owned this note
owned this note
Published
Linked with GitHub
# N64 Gfx Decompilation (F3DEX & S2DEX)
This guide focuses on the decompilation of N64 graphics code from ASM or raw data to C.
## Display Lists
A display list is simply a list of commands indicating to the RSP what should be rendered on the screen every frame.
### Structure
Contrary to common misconceptions, display lists do not have any specific command to identify their start, but they do have a dedicated command used to indicate their end.
Lists are usually pre-processed and used as data, but they can also be generated dynamically in code and inserted in display list buffers at run time.
### Commands
A command (aka a display list entry) corresponds to an element of type `Gfx`, which has a size of 64 bits (8 bytes). This type is the union of many different structs but for the purpose of general decompilation, we can view it as 2 words (w0 and w1).
The purpose of each of the 64 bits in the command varies from command to command, but the first byte is always used to indicate the type of the command (for example, the command mentioned previously to end display lists is `G_ENDDL` which corresponds to the byte `0xDF`).
### Macros
In C, all commands are generated through the use of various macros described in files such as `gbi.h` and `gs2dex.h`.
Unfortunately, there isn't a 1:1 mapping between command types and macros. Different macros can often generate the same type of command with different parameters. There are also many macros which generate a sequence of commands, acting as wrappers.
Wrapper macros aren't necessarily needed for decompilation and matching purposes, but they should be used when possible since they are likely to be what was originally in the source.
Every macro has 2 variants: one for static, pre-processed, commands (starting with `gsSP` or `gsDP`), and one for dynamic commands in code (starting with `gSP` or `gDP`).
The only difference between the 2 variants is that the dynamic version takes an additional first argument as the pointer where the command should be inserted.
When using dynamic variants, the pointer should almost always be post-incremented when provided in the macro (eg. `gDPPipeSync(displayListPointer++);`). This is the pattern used in most cases and is often required for matching decompilation. It's also required in order to use macros which generate multiple display lists since the incrementation has to be applied multiple times inside the macro.
## Decompiling Commands
### Static (Data)
Decompiling display lists used as data is quite straightforward. Since they are processed at compile time, they are usually just arrays of raw `Gfx` elements.
In order to translate the 8 hex bytes of a command to the right macro, you can often just use glankk's `gfxdis` CLI tool included in his [N64 tools](https://github.com/glankk/n64). It almost always manages to decompile command lists to proper macros and parameters. Note that you don't need to install the whole N64 toolchain, only the programs and their dependencies.
When using `gfxdis`, you can provide the data inline using `-d` or provide a file to parse using `-f` (with an optional offset to start from). Other recommended options are: `-dc` if you want colors to use decimal values, and `-x` if you don't want `qu` macros to be used for fixed point values.
In most cases, you want to use `gfxdis.f3dex2` which is based on F3DEX2's `gbi.h`, but other common GBI versions should be supported if you need that.
Otherwise you can always fall back to identifying each element of the command and map it to the right macro/parameter, but this process can be very tedious for some commands. Refer to header files such as `gbi.h`/`gs2dex.h` or online documentation if you have to do this anyway.
Here is a basic example of a static display list decompiled:
```c=
Gfx displayList[] = {
gsDPPipeSync(),
gsDPSetPrimColor(0, 0, 0x80, 0x80, 0x80, 0x80),
gsDPSetEnvColor(0x80, 0x80, 0x80, 0x80),
gsSPEndDisplayList(),
};
```
### Dynamic (Code)
Decompiling dynamic commands used inside code can be a lot more challenging, especially if they are generated from variables and not just constants, but there are a few reliable steps you can follow.
#### Identifying a command
If you are using [mips_to_c](https://github.com/matt-kempster/mips_to_c) or a similar decompiler, the raw code of a dynamic command will look something like this for example:
```c=
temp = pointer;
pointer = (void *) (temp + 8);
temp->unk4 = 0x80808080;
temp->unk0 = 0xfb000000;
```
This code is fairly simple because both words (unk0 and unk4) are made of constants, but it may look a lot more complicated if they are composed of multiple variables with bitwise operations like it's often the case.
Of course this is not how it looked originally so you need to replace it with a macro that includes the right parameters and the post-incremented pointer like we said before.
#### Translating it to a raw macro
For this purpose, you can essentially use the techniques explained in the [Static](#Static-Data) part.
Simply take the `unk0` and `unk4` words, put them together to make a raw command, and use `gfxdis` or manual analysis to figure out the corresponding static `gs` macro.
If a word (or parts of it) is generated from variables, you would want to stub these parts with random values to figure which arguments of the macro each variable belongs to. This is usually as simple as doing [unk0/a random word] to stub an address, but some cases may require trial and error to figure out where each variable should be and if it should be provided with extra computations (eg. casting or masking it).
For the example given above, we can typically run the following command:
```bash=
gfxdis.f3dex2 -x -d fb00000080808080
```
And it will output appropriate macro and parameters:
```c=
gsDPSetEnvColor(0x80, 0x80, 0x80, 0x80)
```
#### Turning it into a pointer-based macro
Once you have this macro, you will want to use its dynamic variant instead, which will handle the pointer part. For this, simply change the `gs` prefix to `g` and add the post-incremented pointer as a first argument.
In our example, we would end up with this:
```c=
gDPSetEnvColor(pointer++, 0x80, 0x80, 0x80, 0x80);
```
#### Some more complex examples
* gSPMatrix with a function call
```c=
temp = ptr;
ptr = (void *) (temp + 8);
temp->unk4 = func_1234();
temp->unk0 = 0xda380003;
```
By simply stubbing the `func_1234()` function call with an arbitrary `0x12345678`, we can use `gfxdis` like this:
```bash=
gfxdis.f3dex2 -x -d da38000312345678
```
To get the following raw macro:
```c=
gsSPMatrix(0x12345678, G_MTX_NOPUSH | G_MTX_LOAD | G_MTX_MODELVIEW)
```
And based on this, we can build the complete pointer-based macro:
```c=
gSPMatrix(ptr++, func_1234(), G_MTX_NOPUSH | G_MTX_LOAD | G_MTX_MODELVIEW);
```
We can also conclude that `func_1234` returns a pointer to a `Mtx` since that's the type of pointer expected by the `gSPMatrix` macro.
* gDPSetPrimColor with variables
```c=
temp = ptr;
ptr = (void *) (temp + 8);
temp->unk0 = 0xfa000000;
temp->unk4 = (var1 << 0x18) | (var2 << 0x10) | (var3 << 8) | var4;
```
This one is more complicated because we have 4 variables merged in 1 word, but from the shifts we can identify how they are used as the 4 bytes that form the word. So we can stub them with identifiable constants and use `gfxdis` to translate it:
```bash=
gfxdis.f3dex2 -x -d fa00000022446688
```
To get the following raw macro:
```c=
gsDPSetPrimColor(0, 0, 0x22, 0x44, 0x66, 0x88)
```
And based on this, we can build the complete pointer-based macro:
```c=
gDPSetPrimColor(ptr++, 0, 0, var1, var2, var3, var4);
```
Using existing documentation on the arguments expected by `gDPSetPrimColor` (eg. N64 developer guides), we can also identify the variables as red/green/blue/alpha intensities.
## Advanced Patterns
Some graphic commands are generated through patterns that are more delicate to deal with, or at least more obscure to understand at first, so here I'll try to share what I know about them so far.
### Texture Loading
To be done.
### Hiliting
To be done.
### Lighting
To be done.
### S2DEX
To be done.
