alt Hacker NewsHumans do it with access to the register-level data sheets, which are only available under NDA, and usually with access to a logic analyzer for debugging.
Usually, the problem with developing a driver isn't "writing the code," it's "finding documentation for what the code should do."
... and then figuring out where the hardware company cheapened out and created a whole unfixable mess (extra fun when you first ship your first 10k batch and things start failing after the vendor made a "simple revision"). Then finding a workaround.