Decades ago, I did something similar but far cheaper. I hooked up a toy tank's remote to RS232 and started bit-banging through RS232. The bits correspond to th

Decades ago, I did something similar but far cheaper. I hooked up a toy tank's remote to RS232 and started bit-banging through RS232. The bits correspond to the voltage of the RS232 pins, which in turn activates the toy tank's remote's buttons. The toy tank is now completely programmable through the PC. The OP's toy does not have any state so it is quite easy to reverse engineer. All you need is a simple map from a desired action to electromagnetic signal. I am thinking of reverse engineering the protocol between my customizeable mechanical keyboard and its PC software. As the mechanical keyboard has an internal state, it is much more difficult to reverse engineer.