Anyone got any theories why this works?

I'm still trying to find an accurate method that will give the possible address in one search. This is the method I currently use. It requires trial and error testing. In my opinion, ZSNES is much easier to use. Even though it doesn't have a few of the other search commands that SNES9x has. It still gets the job done. I have only used ZSNES for hacking SNES games. The same method should work for SNES9x.

1) Do a 1 Byte/Dec value/Comparitive search (ZSNES) or 1 Byte/Previous value/Hexadecimal search (SNES9x).

2) You have 3 choices:

Move your character forward, backwards, or jump.

3) Immediately when your character has performed either action, do a greater than or different to previous value search.

4) You should have about 100 or less possible addresses. Depends on the game or when the search is executed. Not too sure.

5) Look for addresses that have the current values.

CV PV
1 3
4 1
5 4

etc.

These values won't always show. But they are the ones I mostly see when looking for the address. You will have to set the value at 0 to see if your character either doesn't move or goes into hyper mode. When getting the result of your character not moving, it will sometimes be the address saying if you can move, jump, or not. The value 1 should also be tested, when the value 0 fails.

Good Luck!