I made a couple of corrections to my previous post. Apparently none of the chips on the CPU board(except the SH2) have any tricky protection-related function and they seem to be used to generate signals for the SH2 which is constantly powered.
The pinout seems to be identical to the one of the SH2(SH7604), so at this moment I can only think of two ways of reprogramming the keys insides.
* One option is that the SH2 can still run code but with a different unknown-factory-set-key. In that case replacing the BIOS allows the manufacturer to execute code that can reset the keys. I can confirm/refute this optionwhen I get the new sygnal analyzer.
* Another option would be a combination of signals to activate a "programming mode", like i.e.put the two keys in the data bus and activate some control pins.
It also intrigates me that replacing the custom SH2 with a standard SH2, doesn't work. Was the BIOS properly decrypted? Are the control signals on the SH2 working in the same way?