How tomer8007/mtproto-dissector works
The repository provides a Wireshark dissector for inspecting Telegram MTProto traffic, plus Frida scripts for extracting authorization keys from Android and Windows clients. The primary workflow is to open a capture in Wireshark, decode and inspect packets, and optionally provide the matching auth key for decryption. The README documents the dissector capabilities and schema configuration; the dissector implementation itself was not sampled, so internal call relationships are not asserted.
Main entry points: mtproto.lua MTProto dissector · hook_script_android.js Android auth hook · hook_script_windows.js Windows auth hook · hook_android_auth_key.py Android Frida runner
Components 17
Packet dissection
- Wireshark
- MTProto dissector
mtproto/mtproto.lua - Transport decoding
mtproto/mtproto.lua - TCP reassembly
mtproto/mtproto.lua - De-obfuscation
mtproto/mtproto.lua - Packet decryption
mtproto/mtproto.lua - TL RPC parsing
mtproto/mtproto.lua - Auth key preferences
mtproto/mtproto.lua
Protocol schemas
- API TL schemas
mtproto/schema
Android key extraction
- Android Frida runner
auth_key_extraction/hook_android_auth_key.py - Android auth hook
auth_key_extraction/hook_script_android.js
Windows key extraction
- Windows Frida runner
auth_key_extraction/hook_windows_auth_key.py - Windows auth hook
auth_key_extraction/hook_script_windows.js
Other components
- Analyst
- Telegram capture
- Android Telegram app
- Windows Telegram app
Connections 19
- Analyst → Telegram capture: records traffic
README.md - Analyst → Wireshark: opens capture
README.md - Telegram capture → MTProto dissector: supplies packets
README.md - MTProto dissector → Transport decoding: decodes transports
README.md - MTProto dissector → TCP reassembly: reassembles TCP
README.md - MTProto dissector → De-obfuscation: de-obfuscates
README.md - MTProto dissector → Packet decryption: decrypts packets
README.md - MTProto dissector → TL RPC parsing: parses RPC payloads
README.md - API TL schemas → TL RPC parsing: defines TL types
README.md - Analyst → Auth key preferences: enters auth keys
README.md - Auth key preferences → Packet decryption: provides auth key
README.md - Analyst → Android Frida runner: starts extractor
README.md - Android Frida runner → Android auth hook: loads script
auth_key_extraction/hook_android_auth_key.py - Android auth hook → Android Telegram app: hooks auth lookup
auth_key_extraction/hook_script_android.js - Android auth hook → Analyst: prints auth key
auth_key_extraction/hook_script_android.js - Analyst → Windows Frida runner: starts extractor
README.md - Windows Frida runner → Windows auth hook: loads script
auth_key_extraction/hook_windows_auth_key.py - Windows auth hook → Windows Telegram app: hooks auth functions
auth_key_extraction/hook_script_windows.js - Windows auth hook → Analyst: prints auth key
auth_key_extraction/hook_script_windows.js