-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

You could check whether the bytes inside are a structurally valid
protobuf message (that is, a list of tags and values). If yes, then it
is very likely either a nested message (or possibly a bytes field
initialized with a serialized message, but do you even care about the
difference?); if no, then it is a bytes field initialized with something
else.

CHris

On Thu, 13 Jun 2013 15:05:02 -0700 (PDT)
Liang Huang <huangliang...@gmail.com> wrote:

> Hi,
> 
> I captured a block of communication data from a virus between it's
> server. I don't have any ".proto" file about it.
> 
> I tried to write a decoder based on the following information. 
> https://developers.google.com/protocol-buffers/docs/encoding#order
> 
> I got a problem, I cannot identify data is a string or a embedded
> messages, because they have a same wire-type.
> 
> 2Length-delimitedstring, bytes, embedded messages, packed repeated
> fields I doubt if I can reverse it just based on a block of data.
> Can I ???
> 
> Thanks,
> 
> HL
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.20 (GNU/Linux)

iF4EAREIAAYFAlG6wbIACgkQnfE3lq0v9IxJeQD/dsMXkBdS4/hWRLdLM9ZdK63M
CQmvtGwV4WlO73GZthsBAIt9RqPJalUrIE0OTzTci4/usBqumo2dSSuecI+aWaoQ
=SiRx
-----END PGP SIGNATURE-----

-- 
You received this message because you are subscribed to the Google Groups 
"Protocol Buffers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to protobuf+unsubscr...@googlegroups.com.
To post to this group, send email to protobuf@googlegroups.com.
Visit this group at http://groups.google.com/group/protobuf.
For more options, visit https://groups.google.com/groups/opt_out.


Reply via email to