Skip to content
No description, website, or topics provided.
Branch: master
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore
ADDRESS_BOOK_FILE
LICENSE Create LICENSE Jun 11, 2018
README.md fix utf-8 encoding in sample usage Jul 2, 2018
addressbook.proto fix string len bug Oct 13, 2016
parse.py fix utf-8 encoding in sample usage Jul 2, 2018
protobuf_decoder.py
write_msg.py fix string len bug Oct 13, 2016

README.md

protobuf-decoder

This is a protobuf-decoder which can decode protobuf binary file without .proto files. It supports editing to the decoded file and re-encoding to a bianry file. It can also work as a brup plugin.

Have a try

  1. protoc -I=. --python_out=. addressbook.proto

  2. python write_msg.py ADDRESS_BOOK_FILE

    Enter a telephone number and press twice. Now you have a protobuf binary file called ADDRESS_BOOK_FILE.

  3. python parse.py ADDRESS_BOOK_FILE

    Now you can see the decoded field looks like:

    {
        "01:00:embedded message": {
            "01:00:string": "わたし", 
            "02:01:Varint": 1234, 
            "04:02:bytes": "0x5a:0x64:0x3b:0xdf:0x4f:0x8d:0xf3:0x3f:0x2d:0xb2:0x9d:0xef:0xa7:0xc6:0x9:0x40", 
            "05:03:embedded message": {
                "01:00:Varint": 1, 
                "02:01:string": "0800000", 
                "03:02:embedded message": {
                    "01:00:32-bit": 666.7769775390625
                }
            }, 
            "05:04:embedded message": {
                "01:00:Varint": 1, 
                "02:01:string": "0800000"
            }
        }, 
        "02:01:32-bit": 3.140000104904175
    }  
    

    You can compare this result with the google's official decode_raw result using cat ADDRESS_BOOK_FILE | protoc --decode_raw

Burp Plugin

You can also use this script as a burp plugin:

  1. Copy parse.py to your burpsuite's jar directory.
  2. Open burp, load protobuf_decoder.py as a burp extension.
  3. All is done! You are now able to view protobuf binary in json format. You can also modify the value to what you want! But donnot modify the keys unless you know what you are doing.

Explanation:

img1 img2

Note the keys of this json file is in the format of field_number:id:type. field_number is exactly the field_number in .proto file while id has no meaning. It's just a field that helps to de-duplicate the keys in json.

TODO

  1. Deal with minus number.

Acknowledgements

Thanks Mori for fixing bugs and improve this tool!

You can’t perform that action at this time.