Save Screen

How it works

The whole flow lives inside the menu overlay - a chunk of code the game streams into RAM on demand, the same binary that carries the shop, inn, and status screens (it is not an overlay of its own). We traced it with a disassembler (Ghidra); the FUN_80xxxxxx names below are RAM addresses in that trace. Three layers: an outer 9-state dispatcher (FUN_801DC6B4), a sub-screen function-pointer table, and a state machine over libcd (Sony's CD/memory-card library) that does the actual card I/O.

FUN_801DC6B4 drives a 9-case state machine on _DAT_8007B43C. It returns true when the save flow terminates (state ≥ 6). The entry-context pointer _DAT_8007B450 is decoded on state 0 to select which sub-screen opens:

State 2 dispatches via the sub-screen function pointer table at 0x801E4F40: (*(DAT_801E46A4 * 4 + 0x801E4F40))(_DAT_8007B874). Input is suppressed while _DAT_8007B440 > 0x79 (mid-fade). States 3–5 handle the fade-out sequence before the terminal return.

Key functions

FUN_801DAEF4 - load-from-slot driver (sub-screen 0x19)

Runs an actor VM with bytecode at &DAT_801E4E30 (its display actor), waits on _DAT_8007BB80 != 0 (menu-active flag). State 2 calls FUN_801DD35C(1, 1) - the saving-overlay main in load direction (param_2 selects op: 1 = load, 2 = save). Each step calls FUN_80031D00 (text-actor tick / MES advance). It is reached from row 6 of the root command picker FUN_801D6B20 (sub-screen 0x01) - which, despite an earlier label here, is not a slot selector.

FUN_801D6B20 - root command picker (sub-screen 0x01)

The menu overlay's own top level. Phase 0 runs the display script &DAT_801E4BC0, raises DAT_801E46C0 = 0x1000 and masks DAT_801E46BC &= 0xFFF; phase 1 waits for the menu-active flag to clear, then runs a 7-row picker FUN_801D688C(&DAT_801E46BC, 7, 1). Rows 0..4 route unconditionally to sub-screens 5 (Items command window), 0x0E (Magic caster picker), 0x12 (Equip character picker), 0x15 and 0x17. The last two are gated: row 5 (save-card driver 0x18) is blocked when the installed entry context _DAT_8007B450 carries kind byte 0x0D - the test is on the kind, not on the pointer's presence, so a null context takes the allow branch - and row 6 (load 0x19) is blocked when the save-block presence byte is zero. Blocked rows buzz with cue 0x23 and stay. Cancel leaves for sub-screen 0, except under that same 0x0D context where it goes to 3, the Yes/No confirm: one context byte both hides Save and makes leaving ask first. Engine port: engine-core::pause_screens::{root_menu_confirm_route, root_menu_cancel_route}.

FUN_801DAFD4 - slot confirm + saving in progress

Runs the 3-item slot scrolling list via FUN_801D688C(&DAT_801E46BC, 3, 1). On slot 1 confirmed: validates against the save-block existence table at &DAT_80084140 + slot * 2 + 0x1818 (byte 0 = slot present, byte 1 = slot valid), then advances DAT_801E46A4 to 0x1E (the write sub-screen). On slot 2: cancel SFX. Slot 0 routes to the card-full/error sub-screen (0x1B).

FUN_801D688C - shared list-cursor navigator

The menu / shop / save-slot state-handlers funnel list-cursor navigation through one overlay helper, FUN_801D688C(cursor: *u32, count, mode). It reads the overlay confirm / cancel pad masks (_DAT_8007B874 & DAT_801EF0F0 / DAT_801EF0F4) and the held-pad word _DAT_8007BB84, mutates the caller's cursor cell in place, enqueues a UI SFX cue through FUN_80035B50, and returns a result enum: 1 = confirm (SFX 0x36, tested first even when count == 0), 2 = cancel (SFX 0x37), 3 = moved (SFX 0x21), 0 = none. The cursor cell is packed - the low 12 bits are the list index and the high nibble (0xF000) carries caller flags the navigator preserves across a move; held-pad 0x1000 decrements, 0x4000 increments. mode == 0 clamps at the ends, mode != 0 wraps (every ported call site passes 1). Call sites: the 3-item slot list (FUN_801DAFD4), the 2-item Yes/No confirm FUN_801D688C(&DAT_801E46D0, 2, 1) (sub-screen 0x03), and the party-count picker (sub-screen 0x12).

