Boot path: internals

The init sequence

main() (FUN_80015E90) is called once by the entry stub FUN_80026C28 with $gp = 0x8007B318. Each stage below is bracketed by a dev-checkpoint print that is compiled in but inert on the shipped disc.

Switching modes. When a handler writes a mode index different from the latched one, the loop stops XA / CD, flushes the GPU queue, re-reads the pad and clears the held-input and frame-state globals before latching the new index. A negative mode index exits the loop - a dev quit path retail never takes.

The full mode table

A 28-entry table at 0x8007078C, 24-byte stride: even rows are INIT handlers, odd rows per-frame handlers. It is static executable data, so legaia_game_tables::mode_table reads it straight off the disc (asset mode-table). The dev names in the table mislead; the third column is what each pair really is.

• 12 of 14 per-frame handlers are one shared tick (0x80025EEC), parameterised by the entry’s +0x14 word. Only world map (13) and menu (23) carry their own.
• Mode 23 runs no frame driver. Its per-frame handler (FUN_80025F74 → FUN_80017978) calls an 18-instruction stub instead of the master frame driver FUN_80016444, so no actor, effect, move VM or animation advances while the pause menu is up.
• World map is a head swap. Mode 12’s INIT saves the first 0x4000 bytes of the field overlay, loads PROT 0981 over them and restores them on exit; the world-map controller proper stays in 0897 (world map).
• The mode word does not name the minigame. Modes 24/25 host all five warp minigames; the discriminator is the signed halfword _DAT_8007BA34, written by the field VM’s door-warp arm as op0 − 100 and left standing while the minigame runs. Key on the pair, never on 0x19 alone - and 0x18 is the one-frame INIT half. Full chain: asset loader.
• Overlay index arithmetic. Both overlay loaders resolve param + 0x381 in the raw TOC, which is extraction entry param + 0x37F (the +2 shift). No call site can produce params 0 or 1, so extraction entries 0895 / 0896 are unreachable from any static loader call.

Entry layout and the bare INIT handlers

Each 24-byte entry is (name_ptr, …, next_mode: i16 at +0x0A, handler_ptr at +0x10, param at +0x14). next_mode is -1 (self-managed) or 0 (fall back to mode 0) - the only two retail values; the word at +0x08 reading 0xFFFF0000 is that -1 over a zero low half, not a sentinel.

Three INIT handlers skip the “reset, wait, load slot A, jump in” wrapper. Mode 4 writes mode 0 and returns. Mode 16 jals 0x801CE9C0 without loading anything, because slot A already holds what it jumps into: PROT 0895 (init.pak) at file +0x1A8, the routine that draws the publisher logos before writing mode 0x11. Mode 20’s FUN_80055B6C is the battle scene setup, resident in the executable.

Slot B’s default (FUN_80025BA0) is the only runtime-decided load: it mirrors the summon-render flag DAT_8007B6A8, picks extraction 901 when set and 900 otherwise, and skips the load when that overlay is already resident. Two other constant loads: the effect-data init uses raw 0x3D5 (= extraction 979) and the CARD-mode init raw 0x37E (= 892, a container-formats::pack of TIMs); legaia_overlay_images::boot_overlay ports the arithmetic and pins each by content.

Archive directory and CD reads

The TOC is read exactly once: the first three sectors of PROT.DAT land at 0x801C70F0. After that, “give me entry N” is a table lookup, and “give me h:\PROT\FIELD\town01\…” is a CDNAME name lookup followed by the same table lookup. An entry’s size is the sector gap to the next entry, exactly what retail’s own span routine computes (PROT).

Every load ends as “seek to a sector, DMA bytes into RAM” through Legaia’s own layered CD driver - hardware registers and callbacks, not the PsyQ libcd path. Every loader is dual-mode, keyed on the dev/retail flag: the retail branch takes the TOC-index path, the dev branch opens a host path through a break trap real hardware cannot service. The port reads a disc image directly, so the register / interrupt tier is documented rather than ported; the async loaders and the streaming queue above it are ported.

The CD-read API stack, bottom-up

The BIOS-trampoline stubs in this cluster (FUN_8005BD30 = B(0x07), FUN_8005DB9C = B(0x3F), the FUN_80056648 family) are syscall shims with no game logic.

The title tick

The countdown store is sw v0, -0xe94(a0) at 0x801DDCCC, in the delay slot of a bgez that keeps the attract loop running while the counter is non-negative; the per-frame scalar it subtracts is the byte at _DAT_1F800393. That store is where a write watchpoint on the countdown fires.

The extended state block

The tick draws through three executable-side helpers: the ClearImage rect-fill queue, the MoveImage VRAM copy, and the sprite-descriptor dispatcher ({ tag, flags, rect, pixel_data_ptr }, alpha-OR pre-pass under flags & 8, width divisor from flags & 3).

The packed pad mask

The per-frame button mask (_DAT_8007B850) and newly-pressed mask (_DAT_8007B874) are packed by the pad builder FUN_8001822C as ~((pad[2] << 8) | pad[3]): the face / shoulder byte in bits 0..7 and the d-pad / system byte in bits 8..15 - not the raw PSX pad word. Anything that ingests retail RAM-side input must translate.

