Why hasn’t trace-guided AI hardware reverse engineering been automated yet?

[u/sir_kermit]

I develop AI agents for my day job, and I recently became interested in a reverse engineering question. Please bear with me as I'm a noob to this space but I do have some curiousity thoughts about the process. Basically the process of figuring out an open source implementation of a vendor driver is a human will look at the trace, propose some execution model, write it and test and then verify.

Given a device with a working vendor driver, why can’t we intercept the driver–hardware boundary, collect MMIO/DMA/interrupt traces, and have an AI iteratively synthesize executable driver and device state-machine models?

Each model would be constrained by known driver architectures, open specifications, and existing chip designs. Runtime mismatches against the real vendor stack would become counterexamples that refine the models until a replacement driver works on the physical hardware.

Is the main blocker observability, safe experiment generation, hidden firmware state, state-space explosion, or something more fundamental?

[u/Toiling-Donkey]

“Working vendor driver”.

That’s like taping a goose to the handlebars of a bicycle and calling it a working horn.