requesttype=0x1a

Not seen with EOS D60 and Canon RemoteCapture. Seen only with D30.

If byte 0x50 is some sort of opcode, it may come in sequence: 01, 02, 03 in consecutive commands.

Command: 0x7C bytes

0000 3c 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 <...............
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 1a 00 00 12 3c 00 00 00 f8 c4 12 00 ........<.......
0050 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
0060 00 00 00 00 b8 c7 12 00 9b 2b 40 00 58 c8 12 00 .........+@.X...
0070 b8 6d 4f 00 02 00 00 00 01 e6 12 00             .mO.........
        

Reply: 0x80 bytes

0000 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 1a 00 00 22 40 00 00 00 f8 c4 12 00 ......."@.......
0050 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................
0060 ac 00 00 00 5e b5 ff ff 55 1b 00 00 10 00 54 1b ....^...U.....T.
0070 0c 00 ef 19 9c 0f 53 02 58 9d 0c 00 ef 19 ee 26 ......S.X......&
        

So the reply message is just the same length as the command, with 4 bytes of status code inserted. I can't see any mapping between what goes out and what comes back, though. Here the first three words of both command payload and response payload are 1,0,1, but then they diverge.

0000 01 00 00 00  00 00 00 00  01 00 00 00  00 00 00 00
     01 00 00 00  00 00 00 00  01 00 00 00  ac 00 00 00

0010 00 00 00 00  b8 c7 12 00  9b 2b 40 00  58 c8 12 00
     5e b5 ff ff  55 1b 00 00  10 00 54 1b  0c 00 ef 19

0020 b8 6d 4f 00  02 00 00 00  01 e6 12 00
     9c 0f 53 02  58 9d 0c 00  ef 19 ee 26