Glossary
Protocol Buffers (protobuf)
Protocol Buffers is Google's compact binary serialization format; Android uses it for usagestats, system dumps and many Google app data files.
Protocol Buffers (protobuf) is a binary serialization format created by Google. A message is a sequence of fields, each encoded as a field number plus a wire type (varint, 64-bit, length-delimited or 32-bit) followed by the value. The file does not carry field names or types: those live in a separate .proto schema compiled into the app.
Android and Google apps use protobuf widely: usagestats event files from Android 10 onward, dumpsys --proto service dumps inside bugreports, and many Google app caches and settings files. For an investigator that means:
- Without the schema you can still decode the structure.
protoc --decode_raw < fileprints field numbers and values; blackboxprotobuf (Python) and CyberChef's "Protobuf Decode" do the same and let you refine types. - Nested messages and strings both use the length-delimited wire type, so a raw decoder may guess wrong. Check whether a "string" parses as a sub-message.
- Integers are varints; timestamps are commonly milliseconds since the Unix epoch, sometimes stored as offsets from another value in the same file (usagestats does this).
- AOSP
.protofiles are public for system formats, so match the exact Android release before trusting a field mapping.
When a parser such as ALEAPP supports the file, use it, and spot-check a few records with a raw decode to confirm the field mapping on the build you have.