TOC hack and also a firmware hack idea

Hi there everybody, first, big thanks to all who have worked so hard to 
get netmd hacking as far as it is.

TOC
~~~

I tried to recover a disc i accidentally did a full eraze on, with the 
"74min silent track disc, enter test mode, swap disk, power reset, edit 
track title, save" technique and it failed miserably.

I have an MZ-N707, and it re-reads the TOC on power up.
Not impressed, I decided to open it up and see what I could do.
I had success, between the remote/headphone socket and the Mic socket 
there is a small switch to detect the unit is closed.
It opens on contact so i couldn't just short the pins, i had to make a 
clamp out of a drink can and insulate with blue-tack.

This was not enough, there is a plastic switch near the menu button that 
gets triggered by the catch mechanism upon open and close.
i.e. 0-1-0 upon either operation.
This had to be disabled, being a cowboy i just bent the catch part to 
miss the damn thing.
Then, silent disc, power up, quick swap disc, hit menu, edit name, save.
Worked perfectly, and the catch bent back fine... I just hope i don't 
need to do this again!

Firmware
~~~~~~~~

Whilst doing some research I found that there is a flash ram chip, 
refered to by Sony (service manual) as IC804 (AK6417AM-E2) that can be 
programmed via the USB port when either this chip or the mainboard has 
been replaced.
This requires a program called PatchWriter that some nice service 
engineer may leak some day. Or not.
Whilst delving into my N707 I decided to pull it apart a bit further to 
see this chip which turned out to be marked 17AM 2333.
Looking up 17, 417 and 6417 came up with nothing.
2333 came up with a 4k*8 NMOS ROM made by UMC but that won't be large 
enough.
This was at http://www.xs4all.nl/~ganswijk/chipdir/ by the way.
If anyone can hunt more info, good luck!

We do know from the service manual that :-

pin 1 = XCS 	-> pin 71 on IC801 (XCS NV1)
			Chip Select Output to
			NonVolatile Memory (NVRAM)

pin 2 = SCK0	-> pin 47 on IC801 (SCKO)
			Serial Clock Output to
			NVRAM, LCD & ADC

pin 3 = SDO0	-> pin 46 on IC801 (SO0)
			Serial Data Output to
			NVRAM, LCD & ADC

pin 4 = SDI0	-> pin 45 on IC801 (SI0)
			Serial Data Input
			From NVRAM

I'm thinking it might be possible to hijack these pins with a resistor 
driving a transistor to drive a parallel port to catch the contents.
The thing is, the mainboard is also for the N505 and i wonder if the 
reason this is refered to as patch data is because it merely tells 
software burnt into IC801 the configuration of the buttons, etc, rather 
than being the actual firmware.
Pins 122-129 are marked 'not used' and strangely have pin names but not 
descriptions like the other 'not used' pins, leading me to think maybe 
this would be where the firmware goes in at mainboard manufacture time.

Any comments, ideas on the viability of this?
Has anybody tried anything similar?

Adam.