Protocol Reverse Engineering

ACTION REQUIRED (Execute Immediately After Reading)

1. NOW

   : Read

   ../field-journal/precedent-reverse.md

   — Confirm authorization and regular operation boundaries

2. NOW

   : Confirm whether the task is protocol/traffic/serialization format reverse engineering (not pure Web parameter signature → redirect to

   js-reverse/

   )

3. NOW

   : If there is target network interaction → Complete scope with

   ../scripts/case-init.ps1

   ; No ACT on target if

   auth

   is not granted

4. NEXT

   : Read

   ../tool-index.md

   ; Bootstrap missing tools (tshark/wireshark etc. may require manual setup)

5. ACT

   : Enter Phase 1 of the workflow, produce draft frame layout or message dictionary

Applicable Scenarios

• Custom TCP/UDP binary protocols
• Protobuf / gRPC / FlatBuffers / MessagePack
• WebSocket / MQTT / Private RPC
• PCAP / PCAPNG field and state machine recovery
• Client-server verification, serial numbers, encrypted frame headers

Not Applicable to This Skill

js-reverse/

pentest-tools/

firmware-pentest/

Workflow

Phase 1 — Collection and Triage

□ Obtain samples: PCAP / proxy exports / client logs / binaries
□ Mark direction: C→S / S→C; Check for handshake, heartbeat, reconnection
□ Fixed header? Magic number? Length field? TLV? Fixed-length?
□ Compressed (zlib/gzip/lz4) or encrypted (AES/ChaCha in-frame)?
□ tshark -r cap.pcap -T fields -e frame.number -e ip.src -e tcp.payload

Phase 2 — Frame Layout Restoration

□ Align multiple similar messages to find invariant bytes / auto-increment serial numbers
□ Length field: big-endian/little-endian, includes header/excludes header
□ Verification: CRC16/32, checksum, HMAC position
□ Draw state machine: Connect → Auth → Ready → Request/Response → Close
□ Tools: Wireshark custom dissector draft / ImHex / 010 Editor template / Kaitai Struct

Phase 3 — Serialization and Encryption

□ Protobuf: .proto recovery (blackboxprotobuf / pbtk / protoc --decode_raw)
□ gRPC: HTTP/2 headers + protobuf body
□ Encryption: Find key derivation (client so/dll/JS) → Collaborate with ida-reverse / js-reverse / apk-reverse
□ Replay: Only within authorized scope; Test harmless fields first then sensitive operations

Phase 4 — Deliverables

MUST produce:
- Message type table (name / opcode / fields)
- At least 1 reproducible decoding command or script
- Evidence: Excerpt of raw hex + decoded results (desensitized)

Toolchain

References

• references/protocol-workflow.md

  — Quick reference for frame layout and Protobuf
• Related:

  ../ida-reverse/

  ../js-reverse/

  ../firmware-pentest/

  ../pentest-tools/

Routing Context

MASTER-ROUTING

routing.md

ida-reverse

js-reverse

pentest-tools

api-security

malware-analysis

digital-forensics

Task Completion Self-Check

• Has the message layout or state machine been restored (instead of just pasting hex)?
• Is there a reproducible decoding command?
• Have scope / desensitization rules been followed?
• Has the field-journal / report Checklist been updated?