What it does

ProtoLoom finds protobuf information that remains inside compiled software and rebuilds it into files you can inspect and use. It works directly with:

• Android apps and bundles (.apk, .aab, .dex)
• Java archives (.jar, .zip)
• Linux, macOS, and Windows binaries
• Go binaries containing protobuf descriptors

No decompiler or AI service is required. When ProtoLoom cannot prove something, it reports the uncertainty instead of silently guessing.

Install

ProtoLoom requires Python 3.11 or newer. From a local checkout:

uv tool install .

Use

Inspect a file:

protoloom inspect app.apk

Recover its schemas:

protoloom extract app.apk --output out

Open out/dashboard/index.html for the visual report, or use the generated .proto files directly. The output also includes a descriptor set, recovery.json, and a Markdown report.

For difficult Android apps, jadx can be enabled as an optional fallback:

protoloom extract app.apk --jadx --output out

Try ProtoLoom without supplying a binary:

protoloom demo

Why ProtoLoom

• Produces compilable .proto files, not raw string dumps
• Shows where each recovered field came from
• Keeps uncertain results visible
• Runs deterministically without cloud services
• Handles nested archives and multiple binary formats
• Matches the established pbtk tool's schema fidelity exactly on a real, unobfuscated production app — plus native and Go descriptor recovery, which pbtk doesn't do
• Is tested against pinned schemas, shipping apps, and a real exported payload

ProtoLoom is currently alpha software, but its numbers come from real shipping apps, not just synthetic fixtures. It matches pbtk on all nine measured metrics for Mullvad's protobuf-lite schema, and reaches the same 100% once Bitwarden Authenticator's and Gadgetbridge's proto packages are normalized to their compiled Java namespace — a real, documented ambiguity in what protobuf-lite compiles to, not a recovery bug. Where a signal is genuinely gone, ProtoLoom says so instead of guessing: Gadgetbridge's Java generator loses the exact source spelling of some field names, and a build optimizer can strip the last signal distinguishing some merged enum types on Smartspacer, so a minority of names and enum values in those apps stay unresolved rather than invented. Apps built with Square Wire instead of protobuf-lite (Signal, Molly, Meshtastic) aren't a supported schema source yet. Detailed measurements, methodology, and every known limitation are published in benchmarks/results.md.

Development

uv sync --extra dev --group dev
uv run make check

See CONTRIBUTING.md to contribute and SECURITY.md to report a vulnerability.

License

Apache License 2.0. See LICENSE.