Hey ericlewis - this is cool! Can I ask how you figured it out?! Doing this for my PO-33 was on my bucket list. I thought I might have to resort to voltage glitching to get a firmware dump, which is currently beyond my skills.