I recall saying something about this on #nesdev. Basically what the game does is read data from SPR-RAM (bit $2004), then it performs a check on the value read and updates the screen based on such number. However, the $2004 read is performed during HBlank, which makes me think that it may be possible to read SPR-RAM data during HBlank. Here is a sample code that shows what I am talking about:
Code:
---------------------- PROCESSING *SCANLINE* #017 ---------------------
$fd76 A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:246 pla
$fd77 A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:234 pha
$fd78 A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:225 pla
$fd79 A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:213 pha
$fd7a A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:204 pla
$fd7b A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:192 pha
$fd7c A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:183 pla
$fd7d A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:171 pha
$fd7e A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:162 pla
$fd7f A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:150 pha
$fd80 A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:141 pla
$fd81 A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:129 pha
$fd82 A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:120 pla
$fd83 A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:108 pha
$fd84 A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:099 pla
$fd85 A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:087 pha
$fd86 A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:078 pla
$fd87 A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:066 pha
$fd88 A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:057 pla
$fd89 A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:045 pha
$fd8a A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:036 pla
$fd8b A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:024 pha
$fd8c A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:015 pla
$fd8d A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:003 pha
------------------------ PROCESSING *HBLANK* #017 -------------------------
$fd8e A=$ff X=$08 Y=$00 SP=$f7 F= N I C Cycle:003 pla
$fd8f A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:072 nop
$fd90 A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:066 nop
$fd91 A=$ff X=$08 Y=$00 SP=$f8 F= N I C Cycle:060 dex
$fd92 A=$ff X=$07 Y=$00 SP=$f8 F= I C Cycle:054 bne $fd6e
$fd6e A=$ff X=$07 Y=$00 SP=$f8 F= I C Cycle:045 bit $2004
$fd71 A=$ff X=$07 Y=$00 SP=$f8 F= N V I C Cycle:033 bmi $fd73
Eventually the N flags is reset and the game moves on to something else.