Protocol Reverse Engineering
Unverified●30/40Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor·UnknownWe have not crawled the repo tree, so we will not guess
Codex·UnknownWe have not crawled the repo tree, so we will not guess
Gemini CLI·UnknownThe spec defines no detection rule for Gemini
Copilot·UnknownWe have not crawled the repo tree, so we will not guess
npx agentalley add protocol-reverse-engineeringWho is stuck, and on what
Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
The whole source
Frontmatter — 2 properties
| name | protocol-reverse-engineering |
|---|---|
| description | Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication. |
| 1 | --- |
| 2 | name: protocol-reverse-engineering |
| 3 | description: Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication. |
| 4 | ---A5 — No allowed-tools declared — no way to tell what this skill may touch |
| 5 | |
| 6 | # Protocol Reverse Engineering |
| 7 | |
| 8 | Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging. |
| 9 | |
| 10 | ## Traffic Capture |
| 11 | |
| 12 | ### Wireshark Capture |
| 13 | |
| 14 | ```bash |
| 15 | # Capture on specific interface |
| 16 | wireshark -i eth0 -k |
| 17 | |
| 18 | # Capture with filter |
| 19 | wireshark -i eth0 -k -f "port 443" |
| 20 | |
| 21 | # Capture to file |
| 22 | tshark -i eth0 -w capture.pcap |
| 23 | |
| 24 | # Ring buffer capture (rotate files) |
| 25 | tshark -i eth0 -b filesize:100000 -b files:10 -w capture.pcap |
| 26 | ``` |
| 27 | |
| 28 | ### tcpdump Capture |
| 29 | |
| 30 | ```bash |
| 31 | # Basic capture |
| 32 | tcpdump -i eth0 -w capture.pcap |
| 33 | |
| 34 | # With filter |
| 35 | tcpdump -i eth0 port 8080 -w capture.pcap |
| 36 | |
| 37 | # Capture specific bytes |
| 38 | tcpdump -i eth0 -s 0 -w capture.pcap # Full packet |
| 39 | |
| 40 | # Real-time display |
| 41 | tcpdump -i eth0 -X port 80 |
| 42 | ``` |
| 43 | |
| 44 | ### Man-in-the-Middle Capture |
| 45 | |
| 46 | ```bash |
| 47 | # mitmproxy for HTTP/HTTPS |
| 48 | mitmproxy --mode transparent -p 8080 |
| 49 | |
| 50 | # SSL/TLS interception |
| 51 | mitmproxy --mode transparent --ssl-insecure |
| 52 | |
| 53 | # Dump to file |
| 54 | mitmdump -w traffic.mitm |
| 55 | |
| 56 | # Burp Suite |
| 57 | # Configure browser proxy to 127.0.0.1:8080 |
| 58 | ``` |
| 59 | |
| 60 | ## Protocol Analysis |
| 61 | |
| 62 | ### Wireshark Analysis |
| 63 | |
| 64 | ``` |
| 65 | # Display filters |
| 66 | tcp.port == 8080 |
| 67 | http.request.method == "POST" |
| 68 | ip.addr == 192.168.1.1 |
| 69 | tcp.flags.syn == 1 && tcp.flags.ack == 0 |
| 70 | frame contains "password" |
| 71 | |
| 72 | # Following streams |
| 73 | Right-click > Follow > TCP Stream |
| 74 | Right-click > Follow > HTTP Stream |
| 75 | |
| 76 | # Export objects |
| 77 | File > Export Objects > HTTP |
| 78 | |
| 79 | # Decryption |
| 80 | Edit > Preferences > Protocols > TLS |
| 81 | - (Pre)-Master-Secret log filename |
| 82 | - RSA keys list |
| 83 | ``` |
| 84 | |
| 85 | ### tshark Analysis |
| 86 | |
| 87 | ```bash |
| 88 | # Extract specific fields |
| 89 | tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port |
| 90 | |
| 91 | # Statistics |
| 92 | tshark -r capture.pcap -q -z conv,tcp |
| 93 | tshark -r capture.pcap -q -z endpoints,ip |
| 94 | |
| 95 | # Filter and extract |
| 96 | tshark -r capture.pcap -Y "http" -T json > http_traffic.json |
| 97 | |
| 98 | # Protocol hierarchy |
| 99 | tshark -r capture.pcap -q -z io,phs |
| 100 | ``` |
| 101 | |
| 102 | ### Scapy for Custom Analysis |
