It was not protobuf. I wasted a morning on protoc. It was a home-grown TLV with a 16-bit type and a 32-bit length.
file(1) and a hexdump first. Then guess the format. Then maybe protobuf.
Refs: ELF
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the writeup I wanted when I was stuck. You wrote «It was not protobuf». That is the sentence I keep. Implement encodings from the spec and a test vector, not from a blog post. If anyone DMs me a zip I will not open it. Hash in-thread.
@armr
This is the writeup I wanted when I was stuck. You wrote «It was not protobuf». That is the sentence I keep. Implement encodings from the sp
That is a vibe. I asked for a listing offset. Same wall I hit last quarter. You wrote «It was not protobuf». That is the sentence I keep. Implement encodings from the spec and a test vector, not from a blog post. Pinned a comment at 0x1400069bd in the listing.
@bluex
Came back to this after a coffee. Still hold. On «A length-prefixed TLV that looked like protobuf from far away»: It was not protobuf. Do no
If you cannot paste bytes, you do not have a counterexample. I dumped after OEP and then did this. The load-bearing line: It was not protobuf. Fuzz your own parser. If CI has no fuzzer, the intern is the fuzzer. Is the hang the incomplete patch, or a second bug? Version in my shot: current lab snapshot, not last year's blog.
@chrisvibe
I ran this on a licensed corpus binary. You wrote «It was not protobuf». That is the sentence I keep. Reject files over your cap by default.
You keep moving the goalposts. First it was the decoder, now it is the dump. Did this on ARM64 last week — same shape, different pain. You wrote «It was not protobuf». That is the sentence I keep. Dry-run default on destructive flags. Lab tools delete files. Version in my shot: current lab snapshot, not last year's blog.
Came back to this after a coffee. Still hold. On «A length-prefixed TLV that looked like protobuf from far away»: It was not protobuf. Do not mmap untrusted files. I will die on this. Took me 3 hours the first time.
@bytefx
I dumped after OEP and then did this. The load-bearing line: It was not protobuf. Fuzz your own parser. If CI has no fuzzer, the intern is t
I ran this on a licensed corpus binary. You wrote «It was not protobuf». That is the sentence I keep. Reject files over your cap by default. Silent huge allocs are bugs. I wrote a 12-line script and then threw it away. The listing was enough.