I have a python script I made, used it to find all the nodes in my truck. It basically keeps changing the header and asking for the cal id. Here's the responses I got over J1850 using an elm. I used GM TIS and was able to match them after
Module - Calibration
Powertrain Control Module (PCM) Vehicle Control Module (VCM) 15189044
Transmission Control Module (TCM) 15184109
Active Transfer Case Module (ATC) 15057951
Truck Body Control Module (TBC) 9371766
Instrument Panel Cluster (IPC) 15124091
OnStar Module (ONS) 15184771
Front HVAC Module (FHVAC) 15185570
Driver Door Module (DDM) 8993390
Passenger Door Module (PDM) 8993391
You need to find the pinout for the IPC you have, locate the Ground, 12V, IGN, and J1850. Get a female J1962 connector and pins for it. A 12v power supply (old desktop power supply works). Wire everything up.
Heres what you need to do to talk to your IPC, get a elm and connect to it, open a serial connection, enter the line below.
AT SH 6C 60 F1
Now you are talking to the IPC, maybe make sure your IPC is the same address as mine, send command below and you should get a response. (The response is the OSID)
Once you have it working I'm not sure how your gonna reverse engineer anything? I seen some youtube videos before that show all the gauges moving, like a demo mode. The guy was selling them gauge kits and he shows everything moving and the dash is out of the car. If you could find out how he did it and listen on the bus while that's happening then you would have a chance at finding the info you need without it in vehicle. I need to get my hands on a spare IPC to play more. I'm interested in more info myself, I'd like to dump the IPC flash maybe get some info like that.