protocol-reverse

Extract TCP payloads with tshark, align multiple messages of the same type to find constant bytes, length fields, and sequence numbers, then identify checksums like CRC32 or HMAC. Document the frame layout and state machine, and write a reproducible Python decode script.

Use protoc --decode_raw to inspect field numbers and wire types, or blackboxprotobuf and pbtk to infer a schema from captured messages. Field numbers are encoded as varints, making blind decoding feasible without the original definition.

tshark or Wireshark for PCAP parsing and Python for decode scripts are the core requirements. Optional tools include ImHex or 010 Editor for binary templates, Kaitai Struct for parser generation, and IDA or Ghidra for analyzing client-side serialization code.

Skip it for pure HTTP parameter signing or JavaScript encryption, which belong to JS reverse engineering, and for TLS certificate issues handled by standard proxy tooling. Firmware protocol stacks may need firmware emulation first before returning to traffic analysis.

High-entropy frames with no plaintext indicate encryption; locate the nonce or IV near frame boundaries first. Then analyze the client binary or JS to find the key derivation logic before attempting decryption or replay within authorized scope.