[Help Wanted] - Fixing the Package

Hey, I’ve been trying to fix the API, one of the things I’m running into is generating the x-tt-params header. I currently have code semi-working for getting user posts except for this header. I’ll be pushing my current code to the nightly branch, but it’ll likely only be focused on user_posts breaking the other functions temporarily (but they’re already broken so 🤷 ) it’s just meant as a way to collaborate.

Important Information

@MuffinFox pointed out on #690

• for initialisation of parameter encryption there is a call to window._$jsvmprt(a, b, c) with some hardcoded string (key?)
• window._fetch is a patched fetch which adds some additional functionality
• crypthojs lib is used for obfuscation

@asportnoy on #685 about ttwid (which isn’t my current main focus)

• The cookie is generated from a post request to https://www.tiktok.com/ttwid/check/ (set-cookie header). That request requires a fid parameter but I can’t tell what generates that.
• I also noticed this new script which seems relevant to the changes: https://www.tiktok.com/acrawler/webmssdk.js I was able to partially de-obfuscate that with http://jsnice.org/.

Things I’ve noticed

• Appears they’re signing urls using a different algorithm for _signature url parameter.
• ttwid doesn’t really seem to matter (at least for user_posts)
• Whatever tokens they’re checking don’t seem to expire
• VerifyFp doesn’t seem to exist on the initial calls of at least user_posts anymore

Priorities

1. Figure out how x-tt-params is being generated

Related Issues (with more information and potentially more help)

I’ve closed these and linked to this, sorted by most relevant to least relevant

• #690
• #685
• #691
• #688
• #693
• #681
• #674

[ExtReMLapin]

In this kind of situation, you can be sure, there are people from tiktok’s engineering team watching this issue.

If you really want to get the API to work you should probably organize and work together with a little more privacy.

Now, about the x-tt-params code I posted in the previous issue, here is what gets inside b

"x-tt-params": Object(d.a)(b)

aid: [CENSORED INT]
app_language: "fr"
app_name: "tiktok_web"
battery_info: BatteryManager {charging: true, chargingTime: 0, dischargingTime: Infinity, level: 1, onchargingchange: null, …}
browser_language: "fr-FR"
browser_name: "Mozilla"
browser_online: true
browser_platform: "Win32"
browser_version: "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36"
cookie_enabled: true
count: 30
cursor: "0"
device_id: "[UINT64 CENSORED]"
device_platform: "web_pc"
focus_state: true
history_len: 4
is_fullscreen: false
is_page_visible: true
language: "fr"
os: "windows"
priority_region: "FR"
referer: ""
region: "FR"
root_referer: undefined
screen_height: 1440
screen_width: 2560
secUid: "[BASE64 CENSORED]"
timezone_name: "Europe/Paris"
verifyFp: "verify_[CENSORED]"
[[Prototype]]: Object

[davidteather]

@carcabot has replicated the signing function in javascript with a docker container in their repository.

• javascript
• example trending.py