@browsercore/testing 0.1.3 → 0.2.0

package/captures/_probe/parse_existing_settings.py

@@ -0,0 +1,15 @@
+#!/usr/bin/env python3
+"""Parse the existing synthetic chrome-140 settings.bin to document what it actually contains."""
+import struct
+p="/Users/matte/projects/browsercore/testing/captures/chrome-140/http2/settings.bin"
+with open(p,"rb") as f: d=f.read()
+print(f"chrome-140 settings.bin: {len(d)} bytes, hex: {d.hex()}")
+length=struct.unpack(">I", b'\x00'+d[0:3])[0]
+ftype=d[3]; flags=d[4]; stream=struct.unpack(">I",d[5:9])[0]
+print(f"frame: length={length} type=0x{ftype:02x} flags=0x{flags:02x} stream={stream}")
+SETTING_IDS_REV = {1:"HEADER_TABLE_SIZE",2:"ENABLE_PUSH",3:"MAX_CONCURRENT_STREAMS",
+                   4:"INITIAL_WINDOW_SIZE",5:"MAX_FRAME_SIZE",6:"MAX_HEADER_LIST_SIZE"}
+for i in range(0,len(d)-9,6):
+    sid=struct.unpack(">H", d[9+i:11+i])[0]
+    val=struct.unpack(">I", d[11+i:15+i])[0]
+    print(f"  setting {SETTING_IDS_REV.get(sid,sid)} = {val}")

package/captures/_probe/peetprint.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+import json, os
+OUT = "/Users/matte/projects/browsercore/testing/captures/_probe/output"
+
+def get_sv(ext_list):
+    for e in ext_list:
+        if 'supported_versions' in e.get('name',''):
+            return e.get('versions', [])
+    return None
+
+PROFILES = ["chrome124","chrome131","chrome133a","chrome136","chrome120","chrome119","chrome116","chrome110",
+            "firefox133","firefox135",
+            "safari170","safari180","safari184",
+            "edge99","edge101"]
+
+print(f"{'profile':14s} | supported_versions")
+print("-"*90)
+for p in PROFILES:
+    d = json.load(open(os.path.join(OUT, f"{p}.json")))
+    tls = d['tls']
+    sv = get_sv(tls['extensions'])
+    print(f"{p:14s} | {sv}")
+
+print("\n\n=== PEETPRINT (full ordering fingerprint) ===")
+for p in PROFILES:
+    d = json.load(open(os.path.join(OUT, f"{p}.json")))
+    pp = d['tls'].get('peetprint','')
+    print(f"\n{p}:")
+    print(f"  {pp}")
+
+print("\n\n=== SETTINGS + WINDOW_UPDATE + AKAMAI (for settings.frame divergence) ===")
+for p in PROFILES:
+    d = json.load(open(os.path.join(OUT, f"{p}.json")))
+    h2 = d['http2']
+    settings = wu = None
+    for fr in h2.get('sent_frames',[]):
+        if fr['frame_type']=='SETTINGS': settings = fr.get('settings')
+        if fr['frame_type']=='WINDOW_UPDATE': wu = fr.get('increment')
+    print(f"{p:14s} | SETTINGS={settings}  WINDOW_UPDATE={wu}  akamai={h2.get('akamai_fingerprint')}")

