datamining in dungeons How Diablo hackers uncovered a speedrun scandal Investigators decompiled the game to search through 2.2 billion random dungeon seeds. Kyle Orland Feb 15, 2025 6:45 am | 7 The word Debunk radiating flames against a demonic background Credit: Aurich Lawson The word Debunk radiating flames against a demonic background Credit: Aurich Lawson Story textSizeSmallStandardLargeWidth *StandardWideLinksStandardOrange* Subscribers only Learn moreFor years, Maciej "Groobo" Maselewskistood as the undisputed champion of Diablo speedrunning. His 3-minute, 12-second Sorceror run looked all but unbeatable thanks to a combination of powerful (and allowable) glitch exploits along with what seemed like some unbelievable luck in the game's randomly generated dungeon.But when a team of other speedrunners started trying and failing to replicate that luck using outside software and analysis tools, the story behind Groobo's run began to fall apart. As the inconsistencies in the run started to mount, that team would conduct an automated search through billions of legitimate Diablo dungeons to prove beyond a shadow of a doubt that Groobo's game couldn't have taken place in any of them."We just had a lot of curiosity and resentment that drove us to dig even deeper," team member Staphen told Ars Technica of their investigation. "Betrayal might be another way to describe it," team member AJenbo added. "To find out that this had been done illegitimately... and the person had both gotten and taken a lot of praise for their achievement."If we have unearned luckIf you have any familiarity with Diablo or speedrunning, watching Groobo's run feels like watching someone win the lottery. First, there's the dungeon itself, which features a sequence of stairways that appear just steps from each other, forming a quick and enemy-free path down to the dungeon's deeper levels. Then there's Groobo's lucky find of Naj's Puzzler on level 9, a unique item that enables the teleporting necessary for many of the run's late-game maneuvers. Groobo's 3:12 Diablo speedrun, as submitted to Speed Demos Archive in 2009 "It seemed very unusual that we would have so many levels with the upstairs and the downstairs right next to each other," Allan "DwangoAC" Cecil said at a recent presentation attended by Ars Technica. "We wanted to find some way of replicating this."When Cecil and a team of tool-assisted speedrunners (TAS) started that search process in earnest last February, they said they used Groobo's run as a baseline to try to improve from. While Groobo ostensibly had to rely on his own human luck in prepping his run, the TAS runners could use techniques and tools from outside the game to replicate Groobo's run (or something very similar) every time.To find an RNG seed that could do just that, the TAS team created a custom-built map generation tool by reverse-engineering a disassembled Diablo executable. That tool can take any of the game's billions of possible random seeds and quickly determine the map layout, item distribution, and quest placement available in the generated save file. A scanner built on top of that tool can then quickly look through those generated dungeons for ones that might be optimal for speedrunning."We were working on finding the best seed for our TAS, and we were trying to identify the seed from Groobo's run, both to validate that our scanner works and to potentially straight-up use it for the run," Stephan said of the effort. "We naturally had a lot of trouble finding [that seed] because it doesn't exist."A thorough searchIn their effort to find Groobo's storied run (or at least one that resembled it), the TAS team conducted a distributed search across the game's roughly 2.2 billion valid RNG seeds. Each of these seeds represents a different specific second on the system clock when a Diablo save file is created, ranging from between January 1, 1970, and December 31, 2038 (the only valid dates accepted by the game).After comparing each of those billions of those RNG dungeons to a re-creation of the dungeon seen in Groobo's run, the team couldn't find a single example containing the crucial level 9 Naj's Puzzler drop. After that, the team started searching through "impossible" seeds, which could only be created by using save modification tools to force a creation date after the year 2038.The team eventually found dungeons matching Naj's Puzzler drop in Groobo's video, using seeds associated with the years 2056 and 2074. After an exhaustive search, the TAS team couldn't find a dungeon with Naj's Puzzler dropped in the place Groobo's run said it should be. Credit: Analysis of Groobo's Diablo WR Speedrun After an exhaustive search, the TAS team couldn't find a dungeon with Naj's Puzzler dropped in the place Groobo's run said it should be. Credit: Analysis of Groobo's Diablo WR Speedrun The early presumption that Groobo's run was legitimate ended up costing the team weeks of work. "It was baffling when we couldn't find [the early Naj's Puzzler] in any of the searches we did," Cecil said. "We were always worried that the scanner might have bugs in it," Staphen added.The TAS team's thorough search also showed troubling inconsistencies in the