Re NAND crypto
Is this onboard AES on die stuff/serial burned into efuses or just soft encrypted? Equally any options for a sideload/unencrypted read? Thinking similar to the original xbox unlocking the hard drive or there being a raw read API at some level which could be coupled with bankswitching (if it is even necessary) -- if we are already going to be redoing half the kernel for any hacks then meh.
Prices only go one way for this sort of thing, at least until it becomes legacy I guess (seen the prices of 2gb sd cards lately?). Equally looking at PCB shots I am not seeing any nice surface mount things you can drag solder. This means BGA, and probably something really fun like vfbga or similar pitch as we are dealing with small mobile phone style hardware, and with that comes the need for IR soldering (I can see regular BGA on hot air but not likely VFBGA). I don't know too many electronics shops that will see you walking away with much change from $200 for that kind of service and tooling up is not much better. See also that 3ds nand swap thing from a few years back where the guy took the chips and swapped them around.
Also I might argue otherwise on increases in performance -- you might have got too used to the doubling capacity model and missed that double 256 gigs is a lot of extra space in its own right. That said on "slowed down a bit" then so be it but how was I supposed to infer such a meaning from the post you made?
The dock appears to have USB. Bluetooth appears to exist. I am seeing a bunch of unpopulated headers, vias and test points which might serve as a location, it has game carts and it would not be the first time one of those has been redirected for external reads (
https://web.archive.org/web/20051220153223/http://natrium42.com:80/projects/serial.html ).
So far I am seeing a proclamation based on not an awful lot. Tricky thing doing that.