package/captures/_probe/probe.py

@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+"""
+Probe multiple browser profiles with curl_cffi against tls.peet.ws/api/all.
+Saves full JSON per profile + a summary TSV of key fingerprint fields.
+"""
+import json
+import sys
+import os
+import traceback
+from datetime import datetime, timezone
+from curl_cffi import requests
+
+OUT = os.path.join(os.path.dirname(os.path.abspath(__file__)), "output")
+os.makedirs(OUT, exist_ok=True)
+
+PROFILES = [
+    "chrome99", "chrome100", "chrome101", "chrome104", "chrome107",
+    "chrome110", "chrome116", "chrome119", "chrome120", "chrome123",
+    "chrome124", "chrome131", "chrome133a", "chrome136",
+    "edge99", "edge101",
+    "safari155", "safari170", "safari180", "safari184",
+    "safari180_ios", "safari260",
+    "firefox133", "firefox135",
+]
+
+URL = "https://tls.peet.ws/api/all"
+
+
+def probe(profile):
+    resp = requests.get(URL, impersonate=profile, timeout=30)
+    resp.raise_for_status()
+    data = resp.json()
+    # Save raw JSON
+    with open(os.path.join(OUT, f"{profile}.json"), "w") as f:
+        json.dump(data, f, indent=2)
+    return data
+
+
+def extract(d, profile):
+    """Extract summary fields from a tls.peet.ws response."""
+    tls = d.get("tls", {})
+    h2 = d.get("http2", {})
+    # SETTINGS
+    settings_map = {}
+    settings_order = []
+    window_update = None
+    headers_list = []
+    header_order = []
+    priority_info = None
+    akamai = h2.get("akamai_fingerprint", "")
+    for fr in h2.get("sent_frames", []):
+        if fr.get("frame_type") == "SETTINGS":
+            for s in fr.get("settings", []):
+                k, v = s.split(" = ", 1)
+                settings_map[k] = v
+                settings_order.append(k)
+        elif fr.get("frame_type") == "WINDOW_UPDATE":
+            window_update = fr.get("increment")
+        elif fr.get("frame_type") == "HEADERS":
+            headers_list = fr.get("headers", [])
+            header_order = [h.split(":")[0] for h in headers_list]
+            if "priority" in fr:
+                priority_info = fr["priority"]
+    # TLS extension order (names)
+    ext_names = [e.get("name", "?") for e in tls.get("extensions", [])]
+    # supported_versions + key_share groups order + sig_algs + ciphers
+    supported_versions = []
+    key_share_groups = []
+    sig_algs = []
+    ec_point_formats = []
+    ciphers = tls.get("ciphers", [])
+    for e in tls.get("extensions", []):
+        nm = e.get("name", "")
+        if "supported_versions" in nm:
+            supported_versions = e.get("supported_versions", [])
+        elif "key_share" in nm:
+            for k in e.get("shared_keys", []):
+                key_share_groups += list(k.keys())
+        elif "signature_algorithms" in nm:
+            sig_algs = e.get("signature_algorithms", [])
+        elif "ec_point_formats" in nm or "psk_key_exchange" in nm:
+            pass
+        if "ec_point_formats" in nm:
+            ec_point_formats = e.get("elliptic_curves", [])
+    # request headers ordering (non-pseudo)
+    request_headers = [h.split(":")[0] for h in headers_list]
+    pseudo_order = [h for h in request_headers if h.startswith(":")]
+    regular_order = [h for h in request_headers if not h.startswith(":")]
+    return {
+        "profile": profile,
+        "http_version": d.get("http_version"),
+        "user_agent": d.get("user_agent"),
+        "ja3_hash": tls.get("ja3_hash"),
+        "ja3": tls.get("ja3"),
+        "ja4": tls.get("ja4"),
+        "ja4_r": tls.get("ja4_r"),
+        "tls_version_negotiated": tls.get("tls_version_negotiated"),
+        "tls_version_record": tls.get("tls_version_record"),
+        "ciphers": ciphers,
+        "settings_order": settings_order,
+        "settings_map": settings_map,
+        "window_update": window_update,
+        "akamai_fingerprint": akamai,
+        "pseudo_header_order": pseudo_order,
+        "regular_header_order": regular_order,
+        "priority_info": priority_info,
+        "extension_names": ext_names,
+        "supported_versions": supported_versions,
+        "key_share_groups": key_share_groups,
+        "sig_algs": sig_algs,
+        "ec_point_formats": ec_point_formats,
+        "num_extensions": len(ext_names),
+    }
+
+
+def main():
+    results = []
+    failures = []
+    for p in PROFILES:
+        try:
+            d = probe(p)
+            s = extract(d, p)
+            results.append(s)
+            print(f"OK   {p:16s} ja3={s['ja3_hash']} ja4={s['ja4']} settings={s['settings_order']}")
+        except Exception as e:
+            failures.append((p, str(e)))
+            print(f"FAIL {p:16s} -> {e}")
+    # Save summary
+    with open(os.path.join(OUT, "summary.json"), "w") as f:
+        json.dump({"probed_at": datetime.now(timezone.utc).isoformat(),
+                   "results": results, "failures": failures}, f, indent=2)
+    print(f"\n=== {len(results)} OK, {len(failures)} FAILED ===")
+    print("Failures:", failures)
+
+
+if __name__ == "__main__":
+    main()

