I tried looking it up but failed to find any technical write ups of how this was done, do you have any links maybe? Super interesting to read.

https://projectzero.google/2021/12/a-deep-dive-into-nso-zero...

I wonder how much overhead that incurs (i.e. how much slower the exploit code is in the JBIG "VM" versus native).