acdream/docs/research/2026-04-23-daygroup-selection.md

DayGroup Selection — Retail Decompile Hunt

Date: 2026-04-23 Status: RESEARCH COMPLETE — algorithm recovered, ready for C# port. Companion docs: 2026-04-23-sky-retail-verbatim.md (full sky pipeline map).

---

0. TL;DR

Retail's DayGroup picker is a simple integer LCG mixed with (YEAR, DAY_OF_YEAR) from the live TimeOfDay struct, scaled by DayGroupCount. It is not a weighted walk over ChanceOfOccur — it's uniform over all DayGroups. Dereth's 20 DayGroups all carry ChanceOfOccur = 5.0f anyway, so uniform matches the intent. The algorithm lives in FUN_00501990 (previously mis-labeled "deterministic PES roll" in the sky-verbatim doc; it is actually SkyDesc::PickCurrentDayGroup).

---

1. Callers

Call site	File : line	Purpose
FUN_00508010 (sky render) calls FUN_004ff420()	chunk_00500000.c:7553	First thing the per-frame sky render does.
FUN_004ff420() (trampoline) calls FUN_00501990()	chunk_004F0000.c:10684	Region-nullcheck guard, then delegate.

The trampoline also implicitly passes the SkyDesc pointer via ECX (__fastcall, elided in Ghidra's C):

// chunk_004F0000.c:10680
void FUN_004ff420(void) {
  if ((DAT_0084247c != 0) && (*(int *)(DAT_0084247c + 0x50) != 0)) {
    FUN_00501990();       // this == Region+0x50 == SkyDesc*
    return;
  }
}

Note: FUN_004ff4b0 (the OTHER mapped trampoline → FUN_00502a10) is called after FUN_004ff420 inside FUN_00508010. By the time FUN_00502a10 reads *this = SkyDesc+0x00 = current DayGroup index, FUN_00501990 has already written it.

---

2. The selection function

2.1 Decompile (verbatim)

// chunk_00500000.c:1274   FUN_00501990  @ 0x00501990   size=138
// SkyDesc::PickCurrentDayGroup(this)
void __fastcall FUN_00501990(uint *param_1)
{
  float fVar1;
  float fVar2;
  int iVar3;
  int iVar4;
  uint uVar5;
  int iVar6;

  if (DAT_008ee9c8 == 0) {             // global TimeOfDay not yet bound
    iVar4 = 0;
    iVar6 = 0;
    iVar3 = 0;
  }
  else {
    iVar4 = *(int *)(DAT_008ee9c8 + 0x68);   // DAY_OF_YEAR
    iVar6 = *(int *)(DAT_008ee9c8 + 0x10);   // SECONDS_PER_DAY (int, dat-declared)
    iVar3 = *(int *)(DAT_008ee9c8 + 100);    // YEAR (100 decimal = 0x64)
  }
  iVar4 = (iVar3 * iVar6 + iVar4) * 0x6a42fdb2 + -0x7541e9ae;
  fVar1 = (float)iVar4;
  if (iVar4 < 0) {
    fVar1 = fVar1 + _DAT_0079920c;           // +2^32 signed→unsigned float fixup
  }
  fVar2 = (float)(int)param_1[8];            // dayGroupCount (SkyDesc +0x20)
  if ((int)param_1[8] < 0) {
    fVar2 = fVar2 + _DAT_0079920c;
  }
  floor((double)(fVar2 * fVar1 * _DAT_007c6f10));   // dayCount * hash_u32 * (1/2^32)
  uVar5 = FUN_005df4c4();                    // __ftol2: top-of-FPU → int
  *param_1 = uVar5;                          // SkyDesc+0x00 = chosen index
  if (param_1[8] <= uVar5) {                 // safety clamp for float rounding
    *param_1 = 0;
  }
  return;
}

2.2 Key constants

Symbol	Bytes	Role
0x6a42fdb2	1,782,399,410	LCG multiplier (AC-specific, not a named-PRNG constant).
-0x7541e9ae	0x8ABE1652 unsigned	LCG increment.
_DAT_0079920c	~4.29497e9f (2^32)	Standard signed-int→unsigned-float fixup constant.
_DAT_007c6f10	(see §2.4)	Scale factor; interpreted as 1.0 / 2^32 ≈ 2.32830644e-10f. Same constant is reused by all deterministic AC LCG picks (e.g. FUN_00504060 at chunk_00500000.c:4042 for hash-chain lookup).
FUN_005df4c4	—	MSVC __ftol2 helper (float→long32 truncation).

