Primitive scanning.

Doesn't mask off the read/write bits, just tries start/addr/stop for a range of
addresses. Seems to work though.