If this can be of any inspiration:
https://www.eevblog.com/forum/testgear/old-philips-fluke-97/msg3260496/
I'd bet there are plenty of similarities between the old Scopemeters and Combiscopes on the remote control side of the subject.
Marrob released software to read/write calibration data and firmwares to the PM9x series.
I must admit that I missed that post.
We know the undocumented commands are CF, DW, EM, EO, EX, PF, QC and QF - the command table starts just after 0x11E0 in the ROM
CF=Clear Flash; PF = Program Flash and QF=Query Flash would be pretty plausible and consistent with the scope meter. QC is possibly Query Cal though "PC" is definitely not Program Cal - it is "Program Communication" - i.e serial port parameters.
Anyone any suggestions for the rest?
The CPL list from the manual is
AS Auto Setup
AT Arm Trigger
CL Calibrate
DS Default Setup
GL Go to Local
GR Go to Remote
ID IDentification
LL Local Lockout
PC Program Communication
PS Program Setup
PT Program text
PW Program Wavefrom
QS Query Setup
QM Query measurement
QP Query Print
QT Query text
QW Query Wavefrom
RI Reset Instrument
RS Recall Setup (internal)
SS Save Setup (internal)
ST STatus query
TA Trigger Acquisition
The list in the ROM is:
AS, AT, CF, CL, DS, DW, EM, EO, EX, GL, GR, ID, LL, PC, PF,
PS, PT, PW, QC, QF, QM, QS, QT, QW, RI, RS, ST, SS, TA
Looks like a table of 8 byte entries - the AS text is at 11E2 - and my guess is that's the start of the table, but beyond that nothing is obvious.