Speedrunning and Tool-Assisted Speedrunning are often considered a form of e-sport, complete with expectations of fair play and honest competition. Archives and leaderboards have been created during the hobby's history with the specific intention of keeping real records and reflecting honest runs for the sake of truthful competition. Checking and verifying runs, even after the fact, as a means of identifying cheating is an important part of the speedrunning community fair play standards. Cheating has never been an accepted part of the hobby and attempts to keep the hobby free of cheating is an essential part of the health and wellbeing of the hobby itself.

Splicing, or the act of editing together videos from multiple runs, has been considered cheating since the inception of the hobby. Completing a run but not adhering to the category has also always been considered cheating. Run videos from SDA, including Groobo's run, included the banner "Verified: No Cheating", reflecting the community values in 2009.

The site further included this verbiage in the rules: "Once a speedrun has been published on SDA, it will be hosted until it's obsoleted by another run or if there are doubts about the validity of the speedrun (for example cheating, inconsistencies in segmentation or not sticking to the category rules). The obsoleted run will still be available on archive.org, though."

The title screen in the video indicates Diablo version 1.09 was used but the run notes indicate an earlier version was used. At 0:05, the Diablo title screen shows a copyright date of 1996-2001:

The main menu version is inconsistent with the title screen. At 0:12, the Diablo main menu screen appears showing a version of "Diablo v1.00":

The character menu version is inconsistent with the main menu screen. At 0:13, the Diablo character select screen appears:

Starting at 0:48 in dungeon level 1 (dlvl hereafter) through 1:33 in dlvl 9, each dungeon level has a distance between the entrance stairs and the stairs to the next level consisting of 7 tiles for dlvl 1-4, 5 tiles for dlvl 5-8, and 3 tiles for dlvl 9. Such a favorable sequence does not naturally occur from the map generation in Diablo in any version of the game. The team created Diablo map generation analysis tools and performed an exhaustive search of the entire space of all game seeds (which change based on the date and time a new game is started) to identify levels with the shortest walking distance. No date, including invalid dates before 1970 or after 2038 as described in Appendix A - Diablo Level Generation, creates a seed which produces the sequence of stairs shown in the run.

As Groobo notes himself in his earlier 17:38 submission on October 12th, 2006, "...The maps, mosters [sic], drops, chests etc are generated while you create your character, and stay the same every time you play with the same [character]…". Diablo save files include the seed information used to generate dungeon levels.^[3] Specifically, the initial game seed based on the game launch time is used to generate 16 dungeon seeds, one for each dungeon level, which are stored in the save file.^[4] Because dungeon seeds form part of the save file for a given game, "luck manipulation" of dungeon layouts is not possible. The only way to change the layout for a level is to start a new game or directly modify the game code or save file.

Over the course of several weeks and scan iterations, the team reviewed every possible game seed, including invalid seeds occurring after the year 2038, using diablo-mapgen --scanner stairs --start 0 --count 4294967295 (with additional scripting to split the search among multiple processor cores). No set of levels matched the results displayed in the run in either the valid or invalid date ranges. This indicates the run was either created by using levels from multiple incongruent playthroughs of the game beyond what would ordinarily be allowed for a segmented speedrun or the run contained directly manipulated dungeon seeds.

Through the search process, the team was able to identify the exact dungeon seed that generated 13 of the 16 levels shown in the video. Figure 5 shows the dungeon seed for each identified dungeon level and the time and date each playthrough was started. No exact match could be found for dlvl 3 and dlvl 4 with only a partial match for dlvl 9, which indicates Groobo may have used a modified client or external tools to influence object and monster spawns for those two dungeon levels. ^[5]

The contents of inventory change unexpectedly throughout the run, indicating splices from multiple playthroughs were used. The Ring of the Vulture is acquired at 1:08 on dlvl 4:

Multiple quests show inconsistencies compared to what is normally possible in a single playthrough. Diablo splits quests into groups, with one quest from each group randomly selected to be inactive at the start of each playthrough:^[7]

A dungeon level that can only exist with an invalid date is used. When dlvl 9 was identified, it showed inconsistencies in the video compared to what should have appeared in the game as described in Inconsistent Item Drop. During the run, two Lava Lords are standing just to the right of the level entrance, but the monsters would not normally have this starting position.

