I would start by figuring out a way to observe traffic between the 3DS and the cartridge. Needs something like a Wireshark, ollydbg, or curl_setops, etc. (but for the 3DS of course). Maybe some hardware doohickey configuration would allow it, but much easier if there's already a way to execute...