After a longer break I got back to upd7810 stuff. This time I changed my approach a little bit. First of all I have found a way to debug the code using (slightly modified) mame debugger - as I stated earlier, NEC 7810 was used in a rather unpopular handheld console called Hartung GameMaster (it was planned to be a GameBoy killer, but things went a little bit different I guess). All I needed to do was to modify the ROM size and declare remaining 56kB as read-write space to enable memory mapped IO. Apart from that I have enabled PORTA-PORTD to be visible in emulator and I was ready to go. Working with MAME debugger is somewhat similar to working with gdb - once you learn the syntax, it becomes a really powerful tool. I was able to trace some code visually, set some break- and watchpoints on memory locations of my interest and this way I figured out some more memory locations which hide data I was looking for.

Note: I cheated here just a little bit - as you can see, I'm watching addresses from $27E9 to $27EC where probably key presses are saved. That's one of my most recent findings, but back then I didn't have a clue about that:) Just trying to make it look nice.