Instead of WinOLS add A2L import.

IDA sample posted here:
http://nefariousmotorsports.com/forum/index.php?topic=13749.0title=

A2L actually has the useful stuff. And a huge amount of A2L's for MED9 float around online as well.

It's not going to work in car though. Gateway will filter the message.
And either way it's not the way, just modify KWP stack and add a function to some existing service.

Okay well, this is a good example of the XY problem.

You can not write to the flash when the ECU is running.
That's not how flash memory works.

First of all, Flash memory works based on pages. You can only erase an entire page.
Furthermore, while you are programming/erasing the flash, the majority of microcontrollers do not allow executing from it.

So no, you can't just magically send a write command to the flash. While the ECU is running.
The only way is to redirect the flash reads to RAM (and then write RAM), this can be done on code level e.g. Bosch MEDC17 or it can be done on processor level (Overlay functionality).
On MED9 it was done by adding extra hardware (ETK) and remapping the SDA (iirc) accesses there.

If you want to do it without extra hardware, then you have very limited RAM to work with, so you can't just remap the whole calibration area.
It means for every single map and/or parameter that you want to alter that way you need to write extra code to do so.

There is something older called "verstellsystem", which has conveniently placed intercept points in many functions that allow to alter the basic outputs of the ECU at given operating points.
E.g. a flat offset to injection time, or timing or a fixed WGDC.
These can be used on a dyno - you can monitor the current ECU operating conditions and feed a constant custom overlay over the current parameters.
Does not work if you make very fast and sudden changes in operating conditions, but works well enough to tune in steady state or on pulls with a relatively low ramp rate.

not unless the watchdog timeout is taken care of
Also JTAG is usually password protected, not sure if it is on MED9

hey, im having some trouble using your json maps stuff... when I use it, some areas of the bin get defined as "db" and gets skipped when I try to decompile. to be fair i cant even decompile the bin properly, tried selecting several powerpc options and the best i got was considering VLE, but i dont think its accurate. can you give me some pointers? attaching the bin just in case. its a med9.1.1 (mpc563).

thanks in advance

thanks for the info, i tried it from reading it was implemented in mpc56x somewhere. still, weirdly that dissembled more of the file than the regular ppc big 32 option 

i got r2 and r13 from basano, and tried using his addresses for ram/rom, at first, but it didnt work.

also got a memory map from an actual mpc563 full of other addresses, and it still wont work. attaching it here in case it helps someone.

unfortunately i never got the damos for my bin, but i have a full mappack which i used to generate a json and use with your tool. but it ends up turning some undefined symbols into "db" and ghidra just skips it. I even tried setting r2 and r13 without your tool (so that id still keep the bin at 0x0 instead of moving to 0x00400000), plus reinserting the bin again (starting at 0x1c0000) into 0x5c0000, but still got nothing.