# sniffROM > Python tool that reconstructs serial flash contents from passive bus captures: it parses SPI or I²C analyzer exports from Saleae Logic, recorded while a device reads and writes its own flash chip, and writes the observed data into a binary image at the original memory addresses. It recognizes more than 100 SPI flash commands from vendors such as Winbond, Macronix, Spansion and GigaDevice and currently parses 12 of them, reports manufacturer and device IDs seen in JEDEC ID reads, and can print a command summary, show a visual map of the captured address ranges and plot the timing of reads and writes. - Type: Tool - Targets: Firmware · Protocol - Category: Firmware tools - Relationship: Foundation tool - Sources reviewed: 2026-10-20 - Added to the catalog: 2026-11-02 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/sniffrom/index.md) ## Requirements & limits - No releases or tags; the script was last changed in July 2020. A README note added on 2023-12-07 says Saleae Logic 2 breaks the SPI analyzer export that sniffROM depends on, so it currently works only with data exported from Logic 1.x, and that it was unknown when this would be fixed. - A single Python 2 script (it uses print statements) that needs matplotlib for the data map and timing plot; the README's usage text calls it sniffROM_new.py. Input is a CSV export from Saleae Logic's SPI or I²C analyzer, with options for 2-, 3- or 4-byte SPI addresses, byte endianness and analyzing only read or only write commands. - Capturing needs a Saleae logic analyzer connected to the flash bus of a device the analyst is permitted to examine; the wiki's Getting Started page points to an external guide for the capture itself. Only data the device accessed during the capture is recovered, and unseen bytes are filled with a padding value; the wiki's boot-time SPI examples captured about 29% and 42% of the rebuilt images. - GPL-3.0 (COPYING). The repository also stores manufacturers' datasheet PDFs for the supported SPI and I²C chips and a commands.xlsx command table; the datasheets remain their vendors' documents. No firmware images or bus captures are committed. ## Primary sources 1. 2. 3. 4. 5. 6. 7. ## More in Firmware and hardware - [Pawn](https://awesomerea.org/resources/google-pawn/index.md) · Tool - [EMBArk](https://awesomerea.org/resources/embark/index.md) · Tool - [IDAPython Embedded Toolkit](https://awesomerea.org/resources/idapython-embedded-toolkit/index.md) · Tool - [fiano](https://awesomerea.org/resources/fiano/index.md) · Tool - [Pyrrha](https://awesomerea.org/resources/pyrrha/index.md) · Tool - [RETracker](https://awesomerea.org/resources/retracker/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.