I got the algorithm from here:
https://github.com/andrewraharjo/CAN...i/FordStuff.py I didn't post it earlier, because I figured it was pretty easy to find. I have already posted two 5-byte seed-keys for the FG2 Cluster (level 1 to flash, level 3 to configure).
You're right though, about firmware checksums, that's going to be tough since no-one has the boot-loader firmware (first 72KB of flash inside this cluster). But I have already extracted the update-able part from the Ford file.
The EEPROM is mapped into (well, copied into and written back as needed) the V850 chip's RAM, that's how I've been able to find out what some of it does. I'm using Ghidra to decompile the firmware to C (and assembler, but I rarely have to look at that). I have not attempted a read-by-address for a few weeks, so my memory is hazy, but it only rarely yielded sensible data. I did try a number of "styles" too, without any real luck.
I'm not sure you can assume the
PCM (and its well defined behaviour over OBD) translates to the instrument cluster, which I believe has been locked down a little more (if only by obscurity, but more likely lack of functionality).
Thanks for the offer of help though. To be honest, the list of things I want to do to this unit is very short now, and I'm not sure modifying the firmware is going to be needed. Time will tell.