Just took my 3 week old 9400 apart to find the tracks:) - couldn't resist it now. The CPU is a freescale MC9328MX21. More info on the chip here [Link: freescale.com].
Its an ARM 9 achitecture. The good thing is that there is a JTAG interface for debugging.
Now just to get them out.
If you remove the label at the rear of the unit, there are two embedded pins. Me guess is that they are the TDO and TCK line from the chip, but seeing that this is a BGA chip it's going to take a little longer to trace back to the chip:( I also suspect that one of the charge pins is multiplexed with the JTAG TTRST line.

THe connector between the PCB and the charge pins is actually made up of nine strands. 3 to +, 3 to ground, one charge control and the two others to the embedded pins. I suspect that the charge control is muxed with one of the JTAG pins.

I will try and do a little more at our workshops tomorrow.