Re: [protobuf] Decoding message protobuff

2018-07-17 Thread Marc Gravell
Btw you might find https://protogen.marcgravell.com/decode useful - it
explains how each byte is interpreted. It doesn't give the details (so: it
doesn't explain how varint works), but it at least makes it explicit which
bytes have contributed to which outcomes.

On Tue, 17 Jul 2018, 08:22 Marc Gravell,  wrote:

> AA 06 is indeed 101, that's "varint" encoding. The MSB of each byte is
> continuation, 7 bits payload, and adjust for endianness. The idea of
> decode-raw is that it is enough to start guessing at how to reverse
> engineer a message, for example you can see values that are clearly string
> IP-addresses. However, the other fields are much harder to interpret
> without context. If you do have the original .proto schema, it would help
> tremendously.
>
> On Tue, 17 Jul 2018, 05:17 ,  wrote:
>
>> How to decode protobuff embedded message. Please give any pseudo code. I
>> see aa 06 gets decoded as 101. Please let me know how?
>>
>> Protobuff data:
>>
>> echo -n "0a 0b 31 39 32 2e 31 30 2e 31 31 2e 31 10 01 aa 06 88 01 e2 a4
>> 01 83 01 1a 80 01 0a 1e 0a 06 70 6f 72 74 5f 32 10 80 b7 e3 88 08 18 02 32
>> 0c 08 00 10 00 28 00 30 00 38 00 40 00 0a 1e 0a 06 70 6f 72 74 5f 33 10 80
>> b7 e3 88 08 18 03 32 0c 08 00 10 00 28 00 30 00 38 00 40 00 0a 1e 0a 06 70
>> 6f 72 74 5f 34 10 80 b7 e3 88 08 18 04 32 0c 08 00 10 00 28 00 30 00 38 00
>> 40 00 0a 1e 0a 06 70 6f 72 74 5f 35 10 80 b7 e3 88 08 18 05 32 0c 08 00 10
>> 00 28 00 30 00 38 00 40 00" | xxd -r -p | protoc --decode_raw
>> 1: "192.10.11.1"
>> 2: 1
>> 101 {
>>   2636 {
>> 3 {
>>   1 {
>> 1: "port_2"
>> 2: 2165889920
>> 3: 2
>> 6 {
>>   1: 0
>>   2: 0
>>   5: 0
>>   6: 0
>>   7: 0
>>   8: 0
>> }
>>   }
>>   1 {
>> 1: "port_3"
>> 2: 2165889920
>> 3: 3
>> 6 {
>>   1: 0
>>   2: 0
>>   5: 0
>>   6: 0
>>   7: 0
>>   8: 0
>> }
>>   }
>>   1 {
>> 1: "port_4"
>> 2: 2165889920
>> 3: 4
>> 6 {
>>   1: 0
>>   2: 0
>>   5: 0
>>   6: 0
>>   7: 0
>>   8: 0
>> }
>>   }
>>   1 {
>> 1: "port_5"
>> 2: 2165889920
>> 3: 5
>> 6 {
>>   1: 0
>>   2: 0
>>   5: 0
>>   6: 0
>>   7: 0
>>   8: 0
>> }
>>   }
>> }
>>   }
>> }
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Protocol Buffers" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to protobuf+unsubscr...@googlegroups.com.
>> To post to this group, send email to protobuf@googlegroups.com.
>> Visit this group at https://groups.google.com/group/protobuf.
>> For more options, visit https://groups.google.com/d/optout.
>>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Protocol Buffers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to protobuf+unsubscr...@googlegroups.com.
To post to this group, send email to protobuf@googlegroups.com.
Visit this group at https://groups.google.com/group/protobuf.
For more options, visit https://groups.google.com/d/optout.


Re: [protobuf] Decoding message protobuff

2018-07-17 Thread Marc Gravell
AA 06 is indeed 101, that's "varint" encoding. The MSB of each byte is
continuation, 7 bits payload, and adjust for endianness. The idea of
decode-raw is that it is enough to start guessing at how to reverse
engineer a message, for example you can see values that are clearly string
IP-addresses. However, the other fields are much harder to interpret
without context. If you do have the original .proto schema, it would help
tremendously.

On Tue, 17 Jul 2018, 05:17 ,  wrote:

> How to decode protobuff embedded message. Please give any pseudo code. I
> see aa 06 gets decoded as 101. Please let me know how?
>
> Protobuff data:
>
> echo -n "0a 0b 31 39 32 2e 31 30 2e 31 31 2e 31 10 01 aa 06 88 01 e2 a4
> 01 83 01 1a 80 01 0a 1e 0a 06 70 6f 72 74 5f 32 10 80 b7 e3 88 08 18 02 32
> 0c 08 00 10 00 28 00 30 00 38 00 40 00 0a 1e 0a 06 70 6f 72 74 5f 33 10 80
> b7 e3 88 08 18 03 32 0c 08 00 10 00 28 00 30 00 38 00 40 00 0a 1e 0a 06 70
> 6f 72 74 5f 34 10 80 b7 e3 88 08 18 04 32 0c 08 00 10 00 28 00 30 00 38 00
> 40 00 0a 1e 0a 06 70 6f 72 74 5f 35 10 80 b7 e3 88 08 18 05 32 0c 08 00 10
> 00 28 00 30 00 38 00 40 00" | xxd -r -p | protoc --decode_raw
> 1: "192.10.11.1"
> 2: 1
> 101 {
>   2636 {
> 3 {
>   1 {
> 1: "port_2"
> 2: 2165889920
> 3: 2
> 6 {
>   1: 0
>   2: 0
>   5: 0
>   6: 0
>   7: 0
>   8: 0
> }
>   }
>   1 {
> 1: "port_3"
> 2: 2165889920
> 3: 3
> 6 {
>   1: 0
>   2: 0
>   5: 0
>   6: 0
>   7: 0
>   8: 0
> }
>   }
>   1 {
> 1: "port_4"
> 2: 2165889920
> 3: 4
> 6 {
>   1: 0
>   2: 0
>   5: 0
>   6: 0
>   7: 0
>   8: 0
> }
>   }
>   1 {
> 1: "port_5"
> 2: 2165889920
> 3: 5
> 6 {
>   1: 0
>   2: 0
>   5: 0
>   6: 0
>   7: 0
>   8: 0
> }
>   }
> }
>   }
> }
>
> --
> You received this message because you are subscribed to the Google Groups
> "Protocol Buffers" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to protobuf+unsubscr...@googlegroups.com.
> To post to this group, send email to protobuf@googlegroups.com.
> Visit this group at https://groups.google.com/group/protobuf.
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"Protocol Buffers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to protobuf+unsubscr...@googlegroups.com.
To post to this group, send email to protobuf@googlegroups.com.
Visit this group at https://groups.google.com/group/protobuf.
For more options, visit https://groups.google.com/d/optout.