First off, I would like to acknowledge the PTSM project for the basic info on interacting with the cartridge. Refer to that page to see how save file access works.
All below info is from a Japanese version of the game and keyboard.
The bluetooth chip returns 0x00 when not returning actual data.
Here are replies from informational commands
0x1001 - Read Local Version Information
00 04 17 02 04 0F 00 20 41
0x1002 - Read Local Supported Commands
00 FF FF FF 03 FE FF EF FF FF FF EF 1F F2 0F E8
FE 3F F7 8F FF 0C 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00
0x1003 - Read Local Supported Features
00 FF FF 8F FE 9B FF 79 83
0x1004 - Read Local Extended Features, page = 0
00 00 01 FF FF 8F FE 9B FF 79 83
0x1004 - Read Local Extended Features, page = 1
00 01 01 00 00 00 00 00 00 00 00
0x1005 - Read Buffer Size
00 FD 03 40 08 00 01 00
0x1009 - Read BD_ADDR (from my JP cart)
00 0D 48 B5 A3 BD 58
0xFC6E - Read Controller Features
00 07 00 00 00 00 00 00 00
0xFC79 - Read Verbose Config
00 13 11 15 02 17 02
Information from the keyboard (WIP)
Read Remote Name
BD ADDR (from my JP keyboard)
03 f1 81 7f 0c e0
Remote Name
Nintendo Wireless Keyboard
Remote version info
03 0f 00 1c 03
Remote supported features
bc 02 04 38 08 00 00 00
L2CAP Extended feature support
04 00 00 00
SDP Service Search Attribute Request: L2CAP - Range 0x0000-0xFFFF. Has info for HID and PnP. Parse and extract what's needed.
36 02 2f 36 01 d7 09 00 00 0a 00 01 00 00 09 00
01 35 03 19 11 24 09 00 04 35 0d 35 06 19 01 00
09 00 11 35 03 19 00 11 09 00 05 35 03 19 10 02
09 00 06 35 09 09 65 6e 09 00 6a 09 01 00 09 00
09 35 08 35 06 19 11 24 09 01 00 09 00 0d 35 0f
35 0d 35 06 19 01 00 09 00 13 35 03 19 00 11 09
01 00 25 3d 42 72 6f 61 64 63 6f 6d 20 42 6c 75
65 74 6f 6f 74 68 20 57 69 72 65 6c 65 73 73 20
4b 65 79 62 6f 61 72 64 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 09 01 01 25 08 4b 65 79 62 6f 61 72 64 09 01
02 25 10 42 72 6f 61 64 63 6f 6d 20 43 6f 72 70
2e 20 20 09 02 00 09 01 00 09 02 01 09 01 11 09
02 02 08 40 09 02 03 08 0f 09 02 04 28 01 09 02
05 28 01 09 02 06 35 d2 35 d0 08 22 25 cc 05 01
09 06 a1 01 85 01 75 01 95 08 05 07 19 e0 29 e7
15 00 25 01 81 02 95 01 75 08 81 03 95 05 75 01
05 08 19 01 29 05 91 02 95 01 75 03 91 03 95 06
75 08 15 00 26 ff 00 05 07 19 00 29 ff 81 00 c0
05 0c 09 01 a1 01 85 02 15 00 25 01 09 e9 09 ea
75 01 95 02 81 02 95 06 81 01 c0 05 0c 09 01 a1
01 85 03 05 01 09 06 a1 02 05 06 09 20 15 00 26
ff 00 75 08 95 01 81 02 c0 c0 05 01 09 80 a1 01
85 04 15 00 25 01 75 01 95 01 09 82 81 02 95 01
75 07 81 03 c0 05 0c 09 01 a1 01 85 05 06 00 ff
15 00 25 01 75 01 95 01 09 01 81 02 95 07 81 03
c0 05 0c 09 01 a1 01 85 ff 05 06 95 01 75 02 19
24 29 26 81 02 75 06 81 01 c0 09 02 07 35 08 35
06 09 04 09 09 01 00 09 02 0b 09 01 00 09 02 0c
09 0c 80 09 02 0d 28 00 09 02 0e 28 01 36 00 52
09 00 00 0a 00 01 00 01 09 00 01 35 03 19 12 00
09 00 04 35 0d 35 06 19 01 00 09 00 01 35 03 19
00 01 09 00 09 35 08 35 06 19 12 00 09 01 00 09
02 00 09 01 00 09 02 01 09 05 7e 09 02 02 09 10
01 09 02 03 09 a6 14 09 02 04 28 01 09 02 05 09
00 02
HID input report parsing function is at 0x0205bbbc in the UK version of the game.
Report ID 1 is a standard keyboard report. One byte for modifiers, one reserved 0x00 byte, then six bytes for key scancodes.
Report ID 2 is unknown, but handled by the game.
Report ID 3 is battery strength. The game will regularly request this, but it can also be sent any time.
0x00 = dead, 0x01-0x1B = very low, 0x1C-0x4F = low, 0x50-0x8A = medium, 0x8B-0xFF = high
Report ID 4 is not handled by the game?
Report ID 5 is used to indicate a press of the Fn key.
0x00 or 0x01
Report ID 0xFF is used during PIN entry. Not really necessary to emulate, but gives an authentic experience.
0x00 = key pressed
0x01 = backspace pressed
0x02 = escape pressed
I've attached a flash dump from my cartridge. The regions before 0xB000 are never read by the game, but contain things like code that may be used by the bluetooth chip. The embedded code doesn't need to be emulated but it may be useful to study.
I don't know much about it but I do know that it uses different commands to read and write to its save file. They function the same as the commands LWP:TA uses.
0xFCEC - Write flash
0xFCED - Read flash
0xFCEE - Sector erase
By implementing those you can get the game to boot up, but you can't do much other than play with the built in Mii Maker. Research is needed on the GPS device it requires.