WerWolv / ImHex-Patterns

Hex patterns, include patterns and magic files for the use with the ImHex Hex Editor
https://github.com/WerWolv/ImHex
GNU General Public License v2.0
640 stars 168 forks source link

Protobuff definition is not correct #261

Open gsi-viera opened 3 months ago

gsi-viera commented 3 months ago

https://github.com/WerWolv/ImHex-Patterns/blob/3416d30f2b8fac4f12bf73aa1f5d5102a07b7f83/patterns/protobuf.hexpat#L34C5-L37C4

The specification for protobuff states that this record is Varint Encoded.

So it means that it's not guaranteed to have 8 bits. If the field index has its last significant bit on 1 then another byte has to be read.

I've tested this in real life payloads and I've confirmed that it's failing.

applecuckoo commented 1 month ago

This issue should probably be closed since it's a dupe of #152, which describes the exact same problem.