nccgroup / blackboxprotobuf

Blackbox Protobuf is a set of tools for working with encoded Protocol Buffers (protobuf) without the matching protobuf definition.
MIT License
480 stars 82 forks source link

Float instead of fixed32 #18

Closed mxrch closed 1 year ago

mxrch commented 1 year ago

Hi ! I'm writing a CLI application that uses blackboxprotobuf to better analyze protobuf. But I have a little issue; I know that a value is a float, but it is instead considered by blackboxprotobuf by a fixed32. I already tried changing the value of this line to "float" : https://github.com/nccgroup/blackboxprotobuf/blob/3e28323428e77d470574c793fa517f4d4a5dfc5b/lib/blackboxprotobuf/lib/types/type_maps.py#L108 It works great, but it will change every fixed32 to float. Is there a way to better detect float and double values ? Thanks !

rwinkelmaier-ncc commented 1 year ago

Hi!

As far as I know, there's not really any way to deterministically tell if a field is a float or not. The only information the format gives is that it is 32 bits in size. It could be interesting if there was some probabilistic way, such as, "if x bit is set then it's more likely to be a float", but I haven't looked into that.

If you know ahead of time that a certain field is a float, you can also pass in a typedef to the decode function which tells it that field number X will be a float. Unfortunately, no way to do that automatically for arbitrary messages though.

mxrch commented 1 year ago

Thank you very much ! I got it to work by doing something like this :

decoded = decode_message(data)
values = decoded[0]
structure = decoded[1]

structure, custom_types_defined = clean_schema(decoded, values, definitions=definitions) # It will change the message["type"] of the targeted message, defined in the "definitions"
if custom_types_defined:
    decoded = decode_message(data, structure)
    values = schema[0]
    structure = schema[1]