I love this kind of tinkering. It sure is a lot of fun, given enough time.
> I decided to try just fuzzing over the memory locations that did change to see which one would have an effect.
I've been thinking for a long time to do this in an automated way. But I guess even if you can automate the fuzzy generation + screenshots, a person with a lot of domain knowledge will need to check them.