Builds and debug features

At a glance

Anchor build

SCUS-94254, the NA retail disc (executable SCUS_942.54).

Debug menu

Set the byte 0x8007B98F (GameShark 8007B98F 0001), then press SELECT + △ on controller port 2.

In the port

LEGAIA_DEV_MENU=1 for play-window; the Dev-menu checkbox on the browser play page.

Sources

Public cheat-code databases and save-state guides, cross-checked against the disassembly where a row cites a function or an instruction address.

Terms

PROT is the disc's main archive (PROT.DAT); an overlay is a code image the game loads from it into RAM at runtime.

Known builds

What differs between the retail executables

The French, German and Italian discs are container-identical to the USA disc - same PROT layout, same monster records - but their executables are not the NTSC-U engine with swapped text. Two gameplay differences:

• No battle-load stat boost. NTSC-U boosts stats at battle load; the PAL executables do not.
• Different battle spoils. PAL pays half the record's gold and the whole record's EXP; NTSC-U pays a quarter of the gold and three quarters of the EXP.

The JP original (SCPS-10059) matches the PAL behaviour on both counts, so both are NTSC-U additions. The Spanish disc and the EU English disc are unmeasured. Details: PAL localizations.

Cross-region testing priority: SCPS-10059 (original JP), then SCUS-94254 (anchor), then SCES-01752 (EU English).

Region enum

legaia_prot::Region captures the three retail regions. ProtIndex carries it as metadata only - the TOC formula and the CDNAME layout are the same in every region.

Region::from_product_code(code) maps a disc-ID prefix to its variant; Region::translate_addr(na_addr) applies the per-region shift to an NA-anchor address.

Developer attribution

Primary explorer

Prokion (also styled "Procyon"; ぷろきおん in Japanese).

Co-credited

Contrail.

Publisher

SCEI (JP), SCEA (US), SCEE (EU).

That explains the developer paths visible in SCUS_942.54 strings (H:\PROT\FIELD\<stage>\tim.dat and similar): Sony PsyQ on a Windows host with H: mapped to the project tree.

Debug flags

Three flags in the same RAM page decide how much of the developer build the retail disc exposes.

All three have static writers in SCUS_942.54, reached $gp-relative ($gp = 0x8007B318) - which is why a cross-reference sweep that only looks for lui pairs reports none. Published GameShark codes also prove all three are writable at runtime.

Only the byte 0x8007B98F has no accessor of its own; it is reached as the top byte of the word at 0x8007B98C.

JP addresses are not one shift away

The 0x1B90-byte shift between the JP and NA debug-menu byte is what Region::translate_addr applies, and it holds for the cells it was derived from (the published cheat pair), not for the build as a whole. SCPS_100.59 is a separate compile, and no single shift maps NA addresses onto it:

The battle-context fields sit 0xA0 lower in JP. The French SCES_019.44, by contrast, is the NA code relocated, with slot A at 0x801CF0A8 and slot B at 0x801F7400.

Debug pad chords

Once 0x8007B98F is set, these chords are live. The dispatcher is FUN_8001822C.

Each frame FUN_8001822C reads the BIOS pad data at 0x800840F8 and builds a 32-bit button mask, _DAT_8007B850. If the debug word _DAT_8007B98C is zero it strips the upper 16 bits - the controller-2 / debug half - and that is the master gate. A large block guarded by _DAT_8007B98C != 0 then handles the chords.

Two consequences matter when driving the menu externally:

• The chords are port-2 bindings. The same chord on port 1 is ignored.
• The gate does not latch for the session. The debug word's only sw writer is the shared menu / title / save-init routine, which scene transitions run, so entering a scene can clear _DAT_8007B98C mid-session. Re-assert it rather than setting it once.

Globals behind GameShark D-codes

0x8007B7C0

Previous-frame button mask, so D007B7C0 XXXX means "wait for the player to press XXXX".

_DAT_8007B874

mask & ~prev - newly pressed this frame.

0x8007B7C4

mask ^ prev - buttons that changed.

Developer menus

SELECT + △ opens the in-game debug menu, but it is not one screen: it is four tools, each resident in a different overlay, that the retail debug branches reach.

Controls. In the row list, Right steps the hovered row's value up and Left steps it down (the cursor lives at ctx + 0x9E; FUN_801E9F64 dispatches on cursor - 3). The two editors take the whole pad: Up / Down walk their own cursor and Left / Right edit the hovered value, read from the packed words _DAT_8007BB84 (newly pressed) and _DAT_8007B850 (held).

The character editor is worth knowing about even outside a debug build: at the end of every tick it runs a two-stage clamp over all four party records, whichever row is hovered. That clamp is the game's own statement of its stat caps; the records themselves are described on the save screen page.

