The rewinding is done by saving the current state once per frame into a ring buffer by the way. During rewinding, states are popped off the end of the buffer frame by frame, with each individual frame still running "forwards".

To reverse audio, it is added from near the end of the frame's audio buffer towards the beginning, which is possible as long as you know the exact length of the frame (so that you end up at the beginning of the audio buffer when the frame finishes). The frame length varies slightly for technical reasons (it even does on the real thing), so the final length is saved as each frame finishes so that it can be recalled later if the frame is rewound.

I guess an alternative approach would be to always start from the very end of the audio buffer and just processing and sending the samples starting from whatever offset you end up at when the frame finishes. The resampling and low/high-pass library I'm using (blip_buf) doesn't support that out of the box though. (It takes a list of timestamps where the waveform changes, which is handy for the algorithm it's using.)

Feel free to ask question. I could answer general NES questions too. :)