12

Is it possible to decode protobuf serialized files without schema with tools or anything that would decode the binary data to readable format?

andre_lamothe
  • 2,171
  • 2
  • 41
  • 74
  • see my answer here https://stackoverflow.com/questions/7914034/how-to-decode-protobuf-binary-response/48868239#48868239 – AutomatedMike Sep 04 '19 at 11:54

2 Answers2

16

You can often deduce the schema. In fact, IIRC the "protoc" tool has a set of parameters (--decode_raw, iirc) where it will do precisely that - making informed guesses. However, it is a guess - the format is ambiguous in that multiple different types of data can be stored in the same mechanisms - for example, a length-prefixed chunk could be:

  • a sub-object (of any user type)
  • a packed array (of various primitive types)
  • a utf-8 string
  • a raw byte[]
  • and probably something else I'm forgetting

Likewise, a 4-byte fixed-width chunk could be a fixed-width integer, or a float; the integer could be signed or unsigned.

Marc Gravell
  • 1,026,079
  • 266
  • 2,566
  • 2,900
  • I tired to feed a file that is serialized using it, and I wrote protoc filename.protobuf --decode_raw and it says no input file should be givien – andre_lamothe Sep 17 '14 at 20:53
  • @moaz dis you see the example? – Marc Gravell Sep 17 '14 at 21:15
  • yes, and that's what I'm getting: protoc f.bytes --decode_raw When using --decode_raw, no input files should be given. – andre_lamothe Sep 17 '14 at 21:36
  • is it possible to encode the raw bytes again ? so that I can change some values and then re-encode it to the original file ? – andre_lamothe Sep 17 '14 at 22:17
  • @moaz tricky; you'd really need a reader/writer API for that. It is probably easier to write a .proto schema and deserialize/edit/serialize – Marc Gravell Sep 17 '14 at 22:20
  • I mean If I could just decode the raw bytes out of a file, and just wanted to change one byte, it's not possible to re-encode it again ? or know where is actually that byte that I want to modify in the original file ? I'm kinda want to hack a protof file : ) – andre_lamothe Sep 17 '14 at 22:28
  • @moaz that depends a bit on what one byte you are changing. There are some changes that cause length changes (even for one byte), and some changes that do not. If it doesn't cause a length change: you can just hack away. – Marc Gravell Sep 17 '14 at 22:31
  • 2
    The `--decode_raw` option expects to read the input from stdin. So the actual command is `protoc --decode_raw < INPUT_FILE`. – sauerburger Dec 30 '20 at 22:32
0

I use protoc --decode_raw, like @Marc Gravell said, but also if you want to do it in javascript or on the CLI, my tool/library rawproto can be handy, for programmatic access, like import the outputted JSON and parse it with regular stuff. You can also use it on the web, if you want to build your own HTML/javascript GUI tool to mess with raw protobuf.

Your question is specifically about C#, but you might get inspiration from my thing, or be able to use it to generate the proto SDL (which needs a little hand-tuning, generally, but can be a good start to reverse-engineering a proto) which you can use in normal C# protobuf things.

konsumer
  • 3,411
  • 1
  • 30
  • 31