This is actually quite fun. It seems that the DMM supports two types of transfer: either a fully ASCII protocol, but also the same protocol with simple binary framing, each packet starting with 0x10 0X02 <DATA> 0x10 0x03 <CRC> though I was not able so far to get the algorithm for the CRC. The meter also supports two sets of commands, some which are only accessible after some sort of authentication (calibration password, it seems, or maybe a developer key?).
Interesting commands so far: qemap, which accepts a very large list of arguments:
blightVals
rsob
blvals
memvals
jackdetect
updateMode
acsmooth
tempunit
dBmRef
pwpol
hzEdge
dcpol
contbeep
conbeepos
timeFmt
dateFmt
numFmt
lang
recEventTh
rsm
ablto
digits
beeper
apoffto
autorange
bolt
fileMode
qt
beeperTestState
sessionType
calConstantName
calStatus
mode
readingID
attribute
jackName
jackPositionStatus
testPattern
lcdModeState
ledState
mp_props
mpdev_props
mpq_props
memSize
powerMode
buttonName
presstype
channel
sampleTime
recordType
isStableFlag
transientState
xaJackName
You can use the "PRESS" command with one of the 'buttonName' values, for instance. Or you can switch the power button's LED with LEDT - argument matches the result of qemap ledstate - . Or you can (probably) get the LCD's current bitmap with QLCDBM with an offset as argument (0 for instance). I was not able to decode the bitmap so far, but here you go.
In order to get the trendlog recordings, you can use the QRSI command (with argument 0 to 8 ) to get a binary structure which includes the ID of each recording, and then download each sample of the recordings with QSRR with ID as argument. I will publish a proper description once I underttand the binary structures properly, I'm nearly there...
If someone wants to give me a hand, I would like to put my hands on the log of a DMM firmware update, so that understand how to authenticate to the DMM to get access to the low level commands...