Attached ROM images that were extract from HP8752C Serial#:3410A02659 1.3GHz Opt.: None.
Device for U4, U5, U24, U25 : D27C020-200 class EPROM.
Device for EEPROM : X28C64P-15 class EEPROM. 

EPROM (U4,U5,U24,U25) : Firmware Version V5.34 Apr.03, 1995

EEPROM 
8752C_3410A02659_1.3GHz_Original.BIN     : Original EEROM image 1.3GHz Opt.None.
8752C_3410A02659_3GHz_Modified.BIN       : EEPROM image, after modified to 3GHz (Opt.003) and time domain (Opt.010), and then applied the adjustment.
8752C_3410A02659_3GHz_004_Modified.BIN   : EEPROM image, above 3GHz modification and then added 70dB Attenuator option (Opt.004) flag w/o adjustment.
8752C_3410A02659_3GHz_75ohm_Modified.BIN : EEPROM image, above 3GHz modification and then added 75ohm option (Opt.075) flag w/o adjustment.

Following are my analysis results of 8752C option flag.
I confirmed by writing the following value to EEPROM, and then check the startup message.

 1) F0: None.
 2) F1: 010 
 3) F2: 006
 4) F3: 006+010
 5) F4: None
 6) F5: 010
 7) F6: 006
 8) F7: 006+010
 9) F8: 003
10) F9: 003+010
* Option flag 00~09: Also got the same results, it meaning that upper 4 bit are no effect.
 
 bit0---Opt.010 (Time Domain)
 bit1---Opt.006 (6GHz)
 bit2---None    (8753C: Opt.002, 8752C:None, but may indicate Opt.004, but not effect to the actual function, only for the purpose of indication.)
 Bit3---Opt.003 (3GHz)

The flag of Opt.004 and Opt.075 are existing on other area.
These options are able to modify by PEEK/POKE commands at the position "ALT" of A9 CC jumper.
1) Opt.004 : PEEK/POKE Address set: 2621814(dec) 280176(hex), POKE -1, The result of EEPROM change: Address $00BB: $00-->$FF.
2) Opt.075 : PEEK/POKE Address set: 2621808(dec) 280170(hex), POKE  1, The result of EEPROM change: Address $00B8: $00-->$01.
* In the PEEK/POKE command, EEPROM base address is $280000, If you wants to change the contents of EEPROM address $00BB,
  You need to set the PEEK/POKE address to ($280000 + (2*$00BB)) = $280176. (=2621814dec.)

mmbfj310