Thanks, got it working. Throwing watchpoints on FF88AB, I found these two spots where it gets written to, with all reads in the same general area:
77EE2 subq.w #1, ($5c,A6)
7F134 add.w D1, ($5c,A6)
The first is where it gets decremented every frame, and the second is where the dizzy value gets added. There’s some really weird syntax where it loads D1 in the second, though. The value in A6 is FFFF884E, so this makes me think that there is a struct at that address for the state of player 2 and 5c is the offset to the dizzy value, so watching all the data in there could be useful. (Player 1 looks to be FFFF844E.) I’m a C++ programmer, so stepping through assembly isn’t really my thing and theres a lot of opcodes I don’t know following where the value gets added.
EDIT: Weird stuff. The above write was where jump in attacks get set. Grounded attacks are at 7F10C, as well as Chun’s neutral j. hk. (Perhaps the game thinks it’s a grounded normal, which would explain why it doesn’t hit overhead?) Specials and super are at 7F1BE. (Chun’s super and upkicks are 20, btw. The super tops off at a total of 64.) Chun’s cr. hk is at 7F14E and is a hard-coded 130, unlike the others which retrieve their numbers. Lightning Legs is also hard-coded at 7F17E with 100.
The specials are a bit easier to figure out what is going on, since it just adds 2 to the address in register A0 to pull out the dizzy number. Kikkoken, for example, is at 7EEBC, offset 2 to 7EEBE, which has a value of 90.
There’s another address that always get changed right before this one, register A5 - 0x5714. A5 seems to always be FF8000 when P1 hits P2, so the address written to is FF28EC.
The number that gets written there is a random number within a certain range for different attacks. It isn’t the damage, since the numbers don’t line up and jabs sometimes come up with a zero.
That number gets multiplied by 256 and gets added to FF88AC. It stays at that value until the value in FF88AA drops to zero, and then it drops to zero, too. It’s likely that this is the real dizzy value and the other number was a dizzy timer, so it seems like as long as you hit your opponent again before the dizzy timer drops to zero, it retains all the accumulated dizzy. It seems like dizzy happens at 7680, so 30 total dizzy from the smaller original number.
So, so if I were setting something up to look for this stuff, put watch points like this: (all 8-bit)
Dizzy Timer: FF88AB
Last Attack Dizzy: FF28ED