Well, I used STEem debug after the program loaded. In the boiler room window there's a box to change the screen address. The good side effect is that this shows you immediately what's going on in that part of memory. Then, after locating the tiles (the sprites were a bit garbled right after the tiles), I dumped the to a file (using a memory window). I got the palette by opening a memory window at $ff8240 (hardware registers that have the palette data). Then I used a custom GFA program to unscramble the sprites. Of course one could use crackart for this, so in the end it requires no programming skills at all :).

I think I'll write a small tutorial about this (I can't today, I'm a bit busy).