title: Protobuf-net unrecognized stream prefix
body: <p>I'm trying to reverse engineer the Quasar RAT protobuf protocol structure. 
  Quasar is a Remote Administration Tool written in C# which is open source and can be found online here.
  <a href="https://github.com/quasar/QuasarRAT" rel="nofollow noreferrer">https://github.com/quasar/QuasarRAT</a></p>
  
  <p>I've managed to reverse most of it and I can now connect to the Quasar server client from a python script. How ever one question remains open, it appears that every byte stream that is being sent from the client to the server begins with a 3 byte field which is not registered within the protobuf class within Quasar. This field seems to provide the length of the message not including the prefixed bytes. As can be seen within this block for an example a prefixed byte stream generated for an array of size 0x2d2, these are the prefixed bytes being appended to the message. </p>
  
  <pre><code>0x0A, 0xCF, 0x05
  </code></pre>
  
  <p>If how ever I decide to change the message fields before serializing the message, this byte stream would change except from the first <strong>0x0A</strong> byte. It seems that if I keep appending bytes to the message fields the second byte grows and  if I overflow the second byte(make it reach above <strong>0xff</strong>) - it would increment the third byte and reset the second byte to <strong>0x80</strong>. But the math wont make sense to me at all as this field should return the size of the array but doesn't under any sensible formula that I could compute. I know that protobuf-net can generate <strong>PreLengthPrefix</strong> bytes to prefix the message with the length of it but this is not the case here.</p>
  
  <p>Any help would be appreciated.</p>