The two pieces of equipment I used was an Agilent MSOX3104A mixed-signal scope and an HP 1631D logic analyzer.
In the picture, on the right, the MSO digital inputs are connected to the EPROM address lines and the analog probes are connected to the EAROM. The analog inputs were used because the EAROM inputs are at 33V.
On the left, the 1631D is connected to the processor address and data bus lines, plus clock, VMA, and RD/WR.
At first I was only looking at the EAROM with the MSO to see what was being read and written. Triggering was set up on specific serial EAROM addresses and data bytes. Then I wanted to know what code was doing the access, so then I connected the MSO up to the EPROM address lines. Unfortunately, the MSO only has 16 digital inputs so I couldn't see the data bus at the same time.
So, then the 1631D was then connected up to all 16 address and 8 data lines so I could do some stateful tracing of the code and trap values as they were being stored to SRAM. At times the serial decode trigger output from the MSO was used as the arming trigger for the 1631D.
If you're starting out wanting to do this kind of digging, I honestly wouldn't recommend the 1631D. It has a miniscule storage of 1024 events and the UI is slow. I used it because I had it laying around from Z80 development I did years ago. What I do like about it is that it has a 43 bit wide input and a plain-language multi-level trigger set up.
The scope has good serial triggering abilities, but it's really bad at stateful analysis.
If I wanted to do more of this type of work, I would probably look seriously at getting an HP/Agilent 16x00 series modular analyzer, most likely a 16702B, and a state/timing module with lots of capture space like the 16741A with 4Mpts. There's scope modules available for it too, so you can get correlated analog traces. If buying used, make sure you get any cables and probing pods that go with it since those can be difficult and/or expensive to replace.
If you're looking lower cost, I always thought the advanced triggering capability of the OLS logic sniffer was pretty good, but there's no GUI for it that I'm aware of:
http://www.mygizmos.org/ols/fpga.html(And I'm talking about an ADVANCED trigger GUI, not the standard SUMP GUIs that are out there.) But given the way used LA prices have been dropping, you might be able to pick up something would support a 16550 module for not much more then the OLS anyway.
Whatever you might choose, the key is being able to capture all the address and data lines plus some control lines. And the more limited it is on memory, the more sophisticated the triggering should be, at least in my opinion, so you can preserve those events that are important to the task at hand.
EDIT: Fix mangled URL, scope model num.