Masks the title tick tests: 0x44 = L1|Cross (confirm), 0x21 = L2|Circle (cancel), 0x844 = Start|L1|Cross (press start), 0xF5 = any face button + L1 + L2.

The title overlay on disc

PROT 0899 is streamed raw and uncompressed from its LBA (47227) across its 74 sectors, in five DMA bursts that all land inside the entry.

The tick body sits at entry offset +0xEB44, byte-identical to the captured title overlay. Two TIMs are embedded in the data segment: 0x801E5120 (entry +0x16908, the save-menu UI atlas) and 0x801EE120 (+0x1F908, the memory-card icon strip - save screen).

The opening chain in detail

The intro skip

The skip lives in FUN_801D1344. Each frame it tests three things: no dialog is up (_DAT_8007B868 == 0), scratchpad flag bit 26 is set (_DAT_1F800394 & 0x4000000), and confirm is held (_DAT_8007B850 & 0x100). When all three hold it starts a 60-frame fade-out, writes the town01 entry coordinates (0xEC0, 0x2DC0) into _DAT_80073EF4 / _DAT_80073EF8, clears bit 26 so the skip fires once, and calls the name-based scene change FUN_8001FD44 with the overlay literal town01 at 0x801CE82C.

• The scene-change packet copies the target name into 0x8007050C, syncs it to the active buffer 0x80084548 and stages the load; s_ERR_CHANGE_PACKET guards re-entry. It is not the map-id door warp (op 0x3E), which backs up the active scene name into 0x8007BAE8 - empty in the town01 opening saves.
• The arm is the last record of opdeene’s third partition (MAN offset 0xA47, the 2E 1A at 0xA5E); town01 carries no such arm.
• Each leg’s opening record spawns via op 0x44 SPAWN_RECORD (the three op scenes) or the walk-on tile trigger (map01, town01). An exec breakpoint on the spawner FUN_8003BDE0 sees exactly five spawns, one per leg. Subtitle pages roll through the bottom-up crawl roller (FUN_80037174) as a child context, so camera cuts play under the scroll.

Name entry

Opened in town01 by field-VM op 0x49 sub-op 3 in the opening timeline record (P2[3], body offset 0x02C6). The grid is 6×17 ASCII cells in three column groups (upper / lower / digits); the cursor walks a 7×17 space whose last row is Backspace / Space / End, and End on a non-empty name opens a Yes/No commit. The committed name lands at record +0x2A7.

The fresh-state seed (FUN_80034A6C / FUN_800560B4) sets gold to 500, zeroes a ~0x200-byte story-flag region and expands the starting-party template into the live records.

Boot-screen textures

Publisher logos - PROT 0895 init.pak

Each logo’s quads come from a six-record sprite-descriptor table that follows the fourth TIM, so PROKION and SCEA are vertically packed: the top half and the bottom half draw side by side, meeting on the 640×480 stage’s centre. Pacing: SCEA 16 / 131 / 32 frames (fade in / hold / fade out), Contrail 16 / 121 / 16, PROKION 16 / 91 then a 65-frame ramp to a white screen. The warning’s descriptor (record 1, tpage 0x000B / clut 0x7E80) is the one id none of the five emit calls passes; a cold-boot capture through the logos, the title, the attract movie and back logs 857 quad emits and none for it, and the menu overlay later parks the memory-card kanji page on top of its VRAM rect.

Title wordmark - PROT 0890

One 256×256 8-bpp sheet at file offset 0x14228 (66,080 bytes with its CLUT; byte-matches RAM 0x80170DF8) carries the orb, wordmark, prompt and copyright lines. Retail samples it in bands rather than blitting the quad.

System-UI textures: raw TOC entries 0 and 1

A 118-sector region between the TOC (ends at 0x1800) and extraction entry 0 (0x3C800, sector 121) is skipped by the extraction index, but not by the TOC: it is raw TOC entries 0 and 1, which are exactly CDNAME's two head names, init_data and gameover_data. They have different loaders.

Each dev-tree name is the operand of the developer-build branch of a load whose retail branch reads the raw index beside it, so the pairing is read straight off the instructions. Raw entry 0 holds the small-caps menu font, the boot cursor and a few sprite strips - 4-bpp TIMs targeting the bottom-right corner of VRAM. Raw entry 1's one page (0x1B80C) is the GAME OVER screen's, and no retail field, battle or menu save state holds its palette; the port's scene upload leaves it out.

The atlas at 0x11218 (33,312 bytes) is the font the shop / inventory / status panels sample; its in-RAM copy at 0x80106478 is byte-equal modulo CLUT relocation. Alphabet row at y = 224..238, 26 cells 8 px wide from x = 8; digits at y = 209..220. Retail switches CLUT rows per context (white / gold / dim). The title’s own NEW GAME / CONTINUE rows do not use it - they are the footer band of the wordmark sheet.

How we know

Full write-up: docs/subsystems/boot.md.