Well; isn’t that why a lot of traditional ROM hacks historically (at least in the SEGA Genesis/MD hacking scene I was involved with) used savestates as rudimentary ROM hacks? EG - hasn’t it been easier to manipulate data in runtime memory, eg in a savestate; than within the ROM?
Asking because I don’t actually know, I’m just recalling a lot of my early ROM hacking, and indeed discoveries in ROMs, by manipulating memory and savestate rather than the ROM itself.