At 1:27, dlvl 9 appears:

Portions of gameplay are missing in multiple locations, although the encoder used may have introduced missing or duplicate frames, complicating analysis. For instance, At 1:28, a single frame of animation is missing. To demonstrate the issue, the team recreated the same movement in the same dlvl 9 layout and took screenshots of each frame during the animation of walking "down" (toward the bottom of the screen) and then turning to walk "up" (toward the top of the screen):

The item 'Naj's Puzzler' is dropped by an enemy in dlvl 9 but is not present in the dungeon seed. At 1:32, the first Lava Lord is killed and drops 'Naj's Puzzler':

Items are duplicated in ways that are unlikely in version 1.00 as shown on the main menu screen. At 2:09 and again at 2:11, 'Naj's Puzzler' is duplicated while walking:

The music skips at an improbable time in a way that implies the video was spliced. Starting at 2:31, Adria's shop appears on screen:

The inventory of shops changes in ways that are not possible in version 1.00 as shown on the menu screen. At 2:35, the shop contains an initial set of items:

A negative health glitch is used which is not possible in version 1.09 as shown on the title screen. At 3:15 and again at 3:33, the ring is applied to trigger the glitch:

In his comments to dwangoAC, Groobo stated that he "did notice some weird behavior after [using a hero editor] in the diablo fight itself, where diablo would die after taking way less fireballs than what my research indicated was possible." When asked about what exceptions he received from SDA administrators that allowed the use of the hero editor, he explained that he didn't need to be allowed because "The methodology I described was used for reaserch purposes only and is not present in any of the recorded segments."[sic]

These comments prompted the team to perform a deeper analysis on the fight with Diablo. The team closely examined the video of Groobo's fight with Lazarus to determine how much experience he could have gained from killing monsters off-screen. From there, the team compared the changes in Groobo's mana globe with video made by the team of Fireballs cast using the same gear at various character levels and concluded that Groobo had the same amount of mana as a level 12 Sorcerer.

The team then computed the damage range for a level 12 Sorcerer with a level 3 Fireball spell at 38-91 points of damage. The spell's damage would be reduced to 25% of that amount because of Diablo's fire resistance, resulting in a damage range of 9.5-22.75. However, the Fireball also deals the same amount of splash damage, doubling the amount to 19-45.5 damage if every Fireball hits Diablo directly. In a single player game on normal difficulty, Diablo has 833 hitpoints, meaning the minimum number of Fireballs required to kill Diablo would have been 19. This assumes that none of the attacks miss, all attacks do the maximum possible damage, and Diablo does not regenerate any health. This is exactly the number of Fireballs used by Groobo to defeat Diablo.

Next the team used the seed for dungeon level 16 to recreate Groobo's fight with Diablo using PCem in libTAS to create a TAS. By using the same dungeon seed, the TAS would also perfectly match the sequence of random numbers produced by the game's engine, meaning the monsters should behave in exactly the same way as they did in Groobo's video. This held true until 1.5 seconds into the fight when the monsters' AI began making different decisions that suggested the TAS was not doing as much damage as Groobo did in his speedrun. Furthermore, the TAS was not able to defeat Diablo using 19 Fireballs, and the character in the TAS died shortly thereafter due to running out of mana:

The combination of conflicting factors demonstrate Groobo used illegitimate means to produce the results shown in the run, including using more than one release of Diablo, modifying memory directly to create otherwise impossible dungeon level layouts and item drops, combining gameplay from different runs, and using gameplay-removing video splices.

Throughout the run, a number of artifacts and game behaviors indicate that Diablo version 1.00 is in use as identified on the main menu screen while other portions indicate that Diablo 1.09 is in use as identified on the title screen. Alternately, other versions of Diablo such as 1.04 might have been used for some sections but crucially could not have been used for the entire run given the conflicting versions displayed.

Many of the game behaviors and available quests are mutually exclusive, indicating the run was spliced together from multiple playthroughs. Similarly, the game seed and dungeon seed combinations present as well as damage shown in the fight against Diablo cannot exist in legitimate play under any circumstances and indicate external modifications. Finally, A number of graphical and audible artifacts indicate video splices in multiple places, in some cases removing portions of gameplay in ways that would impact the recorded completion time.

Overall, the team's analysis conclusively reveals the run was not possible as Groobo described without disqualifying modifications. The run should therefore be immediately retracted from all leaderboards.

