New to Claude Skills? Learn how to install them →

Pzhaoxuya520 on GitHub

Protocol Reverse Engineering

Free

Reverse engineer custom binary protocols with ease.

Get this skill

Free · Opens the source repo

What Protocol Reverse Engineering does

Protocol Reverse Engineering is designed for developers and security professionals engaged in the analysis and recovery of custom binary protocols. This skill provides a structured workflow for reverse engineering various protocols, including Protobuf, gRPC, WebSocket frames, and PCAP-driven protocol recovery. By following the outlined phases, users can systematically collect data, identify message structures, and reconstruct protocol specifications.

The skill emphasizes the importance of authorization and proper scoping, ensuring that users adhere to ethical guidelines while performing reverse engineering tasks. It guides users through the initial collection of samples, the identification of message formats, and the reconstruction of state machines, all while providing essential commands and tools to facilitate the process. Users are encouraged to document their findings and produce reproducible decoding commands, which are critical for validating their reverse engineering efforts.

This skill is particularly beneficial for those working on network security, protocol analysis, and software development where understanding the underlying communication mechanisms is essential. Whether you are dealing with proprietary protocols or analyzing traffic for security vulnerabilities, this skill equips you with the necessary steps to achieve your goals effectively.

However, it is important to note that this skill is not intended for scenarios focused solely on HTTP parameter signing or TLS certificate issues, which should be addressed using other specialized tools. Additionally, if the task involves deep analysis of firmware protocol stacks, users are advised to explore firmware penetration testing tools before utilizing this skill.

When to use it

Use this skill when you need to analyze custom TCP/UDP binary protocols or recover protocol structures from PCAP files.

When not to use it

This skill is not suitable for simple HTTP parameter signing or TLS certificate issues, nor for deep firmware analysis without prior tools.

What you can build with it

Analyzing Custom Protocols

Use this skill to reverse engineer a custom TCP protocol used in a proprietary application, allowing you to understand its communication structure.

Recovering Protocols from PCAP Files

Apply this skill to analyze captured network traffic in PCAP files, helping you reconstruct the underlying protocols used in the communication.

Decoding Protobuf Messages

Utilize this skill to decode Protobuf messages from a binary stream, enabling you to understand the data structures being transmitted.

How to install Protocol Reverse Engineering

View source

1. Install with the skills CLI

npx skills add zhaoxuya520/reverse-skill/protocol-reverse --agent claude-code

2. Or install it manually

Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.

Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs

Inside SKILL.md

Written by zhaoxuya520

Protocol Reverse Engineering

ACTION REQUIRED(读完后立刻执行)

  1. NOW: 读取 ../field-journal/precedent-reverse.md — 确认授权与常规操作边界
  2. NOW: 确认任务是否为协议/流量/序列化格式逆向(非纯 Web 参数签名 → 转 js-reverse/
  3. NOW: 若有目标网络交互 → ../scripts/case-init.ps1 完成 scope;auth 未 granted 禁止对目标 ACT
  4. NEXT: 读取 ../tool-index.md;缺工具 bootstrap(tshark/wireshark 等可能需手动)
  5. ACT: 进入工作流 Phase 1,产出帧布局或消息字典草稿

适用场景

  • 自定义 TCP/UDP 二进制协议
  • Protobuf / gRPC / FlatBuffers / MessagePack
  • WebSocket / MQTT / 私有 RPC
  • PCAP / PCAPNG 还原字段与状态机
  • 客户端-服务端校验、序列号、加密帧头

不走本 skill

情况去哪
仅 HTTP 参数签名 / JS 加密js-reverse/
仅 TLS 证书问题pentest-tools/ 或浏览器代理
固件内协议栈深挖 + 仿真firmware-pentest/ 后再回本 skill

工作流

Phase 1 — 采集与分诊

□ 拿到样本:PCAP / 代理导出 / 客户端日志 / 二进制
□ 标记方向:C→S / S→C;是否有握手、心跳、重连
□ 固定头?魔数?长度字段?TLV?定长?
□ 是否压缩(zlib/gzip/lz4)或加密(AES/ChaCha 帧内)
□ tshark -r cap.pcap -T fields -e frame.number -e ip.src -e tcp.payload

Phase 2 — 帧布局还原

□ 对齐多个同类消息,找不变字节 / 自增序列号
□ 长度字段:大端/小端、含头/不含头
□ 校验:CRC16/32、checksum、HMAC 位置
□ 画出状态机:Connect → Auth → Ready → Request/Response → Close
□ 工具:Wireshark 自定义 dissector 草稿 / ImHex / 010 Editor 模板 / Kaitai Struct

Phase 3 — 序列化与加密

□ Protobuf:.proto 恢复(blackboxprotobuf / pbtk / protoc --decode_raw)
□ gRPC:HTTP/2 headers + protobuf body
□ 加密:找密钥派生(客户端 so/dll/JS)→ 联合 ida-reverse / js-reverse / apk-reverse
□ 重放:仅在授权 scope 内;先无害字段再敏感操作

Phase 4 — 产物

MUST 产出:
- 消息类型表(name / opcode / fields)
- 至少 1 条可复现的解码命令或脚本
- Evidence:原始 hex 摘录 + 解码结果(脱敏)

工具链

工具必需用途自举
tshark / Wireshark强烈建议PCAP 解析手动 / winget
Python3解码脚本系统
blackboxprotobuf可选未知 protobufpip
ImHex / 010可选结构模板手动
IDA / r2 / Ghidra按需客户端序列化函数见对应 skill

参考

  • references/protocol-workflow.md — 帧布局与 Protobuf 速查
  • 相关:../ida-reverse/ ../js-reverse/ ../firmware-pentest/ ../pentest-tools/

路由上下文

上游: MASTER-ROUTING R21 · routing.md
下游: 需客户端算法 → ida-reverse/js-reverse;需利用重放 → pentest-tools/api-security
同级: malware-analysis(C2 协议)、digital-forensics(流量取证)

任务完成自检

  • 是否还原了消息布局或状态机(而非只贴 hex)?
  • 是否有可复现解码命令?
  • 是否遵守 scope / 脱敏?
  • 是否回写 field-journal / 报告 Checklist?

Frequently asked questions about Protocol Reverse Engineering

Similar skills