Guides / End-to-end tutorials / Protocol decrypt & audit A–Z

Protocol decrypt & audit A–Z

Inspect authorized QA and mobile security traffic captures end-to-end with read-only decrypt and decode primitives — verifying headers, payload hashes, MSSDK frames and protobuf wire fields without signing keys.

1. Read-only capture inspection pipeline

Mobile QA and security teams capturing HTTPS HAR/PCAP traces from their own test devices can decode every proprietary TikTok header and payload layer via the 8 read-only Primitive endpoints (2 credits each) — with zero signing keys in CI or analyst laptops.

Action	Endpoint	Cost
X-Argus decrypt	`POST /v1/crypto/x-argus/decrypt`	2 cr
X-Ladon decrypt	`POST /v1/crypto/x-ladon/decrypt`	2 cr
X-Gorgon decrypt	`POST /v1/crypto/x-gorgon/decrypt`	2 cr
X-Cylons decrypt	`POST /v1/crypto/x-cylons/decrypt`	2 cr
MSSDK decrypt	`POST /v1/crypto/mssdk/decrypt`	2 cr
TTEncrypt decode	`POST /v1/crypto/ttencrypt/decrypt`	2 cr
zstd decompress	`POST /v1/crypto/zstd/decompress`	2 cr
Protobuf decode	`POST /v1/crypto/protobuf/decode`	2 cr

Authorized first-party captures only. Use decrypt inspectors exclusively on traffic captured from devices and test builds you own or are authorized to audit.

2. End-to-end header, telemetry & protobuf verifier

TypeScript SDKPython SDKcURL / MCPcapture_audit

1import { BadRequestError, TikUltra } from 'tikultra'
2
3const client = new TikUltra({ apiKey: process.env.TIKULTRA_KEY, os: 'android', appFlavour: 'tiktok', appVersion: '47.5.41' })
4
5export async function auditCapturedFrame(har: {
6  query: string; xSsStub: string; lanusk: string
7  xArgus: string; xLadon: string; xGorgon: string; xCylons: string
8  mssdkB64: string; applogB64: string; zstdRespB64: string
9}) {
10  const [argus, ladon, gorgon, cylons, mssdk, applog, decompressed] = await Promise.all([
11    client.crypto.xArgusDecrypt({ x_argus: har.xArgus }),
12    client.crypto.xLadonDecrypt({ x_ladon: har.xLadon, aid: '1233' }),
13    client.crypto.xGorgonDecrypt({ x_gorgon: har.xGorgon }),
14    client.crypto.xCylonsDecrypt({ x_cylons: har.xCylons, query_string: har.query, x_ss_stub: har.xSsStub, lanusk: har.lanusk, lanusv: '1' }),
15    client.crypto.mssdkDecrypt({ operation: 'report', payload_base64: har.mssdkB64 }),
16    client.crypto.ttencryptDecrypt({ ciphertext_base64: har.applogB64 }),
17    client.crypto.zstdDecompress({ data_base64: har.zstdRespB64 }),
18  ])
19  const proto = await client.crypto.protobufDecode({ hex: decompressed.data.hex })
20  const spent = [argus, ladon, gorgon, cylons, mssdk, applog, decompressed, proto].reduce((s, r) => s + r.creditsCost, 0)
21
22  return {
23    deviceId:    argus.data.device_id,
24    sdkVersion:  argus.data.sdk_version,
25    clockSkewS:  Math.abs((argus.data.create_time ?? 0) - (gorgon.data.khronos ?? 0)),
26    stubMatched: gorgon.data.x_ss_stub_matched === true && cylons.data.verified === true,
27    ladonAid:    ladon.data.aid,
28    mssdkFields: Object.keys(mssdk.data.decoded ?? {}),
29    applogEvents: applog.data.json?.events?.length ?? 0,
30    protoFields: proto.data.fields,
31    creditsUsed: spent, // 8 x 2 = 16 credits total
32  }
33}

3. Verification checks & zero-cost error handling

Assert three invariants on every captured request: (1) Math.abs(argus.create_time - gorgon.khronos) <= 2 for header clock alignment, (2) x_ss_stub MD5 parity across X-Argus, X-Gorgon and X-Cylons, and (3) non-empty protobufDecode field trees after zstdDecompress. Corrupted or truncated base64 frames raise BadRequestError (400) at 0 credits.