Engine port: legaia_engine_core::menu_input::menu_cursor_nav(cursor, count, wrap, NavButtons) reproduces it as a plain function over a caller-owned cursor cell and a NavButtons snapshot (host derives the booleans from input::InputState), returning a CursorNav enum whose sfx_cue() surfaces the retail cue id for the host to play through its SfxBank. SaveSelectSession::tick_confirm consumes it for the Yes/No confirm cursor.

Load/save dispatch (FUN_801DD35C)

Sub-screens 0x18 and 0x19 are structurally identical 3-state drivers that share the saving-overlay main routine, distinguished only by the op selector passed as param_2. Both install _DAT_8007B44C = DAT_801C6EA0 (card handle) on state 0.

Sub-screen pointer table at 0x801E4F40

See docs/subsystems/save-screen.md for the full pointer-table audit (most 5–15 ms state machines following the same actor-invoke / pad-input / advance pattern as FUN_801DA9F8).

Libcd I/O state machine (FUN_801E3294)

The actual PSX memory-card calls live in FUN_801E3294 - a 5-state libcd state-machine driver in the menu overlay. The per-frame ticker FUN_801E1114 is the static caller wiring it together: every frame it calls FUN_801E3294(DAT_801EF18C, 0); when _DAT_801F021C == 3 (save commit) it sequences FUN_801E3AF0 (sprintf "bu%d_%d" + libcd channel open) → FUN_801E3BA0 (block-count query) → FUN_801E1208 (directory walk).

FUN_801E1208 walks the 15-entry libcd directory table at 0x801F32A8 (stride 0x28), matching each filename against the region-specific Legend of Legaia prefix using BIOS-A(0x18) strncmp:

• BASCUS-94254PRO_ - USA (Legend of Legaia, SCUS-94254)
• BISCPS-10059PRO_ - JP (Legend of Legaia, SCPS-10059)

The actual BIOS card-write thunk is FUN_8006EE34: it calls FUN_8006EE7C (BIOS-B(0x50)) then FUN_8006EE6C (BIOS-B(0x4E)) with channel argument (port, 0x3F, 0). The channel encoding is chan = port * 16 + sub_op.

Save-block checksum (FUN_801E38D8)

A save block is exactly one card block (0x2000 bytes = 0x800 u32 words). FUN_801E38D8 is the block's additive checksum: it sums the first 0x7FF little-endian words with a wrapping accumulator, stopping one word short of the block's final word at byte 0x1FFC - the word where the write path stores the sum. The load direction of FUN_801DD35C reloads it (lw v1,0x1ffc(s1); beq v1,v0 at 0x801df888) and branches on stored-equals-computed to route the slot to the valid or the corrupt state. Ported as save_select::save_block_checksum with the compose helper save_block_checksum_valid mirroring the load-path compare.

Slot list: memory-card slots, not save blocks

Retail's save UI is two-stage, and the two stages live in different id spaces - conflating them is the easy mistake.

Between them sits the card read - the "Now checking. Do not remove MEMORY CARD" dialog - which is why that beat exists at all.

SaveSelectSession is renderer-agnostic and models the phases, not the id space, so a host picks which reading its slot list carries:

• Flat (default): the slot list is the save blocks; the pills show the first two and Save picks a block straight off the pill row. The native shell drives this against its on-disk LGSF slots.
• Card slots (set_card_slots_mode(true)): the slot list is the two ports. Save then crosses the same NowChecking beat Load does and raises its overwrite prompt from the preview rather than from the pill row, and present on a pill means "a card is inserted", not "this holds a save". The browser play page drives this against the player's own card images.

