I thought maybe 48 bytes of ROM were inaccessible for some reason, like the 3870/42, which loses the top 64 bytes of ROM for RAM.
I spent a couple of hours playing with it. I was hopeful it was one of those that just spews out ROM contents in test mode. When the test pin's at VSS, the game plays normally. At VDD, nothing happens; all the output pins are low. Floating, it looks like it's executing random instructions. The chip has 1 4-bit input port and 2 4-bit I/O ports, so I tied all those low with 1K resistors to see if the chip was using those inputs as the address, but that didn't change anything.
Can I send you the chip (and maybe a couple of Rockwell's that are hassling me, too)? I'd like to get them back after you dump them so I can torch them and map out the bits.
Sure I can dump them. To get the data out, it's a bit more nuanced. 2 of the pins (near the corner.. 39 and 40 I think) control things. One lets it force NOPs and the other lets you execute a jump.
So you have to do a bunch of code that counts clocks after dumping the first bank on reset. Then you count clocks up to each jump/call and then let it execute it get into the new bank. Then you have to keep following jumps/calls to get to all banks.
