A mix of serendipity and digging for it.
In the case of OOT, SRM was found accidentally and then researched via live-debugging using emulators and the decompilation project which in turn exists because a debug ROM of OOT MQ was leaked and people were willing to manually rewrite code to match the assembly.