Look for Endpoint 0/IN exchanges between host and controller

[sm-Fifteen]

It seems like messages 0xa1 and 0xae are special in that they're preeceded by the host sending a device-to-host control to the controller, which then replies with a 64 bytes payload which appears to change depending on the last control transfer recieved.

I can get this to occur reliably by opening the controller settings menu, I suspect those to be related to the firmware version. This was done wirelessly, BTW, it's possible this is a reviever thing.

[sm-Fifteen]

Ok, so it would seem like Endpoint 0/IN is used bothed in wired and wireless mode to query the controller. The host sends a device-to-host (curiously enough) interface-class control to the controller, which then replies with a "GET REPORT RESPONSE" containing data. What the packet contains appears to depend on what the last control it received contained (the first byte seems to match).

For some messages, the controller returns data. So far, those all seem to be there to setup this kind of operation :

• 0xae
• 0xba
• 0xa1 (wireless only?)
• 0xb4
• 0x83

I have a few instances of those occuring after a feedback control was last sent (seemingly after shutting down, so that might be the receiver replying, needs more testing) and the controller replies with 0x8f and 63 bytes of padding, so there does seem to be a relation and that all controls can be used to setup a query, but not all of them will return useful information.