protocol-reverse – Other skill for AI agents

Authorized reverse engineering of custom binary protocols, Protobuf/gRPC schemas, WebSocket frames, and PCAP-driven protocol recovery.

OtherSKILL.mdClaude Code · Codex · Hermes · DeepSeek

Install the protocol-reverse skill with one command

Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.

Claude Code

mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/protocol-reverse-200d0.tgz | tar xz -C ~/.claude/skills

Call it in Claude Code: /protocol-reverse – then describe the task you want done.

Codex

mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/protocol-reverse-200d0.tgz | tar xz -C ~/.codex/skills

Call it in Codex: $protocol-reverse – then describe the task you want done.

Hermes Agent

mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/protocol-reverse-200d0.tgz | tar xz -C ~/.hermes/skills

Call it in Hermes Agent: /protocol-reverse – then describe the task you want done.

DeepSeek

mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/protocol-reverse-200d0.tgz | tar xz -C ~/.deepcode/skills

Call it in DeepSeek: /protocol-reverse – then describe the task you want done.

SKILL.md content

Protocol Reverse Engineering

When to Use

Documenting an undocumented wire protocol from captures.
Decoding structured traffic during an authorized analysis.

适用场景

自定义 TCP/UDP 二进制协议
Protobuf / gRPC / FlatBuffers / MessagePack
WebSocket / MQTT / 私有 RPC
PCAP / PCAPNG 还原字段与状态机
客户端-服务端校验、序列号、加密帧头

不走本 skill

| 情况 | 去哪 |

|------|------|

| 仅 HTTP 参数签名 / JS 加密 | js-reverse/ |

| 仅 TLS 证书问题 | pentest-tools/ 或浏览器代理 |

| 固件内协议栈深挖 + 仿真 | firmware-pentest/ 后再回本 skill |

工作流

Phase 1 — 采集与分诊

□ 拿到样本：PCAP / 代理导出 / 客户端日志 / 二进制
□ 标记方向：C→S / S→C；是否有握手、心跳、重连
□ 固定头？魔数？长度字段？TLV？定长？
□ 是否压缩（zlib/gzip/lz4）或加密（AES/ChaCha 帧内）
□ tshark -r cap.pcap -T fields -e frame.number -e ip.src -e tcp.payload

Phase 2 — 帧布局还原

□ 对齐多个同类消息，找不变字节 / 自增序列号
□ 长度字段：大端/小端、含头/不含头
□ 校验：CRC16/32、checksum、HMAC 位置
□ 画出状态机：Connect → Auth → Ready → Request/Response → Close
□ 工具：Wireshark 自定义 dissector 草稿 / ImHex / 010 Editor 模板 / Kaitai Struct

Phase 3 — 序列化与加密

□ Protobuf：.proto 恢复（blackboxprotobuf / pbtk / protoc --decode_raw）
□ gRPC：HTTP/2 headers + protobuf body
□ 加密：找密钥派生（客户端 so/dll/JS）→ 联合 ida-reverse / js-reverse / apk-reverse
□ 重放：仅在授权 scope 内；先无害字段再敏感操作

Phase 4 — 产物

MUST 产出：
- 消息类型表（name / opcode / fields）
- 至少 1 条可复现的解码命令或脚本
- Evidence：原始 hex 摘录 + 解码结果（脱敏）

工具链

| 工具 | 必需 | 用途 | 自举 |

|------|------|------|------|

| Python3 | 是 | 解码脚本 | 系统 |

| blackboxprotobuf | 可选 | 未知 protobuf | pip |

| ImHex / 010 | 可选 | 结构模板 | 手动 |

参考

references/protocol-workflow.md — 帧布局与 Protobuf 速查
相关：../ida-reverse/ ../js-reverse/ ../firmware-pentest/ ../pentest-tools/

路由上下文

上游: MASTER-ROUTING R21 · routing.md

下游: 需客户端算法 → ida-reverse/js-reverse；需利用重放 → pentest-tools/api-security

同级: malware-analysis（C2 协议）、digital-forensics（流量取证）

任务完成自检

[ ] 是否还原了消息布局或状态机（而非只贴 hex）？
[ ] 是否有可复现解码命令？
[ ] 是否遵守 scope / 脱敏？
[ ] 是否回写 field-journal / 报告 Checklist？

Limitations

Encrypted or session-keyed protocols need key material first.
Stateful protocols may require long, varied capture sessions.

> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).

Related skills

public-relations – When the user wants help with public relations, earned media, press coverage, journalist…
purchase-accounting – Purchase register: supplier, invoice, gross amount, VAT and TDS, net payable, ledger…
puzzle-activity-planner – Plan puzzle-based activities for classrooms, parties, and events with pre-configured…
rag-engineer – Expert in building Retrieval-Augmented Generation systems. Masters embedding models…
ralph-loop-yylo – Execute exactly one explicitly assigned YYLO Ledger task through the Ralph loop to a…
ranking-opportunity-finder – Ranking Opportunity Finder. Use when working with query/page performance export or dated…
ranking-progress-tracker – Ranking Progress Tracker. Use when working with dated keyword positions with engine…
re-create – Completely delete and rewrite a file or module from scratch when structural rot makes…

← Browse all skills