I want to send custom values on CAN 280, so Is enought only to change here variables with one I want ( I don't care about conversion factor)
This to me look like CAN-bus data, am I on right trace?

actually, i had a similar challenge. You can find informations here:
http://nefariousmotorsports.com/forum/index.php?;topic=21150.0

It was only modifying a value which already exists. adding another one
is a little bit different task, but very similar.

But every ME7 bin I open have CW_CAN_S is set to FF

Thank you all for your help

you can inject up to 255 variables there using those two as id and data bytes
its pretty simple routine

Nice idea  will try that
Is it possible to send DTC over CAN, to make them like on BMW 0-255
Or to ask better question, is DTC stored somewhere in flash?
From my founding  ME7 use B_xxx to set some error flag  than store that in EEPROM?
Soo first method will be to send error flags to CAN
Second will be to read eeprom data where dtc are saved and send them over can

26 vars is also fine (thanks fknbrkn) in ColorMFA

ROM:854B7E A8 50                             mov     r5, [r0]
ROM:854B80 1A F5 20 20                       bfldh   r5, #DTCBit_H5, #DTCBit_H5
ROM:854B84 B8 50                             mov     [r0], r5
ROM:854B86 0D 10                             jmpr    cc_UC, loc_854BA8
ROM:854B88                   ; ---------------------------------------------------------------------------
ROM:854B88
ROM:854B88                   loc_854B88:                             ; CODE XREF: DFPM_DLSU_DiagnoseLambdaSondeBeforeKAT_sub_85448A+6DAj
ROM:854B88 F2 F4 40 9C                       mov     r4, word_381C40
ROM:854B8C 9A F4 0C E0                       jnb     r4.14, loc_854BA8
ROM:854B90 A8 50                             mov     r5, [r0]
ROM:854B92 0A F5 01 01                       bfldl   r5, #DTCBit_L0, #DTCBit_L0
ROM:854B96 B8 50                             mov     [r0], r5
ROM:854B98 A8 20                             mov     r2, [r0]
ROM:854B9A 0A F2 02 02                       bfldl   r2, #DTCBit_L1, #DTCBit_L1
ROM:854B9E B8 20                             mov     [r0], r2
ROM:854BA0 A8 50                             mov     r5, [r0]
ROM:854BA2 1A F5 20 20                       bfldh   r5, #DTCBit_H5, #DTCBit_H5
ROM:854BA6 B8 50                             mov     [r0], r5
ROM:854BA8
ROM:854BA8                   loc_854BA8:                             ; CODE XREF: DFPM_DLSU_DiagnoseLambdaSondeBeforeKAT_sub_85448A+58j
ROM:854BA8                                                           ; DFPM_DLSU_DiagnoseLambdaSondeBeforeKAT_sub_85448A+6FCj ...
ROM:854BA8 A8 40                             mov     r4, [r0]
ROM:854BAA 88 40                             mov     [-r0], r4
ROM:854BAC E6 FC 65 00                       mov     r12, #65h ; 'e' ; errorNo. #65h
ROM:854BAC                                                           ; 65+<START_CLAAAA>81083F=8108A4
ROM:854BAC                                                           ; CLALATV (P1176, P0133, P0130)
ROM:854BB0 DA 84 DC 66                       calls   84h, SetDTCME75_8466dc ; Sets the Diagnostic Trouble Code
ROM:854BB0                                                           ; r12 = ErrorCode
ROM:854BB4 08 04                             add     r0, #4
ROM:854BB6 98 60                             mov     r6, [r0+]
ROM:854BB8 98 70                             mov     r7, [r0+]
ROM:854BBA 98 90                             mov     r9, [r0+]
ROM:854BBC DB 00                             rets
ROM:854BBC                   ; End of function DFPM_DLSU_DiagnoseLambdaSondeBeforeKAT_sub_85448A
ROM:854BBC

there is a DTC table that is referenced in code with an offset for each DTC, like in the example above. Try to id this code in your file!
This was discussed in Nefmoto, you just need to find it!


edit:
this
http://nefariousmotorsports.com/forum/index.php?topic=10018.0