I spent some time looking at the DB9 protocol and it wasn't obvious what was going on and couldn't get it to do anything except say connection unavailable so I hooked up a WIU-TIU via a USB-to-DB9 cable (FTDI chip inside) and looked at all the exchanges going on. Once you had that it was easy.
So first there's an authentication step where you say H5, the TIU gives you a hex string, and some tippy top secret code in the WIU manipulates that string and produces a new string. The WIU gives that back with an H6 command, and the TIU then says "okay you're legit" and lets you in.
The trick is once that happens the pink light on the WIU turns on, and the authentication only happens once, so you can just swap the DB9 to your own host once it authenticates.
From there the commands to configure the TIU settings are pretty basic
and the commands to do the addresses setting is also super straight forward
My next plans to get me where I want to be
Plan A: I've made a program that records H5/H6 pairs by breaking the USB connection on the WIU over and over so I will record a few 10000, and run them through a K-map solver to see if I can work out the encode:decode relationship. Lets call this the [SanDiegoMark solution].
Plan B: Since our club has WIUs anyways, I'll draw up a little microcontroller PCB with a photosensor. It will detect the pink light on the WIU so it knows when the TIU port is authenticated, then the relay will snap TXD/RXD off the WIU and onto my microcontroller to do my bidding. Let's call this the [gunrunnerjohn solution].