In August, 2024 late in the process of finalizing this analysis, Andy Greenberg of WIRED was able to contact Groobo who subsequently contacted the team. Groobo denied the run was in violation of any SDA rules at the time of the 2009 submission, stating in part "My run is a segmented/spliced run. It always has been and it was never passed off as anything else, nor was it part of any competition or leaderboards. The speeddemosarchive page states that outright."

In light of the timing of the contact from Groobo, the team opted to preserve the remainder of this document as it existed directly prior to the contact with Groobo (outside the addition of the late-breaking Artificially Enhanced Fireball Damage finding and this Response section).

Although the evidence in this document raises concerns about the validity of the run, the team acknowledges that Groobo may not have had malicious intent given circumstances at the time he submitted the run to SDA. Elements of this document may not reflect the viewpoints of record holders or record sites and are only representative of the discoveries made by the team over the course of several months of analysis. However, in the opinion of the team, the collected evidence indicates Groobo's run was illegitimate.

The team presented this analysis to SDA prior to Groobo's contact. The team immediately connected Groobo to SDA to allow them to discuss the analysis directly, independent of any influence from the team. On September 10, 2024, SDA posted an update to the https://speeddemosarchive.com front page announcing the removal of all Diablo runs by Groobo, stating "If groobo can provide something concrete to help his case, we can revert this decision."

Andy Greenberg of WIRED attempted to reach Guinness World Records as a member of the press. Guinness responded only with "We value any feedback on our record titles and are committed to maintaining the highest standards of accuracy." The team subsequently presented this analysis to Guinness directly. After an initial automated response, Guinness responded stating "We have passed your enquiry on to our Records Management Team for consideration. If an update is required on the record title, we will look to action it as soon as is possible."[sic]. No further response has been received from Guinness and the records remain on the site.

Members of the Diablo speedrunning community independently responded to this analysis by engaging in a renewed effort to perform a set-seed, single segment run of Diablo using valid game seed 761519344, with Funkmastermp achieving a total time of 5:57 in early routing attempts and xavier_sp ultimately achieving a time of 5:00.87, or 04:36 as timed by an SDA verifier using modern SDA timing methodology.

Additionally, the team created a preliminary Tool-Assisted Speedrun of Diablo version 1.04 in 3:10.92 using 2009 SDA timing which demonstrates a single game seed of Diablo can theoretically be beaten faster than the timing applied to Groobo's run at the time it was submitted in preparation for the DEF CON talk. The team subsequently submitted an optimized TAS to TASVideos with an SDA timing of 1:46.

To set the initial state when starting a new game the Diablo application uses a C standard library function time(). The value returned by this function varies on different platforms. From the decompilation effort, the team was able to determine the implementation used by Diablo returns the number of seconds since Jan 1, 1970 at 00:00:00 as a 32 bit signed integer value. They were also able to isolate the date handling portion of the game seed generation code and determine how it handled the year 2038 problem, which is shown in the following code snippet:

Diablo uses a type of pseudo-random number generator called a Linear Congruential Generator (LCG). The constants ^[13] used by the Diablo application end up defining a sequence of numbers with period 2³². The RNG returns values between 0 and 2³²-1 where every number appears exactly once in a shuffled order and the sequence of values repeats after 2³² RNG calls.

Each dungeon seed is picked by advancing the RNG state then treating the 32 bit state as a signed integer value and transforming it into a positive integer value between 0 and 2³¹ using the C standard library function abs() (yielding a 31 bit seed^[14]). The end result is a 16-value wide "window" of the sequence of numbers immediately after the initial RNG state.

Because the dungeon seeds use all but one bit of the RNG state, it's possible to reverse the transformation and determine two possibilities of what the RNG state was given a single dungeon seed. With two dungeon seeds you can determine whether they can occur in the same game and if so exactly what the other dungeon seeds are and what the initial RNG seed (starting time) would have been for that game.

Because the dungeon layout for a given game does not change, there's no need to include the full 50KB state in the save file. Instead, the 4-byte dungeon seed can be used to regenerate the level and because the RNG produces the same sequence of numbers all the randomly selected elements will be the same each time the player visits a level. Dungeon layouts are also influenced by what quests are available in the current playthrough, however this is also something that doesn't change mid-playthrough.

Objects, monsters, and items are only generated on the first visit to a level because the player can interact with these elements. If a player defeats a monster, opens a chest, breaks a barrel, or picks up/drops an item the application needs to persist the change for when the player leaves and returns to the level.

The process for identifying a level involves first combining several stills from the video to get as best a view of the given level as possible: