I haven't tried to dump a TMS1000 yet, but if I recall correctly, Kevin only got the low 7 bits when he did it. His idea to dump those and the Rev E TMS1100s is to execute each instruction and then shift out the program counter to see if it is the next value from the LFSR (which means not a call/branch, so the high bit was not set) or if it is the low 6 bits from the opcode (which means the high bit was set). That would likely get most opcodes, leaving only the oddball instances where the code jumps to the next byte in the LFSR sequence, in the same page or another page. Jumping to the next byte in the same page is unlikely (maybe a NOP?), but jumping to the next byte in another page seems fairly likely (there are only 64 bytes in a page), so we'd have to sort those out via emulation.