I believe that the key register is located at 0x4000130. In my opinion, interdpth has the best idea. If he has the address of that routine, we can examine it. Otherwise, I guess just run a ROM with VBA-SDL-H and put a breakpoint on 0x4000130 and try to locate that routine. davidthefat also makes an excellent point about the location of the hack; we don't want to put it before anything important such as collision detection or behavior data like, as 0m3GA said, those ledges that the player jumps over.