№ 01
Write-ups
Featured · Deep dive30 min read
Scraping TikTok's Mobile API
The full write-up: how TikTok signs its private mobile API, device registration and activation, the X-Argus / X-Ladon cipher stack, TLS fingerprinting, and the 24 endpoints it opens up.
Read the write-up →Data · 4 min
Scraping 3 billion TikTok profiles (and what's actually in them)
A run through the shape of the dataset: 3.1 billion unique creators, how many clear the 1k-follower line, and where they are in the world.
Read →Reverse engineering · 5 min
How TikTok's X-Argus request signing works
The header that gates the mobile API: a protobuf sealed with two layers of Simon/Speck and SM3. What it contains and why a wrong one returns an empty 200.
Read →Field notes · 2 min
Where TikTok hides the creator's country
The profile endpoint returns no region. The author object on a post looks like it should, but it's empty. The country is there, one level up.
Read →