NES games will read CPU address $4016 to read controller 1 and $4017 for controller 2.
Since each read only returns one button's status (pressed/not pressed), games will usually have a routine that reads each port 8 times (each read returning 1 bit, the game will combine the 8 reads into 1 byte).
Get FCEUX, go into the game, open the trace logger. I like to have it log to file (it'll ask where to save).
Begin a trace, wait a few frames, then end the trace. Open the trace file, look for LDA $4016.
Immediately after that, it is probably saving the result, so it'll tell you the RAM address being used to store controller input (probably as a ASL/LSR/ROL/ROR $xxxx command).
Now do a search for LDA $xxxx. It should turn up a place where it's reading the button input and then CMP (comparing) it to a certain value, or maybe an AND statement.
(depending on if it's storing the bits right to left, it'd be CMP #$01 for A and CMP #$02 for B, if left to right, it'd be CMP #$80 for A and CMP #$40 for B)

Okay, it's the next code. I checked the ROM and it seems to be:
LDA $4016
LSR (shift the bits from the result)
ROR $28 (shift the bit into RAM $28)

So, RAM $0028 is used to store button data.
So, that should result in the button data being stored right to left (A = right most bit, B = second from right).
So, you should check for $0028 followed by a CMP or AND instuction.