package/captures/_probe/raw_bytes/chrome-131_client_hello.hex

@@ -0,0 +1,32 @@
+0000: 16 03 01 07 00 01 00 06 fc 03 03 dd 4a 8c f2 b0
+0010: 4d f4 86 81 b1 04 f1 46 58 ff ef 12 b5 09 e0 c5
+0020: 82 2a 60 66 79 05 c4 fe 46 54 44 20 47 fd 5a 59
+0030: b5 61 5a a1 e5 bc 14 77 cb e2 2d 43 5d a0 a3 9f
+0040: fb 6f b7 35 37 c4 92 14 47 a3 92 ba 00 20 7a 7a
+0050: 13 01 13 02 13 03 c0 2b c0 2f c0 2c c0 30 cc a9
+0060: cc a8 c0 13 c0 14 00 9c 00 9d 00 2f 00 35 01 00
+0070: 06 93 1a 1a 00 00 fe 0d 01 1a 00 00 01 00 01 ec
+0080: 00 20 ab 64 17 1c 93 3d b9 b7 ce 53 f7 bd 10 7d
+0090: fe c6 25 da 94 44 ef c0 f2 6f 95 f6 02 07 17 10
+00a0: 70 21 00 f0 2f 41 3f fb 36 f5 34 4d 0d f8 a1 83
+00b0: 71 d8 0e 0f 4c bd d8 92 2d 24 17 10 8a b3 b9 ce
+00c0: c5 a7 72 c0 f5 bf c3 d2 9f 25 d9 23 8f 3d 65 da
+00d0: ad ba 3c c1 36 56 13 10 af 30 f7 46 f4 05 94 3a
+00e0: 3f c9 d2 f4 b7 a3 e9 ed 67 7b d7 c9 c1 da 27 75
+00f0: b8 fa 51 e3 16 01 da 0a 59 19 11 a1 f7 da 22 07
+0100: da 02 28 71 45 d1 3e f3 06 cd 33 4f dc d1 96 a6
+0110: 80 0c 48 ac 70 2f d8 1d 7e 33 48 98 19 72 6a 07
+0120: 73 45 64 75 0d a5 fa bd b7 0b b8 f4 79 d7 d8 46
+0130: 40 21 c5 4b 65 00 50 fd 4c da 9a 8c c5 d6 4c 90
+0140: 28 95 84 be 4d d1 84 8d 9b 8e 66 0a 5b 4a 64 a3
+0150: 13 eb 2c 01 d0 2d 44 f5 11 27 4c f9 e4 c9 f0 b8
+0160: ce 2c 60 8f be 1d e0 dc 6c b1 c2 5d ba 5d 8c ea
+0170: 88 8a 64 09 41 fe 8a 4f d5 fb cd 53 21 8e af 46
+0180: 11 53 2b 1f d8 e2 59 d6 ab 79 4a 8a 35 85 22 b4
+0190: e2 88 50 4d 00 2d 00 02 01 01 00 17 00 00 00 0b
+01a0: 00 02 01 00 00 10 00 0e 00 0c 02 68 32 08 68 74
+01b0: 74 70 2f 31 2e 31 00 23 00 00 00 12 00 00 44 69
+01c0: 00 05 00 03 02 68 32 00 33 04 ef 04 ed 9a 9a 00
+01d0: 01 00 11 ec 04 c0 04 7a 9d cc 10 30 0d e5 84 e0
+01e0: 87 60 a0 5a c8 de b9 57 a3 a2 b4 40 f7 32 4f 80
+01f0: a5 32 b9 47 65 dc a6 15 b8 cc 81 90 45 78 69 0b

