Another little finding:

Structure of dma cheat:
0x6.... - pointer
nop
0xB.... - pointer confirmation?
nop
offset 0
value 0
offset 1
value 1
..so on
d2000000 - end flag
nop


Next cheat..


The above seems really consistent with dma cheats. 