You can get a lot off rom chips, it's always the second thing I go for after serial ports- and if you run into a password on the serial port, than it's probably (often hardcoded) in the rom.

Sometimes they don't include headers and the like, so looking up a pinout and soldering to the IC helps in that case too- tapping into the serial connections between chips can reveal a lot too.