2.3 Why this is NOT a weighted CDF

No loop. No cumulative sum. No compare-and-walk. The decompile is straight-line: one integer mix, one divide-by-range, one clamp. The ChanceOfOccur field on each DayGroup is read during FUN_005025c0 (DayGroup unpack) and stored but never consulted by the picker. Retail data happens to make all 20 DayGroups equiprobable (5.0 each, summing to 100.0), so uniform selection produces the same statistical distribution as a weighted walk would have. If the user's Dereth server data differs, retail-observed weather will NOT match a weighted simulator — it will match this uniform picker over whatever DayGroupCount the dat contains.

2.4 _DAT_007c6f10 sanity check

The decompile always uses _DAT_007c6f10 in the pattern int-cast-to-float × count × _DAT_007c6f10 → floor → ftol. Two examples confirm it is 1.0/2^32:

• chunk_00500000.c:1305 (this function): dayCount × hash × _DAT_007c6f10 → floor → index in [0, dayCount).
• chunk_00500000.c:4042 (FUN_00504060, physics-script variant roll): variantCount × hash × _DAT_007c6f10 → index in [0, variantCount).

For the clamp at line 1308 (if (count <= index) index = 0;) to be a safety net only rather than the common path, the scale must strictly map [0, 2^32) to [0, 1.0) — i.e., 1.0/2^32. Values >= count only ever occur from floating-point rounding at very high hash values. This is a textbook uniform-int-from-LCG idiom.

---

3. Where is the current DayGroup index stored?

SkyDesc + 0x00 (byte offset 0). Written by line 1307 or 1309 of FUN_00501990, above. Consumed by:

• FUN_00502a10 (SkyDesc::UpdateSkyObjectTable) at chunk_00500000.c:2429: iVar2 = *(int *)(param_1[6] + *param_1 * 4); — indexes into the DayGroup array (+0x18) using *this.
• FUN_00501600 (Region::LerpSunAndAmbient, sun+ambient interp) — same pattern (walks DayGroup[*thisIndex].SkyTime keyframes).
• FUN_00501860 (Region::LerpFogAmbient, fog interp) — same.

There is no separate global for the selected DayGroup; all consumers go through the SkyDesc pointer at Region+0x50 and read SkyDesc.CurrentIndex = *SkyDesc. This matches FUN_005015d0 (SkyDesc::Init, chunk_00500000.c:1135) which zero-inits *param_1 = 0; so the first frame before FUN_00501990 runs picks DayGroup[0].

---

4. TimeOfDay struct layout (relevant fields)

Global: DAT_008ee9c8 (type void *). Populated by FUN_005a7fd0 (TimeOfDay::Unpack) during Region load, ticked by FUN_005a7800 every frame. Verified field map:

Byte offset	Type	Field	Written where
0x00	double	EpochBase (dat-declared)	FUN_005a7fd0:6045
0x08	int	BaseYear (dat-declared)	FUN_005a7fd0:6051
0x0C	float	SecondsPerDay	FUN_005a7fd0:6056
0x10	int	SecondsPerDay (int copy — source of iVar6)	FUN_005a7fd0:6061
0x40	double	SecondsPerYear = DaysPerYear × SecondsPerDay	FUN_005a7fd0:6068
0x48	float	DayFraction (0..1)	FUN_005a7800:5497
0x50	double	CurrentDay startTick	FUN_005a7510 (via FUN_005a75b0)
0x58	double	CurrentDay endTick	FUN_005a75b0:5345
0x64	int	Year (absolute)	FUN_005a7510:5300: = floor((worldTime+base)/secsPerYear) + baseYear
0x68	int	DayOfYear	FUN_005a7510:5304: = floor(withinYearSec / secsPerDay)
0x6c	int	SeasonIndex	FUN_005a7510:5313

The iVar6 = *(int *)(DAT_008ee9c8 + 0x10) read in FUN_00501990 picks up SecondsPerDay as a multiplier — acting as a spread-factor to guarantee different days in different years yield different hash inputs. (If both sides of the multiplication were small — Year in [0, ~200], DayOfYear in [0, 365] — and SecondsPerDay were 1, the seed range would be tiny. Using the full SecondsPerDay integer makes the seed uniform over a ~31-bit range before the LCG step.)

Retail Dereth values (from dat — confirm when we next parse a Region): SecondsPerDay = 1800 (30 real-minutes = one Dereth-day per r12 §11, times some scale factor baked into the dat). Any value works — the algorithm is agnostic.

