The basic steps are:
- Memory scan as per usual
- Find the start of the emulated address space
- Find a static pointer to the start of this area
- Create a lvl1 pointer path to reach our variable every time
- Done!
http://www.mediafire.com/?zwyyntdzehz
Enjoy

Misc Notes
=======
0xXXXXXXXX always contains a pointer to the start of the emulated memory range in Project64 vX.X
004D6A1C - 1.6
004FADAC - 1.7