Boot path

At a glance

Entry point

main() = FUN_80015E90, called once by the executable stub with $gp = 0x8007B318; it never returns in normal play

Archive directory

First three sectors of PROT.DAT (6 KB) land at 0x801C70F0; every later load is a table lookup

Mode machine

28-entry table at 0x8007078C: 14 modes, each an INIT / per-frame pair; the mode word is _DAT_8007B83C

Overlay window

Slot A at 0x801CE818 holds one of field / menu / cutscene / minigame code at a time; slot B holds the summon-render pair

Title screen

No row is named for it, but it is a mode - the CARD pair (22/23), whose init streams PROT 0899 into slot A

NEW GAME

Writes mode 2 (field), loads PROT 0897 and opens the prologue scene opdeene; name entry comes later, in town01

Port

engine-shell::BootSession (init + the seat), engine-core::mode::ModeSeat (the mode word and the table around it), engine-vm::title_overlay (the title tick)

Confidence

Confirmed - mode table read off the disc; title tick and launch write pinned by live watchpoints

The ladder

Almost every PlayStation game bundles its small files into one archive so the disc can stream them; Legaia’s is PROT.DAT, with a table of contents saying “entry N starts at sector S”. Reading that table is job one. Job two is the asset-type dispatcher: each entry’s first byte is a type tag, and one router hands the bytes to the matching parser (asset-type). Job three is the mode machine below.

Most gameplay code is not in the executable. The field VM, dialog renderer and battle logic live in RAM overlays streamed on demand into 0x801C0000+. “Zero callers in SCUS_942.54” never means dead code - it means the caller is in an overlay.

The main loop

After hardware init, main() spins forever: call the current mode’s handler; if the handler asked for a different mode, do the housekeeping and switch. A negative mode index exits - a dev quit path retail never takes.

Switching modes. When a handler writes a mode index different from the latched one, the loop stops XA / CD, flushes the GPU queue, re-reads the pad and clears the held-input and frame-state globals before latching the new index.

Game-mode state machine

Walking a town, fighting, browsing the pause menu, watching a movie - to the game these are modes, and exactly one is active. Even table rows are INIT handlers (one frame, usually loading an overlay); odd rows are per-frame handlers. The table is static executable data, so legaia_asset::mode_table reads it straight off the disc (asset mode-table). The dev names mislead; this is the ground truth:

• 12 of 14 per-frame handlers are one shared tick (0x80025EEC), parameterised by the entry’s +0x14 word. Only world map (13) and menu (23) carry their own.
• The pause menu runs under CARD (mode 23), not field mode 3. Every menu-open save state holds game_mode = 0x17. The engine mirrors it: BootSession holds the world in SceneMode::Menu.
• Mode 23 runs no frame driver. Its per-frame handler calls an 18-instruction stub instead of the master frame driver, so retail advances no actor, effect, move VM or animation while the pause menu is up. World::tick suspends the same passes and keeps the frame-begin / frame-end passes running underneath.
• World map is a head swap. Mode 12’s INIT saves the first 0x4000 bytes of the field overlay, loads PROT 0981 over them and restores them on exit; the world-map controller proper stays in 0897 (world map).
• The mode word does not name the minigame. Modes 24/25 host all five warp minigames; the discriminator is the signed halfword _DAT_8007BA34, written by the field VM’s door-warp arm as op0 − 100 and left standing while the minigame runs. Key on the pair, never on 0x19 alone - and 0x18 is the one-frame INIT half. Full chain: asset loader.
• Overlay index arithmetic. Both overlay loaders resolve param + 0x381 in the raw TOC, which is extraction entry param + 0x37F (the +2 shift). No call site can produce params 0 or 1, so extraction entries 0895 / 0896 are unreachable from any static loader call.

The interpreters live in those overlays: the field / event VM in 0897, the effect VM cluster in the battle overlay 0898, and the window-widget VM in the menu overlay 0899. Slot-A overlays are mutually exclusive - see the residency figure on the subsystems index.

