Use fceux emulator, open hex editor -> ppu memory, also open ppu viewer tool. Make a savestate. Then manually overwrite bytes in $0000-$1FFF area, look at ppu viewer and see what does it change exactly.
When you find what you're looking for, load a savestate with original bytes. Try to copy several bytes and search them in hex editor -> rom file. There can be several search results in theory, so either change bytes there and reset rom, and/or use code/data logger tool to see which bytes were read from rom.
For more precise search use debugger with write breakpoints for ppu memory. Bytes will be written via $2007 register.