| 103 | |
| 104 | ```python |
| 105 | from scapy.all import * |
| 106 | |
| 107 | # Read pcap |
| 108 | packets = rdpcap("capture.pcap") |
| 109 | |
| 110 | # Analyze packets |
| 111 | for pkt in packets: |
| 112 | if pkt.haslayer(TCP): |
| 113 | print(f"Src: {pkt[IP].src}:{pkt[TCP].sport}") |
| 114 | print(f"Dst: {pkt[IP].dst}:{pkt[TCP].dport}") |
| 115 | if pkt.haslayer(Raw): |
| 116 | print(f"Data: {pkt[Raw].load[:50]}") |
| 117 | |
| 118 | # Filter packets |
| 119 | http_packets = [p for p in packets if p.haslayer(TCP) |
| 120 | and (p[TCP].sport == 80 or p[TCP].dport == 80)] |
| 121 | |
| 122 | # Create custom packets |
| 123 | pkt = IP(dst="target")/TCP(dport=80)/Raw(load="GET / HTTP/1.1\r\n") |
| 124 | send(pkt) |
| 125 | ``` |
| 126 | |
| 127 | ## Protocol Identification |
| 128 | |
| 129 | ### Common Protocol Signatures |
| 130 | |
| 131 | ``` |
| 132 | HTTP - "HTTP/1." or "GET " or "POST " at start |
| 133 | TLS/SSL - 0x16 0x03 (record layer) |
| 134 | DNS - UDP port 53, specific header format |
| 135 | SMB - 0xFF 0x53 0x4D 0x42 ("SMB" signature) |
| 136 | SSH - "SSH-2.0" banner |
| 137 | FTP - "220 " response, "USER " command |
| 138 | SMTP - "220 " banner, "EHLO" command |
| 139 | MySQL - 0x00 length prefix, protocol version |
| 140 | PostgreSQL - 0x00 0x00 0x00 startup length |
| 141 | Redis - "*" RESP array prefix |
| 142 | MongoDB - BSON documents with specific header |
| 143 | ``` |
| 144 | |
| 145 | ### Protocol Header Patterns |
| 146 | |
| 147 | ``` |
| 148 | +--------+--------+--------+--------+ |
| 149 | | Magic number / Signature | |
| 150 | +--------+--------+--------+--------+ |
| 151 | | Version | Flags | |
| 152 | +--------+--------+--------+--------+ |
| 153 | | Length | Message Type | |
| 154 | +--------+--------+--------+--------+ |
| 155 | | Sequence Number / Session ID | |
| 156 | +--------+--------+--------+--------+ |
| 157 | | Payload... | |
| 158 | +--------+--------+--------+--------+ |
| 159 | ``` |
| 160 | |
| 161 | ## Binary Protocol Analysis |
| 162 | |
| 163 | ### Structure Identification |
| 164 | |
| 165 | ```python |
| 166 | # Common patterns in binary protocols |
| 167 | |
| 168 | # Length-prefixed message |
| 169 | struct Message { |
| 170 | uint32_t length; # Total message length |
| 171 | uint16_t msg_type; # Message type identifier |
| 172 | uint8_t flags; # Flags/options |
| 173 | uint8_t reserved; # Padding/alignment |
| 174 | uint8_t payload[]; # Variable-length payload |
| 175 | }; |
| 176 | |
| 177 | # Type-Length-Value (TLV) |
| 178 | struct TLV { |
| 179 | uint8_t type; # Field type |
| 180 | uint16_t length; # Field length |
| 181 | uint8_t value[]; # Field data |
| 182 | }; |
| 183 | |
| 184 | # Fixed header + variable payload |
| 185 | struct Packet { |
| 186 | uint8_t magic[4]; # "ABCD" signature |
| 187 | uint32_t version; |
| 188 | uint32_t payload_len; |
| 189 | uint32_t checksum; # CRC32 or similar |
| 190 | uint8_t payload[]; |
| 191 | }; |
| 192 | ``` |
| 193 | |
| 194 | ### Python Protocol Parser |
| 195 | |
| 196 | ```python |
| 197 | import struct |
| 198 | from dataclasses import dataclass |
| 199 | |
| 200 | @dataclass |
| 201 | class MessageHeader: |
| 202 | magic: bytes |
| 203 | version: int |
| 204 | msg_type: int |
| 205 | length: int |
| 206 | |
| 207 | @classmethod |
| 208 | def from_bytes(cls, data: bytes): |
| 209 | magic, version, msg_type, length = struct.unpack( |
| 210 | ">4sHHI", data[:12] |
| 211 | ) |
| 212 | return cls(magic, version, msg_type, length) |
