Played a little around - and the OpenFirmware's "dump" command on my older SparcBook 3GX (so no Ultra, but 4m architecture) is able to dump virtual memory. Obeying to the forth syntax, the following command...
1000 100 dump ...dumps 256 bytes starting at address 1000. Of course, reading undefined (=unmapped) memory leads to an access violation. But as the firmware manual describes, devices can be selected and than it is possible to dump their io-space and I bet somewhere in there, the NVRAM is hidden. At ffee0000 I see populated memory in the 3GX - the dumpable range starts at ffee0000 and ends at ffefffff (in total 128k). So having a running UltraBook that would be the way to seach for the NVRAM?
