Did you try a
disassembler? I don't know how much you know about this kind of thing, but It basically translates the hex digits in the ROM into something more comprehensible to humans.
My suggestion is to do this in a command prompt, substituting "disasm" for whichever disassembler executable, and the .gb's with actual roms:
$ disasm rom1.gb > rom1.disasm
$ disasm rom2.gb > rom2.disasm
$ diff rom1.disasm rom2.disasm
...And hopefully you'll get a small set of functions in the code that differ. That would be useful, since you could then could breakpoint those functions in a debugging emulator, step through the code to see which memory addresses they use, and then pin the values of those addresses with whatever cheat tool in the emu to get an idea of what they're for. You wouldn't even really need to understand the ASM output from the disassembler— the memory addresses themselves might tell you as much as you'd ever want to know.
Though, whether you'd find exploits from doing that is anybody's guess.