package/captures/_probe/raw_bytes/firefox-133_client_hello.hex

@@ -0,0 +1,32 @@
+0000: 16 03 01 07 2c 01 00 07 28 03 03 0a 65 63 35 d1
+0010: 4c 8d 12 18 0c 76 91 8c 07 34 c6 1b c1 7a ea c4
+0020: 62 8e ab fa 79 86 d5 59 2b dd a3 20 b5 9b d5 86
+0030: 75 5f 8b c6 5c 72 ca f2 54 34 f9 61 47 34 af c2
+0040: 67 50 10 3f ff e9 65 45 f1 0f 58 c5 00 22 13 01
+0050: 13 03 13 02 c0 2b c0 2f cc a9 cc a8 c0 2c c0 30
+0060: c0 0a c0 09 c0 13 c0 14 00 9c 00 9d 00 2f 00 35
+0070: 01 00 06 bd 00 17 00 00 ff 01 00 01 00 00 0a 00
+0080: 10 00 0e 11 ec 00 1d 00 17 00 18 00 19 01 00 01
+0090: 01 00 0b 00 02 01 00 00 23 00 00 00 10 00 0e 00
+00a0: 0c 02 68 32 08 68 74 74 70 2f 31 2e 31 00 05 00
+00b0: 05 01 00 00 00 00 00 22 00 0a 00 08 04 03 05 03
+00c0: 06 03 02 03 00 33 05 2f 05 2d 11 ec 04 c0 71 60
+00d0: 02 c2 b4 7d c1 a1 5c 1f e6 93 09 fc 5d ac 99 10
+00e0: da 70 c3 16 f1 41 ea 22 b5 9f 03 94 0d 53 57 0d
+00f0: 29 c2 52 49 4e 76 92 c2 5b 29 7e ee 35 0f 48 5c
+0100: 3a 0a 55 37 dc 87 07 17 34 03 79 c5 7e 87 95 a1
+0110: c2 cb 75 fa f4 0a 1e 9a a0 13 57 62 2a 37 bd 48
+0120: 5c 62 90 27 25 50 19 6d 48 23 47 33 25 4a b1 f8
+0130: 65 04 56 01 33 eb 06 a0 b4 bb 5d 12 70 b6 ea 77
+0140: 27 53 57 56 8a 4d dc a7 2f 3e 86 10 03 a0 b7 2c
+0150: e9 a1 f0 30 6a 84 b4 46 ed 58 60 0f 64 8b 21 41
+0160: 05 60 86 ba 5b 7b 64 4c 4b b7 06 fc 8e ae c9 8a
+0170: b7 d5 9b 74 87 7e d7 eb 3d 62 6a 62 5d da c9 a6
+0180: 54 79 fe aa 00 ef 69 99 54 19 14 54 6c 4e c8 aa
+0190: 52 e1 16 c1 ab 73 84 79 c0 a8 e5 f0 1b c1 52 cf
+01a0: b1 27 c0 ff 57 46 35 41 92 b5 01 ac 06 41 32 ba
+01b0: 82 00 0b 87 a4 2d 99 7e 59 a1 c5 45 f7 1f cc 66
+01c0: 8a de 1c 73 40 fa 14 08 fa 6d 28 51 5e 96 b7 a3
+01d0: 60 d8 83 f0 08 83 ab 20 bf 8f 98 ca 97 fc 66 fb
+01e0: f2 7e 19 73 b1 ac 06 2a 99 eb ac 15 bb 3d 79 f9
+01f0: 4c f3 24 1e b4 63 40 a4 57 2f 44 8b a0 f7 a4 2a

