Oh, I quite like the idea of working backwards with the write phase and then working forwards!

I was just going through some post I'd not read and came across this one.
The simplest way is to make a NOP generator. Put the trigger on the chip select of the desired part and monitor what addresses generated the chip select.
You can then map out the entire machine that way ( with the possible exception of a write only port ).
Dwight