{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/marin-m/pbtk/blob/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/pyproject.toml",
    "https://github.com/marin-m/pbtk/blob/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/LICENSE",
    "https://github.com/marin-m/pbtk/blob/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/src/pbtk/extractors/jar_extract.py#L46-L52",
    "https://github.com/marin-m/pbtk/blob/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/src/pbtk/extractors/web_extract.py#L57-L65",
    "https://github.com/marin-m/pbtk/blob/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/src/pbtk/utils/transports.py",
    "https://github.com/marin-m/pbtk/tree/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/src/pbtk/utils/external",
    "https://github.com/marin-m/pbtk/blob/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/TROUBLESHOOTING.md",
    "https://github.com/marin-m/pbtk/releases/tag/1.1.3",
    "https://pypi.org/project/pbtk/1.1.3/"
  ],
  "category": "protocol-analysis",
  "description_en": "Recover Protobuf message definitions from compiled programs as readable .proto files. Extractors cover the Java runtimes in JAR, DEX and APK files (including ProGuard-obfuscated code), binaries that embed Protobuf reflection metadata, and web apps using the Protobuf-URL format. A GUI then binds a recovered message type to an HTTP endpoint, decodes hex-encoded captured samples into an editable field tree and resends edited messages, so analysts can relate each field to the response.",
  "description_zh": "从已编译程序中恢复 Protobuf 消息定义，并还原为可读的 .proto 文件。提取器覆盖 JAR、DEX 和 APK 中的各类 Java 运行时（包括经 ProGuard 混淆的代码）、内嵌 Protobuf 反射元数据的二进制文件，以及使用 Protobuf-URL 格式的 Web 应用。随后可在图形界面中把恢复出的消息类型绑定到 HTTP 端点，将十六进制形式的抓包样本解码为可编辑的字段树，并重新发送修改后的消息，帮助分析者把每个字段与响应对应起来。",
  "entry_url": "https://awesomerea.org/resources/pbtk/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/pbtk/",
  "evidence_url": "https://github.com/marin-m/pbtk/blob/7c5fa2ca4cee9e8a2862c6e3332e7b8a850bb8e8/README.md",
  "group": "tools",
  "id": "pbtk",
  "json_url": "https://awesomerea.org/resources/pbtk/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/pbtk/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/pbtk/index.md",
  "name": "pbtk",
  "name_zh": "pbtk Protobuf 逆向工具集",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: 1.1.3, published 2026-08-21 on GitHub and PyPI; the reviewed master commit is four commits ahead of it, adding a version display, a dependency bump and new brand colors, and carries a 1.1.3.1 tag with no GitHub release or PyPI upload. The README's 2026 notes say Java extraction now works mostly with older APKs and the Chrome-based Protobuf-URL web extractor needs an update; finishing the automatic fuzzing part is listed as forthcoming.",
    "Requires Python 3.10+, PySide6 and the Python protobuf runtime. The README documents a snap for Ubuntu, the pbtk-git AUR package, and uv or pipx installs, and says Windows is supported. Java extraction needs a Java runtime (the Debian instructions install OpenJDK 8), and web extraction drives a Chrome or Chromium instance through websocket-client.",
    "Analysts supply the APK, JAR, DEX or native library to analyze and, optionally, hex-encoded request samples they captured themselves with a proxy such as mitmproxy or Wireshark. Replay sends the edited messages to the live endpoint the analyst configures. Extracted .protos and endpoint definitions are stored in a .pbtk folder in the home directory (a pbtk folder under APPDATA on Windows).",
    "GPL-3.0-or-later per pyproject.toml. The package bundles third-party executables: protoc builds, dex2jar 2.4 jars with their Apache-2.0 notice, and JAD decompiler binaries for which the repository includes no license text. Definitions recovered from minified code keep obfuscated names until the analyst renames them."
  ],
  "requirements_zh": [
    "审阅时最新版本为 1.1.3，于 2026-08-21 发布在 GitHub 和 PyPI；所审阅的 master 提交比它多四个提交，加入了版本显示、一次依赖升级和新的品牌配色，并带有一个既无 GitHub 发布也未上传 PyPI 的 1.1.3.1 标签。README 中 2026 年的说明指出，Java 提取目前主要适用于较旧的 APK，基于 Chrome 的 Protobuf-URL Web 提取器有待更新；完成自动模糊测试部分仍列为后续计划。",
    "需要 Python 3.10+、PySide6 和 Python protobuf 运行时。README 介绍了 Ubuntu 的 snap 包、AUR 的 pbtk-git 包以及 uv 或 pipx 安装方式，并称支持 Windows。Java 提取需要 Java 运行时（Debian 安装说明中使用 OpenJDK 8），Web 提取则通过 websocket-client 驱动 Chrome 或 Chromium 实例。",
    "分析者需自行提供要分析的 APK、JAR、DEX 或原生库，并可选提供自己用 mitmproxy、Wireshark 等工具抓取的十六进制请求样本。重放功能会把修改后的消息发送到分析者配置的在线端点。提取出的 .proto 和端点定义保存在用户主目录的 .pbtk 文件夹中（Windows 上为 APPDATA 下的 pbtk 文件夹）。",
    "pyproject.toml 声明 GPL-3.0-or-later。软件包内附带第三方可执行文件：protoc 构建、附 Apache-2.0 声明的 dex2jar 2.4 jar 包，以及仓库中没有任何许可证文本的 JAD 反编译器二进制。从混淆代码中恢复出的定义会保留混淆名称，需由分析者自行重命名。"
  ],
  "targets": [
    "app",
    "protocol"
  ],
  "url": "https://github.com/marin-m/pbtk",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}