If the author is here, thanks for writing this up. I did something similar years ago, but I neglected to write it up. My process was essentially the same as yours, although I used some thrown-together python code to analyze the protobuf data.

After I finished, I found out that the raw .proto files were embedded in the web app, which would have have saved a bit of time, but also taken away some of the fun. So if you want the official schema, you can look there, but it might not be legal to redistribute as-is.

Also, if anyone is poking around with protobuf forensics with ObjectiveC code, I once threw together a script to reverse engineer protobuf definitions from ObjectiveC executables. I haven't tested it recently, but it should work for ObjetiveC code generated by protoc (i.e. if _PBDataWriterWriteInt shows up in nm output):

https://gist.github.com/dunhamsteve/224e26a7f56689c33cea4f0f...