The Verifone Omni 396 uses a protocol similar to the one used by the Tranz 330, XL, and 420 terminals to transfer a new operating system from one device to another.  The Tranz 330 protocol is documented in the TCLOAD reference manual.

The printer port is used to communicate with a host system or terminal.  The transfer rate is configured at 19200, 8N1, with no handshake.

The general packet format is defined as:

<0x02> packet data <0x03><CRC1><CRC2>

The 2 byte CRC is computed as following using the packet data and end of data terminator (0x03):

G(X) = x^16 + x^15 + x^2 + 1

CRC1 = hi(CRC), CRC2 = lo(CRC)

The 0x06 character is used to acknowledge the successful reception of a packet.

The maximum length of any packet data must not exceed 250 bytes.

A download request sends (at minimum):

<0x02>VFI,OMNI-OPSYS,XDL,F,<0x03><CRC1><CRC2>

The following packet types are used between the two terminals:

• 0x4D = M = Display Message
• 0x40 = @ = Data
• 0x53 = S = Success

A data command follows the following format:

<0x02><0x40><2-byte length><2-byte address> data <CRC1><CRC2>

A message command follows the following format:

<0x02><0x4D>message<0x03><CRC1><CRC2>

A success command follows the following format:

<0x02><0x53><0x03><CRC1><CRC2>

A receiver waits for a 0x05, sends the init string, and then, it waits for a command.

A sender sends 0x05, waits for the init string, and then, sends data blocks until the entire firmware has been sent.  At that point, it sends the message “DOWNLOAD DONE CP” followed by the success command.  I found that a second success command will cause the terminal to reset, and finally, execute the new firmware.