Late to the party, but just cracked open my Elvis head.
The ICESDA, ICESCK, and ICE lines on the J22 connector on the main board are for an I2C (3 wire) interface to the Analog to Digitial converter (Sonix SNAD01A) Which is an 8 channel 10-BIT ADC chip. All of the motor pots are connected to this. There is one in the head and one on the main board.
Any custom controller will need to be able to either communicate with this or replace it with something else.
There is a 512K Flash chip in the center of the controller. I will need to get an adapter for my eeprom programmer to dump the code. I imagine it is essentially a bootloader with the basic functions and some basic phrases you hear when you do not have a cart inserted.
The main processor is a sunplus chip on a COB board on the bottom side of the main board. All connections have huge test pads which would be awesome if we actually knew anything about it! There is also a very small grouping of three pins that look suspiciously like a serial port (TX, RX, and GND) I don't have time to mess with this anymore today, but I will attempt to probe it and talk to it if I can.
I would be very surprised if there wasn't some type of SPI port on this, which would allow talking to SD cards.
Anyway, whatever I do, I purchased a bluetooth serial module to put inside there with the intention of controlling him wirelessly.
They definitely made this head for hacking. But, GWJAX will likely beat me since he seems to know programming. I am an electronics guy mainly. I intend to design a replacement PCB as well, using an AVR or ARM. It really looks deceptively simple with all the labeling and modular design. You simply need logic level signals to control it.
GWJax, if you would like to coordinate our efforts, I am interested.
(Edited since this was moved from a different thread and the context was lost)