Skip to main content
protocol-reverse-engineering Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/oimiragieo/agent-studio --skill protocol-reverse-engineeringThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository Related occupations SOC
Based on SOC occupation classification
name protocol-reverse-engineering description Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication. version 1.0.0 model sonnet invoked_by ["reverse-engineer","security-architect"] tools ["Read","Write","Edit","Bash","Glob","Grep"] verified false lastVerifiedAt "2026-02-19T05:29:09.098Z" source builtin trust_score 100 provenance_sha 36d61085315a22aa
Protocol Reverse Engineering
Security Notice
AUTHORIZED USE ONLY : These skills are for DEFENSIVE security analysis and authorized research:
Authorized security assessments with written permissionDebugging network applications you own or have authorization forCTF competitions and security researchProtocol interoperability for legitimate purposesEducational purposes in controlled environments
NEVER use for :
Unauthorized network surveillance or sniffing
Man-in-the-middle attacks without authorization
Privacy violations
Bypassing security controls
Any illegal activities
Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging.
Traffic Capture
Wireshark Capture
wireshark -i eth0 -k
wireshark -i eth0 -k -f "port 443"
tshark -i eth0 -w capture.pcap
tshark -i eth0 -b filesize:100000 -b files:10 -w capture.pcap
tcpdump Capture
tcpdump -i eth0 -w capture.pcap
tcpdump -i eth0 port 8080 -w capture.pcap
tcpdump -i eth0 -s 0 -w capture.pcap
tcpdump -i eth0 -X port 80
Man-in-the-Middle Capture
mitmproxy --mode transparent -p 8080
mitmproxy --mode transparent --ssl-insecure
mitmdump -w traffic.mitm
Protocol Analysis
Wireshark Analysis
# Display filters
tcp.port == 8080
http.request.method == "POST"
ip.addr == 192.168.1.1
tcp.flags.syn == 1 && tcp.flags.ack == 0
frame contains "password"
# Following streams
Right-click > Follow > TCP Stream
Right-click > Follow > HTTP Stream
# Export objects
File > Export Objects > HTTP
# Decryption
Edit > Preferences > Protocols > TLS
- (Pre)-Master-Secret log filename
- RSA keys list
tshark Analysis
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port
tshark -r capture.pcap -q -z conv,tcp
tshark -r capture.pcap -q -z endpoints,ip
tshark -r capture.pcap -Y "http" -T json > http_traffic.json
tshark -r capture.pcap -q -z io,phs
Scapy for Custom Analysis from scapy.all import *
packets = rdpcap("capture.pcap" )
for pkt in packets:
if pkt.haslayer(TCP):
print (f"Src: {pkt[IP].src} :{pkt[TCP].sport} " )
print (f"Dst: {pkt[IP].dst} :{pkt[TCP].dport} " )
if pkt.haslayer(Raw):
print (f"Data: {pkt[Raw].load[:50 ]} " )
http_packets = [p for p in packets if p.haslayer(TCP)
and (p[TCP].sport == 80 or p[TCP].dport == 80 )]
pkt = IP(dst="target" )/TCP(dport=80 )/Raw(load="GET / HTTP/1.1\r\n" )
send(pkt)
Protocol Identification
Common Protocol Signatures HTTP - "HTTP/1." or "GET " or "POST " at start
TLS/SSL - 0x16 0x03 (record layer)
DNS - UDP port 53, specific header format
SMB - 0xFF 0x53 0x4D 0x42 ("SMB" signature)
