There may be a serial port internally between the GPS IC and another IC which handles the transactions to the CF slot. I saw a hack somewhere that successfully extracted serial NMEA data by tapping that line.