Additionally I have found that the MCU reads or writes the EEPROM in this cases:
Switching Frequency from 10k to 100:
Read @0x0164: A5 5A
Read @0x0166: 16 DC 33 4D D2 FF 5B CE
Read @0x0578: A5 5A
Read @0x057A: 8F F3 A0 3D 02 36 AD 3E
Read @0x0964: A5 5A
Read @0x0966: D9 08 80 3F 36 FA C1 3A
Switching Frequency from 100 to 120:
Read @0x0196: A5 5A
Read @0x0198: 94 27 BA 4D 4F CA B2 CE
Read @0x05AA: A5 5A
Read @0x05AC: AB AD 92 3D 60 35 81 3E
Read @0x0996: A5 5A
Read @0x0998: 20 0C 80 3F 49 4D DC 3A
Switching Frequency from 120 to 1k:
Read @0x025E: A5 5A
Read @0x0260: 32 AF AA 49 0C 71 DF CC
Read @0x0672: A5 5A
Read @0x0674: 38 88 34 3D 75 DC E7 3C
Read @0x0A5E: A5 5A
Read @0x0A60: 85 08 80 3F 61 C4 3E 3C
Switching Frequency from 1k to 10k:
Read @0x0326: A5 5A
Read @0x0328: 3A 9D BF 49 9C 23 3A CB
Read @0x073A: A5 5A
Read @0x073C: C8 9A 21 3D 02 39 35 3C
Read @0x0B26: A5 5A
Read @0x0B28: 03 AB 7E 3F 8E 2B 33 3D
Exiting UTIL menu with Power-Up setting as Previous
Write @0x0040: A5
Write @0x0041: 5A
Write @0x0042: 00
Write @0x0043: 00 (Beep, 0: Off, 1: On)
Write @0x0044: 02 (Auto-Off, 0: off,1: 5min, 2: 15min, etc.)
Write @0x0045: 00
Write @0x0046: 00
Write @0x0047: 00
Exiting UTIL menu with Power-Up setting as "Set"
Write @0x0040: A5
Write @0x0041: 5A
Write @0x0042: 00
Write @0x0043: 00 (Beep, 0: Off, 1: On)
Write @0x0044: 02 (Auto-Off, 0: off,1: 5min, 2: 15min, etc.)
Write @0x0045: 00
Write @0x0046: 00
Write @0x0047: 00
(and then)
Write @0x0050: A5
Write @0x0051: 5A
Write @0x0052: 01 (Mode, 00: L, 01: C, 02: R, 03: Z)
Write @0x0053: 0E (Sec. Display, 11: Frequency, 0E: ESR, etc. )
Write @0x0054: 0B (Frecuency, 0B: 10kHz, 07: 1kHz, 03: 120Hz, 02: 100Hz)
Write @0x0055: 00
Write @0x0056: 00
Write @0x0057: 00
Write @0x0058: 00
Write @0x0059: 00
Write @0x005A: 00
Write @0x005B: 00
Write @0x005C: 00 (??, 00: L, 01: CRZ)
Write @0x005D: 00
Write @0x005E: 00
Write @0x005F: 00
Write @0x0060: 00
Write @0x0061: 00
Write @0x0062: 00
Write @0x0063: 00 (01: AUTO, 00: otherwise)
So we can see that the EEPROM address 0x0040 to 0x0047 are used to store settings from the UTIL menu, that 0x0050 to 0x0063 is for the power-on state, and that for each frequency selection a new set of data is read, maybe calibration data?
This also gives more sense to what's happening on power on:
1. Power ON with AUTO (1kHz) power-on state:
[1st Block]
Read @0x0000: A5 5A
Read @0x0030: 56 45 52 32 2E 31 2E 31 31 30 33 00 ("VER2.1.1103\0")
Read @0x0040: A5 5A
Read @0x0040: A5 5A 00 00 02 00 00 00 (Beep, Auto-Off settings and maybe something else)
Read @0x0050: A5 5A
Read @0x0050: A5 5A 02 0D 07 00 00 00 00 00 00 00 01 00 00 00 00 00 00 01 (20 bytes, Power-up state)
[2nd Block]
(5 ms later, no idea what this is yet but depends on the power-up frecuency)
Read @0x0272: A5 5A
Read @0x0274: AA 73 CF 4B 35 BA 1B 4C
Read @0x067C: A5 5A
Read @0x067E: C3 F0 D1 3A A9 E0 87 3A
Read @0x0A7C: A5 5A
Read @0x0A7E: 96 E5 7F 3F 82 8F AF 38
[3rd Block]
(60 ms later, Read the presumably 1kHz cal data)
Read @0x025E: A5 5A
Read @0x0260: 32 AF AA 49 0C 71 DF CC
Read @0x0672: A5 5A
Read @0x0674: 38 88 34 3D 75 DC E7 3C
Read @0x0A5E: A5 5A
Read @0x0A60: 85 08 80 3F 61 C4 3E 3C
2. Power ON with Inductance at 10kHz power-on state:
[1st Block]
Read @0x0000: A5 5A
Read @0x0030: 56 45 52 32 2E 31 2E 31 31 30 33 00 ("VER2.1.1103\0")
Read @0x0040: A5 5A
Read @0x0040: A5 5A 00 00 02 00 00 00 (Beep, Auto-Off settings and maybe something else)
Read @0x0050: A5 5A
Read @0x0050: A5 5A 00 11 0B 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 (20 bytes, Power-up state)
[2nd Block]
(5 ms later, no idea what this is yet but depends on the power-up frecuency)
Read @0x033A: A5 5A
Read @0x033C: 73 B6 27 CA 00 EE 32 CB
Read @0x0744: A5 5A
Read @0x0746: A2 57 CA BA B6 DC 1C BA
Read @0x0B44: A5 5A
Read @0x0B46: 12 D9 7F 3F 03 6B A4 3A
[3rd Block]
(60 ms later, Read the presumably 10kHz cal data)
Read @0x0326: A5 5A
Read @0x0328: 3A 9D BF 49 9C 23 3A CB
Read @0x073A: A5 5A
Read @0x073C: C8 9A 21 3D 02 39 35 3C
Read @0x0B26: A5 5A
Read @0x0B28: 03 AB 7E 3F 8E 2B 33 3D
The 3rd block depends on the power-up frequency and is the same data that is read when changing frequency on the fly. No problem with this.
What's strange is that the 2nd block also depends on the power-up frequency and in fact is near the presumable cal data for that frecuency, but when changing frequency it is not read again, just on power-on. This may be a cal complement, but strangely is not read when changing frequencies.
Other strange thing is that in reagle's case, the 0x0050 read was 0xFF 0xFF and in my case are 20 bytes with the power-up state.
The most interesting part so far is the EEPROM Address 0x0054 which determines the power-up frecuency, so far I know the values for 100Hz, 120Hz, 1kHz and 10kHz (0x0B: 10kHz, 0x07: 1kHz, 0x03: 120Hz, 0x02: 100Hz) and taking into account that from 120Hz it's ascending by 4, 100kHz must be 0x0F
Next Step: Write 0x0F at address 0x0054 on EEPROM, power on, sniff all the way and watch what happens.