 0x09 used)
0x02 -> Bank 2
0x03 -> Bank 3

Bit #2
  0: ROM $8000-$bfff,
  1: ROM $8000-$9fff
Bit #2 0: ?, 1: if bit #2 AND #3 = 1: module off

  The bank field in the chip headers is set according to the value  written
to $df00.

