In ePSXe save states, the save memory structure starts at 0x779CA with the checksum (2 bytes) and followed by the 0x08FF constant (little-endian). If you have trouble finding, you can search "Wos_jj" (= Squall), it is located 0x18 bytes after the beginning of the save data.