ROMcontained

ROMcontained is an open‑source forensic tool designed for the analysis of Read‑Only Memory (ROM) images from embedded firmware and legacy hardware devices. The utility was first released in 2018 by the firmware security research group at the University of Technology, Cityland, and is maintained through a community of developers on GitHub. Its primary purpose is to detect and classify "contamination" within ROMs—anomalies such as embedded malware, tampered code segments, or unintended third‑party library inclusions that may compromise device integrity.

The tool operates by first extracting raw binary contents from a firmware package, then applying a series of signature‑based and heuristic checks. Users can feed the scanner with a ROM image and a database of known malicious or suspicious code patterns; ROMcontained reports any matches, their locations, and confidence levels. It also offers a comparison mode that highlights differences between a clean reference image and a suspect sample, making version tracking straightforward.

ROMcontained supports multiple architectures, including ARM, MIPS, and PowerPC, and can process images encapsulated in common formats such as FIT, UEFI, and proprietary vendor containers. The software is written in Python 3 and depends on the pycryptodome and lief libraries for binary parsing. The project is released under the GPLv3 license, allowing free use, modification, and redistribution.

Documentation for ROMcontained is hosted on ReadTheDocs and includes a detailed user guide, API reference, and example use cases. Community contributions are accepted through pull requests, and a discussion forum on the project's GitHub issues page serves as a venue for bug reports and feature requests.