Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

pbtk

Recover Protobuf message definitions from compiled programs as readable .proto files. Extractors cover the Java runtimes in JAR, DEX and APK files (including ProGuard-obfuscated code), binaries that embed Protobuf reflection metadata, and web apps using the Protobuf-URL format. A GUI then binds a recovered message type to an HTTP endpoint, decodes hex-encoded captured samples into an editable field tree and resends edited messages, so analysts can relate each field to the response.

Targets
App · Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: 1.1.3, published 2026-08-21 on GitHub and PyPI; the reviewed master commit is four commits ahead of it, adding a version display, a dependency bump and new brand colors, and carries a 1.1.3.1 tag with no GitHub release or PyPI upload. The README's 2026 notes say Java extraction now works mostly with older APKs and the Chrome-based Protobuf-URL web extractor needs an update; finishing the automatic fuzzing part is listed as forthcoming.
  • Requires Python 3.10+, PySide6 and the Python protobuf runtime. The README documents a snap for Ubuntu, the pbtk-git AUR package, and uv or pipx installs, and says Windows is supported. Java extraction needs a Java runtime (the Debian instructions install OpenJDK 8), and web extraction drives a Chrome or Chromium instance through websocket-client.
  • Analysts supply the APK, JAR, DEX or native library to analyze and, optionally, hex-encoded request samples they captured themselves with a proxy such as mitmproxy or Wireshark. Replay sends the edited messages to the live endpoint the analyst configures. Extracted .protos and endpoint definitions are stored in a .pbtk folder in the home directory (a pbtk folder under APPDATA on Windows).
  • GPL-3.0-or-later per pyproject.toml. The package bundles third-party executables: protoc builds, dex2jar 2.4 jars with their Apache-2.0 notice, and JAD decompiler binaries for which the repository includes no license text. Definitions recovered from minified code keep obfuscated names until the analyst renames them.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · marin-m/pbtk · Revision 7c5fa2c
  2. pyproject.toml GitHub · marin-m/pbtk · Revision 7c5fa2c
  3. LICENSE GitHub · marin-m/pbtk · Revision 7c5fa2c
  4. src/pbtk/extractors/jar_extract.py#L46-L52 GitHub · marin-m/pbtk · Revision 7c5fa2c
  5. src/pbtk/extractors/web_extract.py#L57-L65 GitHub · marin-m/pbtk · Revision 7c5fa2c
  6. src/pbtk/utils/transports.py GitHub · marin-m/pbtk · Revision 7c5fa2c
  7. src/pbtk/utils/external GitHub · marin-m/pbtk · Revision 7c5fa2c
  8. TROUBLESHOOTING.md GitHub · marin-m/pbtk · Revision 7c5fa2c
  9. https://github.com/marin-m/pbtk/releases/tag/1.1.3
  10. https://pypi.org/project/pbtk/1.1.3/

More in Protocols

All 140 entries in Protocols

↑↓ move↵ open⌘↵ new tab