I do not understand, if you know everything there is to be known about your hardware, can't you work your way up and find out what the binary does exactly?
closed as too broad by kn0x, perror, julian♦, Paweł Łukasik, peter ferrie Feb 2 '18 at 20:54
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
One problem here is that it might be hard to know all facts about the hardware - a great example are the current Meltdown and Spectre security problems, which rely on side-channel effects not (precisely) documented by the processor vendors.
So in general, in cases like these you would have a hard time figuring out what some piece of binary code trying to exploit these properties really does.
However, since you are asking about a BLOB driving a certain piece of hardware, having descriptions of register, timing, interrupt, DMA (etc.) behavior and, if possible, schematics or HDL descriptions of the hardware components, would at least go a long way in finding out what the binary does exactly.