The remotes I reverse-engineered were universal ones with generic MCUs, so their datasheets weren't useful: Skylink model 69 with an EM78P468N, and Skylink model 39 with an HT48R30A-1.
A bit of a shame that they used an MCU instead of an encoder/decoder ASIC, since they could've implemented something better. The fixed-code remotes I've seen use a standard IC like an HT12E.
If those weren't OTP/mask ROM, reflashing them with a different firmware (maybe even a simple rolling code?) could be an interesting exercise...
