Skip to content

Comment on Reverse Engineering Apple's typedstream Formatparent

Comments

Very much so. Pretty much all of these protocols are simplifications of asn1 and in some cases (like protobuf) there are a handful of things that got lost because the wire formats didn’t have them as they didn’t need them. A schema indicator being the single biggest flaw in protobuf.

Why is the lack of a schema indicator the biggest flaw of protobuf?

It makes it impossible to write a general purpose dissector that takes captured messages or bytes and figure out how to parse it.

All they needed was a varint at the head of any marshaled from to at least provide some scoping clue.

If you parse a serialized protobuf byte array without having a .proto file, you have no way to dustinguish a byte string field from a nested message field. Thus you have no way to know how deep your parser should go.

cssOP

Semi-related, one of the `imessage-exporter` contributors provided a great write-up on reverse engineering the handwritten and digital touch message protobufs [0]. The reconstructed proto files are [1] [2].

[0]: https://github.com/trymoose/handwriting2svg/blob/0eb56cf4582...

[1]: https://github.com/ReagentX/imessage-exporter/blob/beeb853b2...

[2]: https://github.com/ReagentX/imessage-exporter/blob/beeb853b2...

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.