I've been out of pocket....but here I is.
So, what I've managed to figure out with a little help from another person. This works on my 2009....I think 2007.5-2009 are the same. I have no idea if it applies to any other year model. It's not as easy as sending a two digit code.
The ECM address is 0x000007E0. Any response will be that address plus 8 so the responses come from 0x000007E8. You will need to put the ECM into "diagnostic" mode by sending it a string of bits. Then you will request the blocks of data you want. The messages to and from the ECM will be 8 bytes consisting of 8 bits each. The RPM is located byte 6 and 7 from the PID 0x21 located in block 22.
That is the one paragraph response....so chew on that for a while and see if it gets you anywere.
My problem is that I can't seem to get the timing down. I know exactly what my tuner is sending and what comes back....but I just can't make it respond to requests that I send. Basically all I'm doing it parsing out the data captured from the bus as it goes past my display to the programmer. The programmer is doing all the requests, I just know where all the data is buried in all the packets.