I have always used Cheat Engine to step through the program on the emulator. Although that's quite time-consuming and absolutely more annoying than using a debugger, it works.
If you can "see the actual CPU state at every point", what will you do next?
@fishkiller2 I sure that most of the code are not much related to the programming language you are using, either C or C#.
1. The execution is started at the command that is specified by the "reset vector" that is stored in the ROM segment 0,
the initial value for the stack pointer at address 0 and the reset routine entry points at addresses 2 and 4.
(page 1-15, nX-U8/100 core instruction manual)
In the emulator, the entry point when [ON] is pressed is at address 2.
2. According to the emulator, data segment 0 is used frequently, and data segment 1 is used only once at initialization (press [ON]) as the copy source of the first (deepest) bytes of the stack.
Although the microcontroller support up to 16 segments, I think the calculator only use 2 data segments, and (probably) only segment 0 is writable. According to the checksum procedure of the emulator, segment 8 is the segment 0 of program/code memory space.
3. The CSR of the real calculator only have its last bit kept, all other bits are zeroed. You can only execute segment 0 (program/code) or segment 1, and as you said earlier, unless the memory are flash, it's not writable.