| 213 | |
| 214 | def parse_messages(data: bytes): |
| 215 | offset = 0 |
| 216 | messages = [] |
| 217 | |
| 218 | while offset < len(data): |
| 219 | header = MessageHeader.from_bytes(data[offset:]) |
| 220 | payload = data[offset+12:offset+12+header.length] |
| 221 | messages.append((header, payload)) |
| 222 | offset += 12 + header.length |
| 223 | |
| 224 | return messages |
| 225 | |
| 226 | # Parse TLV structure |
| 227 | def parse_tlv(data: bytes): |
| 228 | fields = [] |
| 229 | offset = 0 |
| 230 | |
| 231 | while offset < len(data): |
| 232 | field_type = data[offset] |
| 233 | length = struct.unpack(">H", data[offset+1:offset+3])[0] |
| 234 | value = data[offset+3:offset+3+length] |
| 235 | fields.append((field_type, value)) |
| 236 | offset += 3 + length |
| 237 | |
| 238 | return fields |
| 239 | ``` |
| 240 | |
| 241 | ### Hex Dump Analysis |
| 242 | |
| 243 | ```python |
| 244 | def hexdump(data: bytes, width: int = 16): |
| 245 | """Format binary data as hex dump.""" |
| 246 | lines = [] |
| 247 | for i in range(0, len(data), width): |
| 248 | chunk = data[i:i+width] |
| 249 | hex_part = ' '.join(f'{b:02x}' for b in chunk) |
| 250 | ascii_part = ''.join( |
| 251 | chr(b) if 32 <= b < 127 else '.' |
| 252 | for b in chunk |
| 253 | ) |
| 254 | lines.append(f'{i:08x} {hex_part:<{width*3}} {ascii_part}') |
| 255 | return '\n'.join(lines) |
| 256 | |
| 257 | # Example output: |
| 258 | # 00000000 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d HTTP/1.1 200 OK. |
| 259 | # 00000010 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 .Content-Type: t |
| 260 | ``` |
| 261 | |
| 262 | ## Encryption Analysis |
| 263 | |
| 264 | ### Identifying Encryption |
| 265 | |
| 266 | ```python |
| 267 | # Entropy analysis - high entropy suggests encryption/compression |
| 268 | import math |
| 269 | from collections import Counter |
| 270 | |
| 271 | def entropy(data: bytes) -> float: |
| 272 | if not data: |
| 273 | return 0.0 |
| 274 | counter = Counter(data) |
| 275 | probs = [count / len(data) for count in counter.values()] |
| 276 | return -sum(p * math.log2(p) for p in probs) |
| 277 | |
| 278 | # Entropy thresholds: |
| 279 | # < 6.0: Likely plaintext or structured data |
| 280 | # 6.0-7.5: Possibly compressed |
| 281 | # > 7.5: Likely encrypted or random |
| 282 | |
| 283 | # Common encryption indicators |
| 284 | # - High, uniform entropy |
| 285 | # - No obvious structure or patterns |
| 286 | # - Length often multiple of block size (16 for AES) |
| 287 | # - Possible IV at start (16 bytes for AES-CBC) |
| 288 | ``` |
| 289 | |
| 290 | ### TLS Analysis |
| 291 | |
| 292 | ```bash |
| 293 | # Extract TLS metadata |
| 294 | tshark -r capture.pcap -Y "ssl.handshake" \ |
| 295 | -T fields -e ip.src -e ssl.handshake.ciphersuite |
| 296 | |
| 297 | # JA3 fingerprinting (client) |
| 298 | tshark -r capture.pcap -Y "ssl.handshake.type == 1" \ |
| 299 | -T fields -e ssl.handshake.ja3 |
| 300 | |
| 301 | # JA3S fingerprinting (server) |
| 302 | tshark -r capture.pcap -Y "ssl.handshake.type == 2" \ |
| 303 | -T fields -e ssl.handshake.ja3s |
| 304 | |
| 305 | # Certificate extraction |
| 306 | tshark -r capture.pcap -Y "ssl.handshake.certificate" \ |
| 307 | -T fields -e x509sat.printableString |
| 308 | ``` |
| 309 | |
| 310 | ### Decryption Approaches |
| 311 | |
| 312 | ```bash |
| 313 | # Pre-master secret log (browser) |
| 314 | export SSLKEYLOGFILE=/tmp/keys.log |
| 315 | |
| 316 | # Configure Wireshark |
