User Tools

Site Tools


Technical description of Carnivore2

This is the detailed technical description and documentation for the multi-functional Carnivore2 cartridge that was created by RBSC.

NOTE: The hexadecimal numbers are shown as #90, 90h or 0x90

The main components and features:

  • External storage: CF card (CompactFlash)
    • Nextor is used as DOS (built-in support for FAT12/16, maximum partition size: 4 GB)
    • High read and write speeds
    • Supports SD and MicroSD card adapters
    • Nextor supports floppy disk emulation with DSK files
    • Utilities compatible with MSX-DOS versions 1 and 2
    • The cartridge can be configured as a RAM extension, IDE disk, FMPAC and SCC/SCC+ sound cards, or a combination of these devices
  • RAM: 2048 Kb (2 Mb)
    • Includes:
      • 1024 Kb main RAM with mapper
      • 256 Kb for ROM shadowing
      • 720 Kb additional RAM with a mapper, similar to MegaRAM
      • 4 Kb (in the last 64 Kb–block) for the FMPAC SRAM (a backup battery is needed to save data after turning off the power)
  • Flash memory (FlashROM): 8 Mb capacity, 64 Mb/s
    • The first 256 Kb are used for service information and ROM BIOSes
    • Mapper emulation:
      • Linear 64 Kb mode
      • ASCII8
      • ASCII16
      • Konami4
      • Konami5 (SCC/SCC+)
      • Custom mapper
  • Sound
    • PPI and PSG emulation
    • Konami SCC and SCC+ emulation
    • OPLL emulation (YM2413, MSX – Music), BIOS UI translated to English
    • Volume setting for all emulated audio devices
    • PSG and PPI can be enabled and disabled in the user interface
  • Additional 128 byte configuration EEPROM (M93C46MN1), works in 8–bit mode
  • User–adjustable volume for SCC and FMPAC (8 steps), saved in 93C46 EEPROM
  • User–adjustable volume for PSG and Clicker (8 steps), saved in 93C46 EEPROM
  • User–controlled PSG and Clicker device on/off switch
  • User–adjustable VDP frequency (50/60Hz), saved in the 93C46 EEPROM

On–board BIOSes and modules:

File Subslot Description
2 1Mb RAM

The location of the Boot Menu, directory and BIOSes in the FlashROM chip is described below. There are logical and physical blocks and they have different numbering.

The location of blocks in FlashROM

The FlashROM chip that is used in Carnivore2 has 8 logical blocks in the first physical 64kb block and then go the rest of 64kb physical blocks. In the logical blocks there are Boot Menu and directory. The next few blocks are allocated for the BIOSes of the embedded devices.

8kb blocks

The first 8 logical 8kb blocks are grouped into the first physical block that is addressed by the AddrFr register. Logical blocks 0, 1, 6 and 7 contain the Boot Menu's code and data. Blocks 2 and 3 contain directory entries. Then go 2 blocks that are reserved for future use.

Address range Block number Description
000000h–001FFFh 0 after power on (AddrFR=#00, R1Mult=“10000101” B1AdrD = #4000) is visible in subslot 0 at address #4000–#5FFF and contains the first 8kb of boot menu (ROM “AB” header + start addresses)
002000h–003FFFh 1 after power on is visible in subslot 0 at addresses #6000-#7FFF (bits 2–0 of R1Mult = “101” are the size of the shown block (16kb)) and contain the second 8kb of boot menu
004000h–005FFFh 2 directory entries
006000h–007FFFh 3 directory entries
008000h–009FFFh 4 not used
00A000h–00BFFFh 5 not used
00C000h–00DFFFh 6 used for the data of the Boot Menu
00E000h–00FFFFh 7 used for the data of the Boot Menu

64kb blocks

After the first 8 logical 8kb blocks that form the first physical block, there go the physical 64kb blocks of the FlashROM.

