Wouldn't it be possible to reverse engineer these emulators? Maybe the official Nintendo SNES emulator has all the right S-PPU1/2 values in it.