After I went home, I became a bit less certain that the ENBOOT=1 will override the EA pin. Would someone like to try it? You don't have to erase the SB/BV in your part. Just run the part in a board with an external eprom with EA=0. Have the instruction orl AUXR1,#20h then LJMP FC00h. Then connect it to FlashMagic and see if it talks. Instead of FlashMagic, you can connect it a PC running a terminal program at say, 9600 baud, and type a couple of uppercase U chars. If it echo the U back, you're running the bootcode. If that doesn't work, I have what I think is a fix that involves a small bit of hardware to get us back into ISP mode so we can fix stuff.