package/captures/_probe/raw_bytes/safari-17_client_hello.hex

@@ -0,0 +1,32 @@
+0000: 16 03 01 02 00 01 00 01 fc 03 03 e9 b2 26 d5 ec
+0010: 37 3d 47 70 f8 29 c1 b0 96 fb 2d eb be 32 04 8e
+0020: a5 99 7e ec 07 1b d1 3d da e7 a9 20 c8 61 d3 f4
+0030: c9 17 71 a2 5c a6 b3 f6 60 c4 40 64 97 ec e8 2d
+0040: 40 c5 f0 42 9a 2c f1 c8 5d 2c 33 c4 00 2a 2a 2a
+0050: 13 01 13 02 13 03 c0 2c c0 2b cc a9 c0 30 c0 2f
+0060: cc a8 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 35
+0070: 00 2f c0 08 c0 12 00 0a 01 00 01 89 3a 3a 00 00
+0080: 00 17 00 00 ff 01 00 01 00 00 0a 00 0c 00 0a 6a
+0090: 6a 00 1d 00 17 00 18 00 19 00 0b 00 02 01 00 00
+00a0: 10 00 0e 00 0c 02 68 32 08 68 74 74 70 2f 31 2e
+00b0: 31 00 05 00 05 01 00 00 00 00 00 0d 00 18 00 16
+00c0: 04 03 08 04 04 01 05 03 02 03 08 05 08 05 05 01
+00d0: 08 06 06 01 02 01 00 12 00 00 00 33 00 2b 00 29
+00e0: 6a 6a 00 01 00 00 1d 00 20 77 0a 4e b5 d4 f0 fb
+00f0: 66 f2 37 91 d4 0b b5 f1 6e 05 1b 7e c6 89 78 82
+0100: 34 a3 37 a9 3f 57 98 87 5f 00 2d 00 02 01 01 00
+0110: 2b 00 0b 0a 6a 6a 03 04 03 03 03 02 03 01 00 1b
+0120: 00 03 02 00 01 8a 8a 00 01 00 00 15 00 d7 00 00
+0130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+0140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+0190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+01a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+01b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