SSH - "SSH-2.0" banner
FTP - "220 " response, "USER " command
SMTP - "220 " banner, "EHLO" command
MySQL - 0x00 length prefix, protocol version
PostgreSQL - 0x00 0x00 0x00 startup length
Redis - "*" RESP array prefix
MongoDB - BSON documents with specific header
Protocol Header Patterns +--------+--------+--------+--------+
| Magic number / Signature |
+--------+--------+--------+--------+
| Version | Flags |
+--------+--------+--------+--------+
| Length | Message Type |
+--------+--------+--------+--------+
| Sequence Number / Session ID |
+--------+--------+--------+--------+
| Payload... |
+--------+--------+--------+--------+
Binary Protocol Analysis
Structure Identification
struct Message {
uint32_t length;
uint16_t msg_type;
uint8_t flags;
uint8_t reserved;
uint8_t payload[];
};
struct TLV {
uint8_t type ;
uint16_t length;
uint8_t value[];
};
struct Packet {
uint8_t magic[4 ];
uint32_t version;
uint32_t payload_len;
uint32_t checksum;
uint8_t payload[];
};
Python Protocol Parser import struct
from dataclasses import dataclass
@dataclass
class MessageHeader :
magic: bytes
version: int
msg_type: int
length: int
@classmethod
def from_bytes (cls, data: bytes ):
magic, version, msg_type, length = struct.unpack(
">4sHHI" , data[:12 ]
)
return cls(magic, version, msg_type, length)
def parse_messages (data: bytes ):
offset = 0
messages = []
while offset < len (data):
header = MessageHeader.from_bytes(data[offset:])
payload = data[offset+12 :offset+12 +header.length]
messages.append((header, payload))
offset += 12 + header.length
return messages
def parse_tlv (data: bytes ):
fields = []
offset = 0
while offset < len (data):
field_type = data[offset]
length = struct.unpack(">H" , data[offset+1 :offset+3 ])[0 ]
value = data[offset+3 :offset+3 +length]
fields.append((field_type, value))
offset += 3 + length
return fields
Hex Dump Analysis def hexdump (data: bytes , width: int = 16 ):
"""Format binary data as hex dump."""
lines = []
for i in range (0 , len (data), width):
chunk = data[i:i+width]
hex_part = ' ' .join(f'{b:02x} ' for b in chunk)
ascii_part = '' .join(
chr (b) if 32 <= b < 127 else '.'
for b in chunk
)
lines.append(f'{i:08x} {hex_part:<{width*3 } } {ascii_part} ' )
return '\n' .join(lines)
Encryption Analysis
Identifying Encryption
import math
from collections import Counter
def entropy (data: bytes ) -> float :
if not data:
return 0.0
counter = Counter(data)
probs = [count / len (data) for count in counter.values()]
return -sum (p * math.log2(p) for p in probs)
TLS Analysis
tshark -r capture.pcap -Y "ssl.handshake" \
-T fields -e ip.src -e ssl.handshake.ciphersuite
tshark -r capture.pcap -Y "ssl.handshake.type == 1" \
-T fields -e ssl.handshake.ja3
tshark -r capture.pcap -Y "ssl.handshake.type == 2" \
-T fields -e ssl.handshake.ja3s
tshark -r capture.pcap -Y "ssl.handshake.certificate" \
-T fields -e x509sat.printableString
Decryption Approaches
export SSLKEYLOGFILE=/tmp/keys.log
Custom Protocol Documentation
Protocol Specification Template # Protocol Name Specification
## Overview
Brief description of protocol purpose and design.
