The well known emulator SNES9X seems to be a great tool to find out game-state related address lines and what values are to be expected on the data bus.

It only took a few minutes monitoring the address range dedicated to the WRAM, hitting the walls while playing F-Zero and filtering them in a way that only the decreasing values will be kept in the address list.