how did arkose sever decrypt bda?

[crazysvn]

arkose sever need to decrypt the encrypted bda that client side send to it, right? then how does it do this? I don't see client side send key & iv & s to arkose server. I ask this because I want to decrypt bda of a real browser.