Without benefit of notes - here it is from memory-

I worked it out with a VOM, and from studying the continuity of the connections at the remote sensor cord, with the sensor plugged in and also removed.

Two (of the four I am recalling) of the contacts are the send and receive for allowing a hot shoe or PC socket connection made at the far end of the remote sensor cord to trigger the flash.

One of them shows up as a short circuit using the ohm meter with the flash turned off, between it and the flashes' shoe return contact.

The other of the four connection terminals for the sensor turns up at the same potential between center post contact on the hot shoe to edge connection.

On the auto sensor the pair for flash send and recieve are shorted - zero ohms. You can confirm this by trying to fire the flash with the sensor pulled - it won't.

The remaining two terminals on the remote sensor place different resistances across the terminals to vary the light output.

The resistance between the normal sensor pair of terminals will be quite high when the sesnor eye is taped over and then will fall when pointed at a bright light source.

Changing the ND filter by rotating the barrel changes the amount of light that gets at the sensor, hence the amount of resistance it presents to the flash duration circuitry inside the flash.

So finding the resistance terminal pair should not be too hard.

I think I used a 250K linear pot; there was a useless portion on the rotoation where the resisitance was too high. You may want to try a potentiometer with a lower resistance; I don't know how much less though.

Happy experimenting.