-----BEGIN PGP SIGNED MESSAGE-----
You could check whether the bytes inside are a structurally valid
protobuf message (that is, a list of tags and values). If yes, then it
is very likely either a nested message (or possibly a bytes field
initialized with a serialized message, but do you even care about the
difference?); if no, then it is a bytes field initialized with something
On Thu, 13 Jun 2013 15:05:02 -0700 (PDT)
Liang Huang <huangliang...@gmail.com> wrote:
> I captured a block of communication data from a virus between it's
> server. I don't have any ".proto" file about it.
> I tried to write a decoder based on the following information.
> I got a problem, I cannot identify data is a string or a embedded
> messages, because they have a same wire-type.
> 2Length-delimitedstring, bytes, embedded messages, packed repeated
> fields I doubt if I can reverse it just based on a block of data.
> Can I ???
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.20 (GNU/Linux)
-----END PGP SIGNATURE-----
You received this message because you are subscribed to the Google Groups
"Protocol Buffers" group.
To unsubscribe from this group and stop receiving emails from it, send an email
To post to this group, send email to email@example.com.
Visit this group at http://groups.google.com/group/protobuf.
For more options, visit https://groups.google.com/groups/opt_out.