I have the same question related to the VZ10m.
Furthermore, the MCU could have some of the firmware stored in its internal memory. In such a case, we won’t get the full firmware easily...
Just to follow up on the original post, I've had a look at the EPROM inside the VZ-8M and unfortunately it's soldered directly to the PCB (rather than in a DIP socket) which obviously makes removing it to dump its contents using a chip reader a rather messy job.If anyone knows how to read these DIP28 chips without desoldering I'm happy to do it but it does explain why the firmware isn't easy to find online.Chip is an NEC D27C1001D-15 with a M302 sticker over the crystal.