N64 Gfx Decompilation (F3DEX & S2DEX)

This guide focuses on the decompilation of N64 graphics code from ASM or raw data to C.

Display Lists

A display list is simply a list of commands indicating to the RSP what should be rendered on the screen every frame.

Structure

Contrary to common misconceptions, display lists do not have any specific command to identify their start, but they do have a dedicated command used to indicate their end.

Lists are usually pre-processed and used as data, but they can also be generated dynamically in code and inserted in display list buffers at run time.

Commands

A command (aka a display list entry) corresponds to an element of type Gfx, which has a size of 64 bits (8 bytes). This type is the union of many different structs but for the purpose of general decompilation, we can view it as 2 words (w0 and w1).

The purpose of each of the 64 bits in the command varies from command to command, but the first byte is always used to indicate the type of the command (for example, the command mentioned previously to end display lists is G_ENDDL which corresponds to the byte 0xDF).

Macros

In C, all commands are generated through the use of various macros described in files such as gbi.h and gs2dex.h.

Unfortunately, there isn't a 1:1 mapping between command types and macros. Different macros can often generate the same type of command with different parameters. There are also many macros which generate a sequence of commands, acting as wrappers.
Wrapper macros aren't necessarily needed for decompilation and matching purposes, but they should be used when possible since they are likely to be what was originally in the source.

Every macro has 2 variants: one for static, pre-processed, commands (starting with gsSP or gsDP), and one for dynamic commands in code (starting with gSP or gDP).
The only difference between the 2 variants is that the dynamic version takes an additional first argument as the pointer where the command should be inserted.

When using dynamic variants, the pointer should almost always be post-incremented when provided in the macro (eg. gDPPipeSync(displayListPointer++);). This is the pattern used in most cases and is often required for matching decompilation. It's also required in order to use macros which generate multiple display lists since the incrementation has to be applied multiple times inside the macro.

Decompiling Commands

Static (Data)

Decompiling display lists used as data is quite straightforward. Since they are processed at compile time, they are usually just arrays of raw Gfx elements.

In order to translate the 8 hex bytes of a command to the right macro, you can often just use glankk's gfxdis CLI tool included in his N64 tools. It almost always manages to decompile command lists to proper macros and parameters. Note that you don't need to install the whole N64 toolchain, only the programs and their dependencies.
When using gfxdis, you can provide the data inline using -d or provide a file to parse using -f (with an optional offset to start from). Other recommended options are: -dc if you want colors to use decimal values, and -x if you don't want qu macros to be used for fixed point values.
In most cases, you want to use gfxdis.f3dex2 which is based on F3DEX2's gbi.h, but other common GBI versions should be supported if you need that.

Otherwise you can always fall back to identifying each element of the command and map it to the right macro/parameter, but this process can be very tedious for some commands. Refer to header files such as gbi.h/gs2dex.h or online documentation if you have to do this anyway.

Here is a basic example of a static display list decompiled:

Gfx displayList[] = {
    gsDPPipeSync(),
    gsDPSetPrimColor(0, 0, 0x80, 0x80, 0x80, 0x80),
    gsDPSetEnvColor(0x80, 0x80, 0x80, 0x80),
    gsSPEndDisplayList(),
};

Dynamic (Code)

Decompiling dynamic commands used inside code can be a lot more challenging, especially if they are generated from variables and not just constants, but there are a few reliable steps you can follow.

Identifying a command

If you are using mips_to_c or a similar decompiler, the raw code of a dynamic command will look something like this for example:

temp = pointer;
pointer = (void *) (temp + 8);
temp->unk4 = 0x80808080;
temp->unk0 = 0xfb000000;

This code is fairly simple because both words (unk0 and unk4) are made of constants, but it may look a lot more complicated if they are composed of multiple variables with bitwise operations like it's often the case.

Of course this is not how it looked originally so you need to replace it with a macro that includes the right parameters and the post-incremented pointer like we said before.

Translating it to a raw macro

For this purpose, you can essentially use the techniques explained in the Static part.
Simply take the unk0 and unk4 words, put them together to make a raw command, and use gfxdis or manual analysis to figure out the corresponding static gs macro.

If a word (or parts of it) is generated from variables, you would want to stub these parts with random values to figure which arguments of the macro each variable belongs to. This is usually as simple as doing [unk0/a random word] to stub an address, but some cases may require trial and error to figure out where each variable should be and if it should be provided with extra computations (eg. casting or masking it).

For the example given above, we can typically run the following command:

gfxdis.f3dex2 -x -d fb00000080808080

And it will output appropriate macro and parameters:

gsDPSetEnvColor(0x80, 0x80, 0x80, 0x80)

Turning it into a pointer-based macro

Once you have this macro, you will want to use its dynamic variant instead, which will handle the pointer part. For this, simply change the gs prefix to g and add the post-incremented pointer as a first argument.

In our example, we would end up with this:

gDPSetEnvColor(pointer++, 0x80, 0x80, 0x80, 0x80);

Some more complex examples

• gSPMatrix with a function call

temp = ptr;
ptr = (void *) (temp + 8);
temp->unk4 = func_1234();
temp->unk0 = 0xda380003;

By simply stubbing the func_1234() function call with an arbitrary 0x12345678, we can use gfxdis like this:

gfxdis.f3dex2 -x -d da38000312345678

To get the following raw macro:

gsSPMatrix(0x12345678, G_MTX_NOPUSH | G_MTX_LOAD | G_MTX_MODELVIEW)

And based on this, we can build the complete pointer-based macro:

gSPMatrix(ptr++, func_1234(), G_MTX_NOPUSH | G_MTX_LOAD | G_MTX_MODELVIEW);

We can also conclude that func_1234 returns a pointer to a Mtx since that's the type of pointer expected by the gSPMatrix macro.

• gDPSetPrimColor with variables

temp = ptr;
ptr = (void *) (temp + 8);
temp->unk0 = 0xfa000000;
temp->unk4 = (var1 << 0x18) | (var2 << 0x10) | (var3 << 8) | var4;

This one is more complicated because we have 4 variables merged in 1 word, but from the shifts we can identify how they are used as the 4 bytes that form the word. So we can stub them with identifiable constants and use gfxdis to translate it:

gfxdis.f3dex2 -x -d fa00000022446688

To get the following raw macro:

gsDPSetPrimColor(0, 0, 0x22, 0x44, 0x66, 0x88)

And based on this, we can build the complete pointer-based macro:

gDPSetPrimColor(ptr++, 0, 0, var1, var2, var3, var4);

Using existing documentation on the arguments expected by gDPSetPrimColor (eg. N64 developer guides), we can also identify the variables as red/green/blue/alpha intensities.

Advanced Patterns

Some graphic commands are generated through patterns that are more delicate to deal with, or at least more obscure to understand at first, so here I'll try to share what I know about them so far.

Texture Loading

To be done.

Hiliting

To be done.

Lighting

To be done.

S2DEX

To be done.