## Transport
- Layer: TCP/UDP
- Port: XXXX
- Encryption: TLS 1.2+
## Message Format
### Header (12 bytes)
| Offset | Size | Field | Description |
| ------ | ---- | ------- | ----------------------- |
| 0 | 4 | Magic | 0x50524F54 ("PROT") |
| 4 | 2 | Version | Protocol version (1) |
| 6 | 2 | Type | Message type identifier |
| 8 | 4 | Length | Payload length in bytes |
### Message Types
| Type | Name | Description |
| ---- | --------- | ---------------------- |
| 0x01 | HELLO | Connection initiation |
| 0x02 | HELLO_ACK | Connection accepted |
| 0x03 | DATA | Application data |
| 0x04 | CLOSE | Connection termination |
### Type 0x01: HELLO
| Offset | Size | Field | Description |
| ------ | ---- | ---------- | ------------------------ |
| 0 | 4 | ClientID | Unique client identifier |
| 4 | 2 | Flags | Connection flags |
| 6 | var | Extensions | TLV-encoded extensions |
## State Machine
[INIT] --HELLO--> [WAIT_ACK] --HELLO_ACK--> [CONNECTED]
|
DATA/DATA
|
[CLOSED] <--CLOSE--+
## Examples
### Connection Establishment
Client -> Server: HELLO (ClientID=0x12345678)
Server -> Client: HELLO_ACK (Status=OK)
Client -> Server: DATA (payload)
Wireshark Dissector (Lua)
local proto = Proto("custom" , "Custom Protocol" )
local f_magic = ProtoField.string ("custom.magic" , "Magic" )
local f_version = ProtoField.uint16("custom.version" , "Version" )
local f_type = ProtoField.uint16("custom.type" , "Type" )
local f_length = ProtoField.uint32("custom.length" , "Length" )
local f_payload = ProtoField.bytes("custom.payload" , "Payload" )
proto.fields = { f_magic, f_version, f_type, f_length, f_payload }
local msg_types = {
[0x01 ] = "HELLO" ,
[0x02 ] = "HELLO_ACK" ,
[0x03 ] = "DATA" ,
[0x04 ] = "CLOSE"
}
function proto.dissector (buffer, pinfo, tree) "CUSTOM"
local subtree = tree:add(proto, buffer())
subtree:add(f_magic, buffer(0 , 4 ))
subtree:add(f_version, buffer(4 , 2 ))
local msg_type = buffer(6 , 2 ):uint()
subtree:add(f_type, buffer(6 , 2 )):append_text(
" (" .. (msg_types[msg_type] or "Unknown" ) .. ")"
)
local length = buffer(8 , 4 ):uint()
subtree:add(f_length, buffer(8 , 4 ))
if length > 0 then
subtree:add(f_payload, buffer(12 , length))
end
end
local tcp_table = DissectorTable.get("tcp.port" )
tcp_table:add(8888 , proto)
Active Testing
Fuzzing with Boofuzz from boofuzz import *
def main ():
session = Session(
target=Target(
connection=TCPSocketConnection("target" , 8888 )
)
)
s_initialize("HELLO" )
s_static(b"\x50\x52\x4f\x54" )
s_word(1 , name="version" )
s_word(0x01 , name="type" )
s_size("payload" , length=4 )
s_block_start("payload" )
s_dword(0x12345678 , name="client_id" )
s_word(0 , name="flags" )
s_block_end()
session.connect(s_get("HELLO" ))
session.fuzz()
if __name__ == "__main__" :
main()
Replay and Modification from scapy.all import *
packets = rdpcap("capture.pcap" )
for pkt in packets:
if pkt.haslayer(TCP) and pkt[TCP].dport == 8888 :
send(pkt)
for pkt in packets:
if pkt.haslayer(Raw):
original = pkt[Raw].load
modified = original.replace(b"client" , b"CLIENT" )
pkt[Raw].load = modified
del pkt[IP].chksum
del pkt[TCP].chksum
send(pkt)
Best Practices
Analysis Workflow
Capture traffic : Multiple sessions, different scenariosIdentify boundaries : Message start/end markersMap structure : Fixed header, variable payloadIdentify fields : Compare multiple samplesDocument format : Create specificationValidate understanding : Implement parser/generatorTest edge cases : Fuzzing, boundary conditions
Common Patterns to Look For
Magic numbers/signatures at message start
Version fields for compatibility
Length fields (often before variable data)
Type/opcode fields for message identification
Sequence numbers for ordering
Checksums/CRCs for integrity
Timestamps for timing
Session/connection identifiers
Memory Protocol (MANDATORY) Before starting:
Read C:\dev\projects\agent-studio\.claude\context\memory\learnings.md
New pattern -> C:\dev\projects\agent-studio\.claude\context\memory\learnings.md
Issue found -> C:\dev\projects\agent-studio\.claude\context\memory\issues.md
Decision made -> C:\dev\projects\agent-studio\.claude\context\memory\decisions.md
ASSUME INTERRUPTION: If it's not in memory, it didn't happen.
