Here is what I've found so far:
If you're buying a 360 controller, or any other relevant items, please consider using my affiliate link:
Amazon.com: XBox 360 wired controller XBox 360 Store
Vendor: 0x045e (Microsoft)
Product: 0x028e (UK version?)
Class 255, subclass 255, protocol 255
Interface 0: class 255, subclass 93, protocol 1
2 interrupt endpoints: in, out
Interface 1: class 255, subclass 93, protocol 3
4 interrupt endpoints: in, out, in, out
Interface 2: class 255, subclass 93, protocol 2
1 interrupt endpoint: in
Interface 3: class 255, subclass 253, protocol 19
I suspect the controller is a standard HID device, but without any of the descriptors required for a class driver to use it. However, I don't know enough about HID devices (I've only briefly experimented with making a HID device using a USB PIC) to say for certain.
I have created a MacOS X userspace USB program to experiment with the controller, and so far have concentrated on interface 0 (based on this page I believe the others may be things like a USB hub). It is simple enough to read the 'in' pipe and receive packets regarding the state of all buttons and axis on the device. Alongside this, the controller will return some information at start up (size is decimal, data in hex):
Got 3 bytes: 01030E
Got 3 bytes: 020300
Got 3 bytes: 030303
Got 3 bytes: 080300
Along with the standard update from the device:
Got 20 bytes: 00140000000002EF07FE8E07D2FD000000000000
Reports are type 0x00, and seem to be 20 bytes long:
Where x is the left trigger, y is the right trigger, a is the left hat, b is the right hat and t is the buttons:
||Left hat button
||Right hat button
Report type 08
This report takes the format 0803xx, I believe 03 is the packet size and 08 is the type. xx appears to indicate whether or not a headset is attached - 00 is no headset, 02 is headset connected. This occurs whether or not the chatpad is connected, although attaching the chatpad can cause phantom "headset connected" conditions as the plug is temporarily shorted out.
Some control over the LEDs surrounding the XBox button is provided, corresponding to the markings 1, 2, 3 and 4. This is controlled using message type 0x01.
To select a new pattern for the LEDs, send a message of the following form:
Where xx is the desired pattern:
||1 flashes, then on
||2 flashes, then on
||3 flashes, then on
||4 flashes, then on
||Rotating (e.g. 1-2-4-3)
||Alternating (e.g. 1+4-2+3), then back to previous*
* The previous setting will be used for these (all blinking, or 1, 2, 3 or 4 on).
At startup, the device seems to report 01030E. I believe this to indicate that there are 14 options (e.g. 0 to D hex) for the LEDs.
Rumbling is also similar to on the original controller. Rumble commands take the following form:
Where b is the speed to set the motor with the big weight, and l is the speed to set the small weight (0x00 to 0xFF in both cases).
I believe Interface 1 is audio - from what I've seen on Linux it's as simple as reading data from that pipe to record, and then writing it back to play. At some point I intend to add support for this to the OSX driver.
Interface 3 also reports itself as a security device of some sort. I believe it to be the mechanism by which the XBox 360 detects licensed controllers (without the interface, which you must license from Microsoft to include in your controller, the 360 will reject it).