I've made a VM (with VirtualBox) and captured the states for the AC, but somehow my RC doesn't want to connect to the VM. Will have to try again after a reboot.
I've then run a few firmware refreshes on the RC (not in the VM obviously) and tried to capture the different processes. They're really bastards...
The firmware images are held in RAM only, i.e. no file cache that you can grab. With the proper tools you can however dump the RAM segment, and the contents of that have the same format than files recovered from the android app.
Then during the update process that's copied to the device's FTP (filesize same give or take a few bytes... except the contents are completely scrambled. So they download a "clear" binary package, the app/assistant must encrypt it before transferring to the device, and that decrypts it back.
There's a virtual COM port with loads of info being transferred between the assistant and device anytime they're connected, so once the file is transferred the command to start the upgrade most likely goes over that. But given the huge amount of comms and them being either raw binary or also encrypted good luck finding out which packet is the right one...