Comment by sschueller

They probably can many things but I think things like memory timing is something you can't just easily reverse engineer from a blob. You need to test every state that the device can be in and see how the blob responds which is quite difficult.