That's exactly what I used to think reading Kevin's posts! But it turns out that once you get some experience doing this stuff, you can run through a lot of possibilities pretty quickly. I really didn't think I'd get this one to dump, but I just tried a bunch of stuff and got lucky.

The TMS1x00 chips have 3 programmable features- the ROM itself, which contains the game program; the output PLA, which determines the O outputs patterns; and the instruction PLA, which let the chip's opcodes be customized. We can't electronically dump the instruction PLA, but I think we've only seen modified instruction PLAs on TI calculators. We can't directly electronically dump the output PLA, but I have been able to get TMS1100 chips to execute opcodes to output all 32 possibilities, which is just as good. We can electronically dump the ROMs of TMS1100 rev B chips, and 7 bits of each byte of the TMS1000 and TMS1100 rev E chips.

For the chips that only output 7 bits of ROM, we can execute the instruction at each byte and then look at the program counter to see if the instruction was a branch, which means the high bit was a 1. But sometimes those results are ambiguous, and we can't tell for sure. We could most likely figure out the ambiguous bytes by running the game in the debugger. And we could probably figure out the output PLA of TMS1000s by looking at the PCB and running the game. And it's not impossible that we could figure out a customized instruction.

The other TMS1x00 chips (1400, 0980, etc) look like they have circuitry that would only be used to dump the ROM, but we haven't figured out the method. But someone might; Igor told me he spent every day for a month trying different things to get the chip in the Russian LCD games to dump!

So more TMS1x00 chips are dumpable now than before, but there are still some where we can't get a complete dump. But even dumping 7/8 of the ROM can be useful- I decapped the TMS1100E from the Radio Shack Microcomputer Trainer and damaged the die so that I couldn't visually dump all the bits, but someone dumped the chip electronically, and between the two of us, we had all the bits!