Reverse-Engineering Report · Original Binary

Densha de Go! Plug & Play: Complete Architecture of the Original Game

A ground-up architectural study of dgf, the ARM Linux binary that powers Taito's 2018 Densha de Go! Plug & Play TV game unit, produced by decompiling the original executable in Ghidra and Binary Ninja, cross-checked against live runs of the unmodified game. Written for players, fans, and anyone who wants to rebuild this game from scratch.

What this report is

In 2018, Taito shipped Densha de Go! Plug & Play, a palm-sized HDMI “TV game” containing a complete remake of the classic 1996 train-driving arcade game. Unlike the arcade boards and consoles of the series' history, this unit is a small embedded Linux computer: an Allwinner R16 quad-core Cortex-A7 SoC with a Mali-450 GPU, booting Linux 3.4 and running a single 8 MB ARM executable named dgf.

This report dissects that executable. Every claim below was produced by one of three methods, and each section says which:

Title screen with attract video
The original dgf binary running on desktop Linux through the hardware shim; the title screen plays a live-action E231 video behind the logo. Every screenshot in this report is captured this way unless noted.

Who this is for

Three audiences, three levels of depth, all in the same sections:

ReaderWhat to readWhat you'll get
Curious fanEvery section's opening paragraphs and figuresHow the game actually works: one frame of gameplay, start to finish
Train-game enthusiastPhysics, scoring, departure/arrival chaptersExact formulas, tables and thresholds the game judges you by
ReimplementerEverything, plus the Appendix and the Reimplementation GuideAddresses, struct layouts, file formats, and a build order that works

The report map

The game decomposes into clean layers, and so does this report. Read in order, or jump:

01 · Foundations
The Binary
What 8 MB of ARM contains: sections, symbols, build provenance, and how it was decompiled.
02 · Foundations
Hardware & OS Platform
The R16 board, Linux 3.4, boot chain, threads and fibers, input/audio/video/save plumbing.
03 · Foundations
Aqualead Engine Core
The embedded C++ middleware: fiber scheduler, updater queue, heap, scenes.
04 · Gameplay
Game Loop & State Machine
GameTask, the 12 map modes, GameCondition bits, and the 60 Hz frame.
05 · Gameplay
Menu System
MenuTask's 16 states: title, line/diagram select, startup inspection, options.
06 · Gameplay
Departure & Arrival
Door sequences, station announcements, departure signals, stopping at platforms.
07 · Gameplay
Train Physics
Notch to traction: motor tables, four resistance models, ATS/ATC enforcement.
08 · Rules
Scoring & Penalties
15 penalty categories, 42 bonus types, the score pool, and grade computation.
09 · Rules
Routes, Data & Saves
Station chains, timetables, diagram unlocks, and the SaveReg.xml format.
10 · Rules
Win, Lose & Pause
Game-over detection, continue/retry flow, result screens, pause.
11 · Rules
Tutorial (Lecture) Mode
The diagram-00 teaching system: triggers, overlays, and the autodrive instructor.
12 · Media
Rendering Pipeline
Draw packets, the render thread, uber-shaders, 3D world, kanji glyph cache.
13 · Media
Audio System
OpenAL stack, 24-voice pool, engine sound synthesis, station announcements.
14 · Media
Asset File Formats
AAR archives, ALLZ compression, TXM textures, ASN audio, decoded.
15 · Appendix
Reimplementation Guide
What must be replicated exactly, what can be simplified, and the build order.
16 · Appendix
Reference Tables
Every global address, function address, and data table in one place.

One frame of the game, end to end

Before the chapter-by-chapter breakdown, here is the shape of the whole machine. At 60 Hz, the game:

  1. Copies the game condition bit-field that gates every subsystem this frame;
  2. Runs the current map mode (departure choreography, driving, arrival, results), each a small state machine;
  3. Translates controller state into notch/brake positions through a safety-gated input chain;
  4. Integrates one physics step: traction minus four resistance models, brake precedence, jerk penalty;
  5. Runs the ATS/ATC signal logic against the track layout ahead;
  6. Judges the player against profile tables for speeding, late arrival, stop position and driving manner;
  7. Records the frame as a draw-packet stream, which the render thread interprets into GLES 2.0 calls.

Each of those seven bullets is a chapter of this report. The diagram below shows how the executables' layers stack:

Layer diagram: hardware, Linux, Aqualead engine, game systems
The four layers of the Plug & Play unit. The game code sits directly on Aqualead's low-level primitives; the engine's higher-level OOP frameworks exist in the binary but are dead code.
Reading the code exhibits Code blocks throughout show decompiler pseudo-C, lightly annotated. Names in CamelCase come from the binary's own symbol table; DAT_xxxxxx / data_xxxxxx are unnamed globals at their fixed addresses (the binary is non-PIE, so addresses are stable and meaningful). Where Ghidra and Binary Ninja disagree, both are shown.