package/captures/_probe/relay_capture.py

@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+"""
+Transparent TLS relay that captures the authentic ClientHello bytes.
+
+curl_cffi connects to https://tls.peet.ws:443 but we resolve tls.peet.ws to
+127.0.0.1 (via a hosts redirect done by connecting to a local port with the
+Host header set to tls.peet.ws). Actually simpler: we listen locally, and when
+a client connects we:
+  1. read the first flight (ClientHello) from the client — this has SNI=tls.peet.ws
+     because curl_cffi derives SNI from the URL host, which we keep as tls.peet.ws.
+  2. open a real TCP+TLS connection to the actual tls.peet.ws
+  3. save the ClientHello bytes
+  4. forward those bytes + relay the rest bidirectionally
+
+The trick: curl_cffi gets the real tls.peet.ws IP via DNS but we intercept by
+having curl_cffi connect through us. We do this by pointing curl_cffi at
+https://tls.peet.ws/ and overriding resolution with a custom approach:
+curl_cffi/requests allows `impersonate` and we can set the request to go to a
+local socket via a pre-resolved address. Simplest reliable method: add an
+entry mapping tls.peet.ws -> 127.0.0.1 using a tiny DNS override is complex.
+
+Instead we use the CONNECT-less approach: curl_cffi lets us pass the URL as
+https://tls.peet.ws and we intercept resolution by monkeypatching via a custom
+transport is heavy. So we use the PROXY feature: set https proxy to our local
+relay. With an HTTP CONNECT proxy, curl still sends SNI=tls.peet.ws inside the
+tunnel and we relay raw bytes (no decryption), so we can sniff the ClientHello.
+"""
+import socket, threading, time, struct, json, os
+from datetime import datetime, timezone
+from curl_cffi import requests
+
+RAW = "/Users/matte/projects/browsercore/testing/captures/_probe/raw_bytes"
+os.makedirs(RAW, exist_ok=True)
+
+RELAY_HOST = "127.0.0.1"
+RELAY_PORT = 8443
+REAL_HOST = "tls.peet.ws"
+REAL_PORT = 443
+
+def relay_capture(profile, outname):
+    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    try:
+        server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    except Exception:
+        pass
+    server.bind((RELAY_HOST, RELAY_PORT))
+    server.listen(1)
+    server.settimeout(15)
+
+    client_hello = {"data": None}
+    upstream_done = threading.Event()
+
+    def accept_and_relay():
+        try:
+            client_sock, addr = server.accept()
+            client_sock.settimeout(8)
+            # Read initial flight from client (ClientHello).
+            initial = b""
+            try:
+                while True:
+                    chunk = client_sock.recv(4096)
+                    if not chunk:
+                        break
+                    initial += chunk
+                    if len(initial) >= 5:
+                        rec_len = struct.unpack(">H", initial[3:5])[0]
+                        if len(initial) >= 5 + rec_len:
+                            break
+            except socket.timeout:
+                pass
+            client_hello["data"] = initial
+
+            # Now connect to the real server and forward.
+            upstream = socket.create_connection((REAL_HOST, REAL_PORT), timeout=8)
+            upstream.settimeout(8)
+            upstream.sendall(initial)
+            # Bidirectional relay until one side closes.
+            def relay(src, dst):
+                try:
+                    while True:
+                        d = src.recv(4096)
+                        if not d:
+                            break
+                        dst.sendall(d)
+                except Exception:
+                    pass
+            t1 = threading.Thread(target=relay, args=(client_sock, upstream))
+            t2 = threading.Thread(target=relay, args=(upstream, client_sock))
+            t1.start(); t2.start()
+            t1.join(timeout=15); t2.join(timeout=15)
+            try: client_sock.close()
+            except Exception: pass
+            try: upstream.close()
+            except Exception: pass
+        except Exception as e:
+            client_hello["server_error"] = str(e)
+        finally:
+            try: server.close()
+            except Exception: pass
+            upstream_done.set()
+
+    t = threading.Thread(target=accept_and_relay)
+    t.start()
+    time.sleep(0.4)
+
+    # Use our relay as an HTTPS proxy. curl will do CONNECT tls.peet.ws:443
+    # through 127.0.0.1:8443, then TLS with SNI=tls.peet.ws inside.
+    proxy = f"http://{RELAY_HOST}:{RELAY_PORT}"
+    captured_client_error = None
+    try:
+        # First do a plain GET through the proxy to the real host.
+        requests.get(
+            f"https://{REAL_HOST}/api/all",
+            impersonate=profile,
+            proxies={"https": proxy, "http": proxy},
+            timeout=20,
+            verify=True,
+        )
+    except Exception as e:
+        captured_client_error = str(e)[:300]
+
+    t.join(timeout=20)
+    data = client_hello.get("data")
+    if data:
+        path = os.path.join(RAW, f"{outname}_client_hello.bin")
+        with open(path, "wb") as f:
+            f.write(data)
+        print(f"  [{profile}] captured {len(data)} bytes -> {path}")
+    else:
+        print(f"  [{profile}] FAILED capture: {client_hello.get('server_error')} / {captured_client_error}")
+    return data
+
+PROFILES = [("chrome131", "chrome-131"), ("firefox133", "firefox-133"), ("safari170", "safari-17")]
+for prof, outname in PROFILES:
+    print(f"\n=== Relay-capturing {prof} -> {outname} ===")
+    relay_capture(prof, outname)
+    time.sleep(0.5)

