All of what follows is based on my PhotoMax, which is labeled rev 012. You can see my notes on what I've found so far, including the jumper connector pinouts (including serial port), LCD controller connections, and chip select pins for the memory banks.
I have found a way to put the frame's CPU into a debugging mode where you can upload 2Kb of StrongARM code to it through the serial port, and it will execute. Eventually, this will allow the flash code on the chip to be rewritten with Linux, but for now I'm just uploading small test code to try and figure out the details of the LCD controller connections.
To get a serial connection, you'll need a serial transceiver chip such as the Maxim MAX233 to convert the 0 to 5V that the CPU uses to -10 to +10V needed for a computer serial port. The serial pins to the CPU are on J5. Calling the bottom left pin 1, and proceeding counter-clockwise, pin 2 is the serial transmit, pin 3 is ground, and pin 10 is receive.
To enable the BootROM mode (see the EP7212 datasheet) short the two pins of J10 and then plug in the power to the board. Set your serial port to 9600 8N1. When the frame is turned on, the frame should send a '<' character. The frame is now expecting 2KB of StrongARM code. When the 2KB are received, the frame will send a '>' character and then execute the code. For a test program, try this one, it should just print Hello World!!! back to the serial port.
Thanks to LinuxFund.org's donation of Ceiva's to work with, there is now another person working on the Epson SED1355 Framebuffer driver for the Ceiva. Now if only I could find 3 more people who want a free Ceiva...