Protocol Reverse Engineering
ACTION REQUIRED (execute immediately after reading)
NOW: Read ../field-journal/precedent-reverse.md — confirm authorization and routine operational boundariesNOW: Confirm whether the task isprotocol/traffic/serialization formatreverse engineering (if not pure Web parameter signing → switch to js-reverse/）NOW: If there is target network interaction → ../scripts/case-init.ps1 complete scope;auth if not granted, ACT against the target is prohibitedNEXT: Read ../tool-index.md; missing tools bootstrap (tshark/wireshark etc. may need manual installation)ACT: Enter workflow Phase 1, produce a frame layout or message dictionary draft
Applicable Scenarios
- Custom TCP/UDP binary protocols
- Protobuf / gRPC / FlatBuffers / MessagePack
- WebSocket / MQTT / proprietary RPC
- PCAP / PCAPNG recovery of fields and state machines
- Client-server validation, sequence numbers, encrypted frame headers
Not covered by this skill
| Situation |
Where to go |
| HTTP parameter signing only / JS encryption |
js-reverse/ |
| TLS certificate issues only |
pentest-tools/ or browser proxy |
| Deep dive into firmware protocol stacks + emulation |
firmware-pentest/ then return to this skill |
Workflow
Phase 1 — Collection and Triage
□ 拿到样本：PCAP / 代理导出 / 客户端日志 / 二进制
□ 标记方向：C→S / S→C；是否有握手、心跳、重连
□ 固定头？魔数？长度字段？TLV？定长？
□ 是否压缩（zlib/gzip/lz4）或加密（AES/ChaCha 帧内）
□ tshark -r cap.pcap -T fields -e frame.number -e ip.src -e tcp.payload
Phase 2 — Frame Layout Recovery
□ 对齐多个同类消息，找不变字节 / 自增序列号
□ 长度字段：大端/小端、含头/不含头
□ 校验：CRC16/32、checksum、HMAC 位置
□ 画出状态机：Connect → Auth → Ready → Request/Response → Close
□ 工具：Wireshark 自定义 dissector 草稿 / ImHex / 010 Editor 模板 / Kaitai Struct
Phase 3 — Serialization and Encryption
□ Protobuf：.proto 恢复（blackboxprotobuf / pbtk / protoc --decode_raw）
□ gRPC：HTTP/2 headers + protobuf body
□ 加密：找密钥派生（客户端 so/dll/JS）→ 联合 ida-reverse / js-reverse / apk-reverse
□ 重放：仅在授权 scope 内；先无害字段再敏感操作
Phase 4 — Artifacts
MUST 产出：
- 消息类型表（name / opcode / fields）
- 至少 1 条可复现的解码命令或脚本
- Evidence：原始 hex 摘录 + 解码结果（脱敏）
Toolchain
| Tool |
Required |
Purpose |
Bootstrap |
| tshark / Wireshark |
Strongly recommended |
PCAP parsing |
Manual / winget |
| Python3 |
Yes |
Decoding scripts |
System |
| blackboxprotobuf |
Optional |
Unknown protobuf |
pip |
| ImHex / 010 |
Optional |
Structure templates |
Manual |
| IDA / r2 / Ghidra |
As needed |
Client-side serialization functions |
See corresponding skill |
References
references/protocol-workflow.md — Frame layout and Protobuf quick reference- Related:
../ida-reverse/ ../js-reverse/ ../firmware-pentest/ ../pentest-tools/
Routing Context
Upstream: MASTER-ROUTING R21 · routing.md
Downstream: If client-side algorithm is needed → ida-reverse/js-reverse; if replay exploitation is needed → pentest-tools/api-security
Peer: malware-analysis(C2 protocol),digital-forensics(traffic forensics)
Task Completion Self-Check
- Has the message layout or state machine been recovered (rather than just pasting hex)?
- Is there a reproducible decoding command?
- Is scope / data masking being followed?
- Has the field-journal / report Checklist been written back?
