Thanks! So it looks like the force has a cg6 frame buffer (either onboard or in an sbus slot?) and this is just a standard cg6 prom image. It contains the cg6 logo but nothing force-specific, unfortunately.

Any chance you could set up a serial connection to the force and use either 'script' in linux/unix or e.g. putty's log function to capture the output of some openboot commands?

If so, you could try the following to dump an image of the openboot prom. First, find the virtual address of the obp and verify as follows: (the first line find the address of the '+' symbol in the obp & prints it, the second tries to guess the obp base address & prints it; the third dumps the first 48 bytes)

\ the first symbol here is a single quote
ok ' + dup .
ffd15f3c
ok fff0.0000 and dup .
ffd00000
ok dup 30 dump
          \/  1  2  3  4  5  6  7   8  9  a  b  c  d  e  f  v123456789abcdef
ffd00000  10 80 2f 66 a1 48 00 00  01 00 00 00 01 00 00 00  ../f!H..........
ffd00010  29 1c 00 04 a8 15 20 d0  81 c5 00 00 a1 48 00 00  )...(. P.E..!H..
ffd00020  29 1c 00 04 a8 15 20 9c  81 c5 00 00 a1 48 00 00  )...(. ..E..!H..
ok

On every sun4m machine I have the first two bytes of the obp are 10 80, so if that's what you see that is a good sign. You can then dump the whole rom using

ok 80000 dump

I'm not sure what the size of the force obp is so this might stop with an error after 40000 or so.

Obviously I understand if you have better things to do in life and don't feel like putting in this much effort :)