ChatGPTReversed - Educational project

Lets keep it simple, this is a educational project to learn to reverse complex API's and understand how they communicate with the frontend. In this case we take a look at the ChatGPT frontend and reverse engineer the API used to communicate with the LLM.

OpenAi uses several techniques to prevent malicious use of their API, eg. rate limiting, token expiration, hashing, proof of work, continious calls, proxies, captchas, etc.

We take a look at the ChatGPT webapp as starting point and only use the chromium devtools to understand the process.

We start by opening the ChatGPT webapp and open the devtools to see the network requests.

https://chatgpt.com/backend-api/conversation endpoint is called with a POST request, we can see the payload and type of response. (In this case its a EventStream)

Several Identifing headers and cookies are used to prevent abuse, in this case: Authorization(JWT Token), csrf-token(CSRF protection), session-token (Same as the JWT token), Requirements-Token & Proof Token

https://chatgpt.com/backend-api/sentinel/chat-requirements endpoint is called before the conversation starts, it passes in the token x and returns the token y.

{
  "persona": "chatgpt-freeaccount",
  "token": "y",
  "arkose": {},
  "turnstile": {},
  "proofofwork": {
    "required": true,
    "seed": "0.81186133b2821174",
    "difficulty": "073682"
  }
}

To find out how x is retrieved we need to take a look at the minified source code of the frontend.

Token x in this case is variable e which is passed as callback from variable n which uses the function getRequirementsToken to retrieve the token. The function getRequirementsToken in this case returns the token x by checking if the value is already in a map called answers, if not it calls the function _generateAnswer which returns the token x by using a hash function provided by the hashing library hash-wasm.

We place a breakpoint right after the getRequirementsToken function is called and check the returned value which is the token x.

So we have the token x (Requirements token), we need to pass to the endpoint, we also have the token y (Required Requirements Token) which is returned by the endpoint. The last thing we need is the token z (Proof token) which as we find out is also generated with _generateAnswer.

_generateAnswer function is called with the seed and difficulty returned by the endpoint, it uses the seed and also multiple parameters retrieved by the getConfig such as screen size, timezone, cpu cores, etc. to generate a hash and satisfy the difficulty condition. If no hash is found it will increment the step and try again. It falls back to a specified value after multiple steps.

In this case the function _generateAnswer is called with the seed and difficulty returned by the endpoint and that returns the token z.

So we have all the required tokens to call the conversation endpoint and start a conversation with the LLM. To recap:

• Session Token (JWT Token) is returned by https://chatgpt.com/api/auth/session in field accessToken

• CSRF Token is returned by https://chatgpt.com/api/auth/csrf in field csrfToken

• Requirements Token (Token x) is returned by getRequirementsToken function

• Required Requirements Token (Token y) is returned by the endpoint https://chatgpt.com/backend-api/sentinel/chat-requirements

• Proof Token (Token z) is returned by _generateAnswer function with the seed and difficulty returned by the https://chatgpt.com/backend-api/sentinel/chat-requirements endpoint

The rest is basic web communication knowledge.

Documentation

import {ChatGPTReversed} from "chatgptreversed"; // const {ChatGPTReversed} = require("chatgptreversed");

const chatgpt = new ChatGPTReversed({
  sessionToken: "Session Token",
  requirementsToken: "token x",
});

const result = await chatgpt.complete("Hello, how are you?");
console.log(result);

// Output: Hello! I'm here and ready to assist you. How can I help you today?

import {ChatGPTReversed} from "chatgptreversed"; // const {ChatGPTReversed} = require("chatgptreversed");

const chatgpt = new ChatGPTReversed({
  sessionToken: "Session Token",
  requirementsToken: "token x",
});

async function main() {
  const result = await chatgpt.complete("Hello, how are you?");
  console.log(result);
}

main();

// Output: Hello! I'm here and ready to assist you. How can I help you today?

Like this project? Leave a star! 💫⭐