I really had to do that once. Reverse-engineer a wifi driver in an embedded board, some niche RISC instruction set invented by god knows who. Invented a disassemble-annotate-repeat tool called GOLEM based entirely on bitmap-pattern scripts, that would produce a listing. You could edit the listing to include symbolic names for code points and data, then re-run the tool and it would use those names (instead of hex addresses) in the new listing (built a symbol table iteratively). Ultimately I had complete source for the firmware again.