Archive directory and CD reads

The TOC is read exactly once. After that, “give me entry N” is a table lookup, and “give me h:\PROT\FIELD\town01\…” is a CDNAME name lookup followed by the same table lookup. An entry’s size is the sector gap to the next entry, exactly what retail’s own span routine computes (PROT).

Every load ends as “seek to a sector, DMA bytes into RAM” through Legaia’s own layered CD driver - hardware registers and callbacks, not the PsyQ libcd path. The stack splits: the register / interrupt / transport tier is documented, not ported - the engine reads a disc image directly and has no drive to command - while the tier above it, the async loaders and the streaming queue’s enqueue arithmetic over the PROT TOC, is ported. Every loader is dual-mode, keyed on the dev/retail flag: the retail branch takes the TOC-index path, the dev branch opens a host path through a break trap real hardware cannot service.

The title screen

The title screen is a small program of its own: an attract countdown that eventually plays the opening movie, a two-row menu, a memory-card check, and the NEW GAME / CONTINUE launch. It runs under the CARD pair, modes 22/23: that mode’s init loads PROT 0899 and spawns an actor whose handler calls the tick every frame. What is empty is the name search - none of the 28 dev names says “title”, which is why the row looked missing.

All 25 sub-modes carry the role their handler body shows in legaia_engine_vm::title_overlay, and TitleTickState::step executes the graph - one arm per sub-mode plus the shared epilogue, driven by the 56 state[+0x204] stores. The whole sub-mode machine is the front-end menu, memory-card manager and launcher - not an opening narration or name-entry sequence. Master game mode 2 has two writers: LaunchGame (0x06) at 0x801DFC00 on the NEW GAME route and LaunchFade (0x16) at 0x801DFAFC on the load route.

lui   a0, 0x801f
lui   v1, 0x1f80
lbu   v1, 0x393(v1)     ; per-frame scalar  (_DAT_1F800393)
lw    v0, -0xe94(a0)    ; countdown          (0x801EF16C)
subu  v0, v0, v1
bgez  v0, 0x801dfc3c    ; still counting: normal attract loop
_sw   v0, -0xe94(a0)    ; pc 0x801DDCCC - the watchpoint hit

Where the title overlay lives on disc

The title code is the tail of PROT entry 0899 - the same entry whose head is the options-menu bundle. It is streamed raw and uncompressed straight into the overlay window: a multi-sector read from the entry’s LBA (47227) covering its 74 sectors, in five DMA bursts that all land inside the entry.

What NEW GAME launches

Press NEW GAME and you do not get a name-entry screen. You get a scripted opening - the creation-myth crawl, the Seru intro, the Mist story, a fly-in over Rim Elm - and only once you stand in Rim Elm does “Select your name” appear. Every leg is an ordinary field scene chained by script, not a movie, and a confirm press skips the whole thing.

The fresh-state seed. The new-game data init sets gold to a hard-coded 500, zeroes a ~0x200-byte story-flag region, and expands the executable’s starting-party template into the live 0x414-byte records, default names included. The opening scene comes from the title launcher, not from this seed. Port: World::begin_new_game.

The intro skip. Once opdeene’s timeline sets scratchpad flag bit 26 (field-VM op 0x2E GFLAG_SET, operand 0x1A), a confirm press at any time fades out, sets the town01 entry coordinates, clears the bit so it fires once, and issues a name-based scene-change packet to town01. The target name is an overlay literal, which is why opdeene’s own data holds no town01 string. Port: World::take_prologue_handoff, armed by execution when the timeline runs.

