Interactive map

Order: low addresses on top. Hover for a one-liner, click for full detail.

BIOS / OS area
0x80000000 - 0x8000FFFF PSX BIOS workspace, kernel TCB, exception vectors
SCUS_942.54 (the game executable)
0x80010000 - 0x8005FFFF SCUS code (.text + libsnd / libspu / libcd / libapi)
0x80060000 - 0x8007FFFF SCUS .rodata + .data (jump tables, global state)
Game state globals (in SCUS .bss)
0x801C9370 Battle 8-actor pointer table
0x80084708 Character record array (stride 0x414)
0x80074358 - 0x80074367 4×u32 active-ability bitmask
0x801C70F0 In-RAM PROT.DAT TOC (loaded at boot)
0x8007BD24 Pointer to active battle context struct
Heap + scratch
0x80080000 - 0x801BFFFF Game heap (asset buffers, runtime state, dialog buffer)
0x800EB654 Active battle context struct (pointed to by 0x8007BD24)
Runtime overlay window
0x801C0000 - 0x801CFFFF Overlay header / shared dispatch region
0x801D0000 - 0x801EFFFF Overlay code (varies by game mode: title / town / battle / menu)
0x801F0000 - 0x80205FFF Extended overlay region (used by 256 KB town overlay)
Stack
~0x801FFF00 (top, grows down) CPU stack

Click any row above to see details.

Notes

  • The overlay window holds different code depending on which game mode is active. Static analysis only sees what's loaded at the time of capture. The repo has separate overlay imports for: title screen (0971), town (0897), battle (0898), menu, options/0896.
  • Several globals that look like data ("DAT_xxxxx" in Ghidra) are actually pointers to in-heap structs. The battle context at 0x8007BD24 is the canonical example - Ghidra types it as int*, code accesses it as (*ptr)[N].
  • The PROT TOC at 0x801C70F0 is loaded from disc at boot. Sam's earlier TOC math used a wrong offset (toc[p+5]-toc[p+2] instead of toc[p+5]-toc[p+3]+4); fixing it shifted classification of hundreds of entries.