A couple of handy tools are:
IDA - Interactive Disassembler
This program is a very powerful disassembler for multiple platforms that will disect your machine code and try to generate readable assembler code. It requires some knowledge of 8052 architecture, machine language and assembler. Once you get the hang of it it really cracks down and does an awesome job.
8052 Simulator
Nice freeware to simulate the 8052 CPU. I have been able to run the 964 code of the EPROM on this simulator. While this is very neat it still requires some more detailed information to map the processor inputs and outputs to specific functions. You need hardware diagrams to tie it all together. Fun to play with and nice to better understand how 8052 assembler language works. It has a very rudimentary disassembler built in and you can step through the code.
Carrera Motronic Analyzer and Tuner v1.0
This was written a while back for the Carrera Motronic and has some neat features to locate and identify fuel and timing maps [idle, WOT, 2D). It even plots them. You can customize some par files to make it understand the 964 and later chips. I don't know if it ever got developed any further. Some of the information out there for the older Motronic still apply to the 964 and 993. However, the newer version 5.1 is much more complex compared to the version 3.
It seems that code for the 964 runs on more than one CPU. The EPROM that you read out contains the maps and some part of the Bosch Motronic code. But once you crunch it with the disassembler it becomes obvious that there most be more code elsewhere. And inside the Motronic there are I believe three chips (one EPROM and two 8052 CPU derivatives) with quartz windows or Bosch stickers. These CPU's have their own EPROM or PROM. So there seems to be code on one or both chips. To really understand you need to read out those chips as well, figure where in the address space each of the three chips are mapped, and where the memory is mapped. So I would guess you almost need to sacrifice one Motronic to create that information. For this you really need special tools such as logic analyzers and such.
I am sure that some tuners have done all this but are very reluctant to give it up since it is their "IP" and justification to charge a lot of money for their products. I doubt that this info is easy to come by. But you never know, it does not hurt to ask. Often times you see contributions from Russia and other eastern European countries on these subject. This seems to be a hotbed for reverse-engineering engine management systems.
If you get lucky and get ahold of old Bosch documents you might find all this in there. Let us know what you come up with and have fun. One can spend a lot of time on this, ask me how I know.....
I wouldn't be too concerned about the legal aspects unless you plan to launch a big commercial offensive on reverse-engineered products. As long as you do this for your own purpose it should be O.K. Have fun,
Ingo