Reverse Engineering TikTok API with Hermes Agent and GLM 5.3
Automating mobile app metadata extraction using AI agents and native library emulation.
1Automating Complex App Analysis
The project utilized the Hermes Agent and GLM 5.3 to reverse-engineer TikTok's private API. By integrating the Reverse Engineer Anything (REA) repository, the system automated interactions with tools like Ghidra and Jadx. This setup allowed for efficient analysis of Android bytecode and native libraries without requiring expensive emulators or manual intervention.
2The Challenge of Silent Failures
TikTok's API employs a strict security mechanism where invalid requests return an HTTP 200 status with an empty body. This makes debugging difficult, as there are no explicit error codes. Success depends on four factors: device identity, request signature, regional endpoint, and network fingerprint, all verified simultaneously by the server.
3Developing a Content-Based Judge
Since HTTP status codes are unreliable, a custom Python classifier was developed to evaluate responses. This judge inspects the body length to determine if a request was successful. By filtering out empty responses, the system distinguishes between valid data payloads and blocked requests, providing a reliable signal for automated scraping operations.
4Decompilation and Hooking Limits
Initial analysis involved using Jadx to map the signing library and app headers. However, hooking attempts with Frida failed because the signing logic resides entirely within native code, bypassing Java-level calls. This discovery forced a shift in strategy, moving away from simple function hooking toward deeper native library manipulation techniques.
5Bypassing Certificate Pinning
TikTok implements certificate pinning to prevent traffic interception via proxies. Instead of replacing the check, which caused immediate app crashes, the agent modified the logic to flip the final verification result. This allowed the app to proceed normally while enabling the capture of signed traffic for further analysis and study.
6Native Library Emulation Strategy
Because signatures are unique to each request, they cannot be reused. Rather than reimplementing the complex signing math, the team used unidbg to load and execute the app's own native signing library externally. This approach generates valid signatures on a standard server without needing an actual mobile device or emulator.
7Managing Device Identities
Request signatures require a valid device identity recognized by TikTok. The agent was programmed to replicate the app's initial launch sequence to register fresh identities. These identities are warmed up and validated before being used in the scraping pool, ensuring that requests appear legitimate and avoid immediate platform-side blocking.
8Scaling Through Parallel Execution
The final architecture relies on a pool of rotating residential IPs and managed device identities. By running multiple instances of the signing library in parallel, the system achieves consistent data collection. This method effectively mimics real user traffic while maintaining the high throughput necessary for large-scale metadata extraction from the platform.
9Ethical and Practical Constraints
While the technical implementation is functional, the author has restricted the public repository to exclude the specific code interacting with TikTok. This decision aims to prevent potential takedown requests or deindexing. The shared modules focus on the general engineering framework rather than the specific exploit logic used against the target.
10Implications for Data Scraping
This project demonstrates that AI agents can significantly lower the barrier to entry for complex reverse engineering. By delegating tool orchestration to LLMs, developers can navigate sophisticated anti-bot systems with minimal manual effort. The success highlights the evolving landscape of data collection where emulation replaces traditional browser-based automation for efficiency.