That doesn't make sense to me, extracting/copying a firmware blob is not clean-room design. It would only be clean-room design, as the article you link to explains, if you constructed it yourself from scratch based on the functionality you understand it should have. But ok!
You might have gotten lost on the steps involved in clean-room reverse engineering here?
>extracting/copying a firmware blob is not clean-room design
It's stage 1. Clean-room reverse engineering is about working with the nature of copyright, and classically goes roughly like this:
1. You set things up with a "contaminated" or "dirty" side team who have direct exposure to the IP in question, and a "clean" (or "virgin" is another older term) side team that are thoroughly firewalled. The clean side must only have devs who have never ever had any exposure to whatever it is you're trying to clean replicate [0].
2. The dirty side is in charge of producing a "fact sheet"/spec. That side absolutely extracts/disassembles or whatever else to get at the target, which is precisely what "contaminates" them. They are looking at copyrighted code. Then they use that research to a create a purely factual spec, which is then passed across the firewall to the clean side. This must be the only communication.
3. The clean side then uses that to write new code themselves that will handle state per the factual spec they've been given.
The reason it works is that (in the US) purely factual information cannot be copyrighted, there's no "sweat of the brow" doctrine or the like. Copyright, unlike patents, does not cover ideas or methods, it's about the creativity of the person in question. You can't copyright the mathematics of a function, of "when X input is received Y is output", or of general concepts. So if two (or more) people independently create works that happen to cover the exact same subject matter, but can prove they were fully independent, then it doesn't matter even if it happened to be literally identical (however improbable that would be). Each would have their own independent copyright on it.
So clean-room RE avoids all the legal snarls around "how close is this" in favor of the simple binary question of "did the team that wrote this RE'd code have any exposure whatsoever to copyrighted IP?" If the answer to that is "no" that's the end of any legal complaint, because by definition their output cannot be a derivative work. Software patents short circuit that, part of the many reasons they're evil, but as a practical matter the number of really fundamental hard to avoid ones is rapidly shrinking because it's 2025 and by 2005 a lot of the foundations had long since been done.
----
0: Which is not necessarily trivial to hire for, because the kind of person who has the kind of skills you need also is going to tend to enjoy hacking around and reverse engineering stuff for fun anyway increasing the chance they've managed to contaminate themselves.
Such as when it's technically legal to do something as long as you do it a certain way, but the interested parties may not believe that you did it correctly and will bury you in legal discovery requests that financially ruin you or force you to stop.
Or they sue anyways hoping for a favorable ruling that changes the interpretation of the law (Oracle v. Google for a famous example of this)
