This image shows the flash chip in the upper right.  The memory chip is shown on the lower left and the two PAL chips appear on the lower right.

As the flash chip holds the main program of the terminal, I needed to find some way to obtain the contents.  Removing the chip itself and reading it in a programmer was an option, but risky and requiring tools I do not have.  Removing it would also leave me with the task of soldering the chip back into place.

I realized that the device itself was programmable, and, thus, must hold some code inside to reprogram the flash.  I needed to target that procedure.  First, I would need to obtain the protocol to initiate and complete the reprogramming.

Verifone documents the button sequence required to access the local operating system and program one device from another, but not the transfer protocol used between the devices.

I would need the assistance of another tool to obtain the current running code and view what was happening within the device in order to make further progress.

Fortunately, I had just purchased cables and pods for my logic analyzer, which was to be of significant assistance in this entire process.

As demonstrated at VCFMW 9.0, this is the Verifone Omni 396 credit card terminal running CP/M.

After reading about Mozart’s Credit Card, I thought that a credit card terminal would make an excellent platform to use for doing something unusual or interesting.   At the time, I didn’t realize how much I would learn while exploring this device.

I started by examining the various credit card terminals available.   Fortunately, many of the sellers list the processors, memory sizes, and capabilities on their web pages.  I have written software for the Z80 many times in the past, and it was used in Verifone’s Tranz line.  A bit more digging and I found this website, which shows the internals of the Omni 395.

The Omni 395 has a Z180 CPU, 512K of memory, 128K of Flash, two RS-232 ports, and a PIN Pad/barcode port.  Like the Tranz 330 used in Mozart’s Credit Card, it had what appeared to be a socketed flash chip, and looked easy to decipher and reprogram.

Looking at images of the outside of the Omni 396, it didn’t look too different.  It still had the same Z180, 512K SRAM (battery backed,) 128K of Flash, and ports on the back.  Given that there was only a small difference in the model numbers, I felt that the components inside should be similar.   As a result, I purchased one and waited for it to arrive.

The first thing I did was to open it up.  I took one look and my heart sunk.  Unlike the Tranz 330, the Omni 396 had surface mount flash with very tiny pins instead of a socketed EPROM or flash chip.

 Obviously, this posed a slightly greater challenge than I had anticipated!