> Isn't it just a matter of measuring the IO and reproducing it? No, you also have to understand it. For a very simple example, suppose that, on initializatio

> Isn't it just a matter of measuring the IO and reproducing it? No, you also have to understand it. For a very simple example, suppose that, on initialization, the driver always sends 01 02 03 04 88 99 00 to the hardware, which then replies with 05 06 AA BB 01, and then the driver sends 07 08 11 22 05. What is the meaning of each of these bytes? What should the driver do if the hardware instead replied with 05 06 CC DD 07? Is the AA BB always the same for every device, or is it a calibration constant which it got from somewhere else? Is the last byte some kind of checksum, and if so, how to calculate it? And so on. Even for very simple hardware, reverse engineering the IO can be a lot of guesswork.