Re:Gameboy.live: A basic Gameboy emulator with terminal “clo...
by Hackbraten on Monday May 13, 2019 @02:32AM
(#19896797)
That was a super insightful read!
tl;dr For the SGB, they quadrupled the clock speed briefly to glitch over the one instruction responsible for mapping out the ROM.
For the CGB, they halted the clock, drained the voltage to randomize the instruction counter, then used a NOP slide that led to their payload.
Fault injection is a method to cause microprocessors to execute instructions "incorrectly" by manipulating external factors (clock frequency, input power, etc). Getting the CPU to fail to write to a memory address, or flipping the truth of a comparison instruction, and other "glitches" can influence execution of security-sensitive code and ultimately undermine security mechanisms.
The original Gameboy ROM was dumped by physically de-capping the chip and reading out the bits: https://dot-matrix-game.blogspot.com/2014/01/boot-roms.html