This gave me a nice warm fuzzy feeling as I remembered bringing up bare metal Z80s 'back in the day' (can it really be 30 years ago? - yes). One trick I used over and over was to start with a blank EPROM. Every byte is 0xff (pretty much the exact opposite of his 0x00 starting point). The nice thing about that was that 0xff is (from memory) a RST 7 instruction. Which again (from memory) is a kind of one byte subroutine call to address 0x0038. This is nice because it means the CPU (should) settle into a kind of infinite loop, endlessly reading 0xff from 0x0038 AND (very importantly) pushing the return address 0x0039 onto the stack. Of course there is no stack at this stage - but that won't stop the CPU trying, and the effect is an endless series of two byte writes of 0x39 then 0x00 (little endian!) to an address that decrements forever through the 64K address space. It would typically take of the order of a second to cycle once through 64K, and the A15 line would toggle at this rate, the A14 line twice as fast, etc. You could troubleshoot the entire CPU bus interface this way with nothing more than an oscilloscope. Good times.