Funny you should mention this - I'm currently working my way through the ST10's firmware....
I extracted this and have run a very basic pass through IDApro.
I've a boosted 380 and need to change a lot of stuff in the original code to get the most out of the existing hardware.
I'm sure there's some folks here who'll be able to assist with getting the DPP's, offsets and 2nd binary area (0x80000) correct.
If someone could assistist in working out a checksum calculator, that'd be a great help.
Biggest hurdle is time, I'm probably several hundred hours into drafting a realtime tuning solution.
I do have some 1 off specific hardware tools that I use, emulators, programmers and such.
I've managed to find a lot of the maps in the binary file, but yet to get into DTC's and O2's.
It's really a complex RTOS with many checksums (initial and realtime).
One area of interest is around 0x15EFA and it many function calls.
First thing is to understand how the RTOS functions and how the realtime calls are done.
I'm sure there a supervisor type arrangement, yet to be fully understood.
I'm not new to chiptuning by any means, having designed several rom daughter boards for 'untunable' variants.
But this is a lot more technical.
I've attached the ST10F275 extracted binary if you or anyone on here wants a challenge of a brand new ROM to pull apart,
but you've gotta tell us what you're finding.
I kinda have the feeling things are about to get a lot more fun with these..!