如何解码二进制/原始谷歌 protobuf 数据 [英] How to decode binary/raw google protobuf data

问题描述

我有一个带有编码 protobuf 数据的核心转储，我想解码这个数据并查看内容.我有在原始协议缓冲区中定义此消息的 .proto 文件.我的原型文件如下所示:

I have a coredump with encoded protobuf data and I want to decode this data and see the content. I have the .proto file which defines this message in raw protocol buffer. My proto file looks like this:

$  cat my.proto 
message header {
  required uint32 u1 = 1;
  required uint32 u2 = 2;
  optional uint32 u3 = 3 [default=0];
  optional bool   b1 = 4 [default=true];
  optional string s1 = 5;
  optional uint32 u4 = 6;
  optional uint32 u5 = 7;
  optional string s2 = 9;
  optional string s3   = 10; 
  optional uint32 u6 = 8;
}

和 protoc 版本:

And protoc version:

$  protoc --version
libprotoc 2.3.0

我尝试了以下方法:

1. 从核心转储原始数据

1. Dump the raw data from the core

(gdb) dump memory b.bin 0x7fd70db7e964 0x7fd70db7e96d

将它传递给 protoc

Pass it to protoc

//proto文件(my.proto)在当前目录
$ protoc --decode --proto_path=$pwd my.proto <b.bin
缺少标志值:--decode
要解码未知消息，请使用 --decode_raw.

$ protoc --decode_raw
无法解析输入.

关于如何解码它的任何想法?该文档并未详细说明如何进行操作.

Any thoughts on how to decode it? The documentation doesn’t explain much on how to go about it.

编辑:二进制格式的数据(10 字节)

Edit: Data in binary format (10 bytes)

(gdb) x/10xb 0x7fd70db7e964
0x7fd70db7e964: 0x08    0xff    0xff    0x01    0x10    0x08    0x40    0xf7
0x7fd70db7e96c: 0xd4    0x38

推荐答案

您正确使用了 --decode_raw，但您的输入似乎不是 protobuf.

You used --decode_raw correctly, but your input does not seem to be a protobuf.

对于--decode，需要指定类型名称，如:

For --decode, you need to specify the type name, like:

protoc --decode header my.proto < b.bin

但是，如果 --decode_raw 报告解析错误，--decode 也会报告.

However, if --decode_raw reports a parse error than --decode will too.

您通过 gdb 提取的字节似乎不是有效的 protobuf.也许您的地址不完全正确:如果您在任一端添加或删除一个字节，它可能无法解析.

It would seem that the bytes you extracted via gdb are not a valid protobuf. Perhaps your addresses aren't exactly right: if you added or removed a byte at either end, it probably won't parse.

我注意到根据你指定的地址，protobuf只有9个字节长，这仅够设置三个或四个字段的空间.这是你所期待的吗?也许你可以在这里发布字节.

I note that according to the addresses you specified, the protobuf is only 9 bytes long, which is only enough space for three or four of the fields to be set. Is that what you are expecting? Perhaps you could post the bytes here.

您添加到问题中的 10 个字节似乎使用 --decode_raw 成功解码:

The 10 bytes you added to your question appear to decode successfully using --decode_raw:

$ echo 08ffff01100840f7d438 | xxd -r -p | protoc --decode_raw
1: 32767
2: 8
8: 928375

交叉引用字段编号，我们得到:

Cross-referencing the field numbers, we get:

u1: 32767
u2: 8
u6: 928375

这篇关于如何解码二进制/原始谷歌 protobuf 数据的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！