I'm curious to how you linked the address in EE memory to the register...in other terms, how do you find the register that is responsible for changing the memory address?
Is easy when you know data address (003415f0).
Just open ps2dis, open game executable.
Click Analyzer --> Invoke Analyzer
Go to data address you found earlier (press G, and type 003415f0, press enter)

Note: ps2dis detect that part as code, but is wrong. You can fix that by pushing B,H,W,D,F on selected lines, depend on data there. But for now is not important.
Now push space bar to "mark" that address, it will change color.
Since that address is now marked, you can press F3 to find its cross references.
In simpler words F3 button will now jump thru all places where that offset is used.
There are much more places that use that offset, but you are only interested into ones that store value there, not read from it. So "
sb or
sw" not
lbu,
lw.
In this game there are 3 place like that, but one originally store using $zero there , so we don't need to touch it
($zero is special register that always have 0 value).
Other 2 places store there something else that is based on previous operations.
For example original code on one of places looks like that:
li few lines ago load value 1 to v0 register, later that value is stored on 003415f0 using
sb v0, offset in delay slot.
So this naturally set offset to value 1, we break it by changing that is used as source to $zero instead of v0. This make it always write 0 there.
This can sounds little bit harder than it is, but when you will learn some basics, then codes like that are piece of cake.
