Ok that's amazing, never knew that a mac could do that.
as for how the TechStep does enable the troubleshooting mode, that could be as easy as just sending "HELLOMACIMTECHSTEP" to one of the serial ports, since it has to communicate with the ROM anyway, everything an be done softwarematically.