I basically made lots of assumptions about the chip and one of these was that it would be possible to remove it and reconfigure it to allow it to address external memory. It didn't take long to reverse engineer how to configure it like this. Of course, I didn't know any instructions to put in the memory once I realised it didn't support any known opcodes.
But it didn't take that long to work out a few instructions from trial and error. Note that I had already hacked numerous other masked ROM ECUs before attacking this one although they all turned out to have known instruction sets and were merely custom versions of mainstream chips.
Once I could write my own code for the chip it was trivial to get it to read its own ROM and dump it to NVRAM.