> using tools and rigorous methods Lots of speedrun strategies require surprisingly sophisticated tools. People will decompile/disassemble code to figure out w

> using tools and rigorous methods Lots of speedrun strategies require surprisingly sophisticated tools. People will decompile/disassemble code to figure out what is going on. They'll run the game in an emulator and peek at memory values to figure out how the game works and how to manipulate it. They'll use these tools to set up their game state so that there's a sequence of bytes in RAM, then cause program execution to jump to these bytes, to run arbitrary code execution. Here's a video of a speedrunner explaining some of the things he did to get two arbitrary code executions working together to speedrun Super Mario All-Stars + Super Mario World: https://www.youtube.com/watch?v=_MbaZY2DOW0 https://www.youtube.com/watch?v=_MbaZY2DOW0 (it's about 15 minutes) Here's the same runner using one of those arbitrary code executions to inject Flappy Bird into Super Mario World instead of just warping to end credits: https://www.youtube.com/watch?v=hB6eY73sLV0 https://www.youtube.com/watch?v=hB6eY73sLV0 (it's about 6 minutes) He didn't get to that point just by random pressing buttons until something interesting happened. He got to that point because he understands the Super Mario World memory layout well enough to manipulate it and execute the instructions that he chooses for it. That's vulnerability research any way you want to slice it.