other dungeon levels shown in Groobo's run. "Normally you would only need to identify a single level to replicate a run since all the other levels are generated from the same seed," AJenbo told Ars. But the levels seen in Groobo's run came from multiple different seeds, which would require splicing footage from multiple different saves."At that point we also wanted to figure out how manipulated the run was," AJenbo said. "Was it a legit run except for [dungeon level] 9? Was it three good runs combined? In the end we only found two levels that had come from the same run so at least 13 (probably 15) runs were spliced into one video, which is a lot for a game with just 16 levels."The evidence piles upAfter Groobo's dungeon generation problems came to light, other inconsistencies in his run started to become apparent. Some of these are relatively easy to spot with the naked eye once you know what you're looking for.For instance, the "19962001" copyright date seen on the title screen in Groobo's video is inconsistent with the v1.00 shown on the initial menu screen, suggesting Groobo's run was spliced together from runs on multiple different versions of the game. Items acquired early in the run also disappear from the inventory later on with no apparent explanation. This copyright date doesn't line up with the "V1.00" seen later on the menu screen in Groobo's run. Credit: Analysis of Groobo's Diablo WR Speedrun This copyright date doesn't line up with the "V1.00" seen later on the menu screen in Groobo's run. Credit: Analysis of Groobo's Diablo WR Speedrun Even months after the investigation first started, new inconsistencies are still coming to light. Groobo's final fight against Diablo, for instance, required just 19 fireballs to take him out. While that's technically possible with perfect luck for the level 12 Sorceror seen in the footage, the TAS team found that the specific damage dealt and boss behavior only matched when they attempted the same attacks using a level 26 Sorceror.After the TAS team compiled their many findings into a lengthy document, Groobo defended his submission in a discussion with Cecil (screenshots of which were viewed by Ars Technica). "My run is a segmented/spliced run," Groobo said. "It always has been and it was never passed off as anything else, nor was it part of any competition or leaderboards. The Speed Demos Archive [SDA] page states that outright." Indeed, an archived version of Groobo's record-setting Speed Demos Archive submission does say directly that it's made up of "27 segments appended to one file."But simply splitting a run into segments doesn't explain away all of the problems the TAS team found. Getting Naj's Puzzler on dungeon level 9, for instance, still requires outside modification of a save file, which is specifically prohibited by longstanding Speed Demos Archive rules that "manually editing/adding/removing game files is generally not allowed." Groobo's apparent splicing of multiple game versions and differently seeded save files also seems to go against SDA rules, which say that "there obviously needs to be continuity between segments in terms of inventory, experience points or whatever is applicable for the individual game."After being presented with the TAS team's evidence, SDA wrote that "it has been determined that Groobo's run very likely does not stem from only legitimate techniques, and as such, has itself been banished barring new developments." But Groobo's record is still listed as the "Fastest completion of an RPG videogame" by Guinness World Records, which has not offered a substantive response to the team's findings (Guinness has not responded to a request for comment from Ars Technica). A recent Diablo speedrun on a confirmed legitimate dungeon seed. This might seem like a pretty petty issue to spend weeks of time and attention debunking. But at a recent presentation attended by Ars, Cecil said he was motivated to pursue it because "it did harm. Groobo's alleged cheating in 2009 completely stopped interest in speedrunning this category [of Diablo]. No one tried, no one could."Because of Groobo's previously unknown modifications to make an impossible-to-beat run, "this big running community just stopped trying to run this game in that category," Cecil said. "For more than a decade, this had a chilling impact on that community." With Groobo's run out of the way, though, new runners are setting new records on confirmed legitimate RNG seeds, and with the aid of TAS tools.In the end, Cecil said he hopes the evidence regarding Groobo's run will make people look more carefully at other record submissions. "Groobo had created a number of well-respected ... speedruns," he said. "[People thought] there wasn't any good reason to doubt him. In other words, there was bias in familiarity. This was a familiar character. Why would they cheat?"Kyle OrlandSenior Gaming EditorKyle OrlandSenior Gaming Editor Kyle Orland has been the Senior Gaming Editor at Ars Technica since 2012, writing primarily about the business, tech, and culture behind video games. He has journalism and computer science degrees from University of Maryland. He once wrote a whole book about Minesweeper. 7 Comments