| 317 | # Edit > Preferences > Protocols > TLS |
| 318 | # (Pre)-Master-Secret log filename: /tmp/keys.log |
| 319 | |
| 320 | # Decrypt with private key (if available) |
| 321 | # Only works for RSA key exchange |
| 322 | # Edit > Preferences > Protocols > TLS > RSA keys list |
| 323 | ``` |
| 324 | |
| 325 | ## Custom Protocol Documentation |
| 326 | |
| 327 | ### Protocol Specification Template |
| 328 | |
| 329 | ```markdown |
| 330 | # Protocol Name Specification |
| 331 | |
| 332 | ## Overview |
| 333 | |
| 334 | Brief description of protocol purpose and design. |
| 335 | |
| 336 | ## Transport |
| 337 | |
| 338 | - Layer: TCP/UDP |
| 339 | - Port: XXXX |
| 340 | - Encryption: TLS 1.2+ |
| 341 | |
| 342 | ## Message Format |
| 343 | |
| 344 | ### Header (12 bytes) |
| 345 | |
| 346 | | Offset | Size | Field | Description | |
| 347 | | ------ | ---- | ------- | ----------------------- | |
| 348 | | 0 | 4 | Magic | 0x50524F54 ("PROT") | |
| 349 | | 4 | 2 | Version | Protocol version (1) | |
| 350 | | 6 | 2 | Type | Message type identifier | |
| 351 | | 8 | 4 | Length | Payload length in bytes | |
| 352 | |
| 353 | ### Message Types |
| 354 | |
| 355 | | Type | Name | Description | |
| 356 | | ---- | --------- | ---------------------- | |
| 357 | | 0x01 | HELLO | Connection initiation | |
| 358 | | 0x02 | HELLO_ACK | Connection accepted | |
| 359 | | 0x03 | DATA | Application data | |
| 360 | | 0x04 | CLOSE | Connection termination | |
| 361 | |
| 362 | ### Type 0x01: HELLO |
| 363 | |
| 364 | | Offset | Size | Field | Description | |
| 365 | | ------ | ---- | ---------- | ------------------------ | |
| 366 | | 0 | 4 | ClientID | Unique client identifier | |
| 367 | | 4 | 2 | Flags | Connection flags | |
| 368 | | 6 | var | Extensions | TLV-encoded extensions | |
| 369 | |
| 370 | ## State Machine |
| 371 | ``` |
| 372 | |
| 373 | [INIT] --HELLO--> [WAIT_ACK] --HELLO_ACK--> [CONNECTED] |
| 374 | | |
| 375 | DATA/DATA |
| 376 | | |
| 377 | [CLOSED] <--CLOSE--+ |
| 378 | |
| 379 | ``` |
| 380 | |
| 381 | ## Examples |
| 382 | ### Connection Establishment |
| 383 | ``` |
| 384 | |
| 385 | Client -> Server: HELLO (ClientID=0x12345678) |
| 386 | Server -> Client: HELLO_ACK (Status=OK) |
| 387 | Client -> Server: DATA (payload) |
| 388 | |
| 389 | ``` |
| 390 | |
| 391 | ``` |
| 392 | |
| 393 | ### Wireshark Dissector (Lua) |
| 394 | |
| 395 | ```lua |
| 396 | -- custom_protocol.lua |
| 397 | local proto = Proto("custom", "Custom Protocol") |
| 398 | |
| 399 | -- Define fields |
| 400 | local f_magic = ProtoField.string("custom.magic", "Magic") |
| 401 | local f_version = ProtoField.uint16("custom.version", "Version") |
| 402 | local f_type = ProtoField.uint16("custom.type", "Type") |
| 403 | local f_length = ProtoField.uint32("custom.length", "Length") |
| 404 | local f_payload = ProtoField.bytes("custom.payload", "Payload") |
| 405 | |
| 406 | proto.fields = { f_magic, f_version, f_type, f_length, f_payload } |
| 407 | |
| 408 | -- Message type names |
| 409 | local msg_types = { |
| 410 | [0x01] = "HELLO", |
| 411 | [0x02] = "HELLO_ACK", |
| 412 | [0x03] = "DATA", |
| 413 | [0x04] = "CLOSE" |
| 414 | } |
| 415 | |
| 416 | function proto.dissector(buffer, pinfo, tree) |
| 417 | pinfo.cols.protocol = "CUSTOM" |
| 418 | |
| 419 | local subtree = tree:add(proto, buffer()) |
| 420 | |
| 421 | -- Parse header |
| 422 | subtree:add(f_magic, buffer(0, 4)) |
| 423 | subtree:add(f_version, buffer(4, 2)) |
| 424 | |
| 425 | local msg_type = buffer(6, 2):uint() |
