Unfortunately this weekend is booked and don't have much time to work on this. But I did make some progress.
Pulled the sat tuner and got all the taps put in. (You could cut and splice the harness but I wanted the option to make everything look factory if I had to take it in for service someday.)
Wires you need to tap
+12V middle connector T8b pin 2 red with yellow stripe
GND middle connector T8b pin 1 brown
CanL left connector T8a pin 1 orange with brown stripe
CanH left connector T8a pin 2 orange with lilac (purple) stripe
T8a pin one is on the left looking into the connector on the radio.
For those who care they use a TDA8579 op amp driver on the audio and a TJA1054 on the CAN bus.
Ok to get the bugger out slide the seat all the way back and pull out your floor mat.
Next lift up on the two tabs on the back edge of the plastic cover then slide it towards the front of the car.
Now there are 3 or 4 nuts AND BOLTS holding the radio to the silver plate. you can easily remove them with out removing the plate. The trick is getting them back in. I was able to get 2 out of the 3 on mine in without removing the plate. (the carpet holds the nuts in position and you can get them tight that way.) I knocked one of the rear ones out of alignment so had to pull the silver plate in the end.
Next take out all the screws you see. Case just comes apart without cutting any warranty stickers (none on it that I could find)
Backside view. The black wire on left is CANL the red is CANH. The black on right is gnd the red is +12V
All buttoned back up. Had to trim the edge of the box with a dremel to make space for the wires to come out.
Radio and adapter all wired up.
And everything back in the car.
Next weekend I hope to get some basic code running and snoop a few packets.