whalibmob 5.14.3 → 5.14.5

package/cli.js

@@ -202,7 +202,12 @@ function enableWireTrace() {
         return origWrite(chunk, ...rest);
       };
 
-      sock.on('data', (d) => {
+      // Prepended, not appended: the socket already carries the handshake's own
+      // data listener, registered while connect() was building the socket. An
+      // appended one runs after the frame has been read, so a frame the server
+      // sent would print *after* the error it caused — or not at all, once the
+      // failure tears the connection down. The trace has to come first.
+      sock.prependListener('data', (d) => {
         if (this.secured) return;
         // Label positionally, but say so when the reply is plainly not a Noise
         // frame — a proxy or captive portal answering in ASCII is worth reading
@@ -1148,10 +1153,19 @@ function requireConn() {
 // ─── tokenizer ────────────────────────────────────────────────────────────────
 
 function tokens(line) {
-  const t = []; let b = '', q = false;
-  for (const c of line) {
-    if (c === '"' || c === "'") { q = !q; continue; }
-    if (c === ' ' && !q) { if (b) { t.push(b); b = ''; } } else b += c;
+  const s = String(line || '');
+  const t = []; let b = '';
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    // A quote groups only when it opens an argument and is actually closed
+    // later in the line. Anything else is text the user typed — an apostrophe
+    // inside a word, an unterminated quote — and message bodies go out
+    // verbatim, so it has to survive as itself.
+    if ((c === '"' || c === "'") && b === '') {
+      const end = s.indexOf(c, i + 1);
+      if (end !== -1) { b += s.slice(i + 1, end); i = end; continue; }
+    }
+    if (c === ' ') { if (b) { t.push(b); b = ''; } } else b += c;
   }
   if (b) t.push(b);
   return t;
@@ -1246,13 +1260,19 @@ async function handleLine(line) {
         out('disconnected');
         break;
 
-      case '/reconnect':
+      case '/reconnect': {
         if (!_client) { fail('not connected'); break; }
+        // A companion session has no primary registration of its own, so it can
+        // only come back the way it was linked. Read the mode before the
+        // disconnect, while the client that knows it is still the current one.
+        const web = _client._mode === 'web';
         _client.disconnect();
         await new Promise(r => setTimeout(r, 1200));
         out('reconnecting...');
-        await doConnect(_phone);
+        if (web) await doConnectWeb(_phone);
+        else     await doConnect(_phone);
         break;
+      }
 
       // ── messaging ──────────────────────────────────────────────────────────
 
@@ -1617,7 +1637,15 @@ async function handleLine(line) {
         requireConn();
         const jid = normalizeJid(p[1]);
         const ids = p.slice(2);
-        if (!jid || !ids.length) { fail('usage: /read <jid> <msgId...>'); break; }
+        if (!jid) { fail('usage: /read <jid> [msgId...]'); break; }
+        // Two different requests share the name: receipts for named messages,
+        // and the whole chat. Without message ids there is nothing to send a
+        // receipt for, so the chat itself is what gets marked.
+        if (!ids.length) {
+          await _client.markChatRead(jid);
+          out('marked read');
+          break;
+        }
         _client.markRead(jid, ids);
         out('marked read  ' + ids.length + ' message(s) in ' + jid);
         break;
@@ -1647,13 +1675,6 @@ async function handleLine(line) {
 
       // ── chats ──────────────────────────────────────────────────────────────
 
-      case '/read':
-        requireConn();
-        if (!p[1]) { fail('usage: /read <jid>'); break; }
-        await _client.markChatRead(normalizeJid(p[1]));
-        out('marked read');
-        break;
-
       case '/restriction':
       case '/limit': {
         // --demo feeds a made-up restriction into this session and counts it
@@ -1824,7 +1845,15 @@ async function handleLine(line) {
 
       case '/ephemeral': {
         requireConn();
-        const jid = normalizeJid(p[1]) || asGroupJid(p[1]);
+        // The timer is set with a different stanza for a group than for a DM,
+        // so the domain decides which one goes out. A bare id has none, and
+        // normalizeJid answers the user domain for anything it is given, so a
+        // group id has to be recognised by its shape first: either the legacy
+        // "<creator>-<created>" form or the 120363… ids groups are issued now.
+        const raw = p[1] || '';
+        const isGroupId = /@g\.us$/.test(raw) ||
+                          (!raw.includes('@') && (/^\d+-\d+$/.test(raw) || /^120363\d*$/.test(raw)));
+        const jid = isGroupId ? asGroupJid(raw) : normalizeJid(raw);
         const sec = p[2];
         if (!jid || sec === undefined) {
           fail('usage: /ephemeral <jid> <seconds>  (0=off  86400=1d  604800=1w  7776000=90d)');
@@ -2788,7 +2817,10 @@ async function main() {
         process.exit(1);
       }
       if (!fs.existsSync(_sessDir)) fs.mkdirSync(_sessDir, { recursive: true });
-      const sessFile = path.join(_sessDir, `${ph}.json`);
+      // Same file the shell's /reg code writes: a number already filed loose in
+      // the base directory stays there, a new one gets a directory of its own.
+      sessionDirFor(_sessDir, ph, { create: true });
+      const sessFile = storeFileFor(_sessDir, ph);
       let store = loadStore(sessFile);
       if (!store) {
         // Brand new — generate fresh keys, save immediately, no need to check /exist
@@ -2834,7 +2866,7 @@ async function main() {
       const code = flags.code;
       if (!ph)   { fail('phone number required'); process.exit(1); }
       if (!code) { fail('--code is required');    process.exit(1); }
-      const file  = path.join(_sessDir, `${ph}.json`);
+      const file  = storeFileFor(_sessDir, ph);
       const store = loadStore(file) || initAuthCreds(ph);
       out('verifying code for +' + ph + '...');
       try {
@@ -2844,8 +2876,11 @@ async function main() {
           const finalStore = r.store || store;
           finalStore.registered  = true;
           finalStore.codePending = false;
+          // The account can come back filed under a different form of the
+          // number, and that is the one the session belongs to.
           const savedPhone = String(finalStore.phoneNumber || ph);
-          const savedFile  = path.join(_sessDir, `${savedPhone}.json`);
+          sessionDirFor(_sessDir, savedPhone, { create: true });
+          const savedFile  = storeFileFor(_sessDir, savedPhone);
           saveStore(finalStore, savedFile);
           if (r.canonicalPhoneNumber) {
             out('note: WhatsApp knows this account as +' + r.canonicalPhoneNumber +

package/lib/BinaryNode.js

@@ -88,6 +88,10 @@ function _writeValue(value, parts) {
     _writeListSize(value.length, parts);
     for (const item of value) _writeNode(item, parts);
   } else if (value instanceof BinaryNode) {
+    // Node content always reads back as a list, so a lone child has to go out
+    // as a one-element list. Written bare, the child's own list header would be
+    // taken for this node's child count and the rest of the node misparsed.
+    _writeListSize(1, parts);
     _writeNode(value, parts);
   } else {
     _writeString(String(value), parts);

package/lib/MediaService.js

@@ -256,13 +256,36 @@ async function downloadMedia(url, mediaKey, keyName, opts) {
 
 // The CDN applies the same Origin check on the way down as on the way up, so a
 // companion has to identify itself as a browser here too.
-function _httpGet(url, opts) {
+//
+// A file that has moved answers with a redirect, sometimes more than one. A
+// loop, a redirect with nowhere to go, and an outright refusal all have to end
+// as a rejection: an error page handed back as if it were the media only turns
+// up later as a MAC failure in decryptMedia, which says nothing about why.
+const MAX_REDIRECTS = 5;
+
+function _httpGet(url, opts, depth) {
   return new Promise((resolve, reject) => {
     const lib = url.startsWith('https') ? https : http;
     const web = !!(opts && opts.web);
     lib.get(url, { headers: mediaHeaders(web) }, (res) => {
-      if (res.statusCode === 301 || res.statusCode === 302) {
-        return _httpGet(res.headers.location, opts).then(resolve).catch(reject);
+      const status = res.statusCode || 0;
+      if (status === 301 || status === 302) {
+        res.resume();                                   // drop the redirect body
+        const location = res.headers && res.headers.location;
+        if (!location) {
+          return reject(new Error('httpGet: the server answered ' + status +
+            ' without a Location header'));
+        }
+        const hops = (depth || 0) + 1;
+        if (hops > MAX_REDIRECTS) {
+          return reject(new Error('httpGet: more than ' + MAX_REDIRECTS +
+            ' redirects'));
+        }
+        return _httpGet(location, opts, hops).then(resolve, reject);
+      }
+      if (status < 200 || status > 299) {
+        res.resume();                                   // an error page, not media
+        return reject(new Error('httpGet: the server answered ' + status));
       }
       const chunks = [];
       res.on('data', c => chunks.push(c));

package/lib/MediaThumbnail.js

@@ -64,8 +64,14 @@ function probeImageSize(buf) {
     return { width: buf.readUInt16LE(6), height: buf.readUInt16LE(8) };
   }
 
-  // BMP
+  // BMP — the 12-byte BITMAPCOREHEADER holds the size as two Int16, every
+  // later header as two Int32, so the header size decides where to read.
   if (buf[0] === 0x42 && buf[1] === 0x4d && buf.length >= 26) {
+    const headerSize = buf.readUInt32LE(14);
+    if (headerSize < 12) return null;
+    if (headerSize === 12) {
+      return { width: buf.readInt16LE(18), height: Math.abs(buf.readInt16LE(20)) };
+    }
     return { width: buf.readInt32LE(18), height: Math.abs(buf.readInt32LE(22)) };
   }
 

package/lib/Registration.js

@@ -451,6 +451,16 @@ const TWO_DIGIT_CCS = new Set([
   '95','98'
 ]);
 
