The ROM is mask ROM inside the microcontroller and not directly accessible. At first she was only able to modify the content of an external EEPROM for keeping g

The ROM is mask ROM inside the microcontroller and not directly accessible. At first she was only able to modify the content of an external EEPROM for keeping game state connected via I2C and emulate another external (mask) ROM - something like a game cartridge for extending the game - containing mostly images and a single byte triggering additional game logic connected via SPI. Then she found a way to trigger a jump into the LCD RAM by messing with the later ROM and she had already control over the LCD RAM content by modifying the images on that ROM. So finally she used this code execution ability to dump the mask ROM in the microcontroller. I hope I got it right.