protocol-reverse-engineering

Capture, analyze, and document network protocols through packet inspection and binary dissection. Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging. [INIT] --HELLO--> [WAIT_ACK] --HELLO_ACK--> [CONNECTED] | DATA/DATA | [CLOSED] Server: HELLO (ClientID=0x12345678) Server -> Client: HELLO_ACK (Status=OK) Client -> Server: DATA (payload) - Covers traffic capture with Wireshark, tcpdump, and mitmproxy, including transparent interception and ring-buffer rotation for continuous monitoring - Provides protocol analysis techniques: display filtering, stream following, field extraction, and TLS decryption with pre-master-secret logs - Includes binary protocol parsing patterns (length-prefixed, TLV, fixed-header) with Python struct unpacking and entropy analysis for encryption detection - Offers custom protocol documentation templates, Wireshark Lua dissectors, and active testing via fuzzing and packet replay with Boofuzz and Scapy - Capture traffic : Multiple sessions, different scenarios - Identify boundaries : Message start/end markers - Map structure : Fixed header, variable payload - Identify fields : Compare multiple samples - Document format : Create specification - Validate understanding : Implement parser/generator - Test edge cases : Fuzzing, boundary conditions - Magic numbers/signatures...