Address range Physical block number Logical block number Description
010000h–01FFFFh81, AddrFR=#01contain the IDE BIOS
020000h–02FFFFh92, AddrFR=#02contain the IDE BIOS
030000h–03FFFFh103, AddrFR=#03contains FMPAC BIOS
040000h–04FFFFh114, AddrFR=#03Data blocks — these blocks are used for saving the ROM images (games, etc.)
050000h–05FFFFh125, AddrFR=#03
7F0000h–7FFFFFh134127, AddrFR=#7F

FlashROM chip

Model: Numonix M29W640GB TSOP48

Block layout:

#1000064K x 127

Command addresses: #4555 and #5AAA



FlashROM ID: #7E

  • Block 0 is reserved for the directory and the boot menu: BOOTCMFC.BIN
  • Blocks 1–2 are reserved for the IDE BIOS: BIDECMFC.BIN
  • Block 3 is reserved for the FMPAC BIOS: FMPCCMFC.BIN

OPLL еmulation (FMPAC)

The OPLL emulation (FMPAC) that is supported by the cartridge is mapped to ports #7C–7D.

The FMPAC SRAM is emulated by using the 8kb of the upper area of the 1st megabyte of RAM (shadow RAM) that is not shared with the memory mapper. The physical address of the 8kb area for SRAM in the shadow RAM is 0FE000h–0FFFFFh.

NOTE: The settings of SRAM will be lost after powering down unless the cartridge has the backup battery installed.

FMPAC's own control registers:

  • 7FF4h: write YM-2413 register port (write only)
  • 7FF5h: write YM-2413 data port (write only)
  • 7FF6h: activate OPLL I/O ports (read/write)
  • 7FF7h: ROM page (read/write)

To enable 8kb of SRAM at address 4000h–5FFFh, set 4Dh to 5FFEh and 69h to 5FFFh.

Additional configuration EEPROM

Model: M93C46MN1 (128 bytes/1 kbit)

IMPORTANT! The chip is operated only in 8–bit mode!

This EEPROM is used to store additional configuration settings. Using the EEPROM prevents the important configuration settings from being lost after power goes down. The location of the settings in the EEPROM and their description can be found i the table blow.

Address Description
01 FMPAC and SCC volume, 3 bits per value, max volume is 8, first 2 bits are used as flags
02 50 or 60 Hz VDP frequency flag, bit 1 from this byte is used — if this bit is zero then 60 Hz is used
03 PSG and clicker enable/disable flags and volumes, 3 bits per volume, max volume is 8, first 2 bits are used as enable/disable flags
04 Entry sorting (0=disabled)
05 Fade in/out effects (0=disabled)
06 Keyboard/joystick speed (this is an increment for default value)
07 Menu font palette
09 Menu background palette
0B Help font palette
0D Help background palette
0F Volume font palette
11 Volume background palette
13 PSG/PPI font palette
15 PSG/PPI background palette
17 Custom settings in use flag (must be #42)
18 Double reset on “cold boot” (1=enabled)
19 FMPAC mono (1=enabled)
1A Last used entry
1B Music playback status
1C Autostart entry number
1D Help scroller status

Writing to EEPROM is done via the configuration register CardMDR+#23. The commands for EEPROM are saved into this register in a sequence that is described in the chip's datasheet. Only write–enable, read and write commands are used.

Configuration registers

The configuration registers are located at addresses #0F80 or #4F80 or #8F80 or #CF80h. Their visibility and location is controlled by the main control register's first byte — at address #4F80. The main control register is called CardMDR. After power on, the registers are located at address #4F80. All registers are write–only except the pseudo–register for sending/receiving the data when accessing the FlashROM and the register for the configuration EEPROM.

Below you can find the description of configuration registers.

