I was being careless today and called "SetTuningFlag" with no parameters. Managed to turn on factory menu and factory USB mode. PTP didn't work.
Factory Menu:
https://eggnog.danielc.dev/f/55-y740bxdh9ki5sa4zs91w6ack9nst3v.jpgTried a few things, didn't understand most of it.
Had to experiment in Qemu, and compared some ROM dumps. On my 1300D/T6 the flag is located at 0xfee60000+0x2c.
Default value is 0xFFFFFFFF, factory value is 0x0. Running `SetTuningFlag 0xFFFFFFFF`disabled the factory mode.
Or in Lua:
dryos.call("SetTuningFlag", 0xFFFFFFFF)