I think I read earlier about having a hard time reading some areas. It's been a very long time since I played with any of this stuff so forgive the intrusion. Here is an old "no rom call" dumper, kinda a bit bang approach and not exactly what you are doing but I am hoping the example might give you an idea of things when you are hunting in the blind. If not, I'll go back to my corner, lol :)
-Carl
Code:
0001 0000			;This area is not normally commented out and has specific instructions for this particular assembler
0002				;
0003				;Version 0.2
0004				;
0005 0052			SaveA:		equ	$52		;This stuff is used by the assembler program, 
0006									;52 is the physical register for IO in this app
0007 00F0			BTDelay:	equ	$F0		;bit delay this	can be any value ya like
0008									;the atmel code	will measure the bit time
0009
0010 0071			Header:		equ	$71		;Just to make the Assembler output
0011									;the complete Header packet in its code dump packet :)
0012
0013 0071					org	Header
0014				;------------------------------------------------------------------------------------
0015				;
0016				;Example Header packet starts here but has nothing to do with car stuff, obviously XX won't work,
0017				;just edited for example purpose and didn't want to rewrite the whole thing
0018 0071 XX XX	XX XX XX XX			db $XX,$XX,$XX,$XX,$XX,$XX,$XX,$XX,$XX,$XX,$XX,$XX,$XX,$XX,$XX ;^)
	  XX XX	XX XX XX XX
	  XX XX	XX
0019
0020
0021				;------------------------------------------------------------------------------------
0022				;
0023				;BootStrap code	starts here
0024				;
0025 0080					org	$80		;Start of EXECUTED Buffer
0026 0080			EntryPoint:				;Glitch brings us here ;)
0027 0080 9B					sei
0028 0081 A6 55					lda	#$55		;Acknowledgement byte that informs me that dump is coming
0029 0083 20 28					bra	Start		;run dumper
0030
0031 0085			SendByte:
0032 0085 B7 52					sta	SaveA
0033 0087 4F			SendByteAt52:	clra
0034 0088 AD 47					bsr	DecA		;Inter-Byte delay
0035 008A AE 0A					ldx	#$0A
0036 008C 43					coma			;invert	byte
0037
0038 008D 11 00					bclr0	$00		;5 Zero	Bit
0039 008F AD 3C					bsr	DelayBit	;1st Start Bit
0040 0091 20 00					bra	SetIO		;3
0041
0042 0093 10 00			SetIO:		bset	$00, #0		;5 One Bit
0043 0095 AD 36					bsr	DelayBit
0044 0097 98					clc			;2nd Start Bit
0045
0046 0098 25 04			SendBit:	bcs	Send1		;3
0047
0048 009A 11 00					bclr0	$00		;5 Zero	Bit	|
0049 009C 20 04					bra	bitdelay	;3		|count this for	timing calc
0050
0051 009E 10 00			Send1:		bset	$00, #0		;5 One Bit	|but not this
0052 00A0 20 00					bra	bitdelay	;3		|
0053
0054 00A2 AD 29			bitdelay:	bsr	DelayBit
0055 00A4 48					asla	a		;3
0056 00A5 5A					decx			;3
0057 00A6 26 F0					bne	SendBit		;3
0058 00A8 10 00					bset	$00, #0		;Parity	= 0, Stop bits = 1
0059 00AA 81					rts			;6
0060
0061 00AB 30			AddyHi:		db	$30		;In this application we are starting the dump at address 3000 to read to 
0062 00AC 00			AddyLo:		db	$00
0063
0064 00AD			Start:
0065 00AD AD D6					bsr	SendByte
0066 00AF 4A			LongDelay:	deca
0067 00B0 AD 1B					bsr	DelayBit
0068 00B2 26 FB					bne	LongDelay
0069
0070
0071				; ---------------------------------------------------------------------------
0072 00B4 71			ChangeSeg:	db $71			;I can't remember but this might have been a page change
0073 00B5 80			Segment:	db $80			;I think this page started at address 8000
0074				; ---------------------------------------------------------------------------
0075 00B6 92C6			Loop:		dw	$92C6		;Load A([long.w],X)
0076 00B8 AB					db	AddyHi
0077 00B9 20 CA					bra	SendByte
0078 00BB AD CA					bsr	SendByteAt52
0079 00BD 3C AC					inc	AddyLo
0080 00BF 26 F5					bne	Loop
0081 00C1 3C AB					inc	AddyHi
0082 00C3 26 F1					bne	Loop
0083 00C5 3C B7					inc	Segment+2
0084 00C7 A6 80					lda	#$80
0085 00C9 B7 AB					sta	AddyHi
0086 00CB 20 E9					bra	Loop
0087
0088
0089 00CD			DelayBit:				;standard 8 bit	delay loop
0090 00CD B7 52					sta	SaveA
0091 00CF A6 F0					lda	#BTDelay
0092 00D1 4A			DecA:		deca
0093 00D2 26 FD					bne	DecA
0094 00D4 B6 52					lda	$52		;SaveA
0095 00D6 81					rts
0096
0097 00D7 9D					nop			;Padding so packet is the correct length
0098 00D8 9D					nop
0099 00D9 9D					nop
0100 00DA 9D					nop
0101 00DB 9D					nop
0102 00DC 9D					nop
0103 00DD 9D					nop
0104 00DE 9D					nop
0105 00DF 9D					nop
0106
0107 00E0 02					db	$02		;End of packet
0108
0109							;		   | 1 STB  |	     | 2 STB  |
0110							;
0111							;I/O Pin >---------+	    +--------+
0112							;		   |	    |	     |	       ..... data bits
0113							;		   +--------+	     +--------+