search

nccgroup / blackboxprotobuf

Blackbox Protobuf is a set of tools for working with encoded Protocol Buffers (protobuf) without the matching protobuf definition.
MIT License
480 stars 82 forks source link

hex input parse error, please ! #15

Closed 2wong closed 1 year ago

2wong commented 1 year ago

hexcode: 08c8f6e10410010a0708c9f6e10410010a0508914e10010a0708caf6e10410010a0508924e10010a0708cbf6e10410010a0508934e10010a0508944e10010a0508954e10010a0508964e10010a0708c7f6e1041001

rwinkelmaier-ncc commented 1 year ago

Hi!

I've been looking at this a little bit. If you're trying to decode this in Burp, you'll probably need to implement a custom function to decode it since hex is not supported/detected out of the box. https://github.com/nccgroup/blackboxprotobuf/blob/master/burp/blackboxprotobuf/burp/user_funcs.py#L69 for decoding and https://github.com/nccgroup/blackboxprotobuf/blob/master/burp/blackboxprotobuf/burp/user_funcs.py#L83 for encoding

It also looks like the hex might be missing a few bytes in the front? I get an error even after it is hex decoded. protoc --decode_raw does print something out, but I think the types don't make sense and that's why blackboxprotobuf fails.