*WOW* just found this thread; let me tell you this is the most open, useful discussion about these 7M ecus!
I've been messing with trying to disassemble this thing for about 2 years now, with little success..
3P, question and statement...
q: what address did you write the eprom at; on the reader board?
I tried about 6 times (toner transfer boards), and reading the "demo" bin, it appears to start after the memory space in a 27c256 ends...
Tried 27c/f 512's with the program loaded into both banks with no success...
Statement: This may just help the decompile - the processor above the SDIP64 main processor - the one with the 2 traces running to it (Rx, Tx)
is the Knock control processor (there is even a patent published for it)
It's a Intel microcontroller - 87c51 (See attached Datasheet)
And, I'm fairly sure the main processor is a 6800 variant made by Hitachi - I have a couple datasheets with pinouts that are the "mirror" image of ours..
I'm also including some partially translated documentation of kashi's - pinout, mode assignments, memory maps..