Register number, name Bit number Value Description
00 CardMDRMain cartridge's configuration register
01 AddrM0lower address register (bits 7–0) for accessing the FlashROM
02 AddrM1middle address register (bits 15–8) for accessing the FlashROM
03 AddrM2higher address register (bits 22–16) for accessing the FlashROM
04 DatM0pseudo–register for sending/receiving data from/to FlashROM
05 AddrFRregister controlling the number of FlashROM's 64kb block for ROM emulation
The default value of this register is 00h
06 R1MaskConfiguration registers for bank 1
07 R1Addr
08 R1Reg
09 R1Mult
0A B1MaskR
0C R2MaskConfiguration registers for bank 2
0D R2Addr
0E R2Reg
0F R2Mult
10 B2MaskR
11 B2AdrD
12 R3MaskConfiguration registers for bank 3
13 R3Addr
14 R3Reg
15 R3Mult
16 B3MaskR
17 B3AdrD
18 R4MaskConfiguration registers for bank 4
19 R4Addr
1A R4Reg
1B R4Mult
1C B4MaskRsimilar to B1MaskR
1D B4AdrDsimilar to B1AdrD
1E MconfExpanded slot configuration register
1F CMDRCpycopy of the CardMDR+#00 register (to be used with LDIR command)
20 ConfFlFlashROM chip's configuration
The default value of this register is — 010b
2 0 8 bit bus
1 16 bit bus
1 Reset/protect flag
0 1 enable 12V for boosted writing into FlashROM
0 зdisable 12V for boosted writing into FlashROM
21 NSRegNon-standard Register
The default value of this register is #00, please don't change it!
22 SndLVLvolume level register
The default value of this register is 1Bh (00011011b)
7, 6 10 = FMPAC mono,
00 = FMPAC stereo
5, 4, 3 FMPAC audio level (0–7)
2, 1, 0 SCC/SCC+ audio level (0–7)
23 CfgEEPRregister for controlling additional configuration EEPROM (93C46)
7, 6, 5, 4 not used
3 EECS signal Chip Select EEPROM
2 EECK signal CLK (sync)
1 EEDI signal Data Input (data sent to EEPROM)
0 EEDO signal Data Output (data received from EEPROM); read–only
24 PSGCtrlPSG control register
The default value of this register is 1Bh (00011011b)
7 enable/disable PSG
6 enable/disable PPI Clicker
5, 4, 3 PSG audio level (0–7)
2, 1, 0 PPI Clicker audio level (0–7)
25 V_AR_Llower 8 bits of the interceptor code
26 V_AR_Hсhigher 8 bits of the interceptor code
27 aV_huntinterceptor's flag for delayed configuration
0 activation flag for interceptor code on system restart or read from #4000
1 enabled
1 interceptor code's location
0 boot menu in FlashROM
1 first shadow RAM block
28 SLM_cfgper–device subslot assignment (master slot)
7 FMPAC subslot number
5 RAM (Mapper MMM) subslot number
3 IDE (CF) subslot number
1 FlashROM/SCC subslot number
29 SCART_cfgslave slot control register
7 1 slave slot enabled
0 slave slot disabled
6 1 slave slot's location assigned by user
0 slave slot assigned as subslot of master slot
5 1 slave slot expanded (if not used as a subslot of master slot)
0 slave slot non–expanded (if not used as a subslot of master slot)
4 1 master slot's location is assigned by user
0 master slot located at the physical slot
3 1 not used
2 1 allow slot select register for emulated slot (used only for slots 1 and 2)
0 disable slot select register for emulated slot (real slot's register will be used)
2A SCART_SLTslot/subslot configuration on power–on
7, 6 00 = mini ROM up to 32kb without mapper
01 = K4 mapper
10 = K5 mapper without SCC
11 = K5 mapper + SCC
5, 4 master slot number
3, 2 expanded slave slot number
1, 0 slave slot number
2B SCART_StBlslave slot's 64kb block assignment in FlashROM
2C, 2D, 2E FPGA_verFPGA firmware version (3 ASCII bytes)
2FMROM_offs = mini ROM offset in 64kb block (in 8kb steps)

Registers of configuration bank

There are six bank configuration registers:

n — this is the bank number.


Bitmask for bank's register address. This value is normally mirrored into several addresses, for example for Konami 5 cartridges those addresses for the first bank are 5000h–57FFh. Here we use only the high byte's address — F8h (11111000b).