---

5. Pseudocode (ready for C# port)

// SkyDesc.PickCurrentDayGroup — ports acclient.exe FUN_00501990 @ 0x00501990
// Decompile: docs/research/decompiled/chunk_00500000.c:1276
// Must be called every frame before SkyDesc.UpdateSkyObjectTable; value is
// stable across frames within one Dereth-day so repeated calls are cheap.
public static int PickCurrentDayGroup(int year, int secondsPerDay, int dayOfYear, int dayGroupCount)
{
    // Step 1: deterministic per-day seed.
    // (This mirrors retail's 3-int read from TimeOfDay+0x64/0x10/0x68.)
    int seed = year * secondsPerDay + dayOfYear;

    // Step 2: 32-bit signed LCG (x86 wraps silently; force it in C#).
    int mixed = unchecked(seed * 0x6A42FDB2 + (int)0x8ABE1652);
    // equivalent to:  seed * 0x6A42FDB2 - 0x7541E9AE

    // Step 3: signed-int → float with sign fixup (retail does this in x87).
    float hashF = (float)mixed;
    if (mixed < 0) hashF += 4294967296.0f;   // +2^32

    // Step 4: scale to [0, dayGroupCount).
    //   _DAT_007c6f10 == 1.0f / 2^32 in retail.
    const float kInv2Pow32 = 1.0f / 4294967296.0f;
    float countF = (float)dayGroupCount;     // dayGroupCount is always positive (it's a uint)
    int index = (int)MathF.Floor(countF * hashF * kInv2Pow32);   // __ftol2 truncates toward 0

    // Step 5: safety clamp for float rounding edge case.
    if (index >= dayGroupCount) index = 0;

    return index;
}

Call from the per-frame sky render hook, before the keyframe-bracket interpolation pass (mirrors FUN_00508010 which invokes FUN_004ff420() before FUN_004ff4b0()):

// once per frame, before sky object/light interp
skyDesc.CurrentDayGroupIndex = SkyDesc.PickCurrentDayGroup(
    year:            world.TimeOfDay.Year,
    secondsPerDay:   world.TimeOfDay.SecondsPerDayInt,    // the int copy at TimeOfDay+0x10
    dayOfYear:       world.TimeOfDay.DayOfYear,
    dayGroupCount:   skyDesc.DayGroups.Count);

If ACE and acdream agree on (Year, SecondsPerDay, DayOfYear) (trivially true — ACE computes these server-side from the same epoch), both clients will converge to the same index every Dereth-day. This replaces the current SplitMix64 path.

---

6. Cross-check notes

• ACE server does not re-implement this. DayGroup/ChanceOfOccur are parsed (ACE.DatLoader/Entity/DayGroup.cs) but ACE never picks a DayGroup — the server leaves sky-state to each client, relying on every client running the same deterministic function on the same (Year, DayOfYear). Confirmed by grep: no match for 0x6a42fdb2 or SelectDayGroup/RollDayGroup/PickDayGroup anywhere in references/ACE/.
• ACViewer: same — its DayGroup.cs is display-only.
• WorldBuilder: no sky/weather simulation at all.
• Chorizite.ACProtocol: the protocol has no "current DayGroup" message — confirming it's a pure client computation.

So retail's decompile IS our only source, and we have it.

---

7. Gaps

None critical. Two minor open items:

1. _DAT_007c6f10 exact bit value. I inferred 1.0/2^32 from usage pattern but did not find a data-section dump that prints the literal. If the live client ever shows off-by-one drift on a boundary day, re-verify by dumping the .rdata section at 0x007c6f10. (ACDREAM_DUMP_SKY already logs picked index + inputs; we can correlate against a retail client session to confirm.)

2. TimeOfDay+0x10 value for live Dereth. Retail SecondsPerDay has been quoted as both 1800 and 3600 in various reverse-engineering docs depending on whether "seconds" means realtime seconds or Dereth-clock seconds. The algorithm itself is insensitive — whatever integer the dat provides is what both retail and acdream must use. If our Region parser stores it in a differently-named field, make sure the call site passes the dat-raw value (the int at TimeOfDay+0x10), not a re-derived one.

---

8. Summary table

Question	Answer	Evidence
Caller of FUN_00502a10	FUN_004ff4b0 → called from FUN_00508010:7560	chunk_004F0000.c:10732, chunk_00500000.c:7560
DayGroup selection function	FUN_00501990	chunk_00500000.c:1276
Hash formula	(Year × SecondsPerDay + DayOfYear) × 0x6A42FDB2 + 0x8ABE1652	chunk_00500000.c:1296
Weighted by ChanceOfOccur?	No. Uniform over DayGroupCount.	No CDF loop in FUN_00501990
Selected index stored at	SkyDesc + 0x00 (via *param_1 write)	chunk_00500000.c:1307,1309
Read back by	FUN_00502a10:2429, FUN_00501600, FUN_00501860	chunk_00500000.c:2429
Time source	global DAT_008ee9c8 (TimeOfDay), fields +0x64/+0x10/+0x68	chunk_00500000.c:1292-1294