I found out how to use a vendor-specific command to read the raw data from the buffer of the drive before descrambling and ECC. Look up the "FriiDump" project for some more background information. I then patched the firmware in memory (that took a lot of work...) to cause regular read commands to return the raw data.

(Contrary to some of the other comments in this thread, the drive was actually an LG.)