That was a super insightful read! tl;dr For the SGB, they quadrupled the clock speed briefly to glitch over the one instruction responsible for mapping out the

That was a super insightful read! tl;dr For the SGB, they quadrupled the clock speed briefly to glitch over the one instruction responsible for mapping out the ROM. For the CGB, they halted the clock, drained the voltage to randomize the instruction counter, then used a NOP slide that led to their payload.