MIPS overlay code Inferred

At a glance

In the game

Mostly battle code: the 0903..=0966 band is the 64 slot-B cast / summon modules, one per special attack, paged in when that attack is cast; 0968 / 0969 are the two boss-stage modules.

Magic / marker

No header - the blob begins with a MIPS function prologue (addiu sp, sp, -X = 0x27BDFFxx)

Lives in

PROT.DAT entries in the 0901..=0969 range (extraction index), 14-37 KB each; loads into the overlay window 0x801C0000..0x80200000

Parser

legaia_overlay_images::mips_overlay::detect (crates/overlay-images/src/mips_overlay.rs); category mips_overlay in the categorize pipeline

Confidence

Inferred - a shape heuristic with zero false positives over the corpus, not a loader trace; each blob's load base comes from the asset chain that pulls it in.

Used by

Static overlay pipeline, Overlay capture

Layout

Nothing on the disc labels these entries as code - they look like any other binary blob. Every compiled MIPS function opens by moving the stack pointer down to make room for its locals, so a blob that begins with that instruction is a code image whose entry function starts at byte 0.

The detector reads only the first two words; everything after them is the overlay body.

Detection

Three checks together produce zero false positives across the corpus:

1. u32_le[0] & 0xFFFF_FF00 == 0x27BD_FF00 - addiu sp, sp, -X.
2. (u32_le[0] & 0xFF) ∈ [0x80, 0xF8] - only accept reasonable stack adjustments (8 to 128 bytes).
3. u32_le[1]'s 6-bit MIPS opcode field is one of the common function-prologue follow-ups (sw, addiu, lui, lw, R-type, ldc/sdc).

use legaia_overlay_images::mips_overlay;

if let Some(m) = mips_overlay::detect(buf) {
    println!("MIPS overlay: stack frame = {} bytes; second op = {:#04x}",
             m.stack_frame_bytes, m.second_op);
}

Where they sit and what they do

• Range. Every match is in the 0901..=0969 extraction range, 14 KB to 37 KB, with one 163 KB outlier at 0969_xxx_dat.BIN.
• Load base. The overlay window is 0x801C0000..0x80200000; each blob loads at a fixed offset inside it, determined by the asset chain that pulls it in. Recovered bases are committed in crates/asset/data/static-overlays.toml.
• What the band holds. The 0903..=0966 entries are the 64 slot-B cast / summon images, each one special attack's stager (slot-B module layout, cast modules); 0968 / 0969 are the two boss-stage modules (battle). Entries that lead with a pointer table instead of a prologue are covered by the sister detector.
• Importing. Once a base is known, scripts/ghidra-analysis/bulk-import-overlays.sh loads the blob into Ghidra (the disassembler this project uses) at that base.

Trusting an address from an overlay dump

A dumped function's printed address is only as good as the base the dump was made at; a filename prefix is not evidence of the base. Before citing an overlay address, run the byte-match arbiter (scripts/ghidra-analysis/classify-worklist.py --explain <addr>) and trust its image= verdict. Only a REAL self-entry body at a recovered base attests a distinct function at its printed address.

How we know

See also