Pure speculation on my part about how they did it back then, but nowadays one way on emulators is to save the game state just before some variable changes, then allow the variable to change, then save the game state again and look at a diff of both save states. For example save the game just before losing a life and just after losing a life to see what potential memory addresses change when a life is lost. You will get a bunch of other data as well for example when you die the level resets, your score might change etc etc... but as you repeat this process over and over again you will get a sense that address range X-Y is level data, range Y-Z is enemy data, A-B is this data, so on so forth and eventually you'll be able to narrow things down.