disassemble the dump of badge arcade (probably the .code section?), so you can understand how the badge arcade functions, then you can make a plugin, or patch the code. see the optional features in the luma3DS wiki for more detail.
to extract files from cias you can mount them in godmode9, and copy the files, for me the .code is in /0000.00000000/exefs
there are two different titles, the update and the base game.
save data and extradata may also have more information.
note that if you don't already have save data, the service is shut down which makes it harder to examine how it works.
You could see if anything in the GYTB repo is useful.
CTRPluginFramework-BlankTemplate 3gx plugin also includes a cheat engine/tools for inspecting memory. you could also use wireshark or similar to inspect network packets that the 3ds sends.
citra has built in memory tools (i think), and may be useful for helping to understand the badge arcade, i'm not sure if it's compatible with patching, but if it is it has a faster testing time and better debugging than 3ds, though badge arcade may not work in citra due to it not supporting the nintendo network.
this gbatemp thread might help
https://gbatemp.net/threads/assembly-code-and-ida-pro-3ds-cheat-code.532023/
some info on how the files/networking works:
https://gbatemp.net/threads/badge-arcade-archive.635354/