As I figured, I spent less time on this on the weekend than I had hoped I would. But progress has started to come quickly. I have a ribbon cable and 2x5 pin connector hanging out of my IM-ME like the tongue of a cat. It is connected to four of the five debug points at the back of the unit, while a fifth wire is hanging off 2.5V found off some capacitor in back of the LCD. This connector plugs directly into the Bus Pirate, and I've got a Python script putting the IM-ME into debug mode and reading a few registers. I could post some picture, but the ones at Dave's Hacks are much better than I could be arsed to come up with right now.
That makes it all sound easy, and it should have been. But I made more than my share of stupid mistakes along the way. Like getting the cable on to the back of the IM-ME wrong not once, but twice. And like trying to put the IM-ME into debug mode by strobing the Clock line instead of the Data line. And like thinking I was talking to the IM-ME when really I wasn't getting any further than the Bus Pirate. That's why I don't do this stuff in my real line of work. I'd starve to death if I did.
Next I've got to finish off the routines to re-flash the IM-ME, though I'm most of the way there. Once the building blocks are in place, the IM-ME code will get mass-erased and it will begin its life as the flexible radio receiver this little purple and pink piece of plastic always wanted to be.
But I swear, as I was digging around in its internals last night with a soldering iron and screwdriver, I could swear I heard it sobbing. Ever so softly...