@endrift wasn't just me, lesserkuma did most of the work! I suggested they try hooking up a cart dumper to libmgba and have a breakpoint set at 0x8000000. they worked out some cart read issues and were able to get the initialization code dumped that way (this will be a separate plugin for flashgbx most likely since it may be useful in the future).

then I analyzed the code and tried to work out what it was doing, what was strictly necessary for the cart to initialize (above a specific number of reads, reads to specific addresses, writes to certain addresses that initialize traps and mirroring). tested on all my carts and refined until it worked on all of them