Hello,
1 & 2. Yes, I have the firmware files, unencrypyed. Turbo Studio use encrypted firmware files. I’ve managed to reconstruct the firmware from the CAN messages logged during an update. But R5f2134 has a bootloader that won’t change when updating the firmware. So I don’t have a bootloader dump. In other words, you can’t replace this MCU and make it work on a Specialized BMS by writing above mentioned firmware dump.
3. Indeed, eeprom keeps a mirror of some portions of Dataflash inside Renesas MCU. There’s no point modifying eeprom data as it will be overwritten by copy from dataflash as soon as the system boots. Also, there are checksums on data segments.
If you like, you can send only the BMS boards and I can check/repair/unlock as needed.