Well, SAPP actually did a memory search to find the memory it uses, like for the sv_say function and the chat codecave. Though, I'm not sure if it also used other memory locations than what it searched for.