Sure - as a disclaimer I'm not an electrician or anything, probably incorrect terminology and bad practices below... This is at least my understanding of what's going on and the mod worked for me with no side effects. The attached pdf walks through the FSM wiring diagram with the modifications then some pictures of where I tapped into the lines - you can tap into them wherever makes sense to you.
You're gonna want a SPDT "up" relay, and a DPST-NO "down" relay (I used two SPST-NO's for the "down" relay since that's what I had, and just jumped their power and GND's together so that they'd be tripped in parallel). You're also going to want an on-off-on switch as your in-the-car "window" switch. And some t-taps and straight connectors.
I used 18-gauge wire and this switch and relays:
Amazon.com: uxcell JD-1914 5 Pin DC 12V 40A Universal Car Vehicle Motor Fuse Relay Switch Power with Harness : Automotive
Amazon.com: EHDIS Car Relay 4 Pin 12v 40amp Spst Model No.: JD2912-1H-12VDC 40A 14VDC, Auto Switches & Starters,Pack of 2 : Everything Else
mxuteuk 5pcs Snap-in Round Momentary Rocker Switch Toggle Power SPDT (ON)-Off-(ON) Switch 3 Pin AC 250V 6A 125V 10A, Use for Car Auto Boat Household Appliances 1 Years Warranty MXU1-5-123: Amazon.com: Industrial & Scientific
I mounted the relays underneath the left window guide rail, sort of wedged under there with some cushioning material so that they're out of the way and don't vibrate. Drilled a few holes through the sheet metal and routed zip ties thru the relay tabs to mount in place - I'm sure there's a better way to do this.
Tap into the big blue "power" line going into the the ECU (marked 3) and route this to your switch. Route wires from the "up" and "down" terminals of the switch to the coils of their respective relays. The other ends of the coils should be routed to GND.
Tap into the key cylinder's G/R "up" (marked 4) and G/Y "down" (marked 5) lines and route to the normally-open poles of their respective relays, with the opposite ends of the poles going to GND. Since a lot of the relay poles are GND, just jump them all together, and tap just one spot into the GND line going into the ECU - I tapped into the GND line coming out of the key cylinder (marked 6) just because I already had it there from the OP mod.
You'll need to break the GND line going from the unlock detection switch to the ECU and route that GND line (marked 1) thru one of the NC poles of the "up" relay (the other pole connected to actual GND). Then tap into the B/K line (marked 2) going from the unlock detection switch to the ECU and route that to one of the NO poles of the "down" relay.
And that's pretty much it. Hopefully the diagram and pictures are straightforward.
The way it works, when the switch is neutral there is no power flowing to either relay, so they are in their normal state - the re-routed unlock detection switch's GND wire is connected to actual GND (so this switch functions as if you never broke that wire), the "up" and "down" lines aren't connected to GND (just like they wouldn't be otherwise), and the unlock detection signal wire isn't connected to ground (so no intentional "unlock" signal here). Everything functions as if there were no mod.
When you press "up" on the switch, you supply the ~9V from the ECU "power" line to the "up" relay, breaking the unlock detection GND to actual GND connection (ECU think's switch is open and trunk is locked, even if actual detection switch is closed) and connect "up" from the key cylinder to GND (telling the ECU to roll up the window). Once switch is released, relay deactivates and everything reverts to neutral state.
When you press "down" on the switch, you power the "down" relay, shorting/bypassing the unlock detection switch connecting the signal to GND (telling the ECU the trunk is unlocked, even if the actual detection switch is open) and "down" from the key cylinder to GND (telling the ECU to roll down the window). And then this reverts once the switch is released.