I think for games where the RNG is very well understood, people started from a RAM examination tool and looked for a word that changes very rapidly and chaotically. From there you look at the instructions that cause a write to that address (to determine what events cause the RNG to advance) and read from it (to see how it’s used and e.g. if it’s combined or restricted for game balance/pacing reasons). This is easier on earlier consoles with less RAM and simpler code though, and with emulators that support advanced debugging features like RAM-access breakpoints.
A cool visualization for this kind of thing are these RAM artprints. For example, in this one I suspect the RNG counter is the two messy-looking bytes on the 7th row from the top:
