whalibmob 5.0.0 → 5.0.1

package/cli.js

@@ -11,6 +11,8 @@ const {
   checkNumberStatus,
   requestSmsCode,
   verifyCode,
+  assertRegistrationKeys,
+  fetchIosVersion,
   createNewStore,
   saveStore,
   loadStore
@@ -782,11 +784,32 @@ async function handleLine(line) {
           const method = p[3] || 'sms';
           if (!ph) { fail('usage: /reg code <phone> [sms|voice|wa_old]'); break; }
           if (!fs.existsSync(_sessDir)) fs.mkdirSync(_sessDir, { recursive: true });
-          let store = loadStore(path.join(_sessDir, `${ph}.json`));
-          if (!store) { store = createNewStore(ph); saveStore(store, path.join(_sessDir, `${ph}.json`)); }
+          const sessFile = path.join(_sessDir, `${ph}.json`);
+          let store = loadStore(sessFile);
+          if (!store) {
+            store = createNewStore(ph);
+            saveStore(store, sessFile);
+          } else {
+            // Check if these device keys are already registered in WhatsApp.
+            // If they are (not "incorrect"), generate fresh keys so the new
+            // code request and confirm use matching fresh keys — mirrors Cobalt's
+            // assertRegistrationKeys() behaviour.
+            out('checking device keys...');
+            const waVersion = await fetchIosVersion();
+            const fresh = await assertRegistrationKeys(store, waVersion);
+            if (!fresh) {
+              out('  device keys already registered — generating new keys...');
+              store = createNewStore(ph);
+              saveStore(store, sessFile);
+              out('  new keys saved — proceed with code below');
+            }
+          }
           out('requesting ' + method + ' code for +' + ph + '...');
           const r = await requestSmsCode(store, method);
+          // Always save the store after a code request to persist any state
+          saveStore(store, sessFile);
           out('  status  ' + (r && r.status));
+          out('  important: enter the code within 10 minutes');
           out('  now run: /reg confirm ' + ph + ' <code>');
         }
         else if (sub === 'confirm') {
@@ -797,7 +820,7 @@ async function handleLine(line) {
           const store = loadStore(file) || createNewStore(ph);
           out('verifying...');
           const r = await verifyCode(store, code);
-          if (r && (r.status === 'ok' || r.status === 'verified')) {
+          if (r && (r.status === 'ok' || r.status === 'sent' || r.status === 'verified')) {
             if (!fs.existsSync(_sessDir)) fs.mkdirSync(_sessDir, { recursive: true });
             saveStore(r.store || store, file);
             out('registered  session saved to ' + file);
@@ -918,13 +941,30 @@ async function main() {
       const method = flags.method || 'sms';
       if (!ph) { fail('phone number required'); process.exit(1); }
       if (!fs.existsSync(_sessDir)) fs.mkdirSync(_sessDir, { recursive: true });
-      let store = loadStore(path.join(_sessDir, `${ph}.json`));
-      if (!store) { store = createNewStore(ph); saveStore(store, path.join(_sessDir, `${ph}.json`)); }
+      const sessFile = path.join(_sessDir, `${ph}.json`);
+      let store = loadStore(sessFile);
+      if (!store) {
+        store = createNewStore(ph);
+        saveStore(store, sessFile);
+      } else {
+        out('checking device keys...');
+        const waVersion = await fetchIosVersion();
+        const fresh = await assertRegistrationKeys(store, waVersion);
+        if (!fresh) {
+          out('  device keys already registered — generating new keys...');
+          store = createNewStore(ph);
+          saveStore(store, sessFile);
+        }
+      }
       out('requesting ' + method + ' code for +' + ph + '...');
       try {
         const r = await requestSmsCode(store, method);
+        saveStore(store, sessFile);
         out('  status  ' + (r && r.status));
-        if (r && r.status === 'sent') out('  code sent — run: wa registration --register ' + ph + ' --code <code>');
+        if (r && (r.status === 'sent' || r.status === 'ok')) {
+          out('  important: enter the code within 10 minutes');
+          out('  run: wa registration --register ' + ph + ' --code <code>');
+        }
       } catch (e) {
         if (e.message && e.message.includes('too_recent')) out('  code already sent recently — check your phone');
         else fail(e.message);
@@ -944,7 +984,7 @@ async function main() {
       out('verifying code for +' + ph + '...');
       try {
         const r = await verifyCode(store, code);
-        if (r && (r.status === 'ok' || r.status === 'verified')) {
+        if (r && (r.status === 'ok' || r.status === 'sent' || r.status === 'verified')) {
           if (!fs.existsSync(_sessDir)) fs.mkdirSync(_sessDir, { recursive: true });
           saveStore(r.store || store, file);
           out('registered  session saved to ' + file);

package/lib/Client.js

@@ -5,7 +5,7 @@ const path          = require('path');
 const crypto        = require('crypto');
 const { NoiseSocket }     = require('./noise');
 const { MessageSender, generateMessageId, makeJid } = require('./messages/MessageSender');
-const { checkIfRegistered, checkNumberStatus, requestSmsCode, verifyCode } = require('./Registration');
+const { checkIfRegistered, checkNumberStatus, requestSmsCode, verifyCode, assertRegistrationKeys, fetchIosVersion } = require('./Registration');
 const { createNewStore, saveStore, loadStore, toSixParts, fromSixParts } = require('./Store');
 const { BinaryNode }      = require('./BinaryNode');
 const { SignalProtocol }  = require('./signal/SignalProtocol');
@@ -1680,6 +1680,8 @@ module.exports = {
   checkNumberStatus,
   requestSmsCode,
   verifyCode,
+  assertRegistrationKeys,
+  fetchIosVersion,
   createNewStore,
   saveStore,
   loadStore,

package/lib/DeviceManager.js

@@ -234,12 +234,14 @@ class DeviceManager {
   }
 
   // ─── Build participants node ───────────────────────────────────────────────
-  static buildParticipantsNode(encryptedList) {
-    const toNodes = encryptedList.map(({ jid, type, ciphertext }) =>
-      new BinaryNode('to', { jid },
-        [new BinaryNode('enc', { type, v: '2' }, ciphertext)]
-      )
-    );
+  static buildParticipantsNode(encryptedList, mediaSubtype) {
+    const toNodes = encryptedList.map(({ jid, type, ciphertext }) => {
+      const encAttrs = { type, v: '2' };
+      if (mediaSubtype) encAttrs.mediatype = mediaSubtype;
+      return new BinaryNode('to', { jid },
+        [new BinaryNode('enc', encAttrs, ciphertext)]
+      );
+    });
     return new BinaryNode('participants', {}, toNodes);
   }
 }

package/lib/Registration.js

@@ -189,9 +189,9 @@ function computeToken(waVersion, national) {
 
 // ---------- Byte helpers ----------
 
-// Strip 0x05 key-type prefix if present (32-byte raw X25519 key)
-function rawKey(buf) {
-  return (buf.length === 33 && buf[0] === 0x05) ? buf.slice(1) : buf;
+function stripKeyPrefix(buf) {
+  if (buf.length === 33 && buf[0] === 0x05) return buf.slice(1);
+  return buf;
 }
 
 function intToBytes(n, len) {
@@ -230,9 +230,13 @@ function buildForm(pairs, extraPairs) {
 
 // ---------- Payload ----------
 
+// base64url WITH padding — matches Java's Base64.getUrlEncoder().encodeToString()
+function toBase64Url(buf) {
+  return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_');
+}
+
 function buildPayload(store, waVersion, useToken, extraPairs) {
   const { cc, national } = parsePhone(store.phoneNumber);
-  const meta  = getCountryMeta(cc);
   const token = useToken ? computeToken(waVersion, national) : null;
   const fdid  = store.fdid.toUpperCase();
 
@@ -240,17 +244,17 @@ function buildPayload(store, waVersion, useToken, extraPairs) {
     'cc',         cc,
     'in',         national,
     'rc',         String(RELEASE_CHANNEL),
-    'lg',         meta.lg,
-    'lc',         meta.lc,
-    'authkey',    rawKey(store.noiseKeyPair.public).toString('base64url'),
-    'e_regid',    intToBytes(store.registrationId, 4).toString('base64url'),
-    'e_keytype',  Buffer.from([SIGNAL_KEY_TYPE]).toString('base64url'),
-    'e_ident',    rawKey(store.identityKeyPair.public).toString('base64url'),
-    'e_skey_id',  intToBytes(store.signedPreKey.id, 3).toString('base64url'),
-    'e_skey_val', rawKey(store.signedPreKey.public).toString('base64url'),
-    'e_skey_sig', store.signedPreKey.signature.toString('base64url'),
+    'lg',         'en',
+    'lc',         'US',
+    'authkey',    toBase64Url(stripKeyPrefix(store.noiseKeyPair.public)),
+    'e_regid',    toBase64Url(intToBytes(store.registrationId, 4)),
+    'e_keytype',  toBase64Url(Buffer.from([SIGNAL_KEY_TYPE])),
+    'e_ident',    toBase64Url(stripKeyPrefix(store.identityKeyPair.public)),
+    'e_skey_id',  toBase64Url(intToBytes(store.signedPreKey.id, 3)),
+    'e_skey_val', toBase64Url(stripKeyPrefix(store.signedPreKey.public)),
+    'e_skey_sig', toBase64Url(store.signedPreKey.signature),
     'fdid',       fdid,
-    'expid',      store.deviceId.toString('base64url'),
+    'expid',      toBase64Url(store.deviceId),
     'id',         toUrlHex(store.identityId),
     'token',      token
   ], extraPairs);
@@ -261,14 +265,14 @@ function buildPayload(store, waVersion, useToken, extraPairs) {
 function encryptPayload(plaintext) {
   const seed = crypto.randomBytes(32);
   const ephKp = curveJs.generateKeyPair(seed);
-  const ephemeralPub = Buffer.from(ephKp.public);    // raw 32-byte X25519 key (no prefix)
+  const ephemeralPub = Buffer.from(ephKp.public);
   const sharedKey    = Buffer.from(curveJs.sharedKey(ephKp.private, REGISTRATION_PUBLIC_KEY));
 
   const iv = Buffer.alloc(12);
   const cipher = crypto.createCipheriv('aes-256-gcm', sharedKey, iv);
   const enc = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
   const tag = cipher.getAuthTag();
-  return Buffer.concat([ephemeralPub, enc, tag]).toString('base64url');
+  return toBase64Url(Buffer.concat([ephemeralPub, enc, tag]));
 }
 
 // ---------- HTTP ----------
@@ -283,8 +287,7 @@ function httpPost(path, body, waVersion) {
       method: 'POST',
       headers: {
         'User-Agent':     userAgent,
-        'Content-Type':  'application/x-www-form-urlencoded',
-        'Accept':        'text/json'
+        'Content-Type':  'application/x-www-form-urlencoded'
       }
     };
     const req = https.request(opts, (res) => {
@@ -423,21 +426,35 @@ async function checkNumberStatus(phoneNumber) {
            note: 'Could not determine status. Possible datacenter IP restriction. Try a residential proxy.' };
 }
 
+// ---------- assertRegistrationKeys (mirrors Cobalt) ----------
+// Calls /exist to ensure these device keys are NOT already registered.
+// Returns true if keys are fresh (reason='incorrect'), false otherwise.
+async function assertRegistrationKeys(store, waVersion) {
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const result = await sendRequest('/exist', store, waVersion, false, null);
+      if (result && result.reason === 'incorrect') return true;
+    } catch (_) {
+      return true;
+    }
+  }
+  return false;
+}
+
 async function requestSmsCode(store, method) {
   method = method || 'sms';
   const waVersion = await fetchIosVersion();
+  store.version = waVersion;
 
-  const { cc } = parsePhone(store.phoneNumber);
-  const meta    = getCountryMeta(cc);
-
+  // iOS-specific: sim_mcc and sim_mnc are always '000'/'000' (matches Cobalt)
   const methods = method === 'wa_old' ? ['wa_old'] : [method, 'wa_old'];
   let lastResult = null;
 
   for (const m of methods) {
     const extra = [
       'method',            m,
-      'sim_mcc',           meta.mcc,
-      'sim_mnc',           meta.mnc,
+      'sim_mcc',           '000',
+      'sim_mnc',           '000',
       'reason',            '',
       'cellular_strength', '1'
     ];
@@ -464,12 +481,27 @@ async function requestSmsCode(store, method) {
 
 async function verifyCode(store, code) {
   const waVersion = await fetchIosVersion();
-  const normalized = code.replace(/\D/g, '');
+  store.version = waVersion;
+  const normalized = code.replace(/[\s\-]/g, '').replace(/\D/g, '');
   const result = await sendRequest('/register', store, waVersion, true, ['code', normalized]);
 
   const status = result.status;
-  if (status === 'ok' || status === 'verified') return result;
-  throw new Error(`Verification failed: ${result.reason || JSON.stringify(result)}`);
+  if (status === 'ok' || status === 'sent' || status === 'verified') return result;
+
+  const reason = result.reason || '';
+  if (reason === 'missing') {
+    throw new Error(
+      'Verification failed: code expired or already used.\n' +
+      '  Run /reg code <phone> again to get a new code, then immediately confirm it.'
+    );
+  }
+  if (/bad_code|code_invalid|wrong/.test(reason)) {
+    throw new Error('Verification failed: wrong code entered. Check the SMS and try again.');
+  }
+  if (/too_many/.test(reason)) {
+    throw new Error('Verification failed: too many wrong attempts. Wait a few minutes then request a new code.');
+  }
+  throw new Error(`Verification failed: ${reason || JSON.stringify(result)}`);
 }
 
-module.exports = { checkIfRegistered, checkNumberStatus, requestSmsCode, verifyCode, fetchIosVersion, parsePhone };
+module.exports = { checkIfRegistered, checkNumberStatus, requestSmsCode, verifyCode, fetchIosVersion, parsePhone, assertRegistrationKeys };

package/lib/Store.js

@@ -51,13 +51,12 @@ function createNewStore(phoneNumber) {
   const signedPreKeyPair = generateKeyPair();
 
   const signedPreKeyId = (crypto.randomBytes(3).readUIntBE(0, 3) & 0xffffff) || 1;
-  // Sign the 33-byte public key (with 0x05 prefix) using identity private key
   const signature = sign(identityKeyPair.private, signedPreKeyPair.public);
 
   const registrationId = (crypto.randomBytes(2).readUInt16BE(0) & 0x3fff) + 1;
   const fdid           = uuidv4();
   const deviceId       = crypto.randomBytes(16);
-  const identityId     = crypto.randomBytes(20);
+  const identityId     = crypto.randomBytes(16);
 
   return {
     phoneNumber: String(phoneNumber).replace(/^\+/, ''),

package/lib/{messages/MessageSender.js → messages /MessageSender.js }

@@ -123,12 +123,12 @@ function getContent(node) {
   return null;
 }
 
-// phash: SHA-256 of sorted JIDs joined, first 6 base64 chars, prefixed "2:"
-// Matches Baileys generateParticipantHashV2 — server uses it to validate participant list.
 function computePhash(jids) {
-  const sorted = [...jids].sort().join('');
-  const hash   = crypto.createHash('sha256').update(sorted).digest('base64');
-  return '2:' + hash.slice(0, 6);
+  const sorted = [...jids].sort();
+  const digest = crypto.createHash('sha256');
+  for (const jid of sorted) digest.update(jid, 'utf8');
+  const hash = digest.digest();
+  return '2:' + hash.slice(0, 6).toString('base64');
 }
 
 // ─── MessageSender ────────────────────────────────────────────────────────────
@@ -184,7 +184,7 @@ class MessageSender {
       jpegThumbnail:     options.thumbnail || null,
       contextInfo:       options.contextInfo
     }));
-    return this._sendMessage(toJid, msgId, imgBuf, 'media', options);
+    return this._sendMessage(toJid, msgId, imgBuf, 'media', { ...options, _mediaSubtype: 'image' });
   }
 
   // ─── Video ────────────────────────────────────────────────────────────────
@@ -211,7 +211,7 @@ class MessageSender {
       gifPlayback:       options.gifPlayback || false,
       contextInfo:       options.contextInfo
     }));
-    return this._sendMessage(toJid, msgId, vidBuf, 'media', options);
+    return this._sendMessage(toJid, msgId, vidBuf, 'media', { ...options, _mediaSubtype: 'video' });
   }
 
   // ─── Audio / PTT ──────────────────────────────────────────────────────────
@@ -235,7 +235,7 @@ class MessageSender {
       mediaKeyTimestamp: upload.mediaKeyTimestamp,
       contextInfo:       options.contextInfo
     }));
-    return this._sendMessage(toJid, msgId, audBuf, 'media', options);
+    return this._sendMessage(toJid, msgId, audBuf, 'media', { ...options, _mediaSubtype: isPtt ? 'ptt' : 'audio' });
   }
 
   // ─── Document ─────────────────────────────────────────────────────────────
@@ -259,7 +259,7 @@ class MessageSender {
       jpegThumbnail:     options.thumbnail || null,
       contextInfo:       options.contextInfo
     }));
-    return this._sendMessage(toJid, msgId, docBuf, 'media', options);
+    return this._sendMessage(toJid, msgId, docBuf, 'media', { ...options, _mediaSubtype: 'document' });
   }
 
   // ─── Sticker ──────────────────────────────────────────────────────────────
@@ -283,7 +283,7 @@ class MessageSender {
       isAnimated:        options.isAnimated || false,
       contextInfo:       options.contextInfo
     }));
-    return this._sendMessage(toJid, msgId, stkBuf, 'media', options);
+    return this._sendMessage(toJid, msgId, stkBuf, 'media', { ...options, _mediaSubtype: 'sticker' });
   }
 
   // ─── Reaction ─────────────────────────────────────────────────────────────
@@ -297,7 +297,7 @@ class MessageSender {
       text:              emoji,
       senderTimestampMs: Date.now()
     }));
-    return this._sendMessage(toJid, msgId, rxBuf, 'text', options);
+    return this._sendMessage(toJid, msgId, rxBuf, 'reaction', options);
   }
 
   // ─── Core dispatch ────────────────────────────────────────────────────────
@@ -339,30 +339,23 @@ class MessageSender {
     const recipientPhone = phoneFromJid(toJid);
     const ownPhone       = String(this._store.phoneNumber);
     const ownMainJid     = `${ownPhone}@s.whatsapp.net`;
+    const mediaSubtype   = options._mediaSubtype || null;
 
-    // Fetch device lists in parallel
     const [recipientDevices, ownDevices] = await Promise.all([
       this._devMgr.bulkEnsureSessions([recipientPhone], this._signal),
       this._devMgr.ensureOwnDeviceSessions(ownPhone, this._signal)
     ]);
 
-    // Recipient devices — fall back to main JID if usync returned nothing
-    const otherJids = recipientDevices.length > 0 ? recipientDevices : [toJid];
-
-    // Own linked devices (exclude primary — it is the sender)
+    const otherJids     = recipientDevices.length > 0 ? recipientDevices : [toJid];
     const ownLinkedJids = ownDevices.filter(j => j !== ownMainJid);
 
-    // phash — computed over all participant JIDs when multi-device
     const allParticipants = [...otherJids, ...ownLinkedJids];
     const phash = allParticipants.length > 1 ? computePhash(allParticipants) : null;
 
-    // deviceSentMessage wrapper for own linked devices:
-    // tells linked phones/tablets "this message was sent to toJid"
     const dsmBuf = ownLinkedJids.length > 0
       ? encodeDeviceSentMessage(toJid, plaintext, phash)
       : null;
 
-    // Encrypt in parallel: recipients get original, own linked get DSM wrapper
     const [otherEncrypted, ownEncrypted] = await Promise.all([
       this._signal.bulkEncryptForDevices(otherJids, plaintext),
       ownLinkedJids.length > 0
@@ -376,10 +369,6 @@ class MessageSender {
     if (phash) stanzaAttrs.phash = phash;
     if (options.edit) stanzaAttrs.edit = String(options.edit);
 
-    // ── Feature 2: device_identity for pkmsg ─────────────────────────────────
-    // When any enc is type=pkmsg (new Signal session with a device), the server
-    // requires a <device-identity> node carrying our ADVSignedDeviceIdentity
-    // protobuf (field 2 / accountSignatureKey stripped for privacy).
     const hasPkmsg   = encryptedList.some(e => e.type === 'pkmsg');
     const advRaw     = this._client._store && this._client._store.advIdentity;
     const advBytes   = hasPkmsg && advRaw ? stripAdvSignatureKey(advRaw) : null;
@@ -387,15 +376,16 @@ class MessageSender {
 
     let msgContent;
     if (encryptedList.length === 0) {
-      // Fallback: unencrypted (should never happen in prod)
-      msgContent = [...devIdNodes, new BinaryNode('enc', { v: '2', type: 'msg' }, plaintext)];
+      const encAttrs = { v: '2', type: 'msg' };
+      if (mediaSubtype) encAttrs.mediatype = mediaSubtype;
+      msgContent = [...devIdNodes, new BinaryNode('enc', encAttrs, plaintext)];
     } else if (encryptedList.length === 1 && !phash) {
-      // Single device, no multi-device — simple enc node (backward compat)
       const { type, ciphertext } = encryptedList[0];
-      msgContent = [...devIdNodes, new BinaryNode('enc', { v: '2', type }, ciphertext)];
+      const encAttrs = { v: '2', type };
+      if (mediaSubtype) encAttrs.mediatype = mediaSubtype;
+      msgContent = [...devIdNodes, new BinaryNode('enc', encAttrs, ciphertext)];
     } else {
-      // Multi-device — participants node with per-device enc
-      const participantsNode = DeviceManager.buildParticipantsNode(encryptedList);
+      const participantsNode = DeviceManager.buildParticipantsNode(encryptedList, mediaSubtype);
       msgContent = [...devIdNodes, participantsNode];
     }
 
@@ -407,21 +397,17 @@ class MessageSender {
 
   async _sendGroupMessage(groupJid, msgId, plaintext, mediaType, options) {
     options = options || {};
-    const ownPhone = String(this._store.phoneNumber);
-    const ownJid   = `${ownPhone}@s.whatsapp.net`;
+    const ownPhone     = String(this._store.phoneNumber);
+    const ownJid       = `${ownPhone}@s.whatsapp.net`;
+    const mediaSubtype = options._mediaSubtype || null;
 
-    // Group members from cache
     const members = this._client._getGroupMembers(groupJid);
-
-    // Build SKDM for this group (creates/loads SenderKey state)
     const skdmBytes = this._signal.buildSKDM(groupJid, ownJid);
 
-    // Collect unique member phones (excluding self)
     const memberPhones = [...new Set(
       members.map(phoneFromJid).filter(p => p !== ownPhone)
     )];
 
-    // Ensure sessions for all member devices + own linked devices in parallel
     const [memberDevices, ownDevices] = await Promise.all([
       memberPhones.length > 0
         ? this._devMgr.bulkEnsureSessions(memberPhones, this._signal)
@@ -431,15 +417,10 @@ class MessageSender {
 
     const allTargets = [...memberDevices, ...ownDevices];
 
-    // phash MUST include the sender's own primary device.
-    // Cobalt's calculateGroupPhash() explicitly adds senderDevice to the set.
-    // ownDevices contains only linked devices (device != 0); ownJid is device 0.
     const phashTargets = allTargets.includes(ownJid)
       ? allTargets
       : [ownJid, ...allTargets];
 
-    // senderKeyMap: only send SKDM to devices that haven't received it yet.
-    // Persisted in .sk.json so we don't re-send on every group message.
     const skStore   = this._signal.senderKeyStore;
     const skdmMap   = skStore.getSKDMMap(groupJid);
     const skdmRecipients = allTargets.filter(jid => !skdmMap[jid]);
@@ -450,15 +431,9 @@ class MessageSender {
       skStore.markSKDMSent(groupJid, skdmRecipients);
     }
 
-    // SenderKey encrypt the actual group message (one ciphertext for all)
     const skmsgCiphertext = this._signal.senderKeyEncrypt(groupJid, ownJid, plaintext);
-
-    // phash over all group member devices + sender primary device
     const phash = phashTargets.length > 0 ? computePhash(phashTargets) : null;
 
-    // ── Feature 2: device_identity for pkmsg in SKDM ─────────────────────────
-    // SKDM messages sent to devices with no prior Signal session are pkmsg.
-    // Include our ADVSignedDeviceIdentity (field 2 stripped) in the stanza.
     const skdmHasPkmsg = skdmEncrypted.some(e => e.type === 'pkmsg');
     const advRaw       = this._client._store && this._client._store.advIdentity;
     const advBytes     = skdmHasPkmsg && advRaw ? stripAdvSignatureKey(advRaw) : null;
@@ -468,14 +443,17 @@ class MessageSender {
       msgContent.push(new BinaryNode('device-identity', {}, advBytes));
     }
     if (skdmEncrypted.length > 0) {
-      msgContent.push(DeviceManager.buildParticipantsNode(skdmEncrypted));
+      msgContent.push(DeviceManager.buildParticipantsNode(skdmEncrypted, null));
     }
-    msgContent.push(new BinaryNode('enc', { type: 'skmsg', v: '2' }, skmsgCiphertext));
+    const skmsgAttrs = { type: 'skmsg', v: '2' };
+    if (mediaSubtype) skmsgAttrs.mediatype = mediaSubtype;
+    msgContent.push(new BinaryNode('enc', skmsgAttrs, skmsgCiphertext));
 
     const stanzaAttrs = {
       to: groupJid,
       id: msgId,
-      type: mediaType === 'media' ? 'media' : 'text',
+      type: mediaType,
+      addressing_mode: 'pn',
       t:   String(msNow())
     };
     if (phash) stanzaAttrs.phash = phash;
@@ -547,7 +525,7 @@ class MessageSender {
       key:  { remoteJid: toJid, fromMe: !!fromMe, id: origMsgId }
     });
     const msgBuf = encodeMessage('protocol', revokePayload);
-    return this._sendMessage(toJid, msgId, msgBuf, 'text', { ...opts, edit: editBit });
+    return this._sendMessage(toJid, msgId, msgBuf, 'protocol', { ...opts, edit: editBit });
   }
 
   // ─── Ephemeral timer DM ───────────────────────────────────────────────────
@@ -562,7 +540,7 @@ class MessageSender {
       ephemeralExpiration:  seconds
     });
     const msgBuf = encodeMessage('protocol', payload);
-    return this._sendMessage(toJid, msgId, msgBuf, 'text', opts);
+    return this._sendMessage(toJid, msgId, msgBuf, 'protocol', opts);
   }
 
   // ─── Utility: mark read, presence, receipt, ping ─────────────────────────

package/lib/signal/SenderKey.js

@@ -189,10 +189,8 @@ class SenderKeyCrypto {
     const messageKey = this._getMessageKey(state);
     const { iv, cipherKey, macKey } = deriveMessageKeys(messageKey);
 
-    const padLen    = 16 - (plaintext.length % 16);
-    const padded    = Buffer.concat([plaintext, Buffer.alloc(padLen, padLen)]);
     const cipher    = crypto.createCipheriv('aes-256-cbc', cipherKey, iv);
-    const encrypted = Buffer.concat([cipher.update(padded), cipher.final()]);
+    const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
 
     const protoBody = Buffer.concat([
       fieldUint32(1, state.keyId),
@@ -230,9 +228,7 @@ class SenderKeyCrypto {
     if (!crypto.timingSafeEqual(expectedMac, mac8)) throw new Error('SenderKeyMessage MAC invalid');
 
     const decipher  = crypto.createDecipheriv('aes-256-cbc', cipherKey, iv);
-    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
-    const padLen    = decrypted[decrypted.length - 1];
-    return decrypted.slice(0, decrypted.length - padLen);
+    return Buffer.concat([decipher.update(encrypted), decipher.final()]);
   }
 
   static _getMessageKeyAtIteration(state, iteration) {

package/lib/signal/SignalProtocol.js

@@ -36,20 +36,27 @@ async function _withMutex(key, fn) {
   }
 }
 
-// ─── Padding ──────────────────────────────────────────────────────────────────
-
-function randomPadding() {
-  const padLen = (crypto.randomBytes(1)[0] & 0x0f) + 1;
-  const pad    = Buffer.alloc(padLen, 0);
-  pad[0]       = 0x80;
-  return pad;
-}
+const BLOCK_SIZE = 16;
 
 function pad(plaintext) {
-  return Buffer.concat([Buffer.from(plaintext), randomPadding()]);
+  const buf = Buffer.from(plaintext);
+  const paddingLength = BLOCK_SIZE - (buf.length % BLOCK_SIZE);
+  const padded = Buffer.alloc(buf.length + paddingLength);
+  buf.copy(padded);
+  padded.fill(paddingLength, buf.length);
+  return padded;
 }
 
 function unpad(data) {
+  if (!data || data.length === 0) return data;
+  const last = data[data.length - 1];
+  if (last > 0 && last <= BLOCK_SIZE) {
+    let valid = true;
+    for (let i = data.length - last; i < data.length; i++) {
+      if (data[i] !== last) { valid = false; break; }
+    }
+    if (valid) return data.slice(0, data.length - last);
+  }
   for (let i = data.length - 1; i >= 0; i--) {
     if (data[i] === 0x80) return data.slice(0, i);
     if (data[i] !== 0x00) break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "main": "index.js",
   "bin": {