Hunting and pecking work. Also trying to do research on the actual chips on the hardware helps quite a bit.

In the case they put black blobs on their chips or rub everything off, you can go with throwing an oscilloscope and checking the readings coming in and out of the device. Ive had to do that a couple of times to make a “spec” out of chips that no longer have documentation.

Here is a great example: bookmanarchive.com

bookmanarchive.com/reverse-engineering

They do over the teardowns: bookmanarchive.com/reveng/…/DBD-440.0.jpg its pretty neat!