oh yeah. i've mapped it starting at address 0x3000 but the hardware maps the ROM chip in starting at 0x0100, where it just gets aliased all the way up to 0xFFFF. the absolute jump addresses located in the vectors at the top of the ROM refer to addresses starting at 0x3000, so i'm just using that.
hmm, looks like there are a few instructions that aren't 6502. apparently Rockwell defined a few new ones. it would be nice if Ghidra could handle those.
so one of these drives blew a tantalum capacitor. i think i will take this board apart for reverse engineering purposes. there are multiple revisions but this will be a good starting point.
with a combination of hot air and a desoldering gun, i've taken it down to just a few surface mount parts. i'm going to leave those in place for now since many of them are not marked. there is also no silkscreen.
they scanned well. i've taken the top and bottom images and lined them up precisely. these reference images are 600dpi but i may go for a lower res version for KiCad since it stores the images in the pcb file, which slows it down a lot.