Surely the first step should have been to attach a logic analyzer to the cartridge in circuit? For all we know, it might be using a well-known protocol like SDIO...
The part number on the IC, after some contrast enhancements, appears to be MX28K128GL0 --- not a publicly documented Macronix part number, but may be related to the 28F128, a common 16MB (128Mb) NOR flash.
