Since posting this I have discovered a .wbf file dump utility:
https://github.com/julbouln/ice40_ei...utils/wbf_dump
This guy implemented a basic EPD controller in an FPGA and was apparently able to extract waveforms from the file. I tried it on one of my wbf files and it prints a bunch of waveforms then segfaults, so obviously a work in progress. I haven't had time to dig much deeper though.
One question I have is what makes the "regal" technology different from the older "direct update" (non-flashing) waveforms? Is regal merely a more-refined version, calibrated at different temperatures, etc.? Or is there some qualitative difference between the two, like storing the history of a pixel and using that to dynamically alter the waveform?