News for hackers. Stuff that matters.

A comment on Reverse Engineering Apple's typedstream Format. Parent comment

Re:Reverse Engineering Apple's typedstream Format by orf on Tuesday February 04, 2025 @10:14AM (#42933325)
Why is the lack of a schema indicator the biggest flaw of protobuf?
[ Parent | on HN ]
Re:Reverse Engineering Apple's typedstream Format by ptspts on Tuesday February 04, 2025 @10:40AM (#42933781)
If you parse a serialized protobuf byte array without having a .proto file, you have no way to dustinguish a byte string field from a nested message field. Thus you have no way to know how deep your parser should go.
[ Parent | on HN ]
Re:Reverse Engineering Apple's typedstream Format by css on Tuesday February 04, 2025 @12:16PM (#42935445)
Semi-related, one of the `imessage-exporter` contributors provided a great write-up on reverse engineering the handwritten and digital touch message protobufs [0]. The reconstructed proto files are [1] [2].

[0]: https://github.com/trymoose/handwriting2svg/blob/0eb56cf4582...

[1]: https://github.com/ReagentX/imessage-exporter/blob/beeb853b2...

[2]: https://github.com/ReagentX/imessage-exporter/blob/beeb853b2...

[ Parent | on HN ]
Re:Reverse Engineering Apple's typedstream Format by foobiekr on Sunday February 09, 2025 @01:53PM (#42992684)
It makes it impossible to write a general purpose dissector that takes captured messages or bytes and figure out how to parse it.

All they needed was a varint at the head of any marshaled from to at least provide some scoping clue.

[ Parent | on HN ]