So what you're interested in, is byte 2: https://wiki.nesdev.com/w/index.php/PPU_OAM#Byte_2
Specifically, the low 2 bits. So looking at this drawing code, we're interested in writes to $0202 (or that +4, +8, +C, etc). And we can see it in your screenshot. At offset $5D3B* it's doing this:
That first LDA is loading the 'A' register with the value of $40 (in binary: %01000000). If you look at the wiki page linked above, you'll see that the $40 bit corresponds to the "flip horizontal" bit.
From there, it's doing an OR with whatever value is at address $0003 -- so that address must be where it has the palette assignment stored. And as you can see from the trace, the palette assignment is '$01', which means the 'A' register is now going to be $41. The 'STA' instructions then writes that value to the $0200 page to assign the sprite attributes.
So you're halfway there!!! $0003 is a RAM address, but ultimately we need to know where that value is coming from in ROM. So the next step is to look for where it got the value to write to address $0003. There are two approaches you can take here:Approach 1
Open up the trace logger and run it. Then run the game until your $A088 breakpoint triggers. At which point the tracelogger will fill with a bunch of code (this is the code that ran before your breakpoint triggered). Starting from the end of the log, look back to see if you can find where it writes (probably with a 'STA' instruction) to address $0003.Approach 2
Put a 'write' breakpoint on address $0003 and hopefully that'll take you directly to the code without having to scour the tracelog. The problem is, $0003 is probably generic RAM space so it might be written to and used for stuff completely unrelated to what you're looking for. If you're going to take this approach, you're only interested in times when the game writes '01' to that address... so you can set a condition for the write breakpoint in FCEUX so it only breaks when "A==#01"
Whichever approach you take, it should bring you to the code that reads a value from ROM and writes it to address $0003... and that'll give you the ROM offset you're looking for. If you get to the code and can't decipher it, you can post it here and I can walk you through it.
Good luck!*why is it showing ROM offsets? Shouldn't it be showing CPU addresses? Must be a weird setting you have set =x. Whatever, it doesn't matter.
EDIT: @sics: He's not trying to change the colors. He's trying to change which palette the sprite uses.