skills.rest
dslsdzc
dslsdzcCOMMUNITY
Explore all skills by this author →
GitHub

re-protocol

Orchestrates network protocol reverse engineering from packet capture through decryption to state machine reconstruction.

64|9|Updated Aug 17, 2026
Search Tags:#state machine#packet capture#protocol reverse engineering#tls analysis#c2 analysis#key extraction#traffic decryption
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-protocol-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-protocol
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-protocol
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-protocol-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reverse engineering an unknown network protocol requires coordinating many specialized steps—capturing traffic, identifying encryption, extracting keys, decrypting ciphertext, and rebuilding the protocol state machine—and doing them in the wrong order (e.g., parsing ciphertext as plaintext) produces garbage results. This gateway skill orchestrates the full workflow and routes each subtask to the right atomic skill. ## Core Features & Use Cases - End-to-End Workflow Orchestration: Sequences capture (re-netcap) → crypto identification (re-crypto-id) → key extraction (re-crypto-keys) → decryption (re-crypto-decrypt) → state machine reconstruction (re-proto-rev), with evidence hashing at each stage. - Decision-Tree Routing: Branches by input type—pcap vs. binary-only, plaintext vs. ciphertext, ICS/SCADA (Modbus/DNP3/OPC UA), IoT (MQTT/CoAP/BLE/Zigbee), white-box crypto, and standard TLS analysis. - Pitfall Prevention: Encodes hard-won lessons such as isolating sandbox networks before capture (INetSim/fake DNS), never running state machine reconstruction on undecrypted ciphertext, validating decryption against known plaintext, and detecting DoH-based C2 that blinds DNS monitoring. - Use Case: Given a malware sample's captured C2 traffic, the gateway directs you to identify the encryption, pull the key from a memory dump, rewrite the decryption routine as a standalone Python script, verify against known plaintext, then reconstruct the command protocol's fields and state machine with Scapy. ## Quick Start Ask the AI to analyze this captured network traffic and reverse engineer the unknown protocol, decrypting it first if it is encrypted.

Frequently Asked Questions about re-protocol

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer an unknown network protocol?▼

Start by capturing filtered traffic in an isolated sandbox, then check whether it is encrypted using entropy analysis. Decrypt first if needed, then cluster messages by length and timing, infer fixed headers and field types, and rebuild the state machine with a Scapy parser.

How to decrypt encrypted malware C2 traffic?▼

Identify the algorithm via constant-table fingerprints like AES S-boxes, then extract keys statically from strings and resources or dynamically from memory dumps. Rewrite the decryption routine as a standalone Python script and verify output against known plaintext headers.

Why does protocol parsing produce garbage output on captured traffic?▼

The traffic is almost certainly still encrypted—high entropy above 7.0 with no structure means ciphertext. Running field inference on ciphertext yields random bytes, so complete crypto identification and decryption before state machine reconstruction.

Can this analyze ICS and IoT protocols like Modbus or MQTT?▼

Yes, the gateway routes industrial protocols such as Modbus, DNP3, and OPC UA to the ICS sub-skill and IoT protocols like MQTT, CoAP, BLE, and Zigbee to the IoT sub-skill, including point-table extraction and firmware cross-analysis.

What if malware uses DNS over HTTPS for C2 communication?▼

DoH bypasses fake DNS and INetSim isolation, leaving only encrypted 443 traffic to known DoH endpoints. Detect it via TLS handshakes without SNI or connections without DNS events, then pivot to behavioral beacon analysis or redirect the DoH endpoint IP.

When should I capture traffic versus analyze the binary statically?▼

Prefer declarative definitions first—search the binary for embedded proto or schema files, then decompile packing logic, and only fall back to packet capture. Static analysis of the client often reveals the full protocol faster than traffic observation.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

analyzing-network-traffic-of-malware

Analyze malware network traffic PCAPs to identify C2 protocols and generate Suricata rules.

Community
Advanced
wgpsecwgpsec
1.7k

c2-beacon-analysis

Extract C2 configurations and IOCs from Cobalt Strike, Sliver, and Havoc beacon samples.

Official
Advanced
bpnrockstarbpnrockstar

reverse-engineering

Reverse-engineer closed-source binaries and firmware via static and dynamic analysis.

Community
Advanced
DazlarusDazlarus

rest-api

Reviews and guides REST API design using HTTP methods, status codes, and FastAPI patterns.

Community
Intermediate