# tomer8007/mtproto-dissector architecture

> Architecture diagram of the GitHub repository tomer8007/mtproto-dissector, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/tomer8007/mtproto-dissector
- Repository: https://github.com/tomer8007/mtproto-dissector

## Overview

The repository provides a Wireshark dissector for inspecting Telegram MTProto traffic, plus Frida scripts for extracting authorization keys from Android and Windows clients. The primary workflow is to open a capture in Wireshark, decode and inspect packets, and optionally provide the matching auth key for decryption. The README documents the dissector capabilities and schema configuration; the dissector implementation itself was not sampled, so internal call relationships are not asserted.

Main entry points: [`mtproto/mtproto.lua`](https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua) (MTProto dissector), [`auth_key_extraction/hook_script_android.js`](https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_script_android.js) (Android auth hook), [`auth_key_extraction/hook_script_windows.js`](https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_script_windows.js) (Windows auth hook), [`auth_key_extraction/hook_android_auth_key.py`](https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_android_auth_key.py) (Android Frida runner)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_dissection["Packet dissection"]
  node_wireshark["Wireshark"]
  node_dissector["MTProto dissector<br/>[mtproto.lua]"]
  node_transport["Transport decoding<br/>[mtproto.lua]"]
  node_reassembly["TCP reassembly<br/>[mtproto.lua]"]
  node_deobfuscation["De-obfuscation<br/>[mtproto.lua]"]
  node_decryption["Packet decryption<br/>[mtproto.lua]"]
  node_tl["TL RPC parsing<br/>[mtproto.lua]"]
  node_authprefs["Auth key preferences<br/>[mtproto.lua]"]
end

subgraph group_schemas["Protocol schemas"]
  node_schema["API TL schemas"]
end

subgraph group_android["Android key extraction"]
  node_androidrunner["Android Frida runner"]
  node_androidhook["Android auth hook"]
end

subgraph group_windows["Windows key extraction"]
  node_windowsrunner["Windows Frida runner"]
  node_windowshook["Windows auth hook"]
end

node_analyst(("Analyst"))
node_capture["Telegram capture"]
node_androidclient["Android Telegram app"]
node_windowsclient["Windows Telegram app"]

node_analyst -->|"records traffic"| node_capture
node_analyst -->|"opens capture"| node_wireshark
node_capture -->|"supplies packets"| node_dissector
node_dissector -->|"decodes transports"| node_transport
node_dissector -->|"reassembles TCP"| node_reassembly
node_dissector -->|"de-obfuscates"| node_deobfuscation
node_dissector -->|"decrypts packets"| node_decryption
node_dissector -->|"parses RPC payloads"| node_tl
node_schema -->|"defines TL types"| node_tl
node_analyst -->|"enters auth keys"| node_authprefs
node_authprefs -->|"provides auth key"| node_decryption
node_analyst -->|"starts extractor"| node_androidrunner
node_androidrunner -->|"loads script"| node_androidhook
node_androidhook -->|"hooks auth lookup"| node_androidclient
node_androidhook -->|"prints auth key"| node_analyst
node_analyst -->|"starts extractor"| node_windowsrunner
node_windowsrunner -->|"loads script"| node_windowshook
node_windowshook -->|"hooks auth functions"| node_windowsclient
node_windowshook -->|"prints auth key"| node_analyst

click node_dissector "https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua"
click node_transport "https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua"
click node_reassembly "https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua"
click node_deobfuscation "https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua"
click node_decryption "https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua"
click node_tl "https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua"
click node_authprefs "https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua"
click node_schema "https://github.com/tomer8007/mtproto-dissector/tree/main/mtproto/schema"
click node_androidrunner "https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_android_auth_key.py"
click node_androidhook "https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_script_android.js"
click node_windowsrunner "https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_windows_auth_key.py"
click node_windowshook "https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_script_windows.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_wireshark,node_dissector,node_transport,node_reassembly,node_deobfuscation,node_decryption,node_tl,node_authprefs toneBlue
class node_schema toneAmber
class node_androidrunner,node_androidhook toneMint
class node_windowsrunner,node_windowshook toneRose
class node_analyst,node_capture,node_androidclient,node_windowsclient toneIndigo
```

## Components

### Packet dissection

- **Wireshark**
- [MTProto dissector](https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua): `mtproto/mtproto.lua`
- [Transport decoding](https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua): `mtproto/mtproto.lua`
- [TCP reassembly](https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua): `mtproto/mtproto.lua`
- [De-obfuscation](https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua): `mtproto/mtproto.lua`
- [Packet decryption](https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua): `mtproto/mtproto.lua`
- [TL RPC parsing](https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua): `mtproto/mtproto.lua`
- [Auth key preferences](https://github.com/tomer8007/mtproto-dissector/blob/main/mtproto/mtproto.lua): `mtproto/mtproto.lua`

### Protocol schemas

- [API TL schemas](https://github.com/tomer8007/mtproto-dissector/tree/main/mtproto/schema): `mtproto/schema`

### Android key extraction

- [Android Frida runner](https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_android_auth_key.py): `auth_key_extraction/hook_android_auth_key.py`
- [Android auth hook](https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_script_android.js): `auth_key_extraction/hook_script_android.js`

### Windows key extraction

- [Windows Frida runner](https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_windows_auth_key.py): `auth_key_extraction/hook_windows_auth_key.py`
- [Windows auth hook](https://github.com/tomer8007/mtproto-dissector/blob/main/auth_key_extraction/hook_script_windows.js): `auth_key_extraction/hook_script_windows.js`

### Other components

- **Analyst**
- **Telegram capture**
- **Android Telegram app**
- **Windows Telegram app**

## Connections

- Analyst → Telegram capture: records traffic (evidence: `README.md`)
- Analyst → Wireshark: opens capture (evidence: `README.md`)
- Telegram capture → MTProto dissector: supplies packets (evidence: `README.md`)
- MTProto dissector → Transport decoding: decodes transports (evidence: `README.md`)
- MTProto dissector → TCP reassembly: reassembles TCP (evidence: `README.md`)
- MTProto dissector → De-obfuscation: de-obfuscates (evidence: `README.md`)
- MTProto dissector → Packet decryption: decrypts packets (evidence: `README.md`)
- MTProto dissector → TL RPC parsing: parses RPC payloads (evidence: `README.md`)
- API TL schemas → TL RPC parsing: defines TL types (evidence: `README.md`)
- Analyst → Auth key preferences: enters auth keys (evidence: `README.md`)
- Auth key preferences → Packet decryption: provides auth key (evidence: `README.md`)
- Analyst → Android Frida runner: starts extractor (evidence: `README.md`)
- Android Frida runner → Android auth hook: loads script (evidence: `auth_key_extraction/hook_android_auth_key.py`)
- Android auth hook → Android Telegram app: hooks auth lookup (evidence: `auth_key_extraction/hook_script_android.js`)
- Android auth hook → Analyst: prints auth key (evidence: `auth_key_extraction/hook_script_android.js`)
- Analyst → Windows Frida runner: starts extractor (evidence: `README.md`)
- Windows Frida runner → Windows auth hook: loads script (evidence: `auth_key_extraction/hook_windows_auth_key.py`)
- Windows auth hook → Windows Telegram app: hooks auth functions (evidence: `auth_key_extraction/hook_script_windows.js`)
- Windows auth hook → Analyst: prints auth key (evidence: `auth_key_extraction/hook_script_windows.js`)