{
  "added_at": "2026-11-09",
  "additional_evidence_urls": [
    "https://github.com/tux3/crowdstrike-cloudproto/blob/c79852f849dbbbabfaad5ac840e4f8ec853dbcb1/Cargo.toml"
  ],
  "category": "reconstruction-cases",
  "class": "software",
  "description_en": "crowdstrike-cloudproto reconstructs the cloud protocol used between Falcon Sensor and its TS event and LFO file services as an asynchronous Rust crate. It implements common packet framing, TS event exchange, and LFO file downloads; the protocol notes describe Protobuf event payloads, acknowledgments, and LFO request and response packets.",
  "description_zh": "crowdstrike-cloudproto 是异步 Rust 库，还原 Falcon Sensor 与 TS 事件服务、LFO 文件服务之间的云端通信协议。它实现通用数据包封装、TS 事件交换和 LFO 文件下载，并记录 Protobuf 事件载荷、确认机制以及 LFO 请求与响应数据包。",
  "entry_url": "https://awesomerea.org/resources/crowdstrike-cloudproto-case/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/crowdstrike-cloudproto-case/",
  "evidence_url": "https://github.com/tux3/crowdstrike-cloudproto/blob/c79852f849dbbbabfaad5ac840e4f8ec853dbcb1/README.md",
  "group": "cases",
  "id": "crowdstrike-cloudproto-case",
  "json_url": "https://awesomerea.org/resources/crowdstrike-cloudproto-case/record.json",
  "kind": "case-study",
  "markdown_url": "https://awesomerea.org/resources/crowdstrike-cloudproto-case/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/crowdstrike-cloudproto-case/index.md",
  "name": "crowdstrike-cloudproto: reconstructed Falcon Sensor cloud protocol",
  "name_zh": "crowdstrike-cloudproto：Falcon Sensor 云端通信协议还原",
  "record_type": "resource",
  "relationship": "independent-reconstruction",
  "requirement_facets": [
    "prerequisites",
    "prerequisites",
    "prerequisites",
    "limits",
    "license"
  ],
  "requirements": [
    "Rust 1.64 or later.",
    "A valid Customer ID is required to connect to the official TS servers.",
    "A modified client configured for an owned domain with a valid certificate, or disabled certificate validation, is required to run a third-party server.",
    "LFO supports GET requests with optional XZ compression; uploads are not supported, and the author notes that some protocol fields or optional parts may be missing or misnamed.",
    "Licensed under MIT OR Apache-2.0, as declared in Cargo.toml."
  ],
  "requirements_zh": [
    "需要 Rust 1.64 或更新版本。",
    "连接官方 TS 服务器需要有效的 Customer ID。",
    "运行第三方服务器需要将修改后的客户端配置为连接自有域名并使用有效证书，或关闭证书验证。",
    "LFO 支持可选 XZ 压缩的 GET 请求，不支持上传；作者指出部分可选协议内容或字段可能缺失或命名不准确。",
    "Cargo.toml 声明采用 MIT OR Apache-2.0 许可证。"
  ],
  "targets": [
    "protocol"
  ],
  "url": "https://github.com/tux3/crowdstrike-cloudproto",
  "verification": "source-reviewed",
  "verified_at": "2026-11-08"
}