I think that removing read lock will require disassembly of the FW. I've programmed in assembly only a few times, on a Sparc processor (not on any of these burner chipsets), and I've never disassembled anything before (okay, I've tried once to disassemble the LiteOn firmware using a 8051 disassembler, but haven't had any success yet). So I'll leave something like this to the people in the community who have had more disassembly experience.
Address 0xC0000 to 0xCFFFF contains all of the +R/W data.
Address 0xD0000 to 0xDFFFF contains all of the -R/W stuff.
In the +R/W section, there's a header, there's a list of media codes and their speedcodes, and immediately after that are 4 tables with +R data, after that are a few tables with +RW data, and after that, there's stuff that I can't decipher, plus a few more +R and +RW tables.
FYI, there are a total of 89 +R/W codes (this includes the blank & junk codes, which you don't see because they're filtered by my program). Of these, the first 62 are +R (there's a blank code at the beginning), the next 27 are +RW. The first table +R table, for example, is 496 bytes long (62 x 8).