Honestly, I can't really imagine how this would work at all? I could see how, given enough data, you'd be able to infer the intended logic of the server and re

Honestly, I can't really imagine how this would work at all? I could see how, given enough data, you'd be able to infer the intended logic of the server and reimplement something that's compatible (I've done this myself with Wireshark + USB devices in the past). But how would could you reason about specific vulnerabilities in remote code just from a set of requests and responses?