He also bruteforced the entire opcode space to find undocumented instructions (sandsifter).