| 426 | subtree:add(f_type, buffer(6, 2)):append_text( |
| 427 | " (" .. (msg_types[msg_type] or "Unknown") .. ")" |
| 428 | ) |
| 429 | |
| 430 | local length = buffer(8, 4):uint() |
| 431 | subtree:add(f_length, buffer(8, 4)) |
| 432 | |
| 433 | if length > 0 then |
| 434 | subtree:add(f_payload, buffer(12, length)) |
| 435 | end |
| 436 | end |
| 437 | |
| 438 | -- Register for TCP port |
| 439 | local tcp_table = DissectorTable.get("tcp.port") |
| 440 | tcp_table:add(8888, proto) |
| 441 | ``` |
| 442 | |
| 443 | ## Active Testing |
| 444 | |
| 445 | ### Fuzzing with Boofuzz |
| 446 | |
| 447 | ```python |
| 448 | from boofuzz import * |
| 449 | |
| 450 | def main(): |
| 451 | session = Session( |
| 452 | target=Target( |
| 453 | connection=TCPSocketConnection("target", 8888) |
| 454 | ) |
| 455 | ) |
| 456 | |
| 457 | # Define protocol structure |
| 458 | s_initialize("HELLO") |
| 459 | s_static(b"\x50\x52\x4f\x54") # Magic |
| 460 | s_word(1, name="version") # Version |
| 461 | s_word(0x01, name="type") # Type (HELLO) |
| 462 | s_size("payload", length=4) # Length field |
| 463 | s_block_start("payload") |
| 464 | s_dword(0x12345678, name="client_id") |
| 465 | s_word(0, name="flags") |
| 466 | s_block_end() |
| 467 | |
| 468 | session.connect(s_get("HELLO")) |
| 469 | session.fuzz() |
| 470 | |
| 471 | if __name__ == "__main__": |
| 472 | main() |
| 473 | ``` |
| 474 | |
| 475 | ### Replay and Modification |
| 476 | |
| 477 | ```python |
| 478 | from scapy.all import * |
| 479 | |
| 480 | # Replay captured traffic |
| 481 | packets = rdpcap("capture.pcap") |
| 482 | for pkt in packets: |
| 483 | if pkt.haslayer(TCP) and pkt[TCP].dport == 8888: |
| 484 | send(pkt) |
| 485 | |
| 486 | # Modify and replay |
| 487 | for pkt in packets: |
| 488 | if pkt.haslayer(Raw): |
| 489 | # Modify payload |
| 490 | original = pkt[Raw].load |
| 491 | modified = original.replace(b"client", b"CLIENT") |
| 492 | pkt[Raw].load = modified |
| 493 | # Recalculate checksums |
| 494 | del pkt[IP].chksum |
| 495 | del pkt[TCP].chksum |
| 496 | send(pkt) |
| 497 | ``` |
| 498 | |
| 499 | ## Best Practices |
| 500 | |
| 501 | ### Analysis Workflow |
| 502 | |
| 503 | 1. **Capture traffic**: Multiple sessions, different scenarios |
| 504 | 2. **Identify boundaries**: Message start/end markers |
| 505 | 3. **Map structure**: Fixed header, variable payload |
| 506 | 4. **Identify fields**: Compare multiple samples |
| 507 | 5. **Document format**: Create specification |
| 508 | 6. **Validate understanding**: Implement parser/generator |
| 509 | 7. **Test edge cases**: Fuzzing, boundary conditions |
| 510 | |
| 511 | ### Common Patterns to Look For |
| 512 | |
| 513 | - Magic numbers/signatures at message start |
| 514 | - Version fields for compatibility |
| 515 | - Length fields (often before variable data) |
| 516 | - Type/opcode fields for message identification |
| 517 | - Sequence numbers for ordering |
| 518 | - Checksums/CRCs for integrity |
| 519 | - Timestamps for timing |
| 520 | - Session/connection identifiers |
| 521 |
Reviews
Installed this one?Write the first review and take the Trailblazer badge.
Alternatives
Block No Verify HookConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.◐····●35/40Sast ConfigurationConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.◐····●32/40Binary Analysis PatternsMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.◐◐◐◐◐●31/40Anti Reversing TechniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.◐◐◐◐◐●30/40