I've been working on this for some time already, so the first project log is going to be retroactive.
There's a sort of programming connector in the battery bay of Smart Response XE, but it requires spring loaded pogo pins, which I didn't have when the devices arrived, so I opened one up - inside there's dedicated spot for a standard 6 pin ISP connector, which I also didn't have, but I improvised something out of angled goldpins.
Note, the vcc pin in the connector is at 3.3V when powered up, so I'm not sure it it's safe to connect any external power to it, instead I'm powering the device from batteries.
First accessing the device, I found the lock byte set to 0xcc: so, no reading the program or eeprom, quite reasonable if disappointing.
Then I flashed SMART Response XE Tiny Basic Port [By DanGeiger]. And it worked right away. This much couldn't be said about my own code. But after some reverse engineering here and there, discovering some of the misconceptions I had had about avr-gcc and cutting out a bunch of barely-correct code for potentially awesome yet completely unnecessary functionality, I managed to get it working. Some revisions later I have a bare-minimum working version: screen works, keyboard basically works, the edited text can be saved in (and read from) the included flash chip, giving 128kb of storage, oh, and long press on power key powers it down.
I gave it a try and quickly realized the bare-minimum is not enough, so next up: tune the keyboard handling for a better writing experience. Then I'll work on the other milestones, like data export and more advanced handling of flash storage.