
Protocol Reverse Engineering
FreeReverse engineer custom binary protocols with ease.
Free · Opens the source repo
What Protocol Reverse Engineering does
Protocol Reverse Engineering is designed for developers and security professionals engaged in the analysis and recovery of custom binary protocols. This skill provides a structured workflow for reverse engineering various protocols, including Protobuf, gRPC, WebSocket frames, and PCAP-driven protocol recovery. By following the outlined phases, users can systematically collect data, identify message structures, and reconstruct protocol specifications.
The skill emphasizes the importance of authorization and proper scoping, ensuring that users adhere to ethical guidelines while performing reverse engineering tasks. It guides users through the initial collection of samples, the identification of message formats, and the reconstruction of state machines, all while providing essential commands and tools to facilitate the process. Users are encouraged to document their findings and produce reproducible decoding commands, which are critical for validating their reverse engineering efforts.
This skill is particularly beneficial for those working on network security, protocol analysis, and software development where understanding the underlying communication mechanisms is essential. Whether you are dealing with proprietary protocols or analyzing traffic for security vulnerabilities, this skill equips you with the necessary steps to achieve your goals effectively.
However, it is important to note that this skill is not intended for scenarios focused solely on HTTP parameter signing or TLS certificate issues, which should be addressed using other specialized tools. Additionally, if the task involves deep analysis of firmware protocol stacks, users are advised to explore firmware penetration testing tools before utilizing this skill.
When to use it
Use this skill when you need to analyze custom TCP/UDP binary protocols or recover protocol structures from PCAP files.
When not to use it
This skill is not suitable for simple HTTP parameter signing or TLS certificate issues, nor for deep firmware analysis without prior tools.
What you can build with it
Analyzing Custom Protocols
Use this skill to reverse engineer a custom TCP protocol used in a proprietary application, allowing you to understand its communication structure.
Recovering Protocols from PCAP Files
Apply this skill to analyze captured network traffic in PCAP files, helping you reconstruct the underlying protocols used in the communication.
Decoding Protobuf Messages
Utilize this skill to decode Protobuf messages from a binary stream, enabling you to understand the data structures being transmitted.
How to install Protocol Reverse Engineering
View source1. Install with the skills CLI
npx skills add zhaoxuya520/reverse-skill/protocol-reverse --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by zhaoxuya520Protocol Reverse Engineering
ACTION REQUIRED(读完后立刻执行)
NOW: 读取../field-journal/precedent-reverse.md— 确认授权与常规操作边界NOW: 确认任务是否为协议/流量/序列化格式逆向(非纯 Web 参数签名 → 转js-reverse/)NOW: 若有目标网络交互 →../scripts/case-init.ps1完成 scope;auth未 granted 禁止对目标 ACTNEXT: 读取../tool-index.md;缺工具 bootstrap(tshark/wireshark 等可能需手动)ACT: 进入工作流 Phase 1,产出帧布局或消息字典草稿
适用场景
- 自定义 TCP/UDP 二进制协议
- Protobuf / gRPC / FlatBuffers / MessagePack
- WebSocket / MQTT / 私有 RPC
- PCAP / PCAPNG 还原字段与状态机
- 客户端-服务端校验、序列号、加密帧头
不走本 skill
| 情况 | 去哪 |
|---|---|
| 仅 HTTP 参数签名 / JS 加密 | js-reverse/ |
| 仅 TLS 证书问题 | pentest-tools/ 或浏览器代理 |
| 固件内协议栈深挖 + 仿真 | firmware-pentest/ 后再回本 skill |
工作流
Phase 1 — 采集与分诊
□ 拿到样本:PCAP / 代理导出 / 客户端日志 / 二进制
□ 标记方向:C→S / S→C;是否有握手、心跳、重连
□ 固定头?魔数?长度字段?TLV?定长?
□ 是否压缩(zlib/gzip/lz4)或加密(AES/ChaCha 帧内)
□ tshark -r cap.pcap -T fields -e frame.number -e ip.src -e tcp.payload
Phase 2 — 帧布局还原
□ 对齐多个同类消息,找不变字节 / 自增序列号
□ 长度字段:大端/小端、含头/不含头
□ 校验:CRC16/32、checksum、HMAC 位置
□ 画出状态机:Connect → Auth → Ready → Request/Response → Close
□ 工具:Wireshark 自定义 dissector 草稿 / ImHex / 010 Editor 模板 / Kaitai Struct
Phase 3 — 序列化与加密
□ Protobuf:.proto 恢复(blackboxprotobuf / pbtk / protoc --decode_raw)
□ gRPC:HTTP/2 headers + protobuf body
□ 加密:找密钥派生(客户端 so/dll/JS)→ 联合 ida-reverse / js-reverse / apk-reverse
□ 重放:仅在授权 scope 内;先无害字段再敏感操作
Phase 4 — 产物
MUST 产出:
- 消息类型表(name / opcode / fields)
- 至少 1 条可复现的解码命令或脚本
- Evidence:原始 hex 摘录 + 解码结果(脱敏)
工具链
| 工具 | 必需 | 用途 | 自举 |
|---|---|---|---|
| tshark / Wireshark | 强烈建议 | PCAP 解析 | 手动 / winget |
| Python3 | 是 | 解码脚本 | 系统 |
| blackboxprotobuf | 可选 | 未知 protobuf | pip |
| ImHex / 010 | 可选 | 结构模板 | 手动 |
| IDA / r2 / Ghidra | 按需 | 客户端序列化函数 | 见对应 skill |
参考
references/protocol-workflow.md— 帧布局与 Protobuf 速查- 相关:
../ida-reverse/../js-reverse/../firmware-pentest/../pentest-tools/
路由上下文
上游: MASTER-ROUTING R21 · routing.md
下游: 需客户端算法 → ida-reverse/js-reverse;需利用重放 → pentest-tools/api-security
同级: malware-analysis(C2 协议)、digital-forensics(流量取证)
任务完成自检
- 是否还原了消息布局或状态机(而非只贴 hex)?
- 是否有可复现解码命令?
- 是否遵守 scope / 脱敏?
- 是否回写 field-journal / 报告 Checklist?
Frequently asked questions about Protocol Reverse Engineering
Similar skills
Cloudflare Security Audit
Perform authorized security audits on codebases.
Authenticated Scan with OpenVAS
Perform deep vulnerability scans using OpenVAS with credentials.
Active Directory Penetration Test
Conduct focused AD penetration tests with ease.
Active Directory BloodHound Analysis
Visualize Active Directory attack paths and risks.
Orchestrating LLM Attacks with PyRIT
Automate multi-turn adversarial attacks against LLMs.
Operating Sliver C2
Deploy and manage Sliver C2 for red-team engagements.
