Well, you can always address this ram directly, so it's not that you cannot change anything other than by pushing/poping. Also, at least for the game boy there is an opcode that basically lets you store the current stack pointer (sp) and add an offset value to it in a register (ld hl, sp ± $XX). So you can address stuff that was popped before a routine was called. This might be the case if it is in the main loop (as it needs a constant offset of SP to the data being changed).

Also, you could look where the stack is initialized (usually after ram for that slot was cleared) and see if those offsets are actually meant to be in the stack. Depending on the stack type, you can tell if it just happens that you can pop this and it was not planned or if it was to be included in the stack and is just a clever trick used by the engine to call different routines in different places.

cYa,

Tauwasser

Well, I've seen that, too. But it's entirely possible as long as any interrupts are disabled. It's faster than reading from other registers it seems... at least on gb

cYa,

Tauwasser