Which PAL's are you referring to? To my knowledge it isn't possible yet to "read" (for example the PAL16R4(ANC) located at IC25 or the PAL16R6 located at IC26 of the Emax II main board) PAL because they were 1 time programmable with a factory burned fuse that prevents to read the prom. Also it is very, very difficult of re engineering the prom through the "scattered" data it will generate if prom is accessed back works.