search

DeiteriyLab / protobuf-magic

GNU General Public License v3.0
66 stars 2 forks source link

Protobuf reverse engineering workbench #2

Open RoganDawes opened 8 months ago

RoganDawes commented 8 months ago

Hi,

Nice work with this tool. I think it is something that is quite needed for those cases where you don't have the .pb files.

It would be interesting to formulate it as a "reverse engineering workbench", that facilitates the "recovery" of the .pb files based on the observed inputs, allowing the user to refine them as more input is received and compared to the available data. For example, your tool does an initial pass at figuring out the data types based on one or more messages, checking that the data types apply to all messages, and eliminating those that work for some only. Then allow the operator to give names to the fields, and subtypes, etc, much as tools like IDA and Ghidra do for function calls and variables. Perhaps having autocomplete or dropdowns on the types that are limited to the datatypes that decode cleanly for all observed messages? And then can be highlighted if at any point and message is received that no longer decodes cleanly with that particular type?

michael2to3 commented 8 months ago

Hi.

Thank you for the offer. I set myself another task in the todo list. I am not sure that I will be able to implement it soon, but maybe someone will implement it. By the way, if you or anyone you know would like to contribute more to this application, we'd greatly appreciate it!