It's about the same as how you'd approach modern programming, except instead of watching variables you'd watch registers and addresses in RAM/VRAM and work backward from there. Hell, you could even look specifically for instructions that manipulated those addresses.