The default value of this register is F8h


High byte of the bank's address register (example: 50h for address 5000h)

The default value of this register is 50h.


Initial value for bank's number (usually 00h)

The default value of this register is 00h.


RnMult — bank's mode and size register

Bit number Value Description
7 1 bank's register is enabled
0 bank's control is disabled
6 1 mirroring is disabled
0 mirroring is enabled
5 media type selection
0 FlashROM
4 1 writing to bank is enabled
0 writing to bank is disabled
3 0 bank is enabled
1 bank is disabled
bank's size
111b = 64 kb,
110b = 32 kb,
101b = 16 kb,
100b = 8 kb,
011b = 4 kb
other value — bank is disabled
The default value of this register is 85h

The default value is 00h (bank is disabled)


Bitmask for bank's addressing mode into the FlashROM. This is the ROM's emulated size and the number of pages. For example for a 128kb ROM we will need 16 pages of 8kb, so we set the 0Fh (00001111b) mask.

The default value of this register is 03h


High byte of the bank's address (example: 40h for address 4000h).

The default value of this register is 40h


00 CardMDR — main cartridge's configuration register

Bit number Value Description
7 1don't show registers
0show registers
6 0/1/2/3registers are located at addresses 0F80h/4F80h/8F80h/CF80h
4 1SCC enabled
0SCC disabled
3 1delayed configuration
0configuration is changed immediately after updating the registers
2 0delayed configuration is enabled after CPU executes at address 0000h
1configuration is enabled after reading from address 4000h
The delayed configuration works only for AddrFR and bank control registers
1 source for BIOS of embedded devices
0BIOS data (boot menu, IDE controller, FMPAC) is read from FlashROM chip
1BIOS data (boot menu, IDE controller, FMPAC) is read from RAM
Warning! The data must be copied into DAM before setting this bit!
0 configuration registers visibility control
0all configuration registers are visible at addresses 0F80h/4F80h/8F80h/CF80h depending on the values of bits 5 and 6
1configuration registers are not visible, 1 byte of data from the corresponding block in the FlashROM is available at those addresses


1E Mconf — expanded slot configuration register

Bit number Value Description
7 1 slot is expanded
0 slot is not expanded
6 1 MMM mapper ports FC,FD,FE,FF reading is enabled
5 1 control YM2413 (FM Pack Synt. 7Ch,7Dh)
4 1 control 3С порта (МММ mapper)
3 1 control -3 Subslot FM Pack bios ROM
2 1 control -2 Subslot MMM mapper with 1mb of RAM is enabled
1 1 control -1 Subslot CF card interface
0 1 control -0 Subslot MSCC (and this register)

Directory entry format

There are 253 user–controlled directory entries available in the cartridge. The first directory entry can't be edited or deleted because it sets the default cartridge's configuration — all enabled. The directory is 8kb in size and is located in the 2 and 3 logical blocks of the FlashROM chip at addresses 004000h–005FFFh (block 2) and 006000h–007FFFh (block 3). The physical block number (controlled by the AddrFr register) is zero.

Each directory entry occupies 40h (64 bytes) and has the following format:

Register number Name Bit number Value/description
#00NUMRecord number (last one — #FF is ignored)
#01ACTActive/empty record's flag (#FF — active record)
#02STBStarting 64kb block for data
#03LNBData size in 64kb blocks
#04MAPMapper type symbol
#05NAMRecord name (30 bytes)
#23R1MaskConfiguration registers for bank 1
#29R2MaskConfiguration registers for bank 2
#2FR3MaskConfiguration registers for bank 3
#35R4MaskConfiguration registers for bank 4
#3BMconfexpanded slot configuration register
#3CCardMDRmain configuration register
#3DPosSizsize and position in 64kb block for mini ROMs
#3ERstRunreset and start options


