Here is something I have been working on for a few days now and only got a little bit of progress. But progress is progress and this really helps me understand gameboy debugging.
Analyzed the WRAM addresses for any and all changes that occur when you press buttons, select particular cursor locations and of course: when you enter DJ mode (Trippy H).
After hours and hours, I found that WRAM $D5CE is the game mode byte, or at least that's what I call it. This byte is changed directly before switching between dancing mario, menu, view, shoot and trippy H (as well as the other menus and modes).
1:D5CE 00 w
The first instance was when you press a button while mario dances. I restarted the emu and pressed A. The code broke and stopped at $74AC where there was an "LD A, $00"
Has someone done this before?
Dance = 19, menu = 00, shoot = 01, DJ = 1F, view = 02, play - 07, etc.
After learning this, I set an access break when the byte 00 is written to $D5CE
I replaced this with "LD A, $1F" and restarted again.
This time when you press a button at dancing mario, Trippy H starts!
----------------------------------------------------------------------------------------------------------------
Next update I would like to stop the cart from checking if the camera is present. This will allow the ROM to be put onto a normal flash cart.
2nd future update would be to remove unnecessary routines like "shoot " and "view" hopefully the ROM itself can be reduced in size. Potentially an MBC1 + SRAM + BATTERY
3rd future update I would like to break the ROM even more and remove saving altogether so that it can be safely put on a 64M cart along with LSDJ or a dedicated ROM only cart.
Once I print some, I'll update with another post. 
