Pokemon Stadium
Uses Yay0, iirc.
A lot of Zoinkity's notes.
ROM/RAM Map
Stadium Editor
OS, Graphic and Audio Functions
0x8010b7e0,__assertBreak 0x8014ebc8,spShow 0x8014ebc8,spHide 0x801568b0,__osSetCause 0x801568c0,osSendMesg 0x80156a10,osStopThread 0x80156ad0,osRecvMesg 0x80156c10,osSetIntMask 0x80156cb0,__osDequeueThread 0x80156cf0,guScaleF 0x80156d44,guScale 0x80156d90,__sinf/fsin/sinf 0x80156f50,alUnlink 0x80156f80,alLink 0x80156fa4,alClose 0x80156fdc,alInit 0x80157410,__ull_rshift 0x8015743c,__ull_rem 0x80157478,__ull_div 0x801574b4,__ll_lshift 0x801574e0,__ll_rem 0x8015751c,__ll_div 0x80157578,__ll_mul 0x801575a8,__ull_divremi 0x80157608,__ll_mod 0x801576a4,__ll_rshift 0x80157fd0,bzero/_bzero/blkclr/_blkclr 0x80158174,alBnkfNew 0x80158278,alSeqFileNew 0x80158cc0,osCreateThread 0x80158ff0,__osSetCount 0x80159090,osVirtualToPhysical 0x80159110,__osSetSR 0x80159120,osWritebackDCache 0x801594f0,__osGetSR 0x8015a5c0,guPerspectiveF 0x8015a7f0,guPerspective 0x8015a9e0,osViBlack 0x8015aaa0,osSpTaskYield 0x8015b1c0,osViSetMode 0x8015b230,osViRepeatLine 0x8015b5e0,__osProbeTLB 0x8015bd00,osGetCount 0x8015ceb0,sqrtf 0x8015cee0,guMtxXFMF 0x8015cf80,guMtxCatF 0x8015d0f0,guMtxXFML 0x8015d150,guMtxCatL 0x8015d1b0,guRandom 0x8015e020,sprintf 0x8015e0f0,osEPiStartDma 0x8015e1d0,alHeapInit 0x8015e250,memcpy 0x8015e27c,strlen 0x8015e2a4,strchr 0x8015e2f0,osInvalDCache 0x8015e3a0,osCreateMesgQueue 0x8015e3d0,osInvalICache 0x8015e540,__osSpDeviceBusy 0x8015e570,__osSiDeviceBusy 0x8015e5a0,guTranslateF 0x8015e5e8,guTranslate 0x8015e640,osJamMesg 0x8015e790,osSetThreadPri 0x8015e870,osGetThreadPri 0x8015e9f0,osViSwapBuffer 0x8015ec20,osSpTaskYielded 0x8015eca0,guRotateRPYF 0x8015edec,guRotateRPY 0x8015ee40,bcmp/_bcmp 0x8015ef60,guRotateF 0x8015f0f4,guRotate 0x8015f150,osGetTime 0x801615f0,alLoadParam 0x801617c4,alRaw16Pull 0x80161c9c,alAdpcmPull 0x80162140,alFilterNew 0x80162220,__osSetGlobalIntMask 0x801623c0,osDpGetCounters 0x80162420,guNormalize 0x801624b0,__osSetCompare 0x801624c0,osAiGetStatus 0x801624d0,osDpSetStatus 0x801624e0,alCopy 0x80162560,bcopy/_bcopy 0x80162870,__osResetGlobalIntMask 0x801628d0,guOrthoF 0x80162a24,guOrtho 0x80162f60,osPiGetCmdQueue 0x80162f90,__cosf/fcos/cosf 0x801632b0,osSetTime 0x801632e0,osViSetEvent 0x801636f0,__osSetFpcCsr 0x80163700,osAiGetLength 0x80163760,osMapTLBRdb 0x801637c0,osYieldThread 0x80163e00,__osGetCause 0x80163f70,osSetTimer 0x80164050,_Ldtob 0x80164b10,lldiv 0x80164c10,ldiv 0x80164ca0,_Litob 0x80164f90,__osSpSetStatus 0x80164fa0,__osSpGetStatus 0x801652e0,osWritebackDCacheAll 0x80165310,alHeapDBAlloc 0x80165370,osStartThread 0x801654c0,osViSetXScale 0x801655f0,osViSetYScale 0x80165650,__d_to_ll 0x8016566c,__f_to_ll 0x80165688,__d_to_ull 0x80165728,__f_to_ull 0x801657c4,__ll_to_d 0x801657dc,__ll_to_f 0x801657f4,__ull_to_d 0x80165828,__ull_to_f 0x80165860,alSynAllocFX 0x80165900,alSynDelete 0x80165c50,__osAiDeviceBusy 0x80165ed0,osViGetCurrentFramebuffer 0x80165ed0,osViGetNextFramebuffer 0x80165f10,__osSpSetPc 0x80179730,osViModeNtscLpf1 0x801797d0,osViModeNtscLaf1 0x80179820,osViModeNtscLpn2 0x80179870,osViModeNtscLpf2 0x801798c0,osViModeNtscLan2 0x80179910,osViModeNtscLaf2 0x80179960,osViModeNtscHpn1 0x801799b0,osViModeNtscHpf1 0x80179a00,osViModeNtscHan1 0x80179a50,osViModeNtscHaf1 0x80179aa0,osViModeNtscHpn2 0x80179af0,osViModeNtscHpf2 0x80179ff0,osViModeMpalLpf1 0x8017a090,osViModeMpalLaf1 0x8017a0e0,osViModeMpalLpn2 0x8017a130,osViModeMpalLpf2 0x8017a180,osViModeMpalLan2 0x8017a1d0,osViModeMpalLaf2 0x8017a220,osViModeMpalHpn1 0x8017a270,osViModeMpalHpf1 0x8017a2c0,osViModeMpalHan1 0x8017a310,osViModeMpalHaf1 0x8017a360,osViModeMpalHpn2 0x8017a3b0,osViModeMpalHpf2 0x8017e210,__osRcpImTable 0x8017e5d0,__libm_qnan_f
GB emulation
Zoinkity's information
Also, if you want to watch pak reads, the functions in question in CPSJ: 80051110 osGbpakCheckConnector() 800515B0 osGbpakPower() 80052480 osGb****nit() 80059210 osGbpakReadId() 80059790 request SI write of data A3 to queue A0 on channel A1 at offset A2 8005C670 osGbpakReadWrite()
Throw a breakpoint down on 801214E0 to catch when it initializes the pak. Throw another one down on 80121504 to catch when the ID is loaded. Note this is done twice; one loads the thing to a control structure, the other to a buffer to verify the contents.
The header is tested for integrity twice. The N64 does a test on the header data similar to the one used by the GB, but the normal GB test is also run. Believe it or not, they copy the bootstrap over the first 0x102 of ROM and run it like normal, then overwrite it with the original contents if it runs successfully. From the return value (0xFF), it's probably the GB Pocket bootstrap. It differs only from a standard GB bootstrap in the return value and the additional two bytes, acting as an infinite loop.