" If Model T strings can hold NULLs, then maybe one could create a string and change its pointers so it reads from any arbitrary location in memory."
Indeed... we used this fact to dump the entire RAM in binary format out the serial port, from a BASIC program in less than 30 seconds. Faster if you poke a higher baud rate. This one dumps to NADSBox (has code to invokes the command to get NADSBox to start capturing) https://bitchin100.com/wiki/index.php?title=Model_100_RAM_Dump_One-Liners Or there's TBACK.EXE, no special hardware needed... can both inject the dump code and receive the file on the host in one step (tested on Linux/WINE as well as Windows). And it can restore the image onto a laptop. The only thing you need to do on the laptop is remember RUN"COM:98N1E<ENTER> -- John.