Home

What is sniffROM?

A tool for passive data capture and reconnaissance of flash chips. It is used in conjunction with a Saleae logic analyzer to reconstruct flash memory contents and extract contextual information about device operations.

It supports SPI and I²C flash chips which are commonly found in embedded devices. These chips often contain application/bootloader firmware, configuration parameters, cryptographic secrets, etc.

What does sniffROM do?

The Saleae Logic software comes with various protocol analyzers such as Serial Peripheral Interface (SPI), allowing the user to export command-aware data to a comma-separated value (csv) file.

sniffROM parses the output generated by the Saleae Logic software to extract useful information. Specifically:

• Sniff flash data that was accessed via READ and WRITE commands
• Uncover important memory locations
• Graphically analyze timing of data reads and writes
• Intercept metadata such as manufacturer and chip IDs

Due to the passive nature of this tool's operation, it can recover flash contents and other data in cases where direct in-situ probing of the chip is unreliable, and desoldering of the chip is not desired.

Go to Getting Started