Re:Reverse Engineering Apple's typedstream Format
by foobiekr on Monday February 03, 2025 @02:52PM
(#42922097)
Very much so. Pretty much all of these protocols are simplifications of asn1 and in some cases (like protobuf) there are a handful of things that got lost because the wire formats didn’t have them as they didn’t need them. A schema indicator being the single biggest flaw in protobuf.
[ Parent
| on HN ]
Re:Reverse Engineering Apple's typedstream Format
by orf on Tuesday February 04, 2025 @10:14AM
(#42933325)
Why is the lack of a schema indicator the biggest flaw of protobuf?
Re:Reverse Engineering Apple's typedstream Format
by ptspts on Tuesday February 04, 2025 @10:40AM
(#42933781)
If you parse a serialized protobuf byte array without having a .proto file, you have no way to dustinguish a byte string field from a nested message field. Thus you have no way to know how deep your parser should go.
Re:Reverse Engineering Apple's typedstream Format
by css on Tuesday February 04, 2025 @12:16PM
(#42935445)
Semi-related, one of the `imessage-exporter` contributors provided a great write-up on reverse engineering the handwritten and digital touch message protobufs [0]. The reconstructed proto files are [1] [2].
[0]: https://github.com/trymoose/handwriting2svg/blob/0eb56cf4582...
[1]: https://github.com/ReagentX/imessage-exporter/blob/beeb853b2...
[2]: https://github.com/ReagentX/imessage-exporter/blob/beeb853b2...
Re:Reverse Engineering Apple's typedstream Format
by foobiekr on Sunday February 09, 2025 @01:53PM
(#42992684)
It makes it impossible to write a general purpose dissector that takes captured messages or bytes and figure out how to parse it.
All they needed was a varint at the head of any marshaled from to at least provide some scoping clue.