You're right: many of TecToy's Brazil-exclusive Master System games were tweaked versions of Game Gear releases. That includes games like Ecco 2, Mortal Kombat 3 and Sonic Blast, but not the aforementioned Street Fighter II which they developed independently.
I think the Master System version of Sonic Spinball came from Sega themselves though. It was sold in Europe as well as Brazil.
I don't know if they even had an emulator at the time - I don't think a 1980s PC could run a NES emulator at a reasonable speed.
Another possibility is that they used a hardware device. Perhaps something that watches the 6502 `sync` pin to know when an opcode byte is being read, and verifies that the data bus contains a legal value.
> On execution, 16-bit Thumb instructions are transparently decompressed to full 32-bit ARM instructions in real time, without performance loss.
That quote is from the ARM7TDMI manual - the CPU used in the Game Boy Advance, for example. I believe later processors contained entirely separate ARM and Thumb decoders.
Throughout the entire NES game library, almost no games use these illegal opcodes. Apparently as part of the licensing process, Nintendo would verify that games only used the official instructions.
I wonder how they tested that, though? I don't think developers had to submit their source code to Nintendo, so they would have had to analyse the binaries in some way?
Nice and compact! When I was writing a Z80 emulator I made heavy use of the tables in Sean Young's "The Undocumented Z80 Documented" [0] (chapters 8, 9 & 10). This 2-page reference card seems to contain just about everything in the document's 22 pages.
Instruction timings are in the pink table on the left-hand side. For example, `ADC HL, BC; ED4A; H15` means that the instruction affects the flags as in row H and takes 15 cycles to execute.
I think the Master System version of Sonic Spinball came from Sega themselves though. It was sold in Europe as well as Brazil.