Reminds me of the CHDK hackers trying to dump firmware off a Canon camera. They could get the altered firmware to activate and could read memory and control an LED, so... they blinked the firmware out through the LED, and read it with a ball mouse's optical sensor attached to a microphone cord. :-)