[SiriusHardware]

There's always the prospect of using NENIN to kick the SC/MP off the bus and then directly flood the RAM with code from something directly attached to the address, data and control lines and presumably isolated from them all by tristate buffers. When released again the SC/MP will try to resume where it left off even though the code it was executing may have vanished, so you'd probably need to assert Reset as well, to force predictable behaviour after loading of new code.

The 'keypad injection' method obviously only works when the OS is present and working as it literally types the code into the machine exactly the same way as a human operator does - but quite a bit faster - using the normal user interface provided by the OS.