so the work by @tnt was about scanning through the voltages and counting how many firmware reads were made before it crashed. Then we could pick a value in the middle of the range and use some hand coded ASM to setup the IOs