I thought about that, but...
To write drivers for the peripheral device, I would need to know what pins they are connected to, and to do THAT I would have to desolder the CPU, which I won't be able to solder back on (as I said, it's in a BGA package).
I had another idea: writing a simple program, that would give a logical 1 onto a single pin and probing for it with a multimeter or something (or for example oscilating a single pin at a cirtain frequency). But do that, I would have to be able, to flash the device... And to do that I would need access to the BDM pins...
Or is the firmware stored ONLY in flash?
The HD200 (I'm not sure about the HD300) seems to have a BDM port (the unsolder ZIF near the CPU), but I don't know it's pinout...
Any ideas, anyone?
[Other than simply sacrificing a player, which I don't want to do.]