The grid cursor is the host's, not the session's: SlotPreview ignores directions, so which of the fifteen blocks is focused - and therefore which block a confirm commits - is host state.

Messagebox panel geometry (FUN_801E36C4)

Every save-UI panel rect flows through one drawer. Its x is a centre, not a left edge, and the box emitter it forwards to inflates the centre rect by a uniform 8px on every side (the same inflation as the dialog reading box):

footprint = (center_x - w/2 - 10,  y - 2,  w + 16,  h + 16)

Pinned against the live GP0 draw list (the sprite rects the GPU actually receives): the header tab (48, 6, 65, 13) predicts (6, 4, 81, 29) - exactly the Load panel's byte-pinned 14-sprite composition - and the parked "Now checking" dialog (160, 97, 169, 26) predicts (66, 95, 185, 42). Gold-border pixel scans read one pixel inside this footprint (the outermost tile ring scans as background), which is what an earlier +14 / -9 / -1 model was built on.

The confirm prompt is two panels plus stacked options - not one box with Yes/No side by side: prompt bar (8, 86, 300, 29) and Yes/No box (129, 118, 58, 42) at the parked slide y = 88.

Engine port

legaia_save::SaveFile (with SaveExt) is the clean-room counterpart: the LGSF v2 container (party records, story flags, money, inventory, play-time, per-character ext) with backward-compatible v3 (full 512-byte story-flag bitmap) and v4 (LGX4 shiny-Seru block) extensions. It round-trips via engine-core's save_full / load_full calls; the legaia-engine save / load subcommands exercise this path end-to-end.

Retail-save offsets are pinned (story_flags at SC +0x14C0, inventory at SC +0x1818); see docs/subsystems/save-screen.md for the full block layout. The libcd I/O state machine that drives both load and save is pinned at FUN_801E3294; the actual BIOS card-write thunk is FUN_8006EE34 (which calls BIOS-B(0x4E) _card_write via the wrapper at FUN_8006EE6C). FUN_8001A8B0 is plain memcpy used to stage data into / out of the staging buffer at 0x801E5120.

UI render side. legaia_engine_core::save_menu_atlas composes a single 256×256 RGBA atlas containing the 9-slice panel tiles, the interior-fill tile (pre-baked gouraud gradient), the pointing-finger cursor, and the slot pills, each decoded with its correct CLUT row; legaia_engine_render::save_select_chrome_draws_for emits the retail-pinned tile composition, and the “Load” title renders from the whitewashed dialog-font stencil at SAVE_SELECT_TITLE_POS with the SAVE_SELECT_TITLE_COLOR tint. All retail framebuffer coordinates are expressed in the canonical 320 × 240 boot-UI stage so they stay in lockstep at any window resolution.

Animation side. SaveSelectSession::slide_anim_t() collapses retail slide timers 0/2 into one driver, with interpolate_anim((start, target, t)) implementing the 12-bit fixed-point formula; info_panel_slide_anim_t() drives the bottom info panel's vertical slide, and slot_info_panel_draws_for / slot_info_panel_text_draws_for take a panel_y_offset so every per-element constant stays panel-relative.

Story-flag persistence vs. scratchpad word

Two distinct stores share the name “story flags” but live in unrelated regions, and the SC save/load path does not sync between them:

The scratchpad word _DAT_1F800394 is the field-VM transient that opcodes 0x2E (set bit), 0x2F (clear bit), and 0x30 (test bit) operate on. A static sweep across all dumped functions finds one non-RMW writer: FUN_8001DCF8 at PC 0x8001E17C, which seeds the lower 16 bits from mode_table[mode_idx].param on mode init. No retail code path copies between the wide bitmap and the scratchpad word, so the engine's SaveExt::story_flags (mirroring the scratchpad word) and SaveExt::story_flag_bits (mirroring the bitmap) round-trip independently - that matches retail behaviour.

