home · reference · PSX RAM map

PSX RAM map

The PSX has exactly 2 MB of main RAM, at addresses 0x80000000-0x801FFFFF, and everything the running game is - its code, the party's stats, the loaded scene, the story flags - lives somewhere in that window. This map says what lives where. Click any region to see the details.

Interactive map

Order: low addresses on top. Hover for a one-liner, click for full detail. Three landmarks orient everything else: SCUS_942.54 (the game's main executable) loads at 0x80010000 and its data segment holds the persistent game state; the region above 0x801C0000 is the overlay window, where the game swaps in per-mode code (title / town / battle / menu) on demand; and the addresses quoted across this site's docs and cheat tables all point into this map.

BIOS / OS area
0x80000000 - 0x8000FFFF PSX BIOS workspace, kernel TCB, exception vectors
SCUS_942.54 (the game executable)
0x80010000 - 0x8005FFFF SCUS code (.text + libsnd / libspu / libcd / libapi)
0x80060000 - 0x800FFFFF SCUS .rodata + .data + .bss (jump tables, global state, character records, story flags)
Game state globals (in SCUS .bss)
0x801C9370 Battle 8-actor pointer table
0x80084708 + n*0x414 Per-character record (4 slots; display name at internal +0x2A7). Slot 3 (Terra) runs into the story-flag bitmap at 0x80085600, so its tail (+0x2BC..) aliases the globals.
0x80085958 Item inventory (2-byte stride, alternating id/count; live window is 128 or 256 slots, not the 72 the cheat corpus spans)
0x80074358 - 0x80074367 4×u32 active-ability bitmask
0x800845B4 Point Card counter (u32; unmapped by every public cheat archive). Shop buy commit FUN_801db7f4 accrues price/20 per unit when item 0xFE (the Point Card) is held, cap 9,999,999. GameShark-style max: 800845B4 967F + 800845B6 0098.
0x801C70F0 In-RAM PROT.DAT TOC (loaded at boot)
0x8007BD24 Pointer to active battle context struct
0x8007BC3C + 0x801F351C..3528 World-map render-pipeline gate flag + params
0x8007C34C..0x36C Actor-list slot table (7 linked-list heads consumed by FUN_8002519c)
0x800EB654 Active battle context struct (pointed to by 0x8007BD24)
Runtime data buffers
0x80100000 - 0x801BFFFF Runtime data buffers (asset slabs, per-scene state, dialog buffer)
Runtime overlay window
0x801C0000 - 0x801CFFFF Overlay header / shared dispatch region
0x801D0000 - 0x801EFFFF Overlay code (varies by game mode: title / town / battle / menu)
0x801F0000 - 0x80205FFF Extended overlay region (used by 256 KB town overlay)
Stack
~0x801FFF00 (top, grows down) CPU stack

Click any row above to see details.

Notes

  • The overlay window holds different code depending on which game mode is active. Static analysis only sees what's loaded at the time of capture. The repo has separate overlay imports for: title screen, town (PROT 0897), battle (PROT 0898), and the menu/options overlay (PROT 0899).
  • Several globals that look like data ("DAT_xxxxx" in Ghidra) are actually pointers to runtime structs. The battle context at 0x8007BD24 is the canonical example - Ghidra types it as int*, code accesses it as (*ptr)[N].
  • The PROT TOC at 0x801C70F0 is loaded from disc at boot. The entry size formula is size = toc[p+5] - toc[p+3] + 4, where p is the entry's word offset in the raw TOC. See the PROT.DAT format page.
Superseded readings (do not re-walk)
  • "PROT 0896 @ 0x801C5818" as a menu-overlay base is refuted - that base was an over-read artifact; the menu overlay is PROT 0899 at 0x801CE818, and live field captures hold an ISO9660 directory cache at 0x801C5818.

See also

Reference Functions Boot sequence Ghidra tooling