I've got some Rev E TMS1100s that I know the ROM contents, so I could try reading some bytes with the top bit cleared and some with it set to see if I can tell the difference. I need to figure out how to accurately sample the current.
I'd love to figure out how to read the top bits in TMS1000s and Rev E TMS1100s. Kevin's "execute each byte and shift out the PC" method works, but that Tandy Championship Football game that I dumped had 51 "ambiguous" bytes, where the bottom 6 bits were the same as the next LFSR PC, so I couldn't tell if they were jumps or not. Since the normal 8-bit dump worked, I could tell that only 4 of those were really jumps.
I have been unable to get my Output O PLA dumper to work on TMS1000s or Rev E TMS1100s, so some would still have to be decapped to get that.