Continue → Load screen sprite sources

The retail Continue → Load screen overlays a “Load” header panel and N blue SLOT pills on top of dimmed title art, with a pointing-finger cursor next to the active pill. Every sprite source is byte-confirmed via a VRAM dump (VRAM is the PS1's video memory, where every texture and CLUT palette row lives) plus a scan of the GP0 primitives (the GPU's raw draw commands) at PCSX-Redux save state 9:

Slide-in UI primitive (FUN_801E1C1C)

The save-UI overlay's slide-in animations all flow through a single primitive, FUN_801E1C1C(mode, anim_t, start_x, start_y, target_x, target_y). The function inlines its own 12-bit fixed-point linear interpolation, then dispatches per mode to emit the slid-in content at the interpolated (x, y):

iVar10 = (param_5 - param_3) * param_2;       // (target_x - start_x) * t
if (iVar10 < 0) iVar10 += 0xfff;               // round-toward-zero
param_3 = param_3 + (iVar10 >> 0xc);           // start_x + delta * (t/4096)

anim_t is 12-bit fixed-point in [0, 0x1000]: t=0 at start, t=0x1000 at target. Each animated element owns a dedicated timer global that the dispatcher (FUN_801DD35C) ramps +0x100 per frame, clamped at 0x1000 - a 16-frame slide at NTSC.

Bottom info panel (FUN_801E08D8)

Once the "Now checking" dialog dismisses and the slot-preview screen appears, the save-UI overlay emits a bottom info panel showing the selected slot's kingdom, game time, party leader portrait, and per-character stats. FUN_801E08D8(slot_index, view_mode) renders the whole panel and is called once per frame by the grid-renderer wrapper FUN_801E06C0.

Vertical slide-in (sixth save-UI animator)

The info panel has its own bespoke vertical slide-in, distinct from the FUN_801E1C1C primitive - the primitive can only animate ONE element, while the info panel propagates a single panel_y across 15+ separate sprite/text emit calls. Entry math:

iVar4 = DAT_801ef1a0 * -0x100;
if (iVar4 < 0) iVar4 += 0xfff;
iVar4 >>= 0xc;
local_34 = iVar4 + 0x18a;   // panel chrome top-y

local_34 ramps from 394 (off-screen below) at anim_t = 0 down to 138 (parked under load chrome) at anim_t = 0x1000. The timer DAT_801ef1a0 is held to 0 while DAT_801ef160 (NowChecking) is up, then increments once the NowChecking dialog has retracted - matching the engine's SaveSelectSession::info_panel_slide_anim_t() semantics.

Title row layout (view mode 1)

All emit at y = local_34 + 4 (= 142 fully-landed). The "No.X" slot-number badge is rendered as a sprite via FUN_801E3FF0 (CLUT row = slot_index << 4) at x = 8; kingdom name at x = 48; "Time " label at x = 208; HH:MM:SS digits at x = 236 / 260 / 284.

Per-character row layout

Iterates i = 0..slot_buf[+0x28] (party member count). Horizontal stride +0x60 = 96 px starting at base_x = 16, so columns 0/1/2 emit at x = 16 / 112 / 208. Per-character vertical base s3 = local_34 + 20 (= 158):

HP / MP value colour ramp: 7 (green, default), 6 (yellow, cur ≤ max/2), 9 (red, cur ≤ max/4).

Per-slot data buffer

The renderer reads slot N from 0x801EF1B8 + N * 0x100.

Full reference

Complete state-machine and sub-screen tables with Ghidra provenance live at docs/subsystems/save-screen.md in the repo. Function dumps: ghidra/scripts/funcs/overlay_menu_801dc6b4.txt, overlay_menu_801daef4.txt, overlay_menu_801dafd4.txt, overlay_save_ui_select_801e1c1c.txt, overlay_save_ui_select_801e08d8.txt. Capture sources: the overlay_save_ui_select.bin / overlay_save_ui_saving.bin mednafen captures (slot-select and writing-in-progress states), both confirmed as the menu overlay by function-address identity.

See also