Name entry runs in town01 under mode 3, opened by field-VM op 0x49 sub-op 3 in the opening timeline record (P2[3], body offset 0x02C6). The overlay draws a 6×17 ASCII grid in three column groups (upper / lower / digits); the cursor walks a 7×17 space whose last row is Backspace / Space / End, and End on a non-empty name opens the Yes/No commit. The committed name lands at record +0x2A7. Port: engine-core::name_entry, rendered by name_entry_draws_for; a story flag on the record keeps a later visit from re-prompting.

if (_DAT_8007b868 == 0 && (_DAT_1f800394 & 0x4000000) && (_DAT_8007b850 & 0x100)) {
    FUN_801d58f0(2, 0, 0xffffff, 0, 0x3c, -1);   // fade out
    _DAT_80073ef4 = 0xec0;  _DAT_80073ef8 = 0x2dc0;   // town01 entry coords
    _DAT_1f800394 &= 0xfbffffff;                  // clear bit 26 (fire-once)
    func_0x8001fd44(s_town01_801ce82c, 3);        // next scene = "town01"
}

Boot-time art

Three separate sources feed the boot screens: the publisher logos in init.pak, the title wordmark sheet in PROT 0890, and a bundle of system-UI textures that sits in no PROT entry at all.

Publisher logos - PROT 0895 init.pak

PROKION, Contrail, “SCEA Presents” and the epilepsy warning are four uncompressed TIMs in one bundle. Mode 16 READ INIT uploads all four to VRAM and then plays them from the overlay’s own 13-state sequencer, in the order SCEA, Contrail, PROKION - not the order they sit in the file. Each logo’s on-screen quads come from a six-record sprite-descriptor table that follows the fourth TIM, so PROKION and SCEA are vertically packed: the top half and the bottom half draw side by side, meeting on the 640×480 stage’s centre.

The fade is not alpha: the quads are opaque, and the sequencer scales each vertex colour so the PSX texture blend texel × colour / 128 darkens them - level 0 is black and 0x80 leaves the texel alone. Per-logo pacing: SCEA 16 / 131 / 32 frames, Contrail 16 / 121 / 16, PROKION 16 / 91 then a 65-frame ramp to a white screen.

The epilepsy warning is never shown. Its sprite descriptor (record 1, tpage 0x000B / clut 0x7E80) is the one id none of the five emit calls passes, and a cold-boot capture carried through the logo chain, the title screen, the attract movie and the return to the title logs 857 quad emits with zero for that descriptor and finds no primitive anywhere in RAM carrying its CLUT - while the three logo CLUTs, swept in the same pass as a control, each land on their documented screen rect. Later in the same boot the menu overlay parks the memory-card kanji page on top of the warning’s VRAM rect, so its pixels do not survive to the title either.

Parser legaia_asset::init_pak; sequencer, quad table and pacing in engine_core::publisher_logos; shown by the asset viewer’s “Boot publisher logos” panel, by play-window --boot-ui and by the browser play page’s own boot chain, which opens the logo stage ahead of the title card off the same session and the same shared quad builder. The entry’s bat_back_dat filename label is the +2 shift, not a mislabel. There is no single title.pak entry: that dev-tree bundle is split between PROT 0890 (wordmark) and PROT 0899 (options bundle + title code).

Title wordmark - PROT 0890

One 256×256 8-bpp sheet at file offset 0x14228 (66,080 bytes with its CLUT) carries the orb, wordmark, prompt and copyright lines. Retail samples it in bands rather than blitting the quad; the engine (title_screen_atlas) emits one sprite per active band.

System-UI textures in the pre-entry gap

A 118-sector region sits between the TOC (ends at 0x1800) and the first indexed entry (0x3C800, sector 121). It holds the small-caps menu font, the boot cursor and a few sprite strips - all 4-bpp TIMs with palettes, all targeting the bottom-right corner of VRAM. No per-entry extractor visits it; ProtIndex::prot_dat_raw_bytes reads it directly.

Debug flags

Two RAM values decide whether the game behaves like the shipped disc or a dev station. On real hardware both read “retail”; a cheat device can flip them, which is how the debug menu on the retail disc becomes reachable (docs/reference/builds.md lists the bindings).

How we know

The game shipped without symbols; functions are named FUN_<address> after their RAM location in the Ghidra trace.

See also