Protocol Buffers for Forensic Examiners: The Varint Trap

				
					from datetime import datetime, timezone


def decode_varint(data, offset=0):
    """
    Decode a protobuf varint (LEB128) from bytes.
    Returns (value, bytes_consumed).
    """
    result = 0
    shift = 0
    bytes_consumed = 0

    while True:
        byte = data[offset + bytes_consumed]
        bytes_consumed += 1

        # AND with 0x7F: strip MSB, keep 7 data bits
        payload = byte & 0x7F

        # OR with shifted payload: merge into result
        result |= payload << shift

        # AND with 0x80: test continuation bit
        if (byte & 0x80) == 0:
            break

        shift += 7

    return result, bytes_consumed


def parse_fields(data):
    """
    Parse raw protobuf bytes into fields.
    Returns list of (field_number, wire_type, value) tuples.
    """
    offset = 0
    fields = []

    while offset < len(data):
        # Read the field tag (varint)
        tag, consumed = decode_varint(data, offset)
        offset += consumed

        # Unpack: low 3 bits = wire type, upper bits = field number
        wire_type    = tag & 0x07
        field_number = tag >> 3

        if wire_type == 0:          # Varint
            value, consumed = decode_varint(data, offset)
            offset += consumed

        elif wire_type == 1:        # 64-bit fixed
            value = data[offset:offset + 8]
            offset += 8

        elif wire_type == 2:        # Length-delimited
            length, consumed = decode_varint(data, offset)
            offset += consumed
            value = data[offset:offset + length]
            offset += length

        elif wire_type == 5:        # 32-bit fixed
            value = data[offset:offset + 4]
            offset += 4

        else:
            print(f"Unknown wire type {wire_type} at offset {offset}")
            break

        fields.append((field_number, wire_type, value))

    return fields


def xor_decrypt(data, key):
    """XOR each byte of data with the repeating key."""
    return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))


# ============================================================
# THE PROTOBUF BLOB (raw bytes)
# ============================================================

raw = bytes.fromhex(
    "08E90712054C616E636518D2CF8DBB06"
    "2204DEADBEEF2AB5019AC8CE80ADC4CA"
    "CFAAC5DBCFB8D8D08BAD8DD781AAC29E"
    "8EBDCED19AB0D99EDBEA958FC2EC9F87"
    "DFF39A8FDAE88DDC8AB8C2CC8AFEEBCC"
    "86BACCC7C1FEF8CD8AFED9D68AFEDEDF"
    "82BB8DD38AAAC5D18BFECCCDCFB2CCCD"
    "9BFED9D782BB839EABB18DD080AA8DDD"
    "80B0D9DF8CAA8DD38AFEC2D0CFAAC5D7"
    "9CFEC3CB82BCC8CCCFBFCADF86B08D93"
    "CFABDEDBCFAAC5DBCFADC8DD80B0C9DF"
    "9DA78DDD87BFC3D08AB2839EABBBDECA"
    "9DB1D49E9BB6C4CDCFB0C2CA8AF0"
)

print(f"Parsing {len(raw)} bytes of protobuf data.\n")

# Parse all protobuf fields
fields = parse_fields(raw)

wire_type_names = {
    0: "Varint",
    1: "64-bit fixed",
    2: "Length-delimited",
    5: "32-bit fixed"
}

xor_key = None
encrypted_msg = None

for field_num, wire_type, value in fields:
    wt_name = wire_type_names.get(wire_type, f"Unknown({wire_type})")
    print(f"--- Field {field_num} | Wire Type {wire_type} ({wt_name}) ---")

    if wire_type == 0:
        print(f"  Value: {value}")
        if field_num == 3:
            # Convert Unix timestamp
            dt = datetime.fromtimestamp(value, tz=timezone.utc)
            print(f"  As datetime: {dt.strftime('%Y-%m-%d %H:%M:%S UTC')}")

    elif wire_type == 2:
        print(f"  Length: {len(value)} bytes")
        # Try to display as text
        try:
            text = value.decode("utf-8")
            if all(c.isprintable() or c in "\n\r\t" for c in text):
                print(f'  As text: "{text}"')
            else:
                raise ValueError
        except (UnicodeDecodeError, ValueError):
            print(f"  Hex: {value.hex()}")

        # Capture key and ciphertext
        if field_num == 4:
            xor_key = value
            print(f"  XOR Key: 0x{value.hex().upper()}")
        elif field_num == 5:
            encrypted_msg = value

    print()

# Decrypt the message
if xor_key and encrypted_msg:
    print("=" * 60)
    print("DECRYPTING MESSAGE")
    print("=" * 60)
    plaintext = xor_decrypt(encrypted_msg, xor_key)
    print(f"\n  {plaintext.decode('utf-8')}\n")