From experience, and corruption etc.
From experience, I know that the PSP stores most of the X/Y positions etc as single precision floating point.
Typically, if I want to see what's in a PRX, just look for values that look like floating point values (there's no magic way to tell if something's floating point - you just have to guess whether something is floating point or not).
Once you find a patch of floats, just corrupt them (overwrite them with random values) to see if anything changes. If something does, then keep corrupting the area until you narrow it down to a single value - and there, you have the offset.
It can take time, and you never really know if you're going to get anywhere when you start, but it's much faster and easier than reverse engineering...
Alternatively, if you're looking for a particular value, if you can make an estimate of what it is, then you can try searching for that. For example, I guessed that when you press the volume button, the volume bar stays on screen for 2 seconds. From experience, I know that time is typically stored as milliseconds, rather than seconds (though the PSP seems to use microseconds sometimes as well). So when I was asked
this - I just searched for a floating point value of 2000 and found it.
I was thinking about a "guide" on tips on how to find these, but the main thing is, experience...