AwesomeREA.org

Tool

pbtk

Recover Protobuf message definitions from compiled programs as readable .proto files. Extractors cover the Java runtimes in JAR, DEX and APK files (including ProGuard-obfuscated code), binaries that embed Protobuf reflection metadata, and web apps using the Protobuf-URL format. A GUI then binds a recovered message type to an HTTP endpoint, decodes hex-encoded captured samples into an editable field tree and resends edited messages, so analysts can relate each field to the response.

Requirements and limitations

  • Latest release at review: 1.1.3, published 2026-08-21 on GitHub and PyPI; the reviewed master commit is four commits ahead of it, adding a version display, a dependency bump and new brand colors, and carries a 1.1.3.1 tag with no GitHub release or PyPI upload. The README's 2026 notes say Java extraction now works mostly with older APKs and the Chrome-based Protobuf-URL web extractor needs an update; finishing the automatic fuzzing part is listed as forthcoming.
  • Requires Python 3.10+, PySide6 and the Python protobuf runtime. The README documents a snap for Ubuntu, the pbtk-git AUR package, and uv or pipx installs, and says Windows is supported. Java extraction needs a Java runtime (the Debian instructions install OpenJDK 8), and web extraction drives a Chrome or Chromium instance through websocket-client.
  • Analysts supply the APK, JAR, DEX or native library to analyze and, optionally, hex-encoded request samples they captured themselves with a proxy such as mitmproxy or Wireshark. Replay sends the edited messages to the live endpoint the analyst configures. Extracted .protos and endpoint definitions are stored in a .pbtk folder in the home directory (a pbtk folder under APPDATA on Windows).
  • GPL-3.0-or-later per pyproject.toml. The package bundles third-party executables: protoc builds, dex2jar 2.4 jars with their Apache-2.0 notice, and JAD decompiler binaries for which the repository includes no license text. Definitions recovered from minified code keep obfuscated names until the analyst renames them; no application was analyzed and no requests were sent.

About this entry

Type
Tool
Category
Protocol analysis tools
Relationship
Foundation tool
Targets
App · Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · marin-m/pbtk · Revision 7c5fa2c
  2. pyproject.toml GitHub · marin-m/pbtk · Revision 7c5fa2c
  3. LICENSE GitHub · marin-m/pbtk · Revision 7c5fa2c
  4. src/pbtk/extractors/jar_extract.py#L46-L52 GitHub · marin-m/pbtk · Revision 7c5fa2c
  5. src/pbtk/extractors/web_extract.py#L57-L65 GitHub · marin-m/pbtk · Revision 7c5fa2c
  6. src/pbtk/utils/transports.py GitHub · marin-m/pbtk · Revision 7c5fa2c
  7. src/pbtk/utils/external GitHub · marin-m/pbtk · Revision 7c5fa2c
  8. TROUBLESHOOTING.md GitHub · marin-m/pbtk · Revision 7c5fa2c
  9. https://github.com/marin-m/pbtk/releases/tag/1.1.3
  10. https://pypi.org/project/pbtk/1.1.3/