Hi Steven, great experiment and admirable initiative. The IR protocol used in the signals you observed is NEC protocol, which is widely used for remote controller: logical 0 is a 562.5us pulse burst followed by a 562.5us space (total transmit time 1.125ms), and logical 1 is a 562.5us pulse burst followed by a 1.6875ms space (total transmit time 2.25ms). Link to explanation: [Link: forum.phpoc.com]

I suppose if you try all the rest of the 8-bit HEX numbers other than 0x16, 0x25, 0x07, you will be able to see if there are other HEX mappings implemented in the toy's chipset (mappings from code to motor driving pattern).

Cheers from the best Tampa pool cleaning service. I was once a RC toy lover and tinker as well. Hope to see more follow-up fun projects from you Steven!