Reaching the menus in the port

The Rust port carries all four tool families, and both play hosts mount them only behind an explicit opt-in:

Native play-window

Set LEGAIA_DEV_MENU=1 in the environment.

Browser play page

Tick the Dev-menu checkbox. It starts unchecked on every load and is neither persisted nor readable from the URL, so a shared link can never switch it on.

Square

Swaps the row list for the battle-records page, on both hosts.

With the opt-in taken, the row list is drawn and driven once a frame off the same packed pad words retail's developer code reads. Without it nothing runs and nothing is drawn, so a default build or page is unchanged.

The port's list carries the subset of retail's rows whose backing state the engine owns - MAP_CHANGE, ENCOUNT, EVENT_FLAG, PLAYER_PARAM, EQUIP - so that no row steps a value nothing reads. The missing rows need overlay-resident state the engine never loads. The clearest case is the flag-list table (DAT_801F2E94, stride 0xA with an 'X' sentinel): without it, the EVENT FLAG page edits a raw index only.

Camera control axes

The coordinates debug overlay names its camera axes in film-crew terms - a handy string-search anchor for finding the camera-debug renderer.

The labels live in the field overlay (PROT 0897), not in SCUS_942.54. The block starts at 0x801CF1E4 and runs VX VY VZ AX AY AZ WX WZ SC WY, then DCX / DCY / DCZ, MX0 / MY0 / MX1 / MY1, and PLAYER_STAT / HEIGHT_STAT / FREEZE_STAT / ANM_FREEZE_FLAG. Search the extracted PROT entry, not the executable.

CDNAME subsystem semantics

The block labels of CDNAME.TXT past the per-scene blocks. The numbers are the file's own #define values, which are raw in-RAM TOC indices: the extraction entry (the NNNN in a "PROT entry NNNN" citation) is the define minus 2 (see CDNAME). A label is a hint, not a verdict - several blocks hold something other than their name suggests.

Dispatch RAM addresses (GameHacking.org)

PSX RAM cells (KSEG0, 0x80000000 base) that published cheats use - useful anchors for runtime tracing.

Sample values the cheats write to 0x8007B450:

When the trigger is 0x0003, writing a map ID to 0x80084540 warps there.

Mini-game state regions

Each mini-game is a slot-A overlay image: the mode-24 warp streams its PROT entry (fishing 0972, slot machine 0975, Baka Fighter 0976, Muscle Dome 0977, dance 0980) to 0x801CE818 over whatever was resident. The addresses below name mini-game state only while that mini-game's image is loaded; per-image extents are on the RAM map.

Character struct

Stride 0x414 bytes (1044), confirmed by file-offset deltas in ePSXe save states (Vahn / Noa / Gala). Four slots (Vahn / Noa / Gala / Terra the wolf) make a party block of about 4096 bytes - one PSX RAM page. Offsets are relative to the Level field, all u16 little-endian unless noted.

"Current" stats are post-equipment; "unequipped" are the base values. The stat order is fixed across both blocks and all four slots. The full record is on per-character save record.

Money and inventory

Money

24-bit (three consecutive u8 bytes, little-endian). Cap 0x00FFFFFF = 16,777,215 G.

Inventory

One shared list, 2 bytes per entry [item_id, quantity]. Weapons, armor, items and Ra-Seru levels all live in it.

Item ID table

Up to 256 IDs. Canonical NA assignments:

ID 0x12 is "empty wp. for Noa" and 0x52 is "empty wp. for Vahn" - reserved-but-empty slots.

Move tables (Tactical Arts)

Slot 0x00 is the Miracle Art starter on every character (action constant 0x1B = Vahn's Craze / Noa's Ark / Biron Rage, gated by a story flag). Vahn and Gala carry their 14 regular arts at slots 0x01..0x0E. Noa's table runs to slot 0x10 with holes at 0x02 / 0x03 - her Hurricane Kick covers three on-disc levels through one slot - so her slot 0x0F is the ordinary art Acrobatic Blitz, not a Miracle Art. Mirror: legaia_art::tables.

The field VM's EXEC_MOVE (op 0x22, see script VM) feeds these IDs into the move-table consumer at FUN_800204F8; the file format is on MDT.

Translation notes

Character names that differ between the JP and NA scripts - they matter when comparing MES text across regions:

Unused content

Useful as fixtures for validating extractors:

• Unused enemies: index 78 ("Comm") and 140 ("Evil Bat") in the monster table.
• Unused items: "Something Good" (sells for 50,000 G) and an unnamed accessory that forces Seru-only encounters.
• Placeholder battle background: a graphic containing ぷろきおん in hiragana, loaded when a real battle background is missing.
• Placeholder music: tracks copied from Alundra (the Zazan battle theme) and Wild ARMs (battle theme) sit in the SEQ / VAB data.

See also