In only 0x100 bytes of ROM that is so simple, there’s unlikely to be too many software bugs that allow dumping. Decapping a chip and imaging it isn’t cheap either. The hardware mechanism for locking the boot ROM may be hard to figure out without having the boot ROM already. And given how simple and effective the hardware mechanism is, it, too, is unlikely to have any obvious flaws to exploit.

So they didn’t exploit flaws, they just tried to work around the protection.

Even though the Gameboy is relatively slow (~4.7 Mhz processor IIRC) it’s still not going to be easy to hit exactly at the right time to be able to perform your fault injection.

The protection is simple enough to be effective. If you did it with a modern manufacturing process it’d probably be quite difficult to be able to image the bits directly...

Nowadays, for say Nintendo Switch, you are more likely to see keys and firmware data dumped via early boot exploits or privilege escalation.

There's a description of the particular fault injection used for the Gameboy Color here: https://www.its.caltech.edu/~costis/sgb_hack/

Fault injection is a method to cause microprocessors to execute instructions "incorrectly" by manipulating external factors (clock frequency, input power, etc). Getting the CPU to fail to write to a memory address, or flipping the truth of a comparison instruction, and other "glitches" can influence execution of security-sensitive code and ultimately undermine security mechanisms.

The original Gameboy ROM was dumped by physically de-capping the chip and reading out the bits: https://dot-matrix-game.blogspot.com/2014/01/boot-roms.html

That was a super insightful read!

tl;dr For the SGB, they quadrupled the clock speed briefly to glitch over the one instruction responsible for mapping out the ROM.

For the CGB, they halted the clock, drained the voltage to randomize the instruction counter, then used a NOP slide that led to their payload.