System ROM Dumping

[travisgoodspeed]

While this exploit can read from any address, the Memory Access Control Module prevents any reads from System ROM while executing from SRAM.

It might be possible to solve this by calling a function or gadget in the System ROM, but the 8-bit X register in the 68HC05 instruction set makes it very hard to imagine the right gadget, much less find one.

Close this issue when an appropriate trick for reading the forbidden ROM is discovered, or leave it open if we still have no solution.