2

im reversing a android app and i managed to intercept a grpc request and decode it using protoc but i cant seem to make sense of any of the data, i know its compressed using gzip because of the request headers

        "content-type": "application/grpc; charset=utf-8",
        "grpc-accept-encoding": "identity,deflate,gzip",
        "accept-encoding":  "identity,gzip",

and this is the decoded protcolbuffer


   "1": {
        "1": "¸z =PÞCw.\u001e}».*\u001f\u0011"
    },
    "2": some value,
    "3": {
        "1": {
            "1": {
                "1": "©ÄS¢ÄþP\f.½\fÑWÄK>"
            }
        }
    },
    "4": {
        "2": 1,
        "4": {
            "2": {
                "1": "other value"
            }
        },
        "7": 2
    }
}

i already tried gunzip on cyberchef but i could not decompress anything without a file signature so how should i decompress the other unreadable values into plain text?? when ever i send the same binary data above the intended functionality works so i know the server is turning them back into readable text somehow and say i want to intercept the data on the android app before it gets serialized what is the best place to do that?

update: this is the result decoding the data using proto with the same structure as above what is this data how do i decode it?

s {
  string1: "\270z =P\336Cw\211\036}\273\214*\037\021"
}
id: 1640553558
d {
  d0 {
    d1 {
      string2: ">D_.\233d\\\177\210\274\320\000}\253\')"
    }
  }
}
g {
  id2: 1
  f {
    f0 {
      string3: "Eiei"
    }
  }
  id3: 2
}

this is the .proto i built

syntax = "proto2";


message body {
    message b1 {
        optional string s0 = 1; 
    }

    optional b1 s = 1;

    optional int32 id = 2;
    message b2 {

        message b3 {

            message body4 {
                optional string string2 = 1;
            }
            optional body4 d1 = 1;
        }
        optional b3 d0 = 1;
    }
    optional b2 d = 3;
    

    message b4 {
        optional int32 id2 = 2;
        message b5 {
            message b6 {
                
                optional string message0 = 1;
            }
            optional b6 f0 = 2;
        }
        optional b5 f = 4;
        optional int32 id3 = 7;

    }

    optional b4 g = 4;
}
Improve this question
9
  • The raw decoded protobuffer looks pretty good. Based on that structure you should build an .proto file and give each attribute a meaningful name if you manage to identify the data it carries. Fields that contain binary data like 1.1 can just be binary fields or what also sometimes happens is that these are again protobuf objects that can't be identified as object in RAW decoding. Use the manually built .proto file and text what happens if you define the field 1.1 as message may be the decoder can then split it up into further attributes.
    – Robert
    Apr 14, 2021 at 7:08
  • @Robert thank you for your answer im still new to protos but i still dont understand why? why would it not decode it to its original data why does it need a attribute to do that? i mean why would i need to specify attributes to strings i thought that strings are passed as hex data? furthermore why would it split it up to further objects when each data section is length delimeted?? and i geuss i would need to bruteforce the data types until i get a readable text?
    – ahmed mani
    Apr 14, 2021 at 22:36
  • Protobuf is designed to be decoded by a protobuf definition file which defines what messages (object) and field types are used at which position. You did a RAW decoding without protobuf definition file. In RAW made not every message class can be detected. You should really start with a protobuf tutorial to learn how protobuf should be used. That will help you reversing the protocol.
    – Robert
    Apr 15, 2021 at 7:02
  • @Robert i built a .proto file with same structure as above if i specify 1.1 as another message i get "Error parsing message" if i specify it as a string or bytes i get the same message wich is "\270z =P\336Cw\211\036}\273\214*\037\021" what is this data? how do i decode it? same for the other field i updated my answer with the result from the decoder with the proto file
    – ahmed mani
    Apr 17, 2021 at 0:37
  • i tried decoding it and i got the same data i started with
    – ahmed mani
    Apr 17, 2021 at 0:52

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.