Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

protobuf-inspector

Parses Protocol Buffers blobs (proto2 or proto3) without their .proto definition and prints a colored view of the fields in wire order, trying each length-delimited chunk as a nested message, then a packed array, a string and finally a hexdump. Analysts record what they work out in a protobuf_config.py file, with field types and names, message and enum types and custom native types, until the parser no longer has to guess. Field names, zig-zag encoding, signedness and integer-versus-float choices cannot be read from the wire, and the README says guesses can be wrong, especially for small chunks.

Targets
Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Development is dormant: the only release, 0.2 on PyPI and tagged v0.2.0, and the reviewed master commit both date from 2020-11-24, with no later commits.
  • Install with pip (setup.py declares Python >=3.3) and pipe one raw protobuf blob to protobuf_inspector on standard input, optionally naming the root message type. The README documents no capture, gRPC or HTTP handling, so blobs must first be extracted from traffic or files the analyst is entitled to inspect.
  • The CLI searches the working directory and each parent up to the filesystem mount point for protobuf_config.py and runs it with runpy, so a config file executes as Python code. A dump type writes matching chunks to dump.N files in the working directory, and parse errors stop inside the affected field and make the command exit non-zero.
  • ISC license. The README says the Python API was not designed as a library and may change. The repository has no tests or CI configuration.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mildsunrise/protobuf-inspector · Revision 3211be9
  2. CONFIG.md GitHub · mildsunrise/protobuf-inspector · Revision 3211be9
  3. protobuf_inspector/__main__.py GitHub · mildsunrise/protobuf-inspector · Revision 3211be9
  4. protobuf_inspector/types.py GitHub · mildsunrise/protobuf-inspector · Revision 3211be9
  5. setup.py GitHub · mildsunrise/protobuf-inspector · Revision 3211be9
  6. LICENSE GitHub · mildsunrise/protobuf-inspector · Revision 3211be9
  7. https://pypi.org/project/protobuf-inspector/0.2/

More in Protocols

All 140 entries in Protocols

↑↓ move↵ open⌘↵ new tab