Artificial Intelligence1 min read

Hermes and REA and GLM 5.3 = Reverse engineering TikTok app for less than $20

By · Published by Everything Blog

In short

The setup combined the GLM 5.3 model on OpenRouter with the Hermes agent and an open-source tool named Reverse Engineer Anything to automate deep binary inspection. By serving as an MCP server, REA orchestrated common analysis tools like Ghidra, jadx, and mitmproxy to dissect the target application. This allowed the team to overcome TikTok's requirement for embedded native library request signatures, valid device identities, regional endpoints, and mobile network fingerprints. Notably, failing any of these parameters resulted in deceptive HTTP 200 responses with completely empty bodies.

Key points

  • The combination of REA and GLM 5.3 enables automated driving of legacy tools such as Ghid…: The combination of REA and GLM 5.3 enables automated driving of legacy tools such as Ghidra and IDA.
  • Successful API interaction demands satisfying strict mobile network fingerprints and embe…: Successful API interaction demands satisfying strict mobile network fingerprints and embedded native library signatures.
  • Platform data extraction workflows can now bypass expensive commercial paywalls using low…: Platform data extraction workflows can now bypass expensive commercial paywalls using low-cost AI agents.

Sources checked by our analysis pipeline: 1

A few weeks ago, a TikTok dataset published on Hugging Face caught my eye: it contained metadata of 5.6B videos from the platform. That’s a huge dataset, and the data collection immediately appeared to me to be the most interesting part. Using a browser or an emulator to do so would have been too expensive. In fact, the write-up from DataSocial explained the general shape of the approach: it was completely headless, with no emulators in the loop.

I was able to read it before it disappeared (thanks Web Archive for the snapshot) and was intrigued by replicating it, but it didn’t reveal the ingredients of the secret sauce. They were put behind a paywall costing 1699 USD. Which, I mean, is totally fine, but then I asked myself: “I have this cool reverse engineering setup, made by Hermes Agent, Reverse Engineer Anything repo and GLM 5.3, maybe I can find the answers by myself”.

So I did. Or better, we did. Well, most of the work was done by GLM; I just set the direction and checked the results.

Artificial Intelligence