Unlocking Programmable Logic Controllers' Hidden Capabilities