PosSiz — size and position in 64kb block for mini ROMs

Bit number Value/description
7 reserved
offset of mini ROM in 64kb block based on ROM's size:
8 kb 16 kb 32 kb
000b 0 kb 0 kb 0 kb
001b 8 kb 16 kb 32 kb
010b 16 kb 32 kb
011b 24 kb 48 kb
100b 32 kb
101b 40 kb
110b 48 kb
111b 56 kb
3 non–standard ROM size:
1 — 49 kb
0 — standard ROM size
mini ROM's size:
110b = 32 kb
101b = 16 kb
100b = 8 kb
011b = 4 kb
000b = not mini ROM


RstRun — reset and start options

Bit number Value/description
3 ROM's start address:
0 — use bit 2 from this register
1 — use start address at 0002h
2 ROM's start address:
0 — use start address at 4002h
1 — use start address at 8002h
1 execution control:
0 — don't start ROM
1 — start using ROMini address (bits 3,2)
0 reset flag:
0 — do not reset MSX
1 — reset MSX


The cartridge supports a few common mappers and the linear mode that allows first 64kb of the MiniROM to be visible in the address space. The physical addresses allocated for the mappers' operation lie in the range of 100000h–1FFFFFh. This means that only the second megabyte of RAM is used.

Mappers type values:

KKonami5 (SCC) mapper
kKonami4 mapper
aASCII8 mapper
AASCII16 mapper
Mmini ROM (8, 16, 32, 48 and 64kb ROM without mapper)
Cconfiguration entry
Uunknown mapper


The cartridge supports the ASCII8 mapper.

Default configuration values:

#F8#60#00#84#FF#40bank 1
#F8#68#01#84#FF#60bank 2
#F8#70#02#84#FF#80bank 3
#F8#78#03#84#FF#A0bank 4
#FF#AC#00#02#FF configuration registers


The cartridge supports the ASCII16 mapper.

Default configuration values:

#F8#60#00#85#FF#40bank 1
#F8#70#01#85#FF#80bank 2
#F8#70#02#08#3F#80bank 3
#F8#78#03#08#3F#A0bank 4
#FF#8C#00#01#FF configuration registers


The cartridge supports the Konami4 mapper.

Default configuration values:

#E8#50#00#04#FF#40bank 1
#E8#60#01#84#FF#60bank 2
#E8#80#02#84#FF#80bank 3
#E8#A0#03#84#FF#A0bank 4
#FF#AC#00#02#FF configuration registers


The cartridge supports the Konami5 (SCC) mapper.

Default configuration values:

#F8#50#00#84#FF#40bank 1
#F8#70#01#84#FF#60bank 2
#F8#90#02#84#FF#80bank 3
#F8#B0#03#84#FF#A0bank 4
#FF#BC#00#02#FF configuration registers


The cartridge supports MiniROM (ROM images up to 49kb) without mapper.

Default configuration values:

#F8#60#00#06#7F#40bank 1
#F8#70#01#08#7F#80bank 2
#F8#70#02#08#3F#С0bank 3
#F8#78#03#08#3F#A0bank 4
#FF#8C#07#01#FF configuration registers

Linear 64kb mode

The cartridge supports the linear 64kb mode, when the first 64kb of the ROM are visible in the address space.

The default configuration values for MiniROMs are:

#F8#60#00#06#7F#40bank 1
#F8#70#01#08#7F#80bank 2
#F8#70#02#08#3F#C0bank 3
#F8#78#03#08#3F#A0bank 4
#FF#8C#07#01#FF configuration registers

Bank addresses in linear mode:

#0000–#3FFFbank 1
#4000–#7FFFbank 2
#8000–#BFFFbank 3
#C000–#FFFFbank 4

Default register values

Below you can find the default values for several configuration registers.

CardMDRCardMDR+#0020h (but may vary because of 2 last bits)

RCP file format

RCP file format description.

Address (byte) Description
#00Mapper type
#01R1MaskConfiguration registers for bank 1
#07R2MaskConfiguration registers for bank 2
#0DR3MaskConfiguration registers for bank 3
#13R4MaskConfiguration registers for bank 4
#1DNot used, always FF


en/msx/carnivore2/specification.txt · Last modified: 2020-07-25 23:46 by GreyWolf