package/captures/_probe/socks_capture.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""
+SOCKS5 proxy that captures the raw TLS ClientHello.
+
+curl_cffi connects to the SOCKS5 proxy saying "connect to tls.peet.ws:443".
+We open the real connection, complete the SOCKS handshake, then relay — but
+capture the first TLS record (ClientHello) the client sends before forwarding
+it upstream. Because the destination is tls.peet.ws, SNI is correct.
+"""
+import socket, struct, threading, time, os
+from curl_cffi import requests
+
+RAW = "/Users/matte/projects/browsercore/testing/captures/_probe/raw_bytes"
+os.makedirs(RAW, exist_ok=True)
+
+RELAY_HOST = "127.0.0.1"
+RELAY_PORT = 8443
+REAL_HOST = "tls.peet.ws"
+REAL_PORT = 443
+
+def socks_capture(profile, outname):
+    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    try:
+        server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    except Exception:
+        pass
+    server.bind((RELAY_HOST, RELAY_PORT))
+    server.listen(1)
+    server.settimeout(20)
+
+    result = {"data": None}
+
+    def handle():
+        try:
+            client, addr = server.accept()
+            client.settimeout(10)
+            # ---- SOCKS5 handshake ----
+            # Client sends: VER=0x05, NAUTH, auth methods
+            hdr = client.recv(2)
+            if not hdr or hdr[0] != 0x05:
+                client.close(); return
+            nmethods = hdr[1]
+            client.recv(nmethods)  # read auth methods
+            # Reply: no auth required
+            client.sendall(b'\x05\x00')
+            # Client request: VER, CMD=0x01(connect), RSV, ATYP, DST.ADDR, DST.PORT
+            req = client.recv(4)
+            if not req or req[0] != 0x05 or req[1] != 0x01:
+                client.close(); return
+            atyp = req[3]
+            if atyp == 0x01:  # IPv4
+                dst = socket.inet_ntoa(client.recv(4))
+            elif atyp == 0x04:  # IPv6
+                dst = socket.inet_ntop(socket.AF_INET6, client.recv(16))
+            elif atyp == 0x03:  # domain
+                dlen = client.recv(1)[0]
+                dst = client.recv(dlen).decode()
+            else:
+                client.close(); return
+            port_bytes = client.recv(2)
+            dst_port = struct.unpack(">H", port_bytes)[0]
+            # Connect to the real destination
+            upstream = socket.create_connection((REAL_HOST, REAL_PORT), timeout=10)
+            upstream.settimeout(10)
+            # SOCKS success reply (bound addr = 0.0.0.0:0)
+            client.sendall(b'\x05\x00\x00\x01' + socket.inet_aton('0.0.0.0') + struct.pack(">H", 0))
+
+            # ---- Now relay, capturing client's first TLS flight ----
+            initial = b""
+            try:
+                while True:
+                    chunk = client.recv(4096)
+                    if not chunk:
+                        break
+                    initial += chunk
+                    if len(initial) >= 5:
+                        rec_len = struct.unpack(">H", initial[3:5])[0]
+                        if len(initial) >= 5 + rec_len:
+                            break
+            except socket.timeout:
+                pass
+            result["data"] = initial
+            # forward captured bytes + continue relay
+            upstream.sendall(initial)
+            def relay(src, dst_s):
+                try:
+                    while True:
+                        d = src.recv(4096)
+                        if not d: break
+                        dst_s.sendall(d)
+                except Exception:
+                    pass
+            t1 = threading.Thread(target=relay, args=(client, upstream))
+            t2 = threading.Thread(target=relay, args=(upstream, client))
+            t1.start(); t2.start()
+            t1.join(timeout=20); t2.join(timeout=20)
+            try: client.close()
+            except Exception: pass
+            try: upstream.close()
+            except Exception: pass
+        except Exception as e:
+            result["server_error"] = str(e)
+        finally:
+            try: server.close()
+            except Exception: pass
+
+    t = threading.Thread(target=handle)
+    t.start()
+    time.sleep(0.4)
+
+    proxy = f"socks5h://{RELAY_HOST}:{RELAY_PORT}"
+    try:
+        requests.get(
+            f"https://{REAL_HOST}/api/all",
+            impersonate=profile,
+            proxies={"https": proxy, "http": proxy},
+            timeout=25,
+            verify=True,
+        )
+    except Exception as e:
+        result["client_error"] = str(e)[:300]
+
+    t.join(timeout=25)
+    data = result.get("data")
+    if data:
+        path = os.path.join(RAW, f"{outname}_client_hello.bin")
+        with open(path, "wb") as f:
+            f.write(data)
+        print(f"  [{profile}] captured {len(data)} bytes -> {path}")
+    else:
+        print(f"  [{profile}] FAILED: {result.get('server_error')} / {result.get('client_error')}")
+    return data
+
+PROFILES = [("chrome131", "chrome-131"), ("firefox133", "firefox-133"), ("safari170", "safari-17")]
+for prof, outname in PROFILES:
+    print(f"\n=== SOCKS-capturing {prof} -> {outname} ===")
+    socks_capture(prof, outname)
+    time.sleep(0.5)

