Custom protocol reverse engineering

When it applies

The target speaks something that isn't plain HTTP/JSON: a custom binary TCP/UDP protocol, Protobuf/gRPC with no reflection, FlatBuffers/MessagePack, WebSocket or MQTT frames, or a private RPC format — and you have a PCAP, a proxy export, client logs, or the client binary. (For pure HTTP parameter signing in JS, use reverse-eng-js; for gRPC's HTTP/2 attack surface itself, api-grpc.) Target and any replay testing must be in scope.txt (tradecraft-scope-roe) — replay only against systems you're authorized to touch.

Why it works

Protocols are machines, and machines are regular: fixed headers, magic bytes, length fields, monotonic sequence numbers, and repeated type-length-value structures. Align many samples of the same message type and the invariant bytes identify themselves; the variable ones are your fields. Serialization formats like Protobuf are self-describing enough to decode blind — field numbers and wire types survive even without the .proto.