I had tried to do this a while back by attempting to modify the control rom to dump the contents of the internal MCU ROM during a DUMP ALL INSTRUMENTS command through the MIDI out port, but I could never get it to work.
hitachi mcu was dumped by injecting dumper code to conrol ROM and read using logic analyzer. mitsubishi was dumped by injecting dumper to RAM and executing it using power glitching
I had tried to do this a while back by attempting to modify the control rom to dump the contents of the internal MCU ROM during a
DUMP ALL INSTRUMENTS
command through the MIDI out port, but I could never get it to work.