to that ssh/x11 forwarding stuff:
These Players do not seem to be running X11, ssh or anything that would be useful for this.
I think the DvdPlayer binary is directly accessing the framebuffer.
At least this is true for my Me2 1000s.
Is it possible on your box to login via telnet? (username: root)
If yes, post here or send via PM, a dump of "dmesg" and "uname -a", "ps ax" (or simply "ps" if it doesn't work) this should give some clues. Also interessting would be the version of BusyBox (shown directly after login).
If you are currious you can try to disassembleit and look at the chip. But you will probably lose your warrenty.
If you are a bit familiar with linux add all stuff you think which is useful. (such as "mount")
Maybe it is possible to invoke a command (e.g.: to play music) to "DvdPlayer" directly via telnet.
NOTE: "DvdPlayer" is the name of the binary which runs the menu at my box. Maybe at yours it is another binary ("ps" should report that)