I had a similar experience getting usable documentation for NXP's RF tuner ICs. In the end, I had to do a ton of guesswork on top of the partial documentation they were willing to share to end up with a working design.

Which is funny because at one point I stumbled upon a web site that was selling layer-by-layer microphotographs of the chip I was using. They weren't much use to me, but for someone wanting to reverse engineer the chip I'm sure they would be a lot more useful than a complete description of the chip's external interface.

Mifare Desfire EV1 RFID tag[1].

[1]: http://uk.farnell.com/nxp/mf3mod4101da4-05-1/rfid-read-write...