The address for balloons is searched for by comparing the RAM in different states when you have different known balloon counts. When you have 1 balloon, the value is 1. When you have 3, it's 3. This is very easy to search for. Then, you need to repeat the same search process on another console...