package/captures/_probe/validate_fresh.py

@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""Fresh re-probe chrome131 + safari170 through oracle, compare to captured bytes."""
+import json, os, hashlib, struct
+from curl_cffi import requests
+OUT = "/Users/matte/projects/browsercore/testing/captures/_probe/output"
+
+def parse_ja3(data):
+    pos=5
+    handshake_len=struct.unpack(">I", b'\x00'+data[6:9])[0]; pos=9
+    end=9+handshake_len
+    ver=struct.unpack(">H", data[pos:pos+2])[0]; pos+=2
+    pos+=32
+    sid=data[pos]; pos+=1+sid
+    csl=struct.unpack(">H", data[pos:pos+2])[0]; pos+=2
+    ciphers=[struct.unpack(">H", data[pos+i:pos+i+2])[0] for i in range(0,csl,2)]
+    pos+=csl
+    cl=data[pos]; pos+=1+cl
+    exts=[]; sg=[]; ecpf=[]
+    if pos+2<=end:
+        el=struct.unpack(">H", data[pos:pos+2])[0]; pos+=2
+        eend=pos+el
+        while pos+4<=eend:
+            et=struct.unpack(">H", data[pos:pos+2])[0]
+            xl=struct.unpack(">H", data[pos+2:pos+4])[0]; pos+=4
+            exts.append(et)
+            if et==0x000a and xl>=4:
+                ll=struct.unpack(">H", data[pos:pos+2])[0]
+                for i in range(0,ll,2): sg.append(struct.unpack(">H", data[pos+2+i:pos+4+i])[0])
+            elif et==0x000b and xl>=1:
+                ll=data[pos]
+                for i in range(ll): ecpf.append(data[pos+1+i])
+            pos+=xl
+    return ver, ciphers, exts, sg, ecpf
+
+def ja3hash(ver,ciphers,exts,sg,ecpf):
+    s=",".join([str(ver), "-".join(str(c) for c in ciphers), "-".join(str(e) for e in exts), "-".join(str(g) for g in sg), "-".join(str(f) for f in ecpf)])
+    return hashlib.md5(s.encode()).hexdigest(), s
+
+RAW="/Users/matte/projects/browsercore/testing/captures/_probe/raw_bytes"
+
+for profile, cap, label in [("chrome131","chrome-131","chrome-131"),("safari170","safari-17","safari-17")]:
+    # fresh oracle probe
+    r=requests.get("https://tls.peet.ws/api/all", impersonate=profile, timeout=30)
+    od=r.json()
+    # save fresh
+    with open(os.path.join(OUT,f"{profile}_fresh.json"),"w") as f:
+        json.dump(od,f,indent=2)
+    oja3=od['tls']['ja3_hash']
+    oja3str=od['tls']['ja3']
+    oexts=[e['name'] for e in od['tls']['extensions']]
+    # captured bytes
+    with open(os.path.join(RAW,f"{cap}_client_hello.bin"),"rb") as f: d=f.read()
+    ver,ciphers,exts,sg,ecpf=parse_ja3(d)
+    cja3, cja3str = ja3hash(ver,ciphers,exts,sg,ecpf)
+    # GREASE-stripped comparison
+    def strip_grease(vals): return [v for v in vals if (v & 0x0f0f)!=0x0a0a]
+    cja3_strip, cja3str_strip = ja3hash(ver, strip_grease(ciphers), strip_grease(exts), strip_grease(sg), ecpf)
+    print(f"\n{label}:")
+    print(f"  oracle  ja3={oja3}  str={oja3str}")
+    print(f"  capture ja3={cja3}  str={cja3str}")
+    print(f"  capture ja3 (GREASE-stripped)={cja3_strip}  str={cja3str_strip}")
+    print(f"  match stripped? {cja3_strip==oja3}")
+    print(f"  oracle exts: {oexts}")
+    print(f"  capture exts: {exts}  (hex {[hex(e) for e in exts]})")
+    # check SNI present in capture
+    print(f"  capture has server_name(0)? {0 in exts}")