I got lucky with the Lightfight COP421L - it was easy to dump by just giving it power, a resistor and cap for the oscillator, 3V on SO, and grounding SI. I had to let it run normally for a bit so that the code set up the L port as output, then 3V on SO put it in ROM dump mode. Since SK is used as an output it doesn't indicate when the ROM bits are valid, but they are wide enough that I could find the centers easily. There were 32 zeroes at the end of the dump that helped ID the start, and I confirmed it by disassembling the code and checking JSR addresses.
I couldn't measure the clock rate from the oscillator pin; the capacitance of my 'scope probe slowed it down. Maybe the same thing was happening with the Entex BB3 TMS1100. When you turn on power, it continually displays a dot, then a small square, then a large square, and it beeps each cycle. I counted 30 cycles in 23.3 seconds. The resistor and cap used are listed in the datasheet as giving a 19uS instruction time, +/- 15%.
