If you don't know the register then this is likely to be very difficult.
I found a terminal emulator that would automatically work out checksums, which allowed me to manually type modbus commands, you could try a brute-force approach to work out which registers return a non-error result, then try to work out which is position.
Unfortunately I am away from that PC at the moment and can't remember what I used. I might be able to find out tomorrow.
There may be existing software out there that will poll all register addresses looking for replies.
