{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/nccgroup/blackboxprotobuf/blob/b98861e0f732e902923abc36cc08c40917f34127/lib/README.md",
    "https://github.com/nccgroup/blackboxprotobuf/blob/b98861e0f732e902923abc36cc08c40917f34127/burp/README.md",
    "https://github.com/nccgroup/blackboxprotobuf/blob/b98861e0f732e902923abc36cc08c40917f34127/mitmproxy/README.md",
    "https://github.com/nccgroup/blackboxprotobuf/blob/b98861e0f732e902923abc36cc08c40917f34127/lib/pyproject.toml",
    "https://github.com/nccgroup/blackboxprotobuf/blob/b98861e0f732e902923abc36cc08c40917f34127/LICENSE",
    "https://github.com/nccgroup/blackboxprotobuf/releases/tag/v1.4.2",
    "https://pypi.org/project/bbpb/1.4.2/"
  ],
  "category": "protocol-analysis",
  "description_en": "NCC Group's tools for decoding and re-encoding Protocol Buffers messages without the matching .proto definition. The decoder returns the message data with an editable type definition built from best-effort guesses based on wire types; analysts can name fields, correct types and re-encode edited messages, which protoc --decode_raw cannot do. It ships as a Python library with a bbpb CLI, a Jython Burp Suite extension and a mitmproxy addon, and its README traces it to modifying messages during mobile penetration tests.",
  "description_zh": "NCC Group 推出的工具集，可在没有对应 .proto 定义的情况下解码并重新编码 Protocol Buffers 报文。解码器返回报文数据，以及根据线路类型尽力推测生成、可编辑的类型定义；分析者可以为字段命名、修正类型并重新编码修改后的报文，这是 protoc --decode_raw 做不到的。它提供 Python 库及 bbpb 命令行工具、基于 Jython 的 Burp Suite 扩展和 mitmproxy 插件，README 说明它最初用于在移动应用渗透测试中修改报文。",
  "entry_url": "https://awesomerea.org/resources/blackbox-protobuf/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/blackbox-protobuf/",
  "evidence_url": "https://github.com/nccgroup/blackboxprotobuf/blob/b98861e0f732e902923abc36cc08c40917f34127/README.md",
  "group": "tools",
  "id": "blackbox-protobuf",
  "json_url": "https://awesomerea.org/resources/blackbox-protobuf/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/blackbox-protobuf/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/blackbox-protobuf/index.md",
  "name": "Blackbox Protobuf",
  "name_zh": "Blackbox Protobuf 无定义 Protobuf 解码与重编码工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The library and CLI install from PyPI as bbpb (1.4.2, Python >=3.8,<4.0); the README calls the blackboxprotobuf PyPI package an older fork. The mitmproxy addon loads mitmproxy/bbpb.py with bbpb installed in the same environment; edited types survive restarts only with the bbpb_project_file option, and editing commands are unavailable in mitmweb.",
    "The Burp extension needs Burp Suite configured with Jython 2.7+ and a clone with git submodule update --init. gRPC needs Burp's HTTP/2 support, and only uncompressed gRPC payloads are handled.",
    "Field types are guessed from wire types and occasionally field content, so type definitions may need analyst correction; field names and meanings are not recovered, and a type-discovery tool is listed only as future work. .proto import and export use a partial parser that does not resolve import statements.",
    "MIT. The default branch was last committed on 2025-03-14, the day of release v1.4.2."
  ],
  "requirements_zh": [
    "库与命令行工具可从 PyPI 以 bbpb 安装（1.4.2，要求 Python >=3.8,<4.0）；README 指出 PyPI 上的 blackboxprotobuf 软件包是较早的派生版本。mitmproxy 插件加载 mitmproxy/bbpb.py，并要求在同一环境中安装 bbpb；只有设置 bbpb_project_file 选项，编辑过的类型才能在重启后保留，mitmweb 中也无法使用编辑命令。",
    "Burp 扩展需要配置了 Jython 2.7+ 的 Burp Suite，并在克隆仓库后运行 git submodule update --init。处理 gRPC 需开启 Burp 的 HTTP/2 支持，且只支持未压缩的 gRPC 负载。",
    "字段类型根据线路类型（偶尔结合字段内容）推测，类型定义可能需要分析者修正；字段名称和含义无法恢复，类型发现工具仅列为未来计划。.proto 导入导出使用不完整的解析器，不处理 import 语句。",
    "采用 MIT 许可。默认分支最后一次提交于 2025-03-14，与 v1.4.2 发布同日。"
  ],
  "targets": [
    "app",
    "protocol"
  ],
  "url": "https://github.com/nccgroup/blackboxprotobuf",
  "verification": "source-reviewed",
  "verified_at": "2026-10-18"
}