v0.4 Go 1.23+ Apache-2.0 @theworker02

WIRETAP

Evidence-backed binary protocol inference — offline, deterministic, explainable. Competing field hypotheses with measured evidence. No LLM APIs. No telemetry.

Get started Go module v0.5.0 GitHub Sponsor

Why Wiretap

Measure first. Propose competing hypotheses. Attach evidence. If the corpus is thin, say Insufficient evidence — never invent confidence.

Inference pipeline

Stats → regions → competing passes → competition prune → structured report.

Honest confidence

Evidence-gated ranks. Overlapping aliases pruned. Entropy stays candid.

Offline by design

No telemetry, no cloud models. Captures stay on your machine.

Exports

HTML/JSON reports, SVG/Mermaid maps, Go / Kaitai / Wireshark stubs.

Install

go install github.com/theworker02/wiretap/cmd/wiretap@v0.5.0
wiretap doctor
wiretap catalog
wiretap analyze examples/mystery/captures.hex

Requires Go 1.23+. Module docs on pkg.go.dev (@v0.5.0). Binaries: GitHub Release v0.5.0. Or build from source — see Get started.

Quick demo

# Unix
./scripts/demo.sh

# Windows PowerShell
.\scripts\demo.ps1

Walkthroughs and corpora: Examples.

Authorized use only. Capture helpers load operator-provided files — not MITM, not live interface sniffing. Read Security. Maintained by @theworker02.