The following is a brief explanation of the most basic parts of the communications protocol for Dream Cheeky's USB rocket launcher based on sketchy details from usb sniffs that I only sort of understand. But, it works, which is good enough for me at this point. The program uses libusb for communications (which is part of my confusion, for its documentation is so poor that it may have well been written in Betacrypt 3) and ncurses for screen formatting. Also, I apologize for the formatting of this page as well as my English style.
Each command to the launcher requires 3 control messages. The first is all zeroes, presumably signalling that a command is coming. Next, the command is sent. Finally, another message of all zeroes.
The meat of the protocol is in the second message. Each mode of operation is signified by a bit in the first byte. 0x1 moves up, 0x2 down, 0x4 left, 0x8 right, 0x10 starts the firing sequence.
When a message is sent, the device is put into the associated state, these commands are not one shots. As such, you have to send a message triple where all 3 messages are all zeroes in order to stop whatever is happening (in my case, pressing a key sends the move/fire message and not having a key pressed sends the do nothing message). This true when firing as well as moving. If you send a fire message you must also send a stop message or it will keep charging and shooting forever. If you send the stop message too soon, the pressure cylinder will remain partially charged. The firing sequence is goofy and is better understood through experimentation than listening to me. At any rate, the sequence takes about 6.77 seconds.
The USB specification is still a bit of a mystery to me, so just look at the code for all that jazz.