Trying to dump Yamaha SKW-01

Unfortunately, I can't download it from URL.
(I want to downloiad it.)

Kanji ROM for Yamaha SKW-01 seems to be different I/O from MSX's Kanji

In order for the Kanjii ROM to be dumped, it is necessary to analyze the program ROM. This is because it is currently unknown which I/O port it goes through.
(Unfortunately I can't analyze it.)

However the part number next to the chip in the CX-5M does indicate it is a 32kB ROM. So I guess it is just the data bus going through these ROMs.

The best tool to dump roms and cartridges is Power Chupim.
Have you tried that ?

I'd be happy to drop it into a Git repo with some basic disassembly framework and and get it started. Assuming this is a standard ROM starting at $4000 and/or $8000, with a standard header, it's probably a couple of hours work to reverse-engineer the header, the startup code for the `CALL JWP` program, and get some idea of what parts are code and what parts are data. It's hard to see how much further I might get beyond that, but at least it will be left in a state where others can easily carry on with the work if they want.

Unfortunately, I don't have access to the ROM dump; all I get when I click that link (after enabling cookies for that site) is an Apple Cloud login screen. (I have no account, nor do I care to set one up). Maybe someone else can grab it (if it's even still there) and make it available in a more public way?

There's a CX5F with this cart installed up for auction now on Yahoo auctions, and I have a bid in for it, but I'm not interested enough to pay more than a few thousand yen for it (including the thousand yen or so the seller will charge me for shipping). If I get it I can re-dump the program ROM and I'll have a unit to test, otherwise testing (and a re-dump, if the first one is lost) will be on whomever has one.

I was taking a quick look yesterday morning: https://gist.github.com/theNestruo/c18e9c02b277925cd8f5b5666...
(please be aware this disassembly untrustworthy, as I have been manually merging several disassembly iterations).

Despite the preliminar state of the disassembly, I have already found several suspicious writes and reads to addresses that would be ROM in a regular cartridge, all of the in the range $7fc0-$f7fcf:

; Written in L407D: point hl to $7fc0 + [$f125] (0..3?)
; then write [hl++] = e, [hl--] = d
; then wait until bit 0 of [hl], read twice, is nz
; then read a from [++hl]
L7FC0:
;               writes e        writes d
;               reads bit 0     reads a
        DB      00h,            0FFh
        DB      00h,            0FFh
        DB      00h,            0FFh
        DB      00h,            0FFh

; Written in L409A and L40A6: l (low byte of hl)
L7FC8:  DB      0FFh

; Written in L409A and L40A6: h (high byte of hl)
L7FC9:  DB      0FFh

; Read in L409A: a
; Written in L40A6: a
L7FCA:  DB      0B1h

L7FCB:  DB      0B1h

; Written in L7D89, called from L7F21, called from L405D (H.LPTO hook):
; - Sends $00 then $ff to $7fcc
; Read in L7DBA ("Returns the bit 3 of $7fcc as $00 (=1) or $ff (=0)")
L7FCC:  DB      0FFh

L7FCD:  DB      0FFh

; Written in L7D89, called from L7F21, called from L405D (H.LPTO hook): a
L7FCE:  DB      0FFh

L7FCF:  DB      0FFh

No idea about what they do, though :D