Register $2A:

Where in the memory is the register $2A located?

To find it, I modified Daos' attack script:

Daos data: [$0B49CD] (offset [+$00])
Daos' attack script:
offset [+$28]
32 01
0C 2A AA 0A
offset [+$2E]
3E 2E 00
00

The infinite loop "freezes" the program, so the register $2A will not 
be modified after being loaded with $0AAA.

I make a save state while the program is in the infinite loop:
L2.zst

Hex search in L2.zst: $AA 0A
=> $AA 0A at offset [$20075]

=> register $2A is at offset[$20075] in a save state?

New modification to Daos' attack script:
offset [+$28]
32 01
0C 2A AA 0B
offset [+$2E]
3E 2E 00
00

Hex search in L2.zst: $AA 0B
=> $AA 0B at offset [$20075]

=> register $2A IS at offset[$20075] in a save state.


New modification to Daos' attack script:
offset [+$28]
32 01
32 05
0C 2A AA 0B
offset [+$30]
3E 30 00
00

Hex search in L2.zst: $AA 0B
=> $AA 0B at offset [$20075]. No other occurence of $AA 0B near that offset.
=> There's only one register $2A.

**********

Register $27:

New modification to Daos' attack script:
offset [+$28]
32 01
0C 27 AA 0B
offset [+$2E]
3E 2E 00
00

Hex search in L2.zst: $AA 0B
=> $AA 0B at offset [$2006F]

=> register $27 is at offset[$2006F] in a save state.

[$20021:$20022]    register $00
[$20023:$20024]    register $01
...
[$20041:$20042]    register $10
...
[$2006F:$20070]    register $27
[$20071:$20072]    register $28
[$20073:$20074]    register $29
[$20075:$20076]    register $2A
...
[$200C3:$200C4]    register $51
[$200C5:$200C6]    register $52
...
[$200D1:$200D2]    register $58
...
[$2011F:$20120]    register $7F