+// Every country we carry metadata for has to be splittable here, or parsePhone
+// takes the wrong prefix and the registration token ends up computed over the
+// wrong national number — which the server answers by refusing the code. The
+// two lists above were maintained by hand and had already drifted, so the
+// country table itself gets the last word.
+for (const cc of Object.keys(COUNTRY_META)) {
+  if      (cc.length === 3) THREE_DIGIT_CCS.add(cc);
+  else if (cc.length === 2) TWO_DIGIT_CCS.add(cc);
+}
+
 function parsePhone(phoneNumber) {
   const str = String(phoneNumber).replace(/\D/g, '');
 
@@ -1639,6 +1649,10 @@ async function assertRegistrationKeys(store, waVersion) {
   return false;
 }
 
+// The retry policy below is "unknown error once, then give up", so this only
+// bites when the server keeps answering with a different reason each time.
+const MAX_CODE_REQUEST_ATTEMPTS = 5;
+
 async function requestSmsCode(store, method, opts) {
   method = method || 'sms';
   opts   = opts   || {};
@@ -1721,14 +1735,22 @@ async function requestSmsCode(store, method, opts) {
         throw new Error(`WhatsApp security block: "${body}" — use a residential IP/proxy`);
       }
 
-      // Same error twice in a row → give up
-      if (reason && reason === lastReason) {
-        throw new Error(`Registration error (${m}): ${reason} — raw: ${JSON.stringify(result)}`);
+      // Same error twice in a row → give up. Compared even when the reason is
+      // empty: a 200 carrying a non-JSON body leaves both status and reason
+      // undefined, and skipping those would retry a real /code request forever.
+      if (reason === lastReason) {
+        throw new Error(`Registration error (${m}): ${reason || 'no status in response'} — raw: ${JSON.stringify(result)}`);
       }
 
       // First occurrence of unknown error → retry once
       lastReason = reason;
       attemptNum++;
+
+      // A server answering with a different reason every time would otherwise
+      // keep this loop going indefinitely.
+      if (attemptNum > MAX_CODE_REQUEST_ATTEMPTS) {
+        throw new Error(`Registration error (${m}): giving up after ${MAX_CODE_REQUEST_ATTEMPTS} attempts — raw: ${JSON.stringify(result)}`);
+      }
     }
   }
 
@@ -1777,7 +1799,9 @@ async function verifyCode(store, code, opts) {
   const waVersion = await fetchWaVersion(_device);
   store.version = waVersion;
   store.device  = _device;
-  const normalized = code.replace(/[\s\-]/g, '').replace(/\D/g, '');
+  // A verification code is all digits, so callers reasonably hand one over as a
+  // number; coercing here keeps that from dying on .replace before we ask.
+  const normalized = normalizeCodeResult(code);
 
   const screen = currentVerifyScreen(store);
   await sendFunnelLog(store, waVersion, screen, 'submit_code', 'submit_code_attempt');

package/lib/WAUSync/USyncQuery.js

@@ -49,11 +49,9 @@ class USyncQuery {
             sideList: []
         };
 
-        const usyncNode = findChild(result, 'usync');
-        const listNode = usyncNode ? findChild(usyncNode, 'list') : undefined;
-
-        if (listNode && Array.isArray(listNode.content)) {
-            queryResult.list = listNode.content.reduce((acc, node) => {
+        const parseUsers = (listNode) => {
+            if (!listNode || !Array.isArray(listNode.content)) return [];
+            return listNode.content.reduce((acc, node) => {
                 const id = node && node.attrs && (node.attrs.jid || node.attrs.id);
                 if (id) {
                     const data = Array.isArray(node.content)
@@ -74,6 +72,15 @@ class USyncQuery {
                 }
                 return acc;
             }, []);
+        };
+
+        const usyncNode = findChild(result, 'usync');
+
+        if (usyncNode) {
+            queryResult.list = parseUsers(findChild(usyncNode, 'list'));
+            // side_list carries users too and is a normal part of a result —
+            // leaving it unparsed makes callers iterating sideList see nothing.
+            queryResult.sideList = parseUsers(findChild(usyncNode, 'side_list'));
         }
 
         return queryResult;

package/lib/appstate/AppStateSync.js

@@ -111,7 +111,13 @@ function decodeMutations(mutations, state, getKey, onMutation, validateMacs) {
   };
 
   for (const m of mutations) {
-    if (!m || !m.valueBlob || !m.keyId) { skipped++; continue; }
+    // The index MAC is what the value is filed under in the hash, so a record
+    // that arrived without one cannot be folded in at all — skip it the same
+    // way as any other malformed row rather than let it take the run down.
+    if (!m || !m.valueBlob || !m.keyId || !m.indexBlob || !m.indexBlob.length) {
+      skipped++;
+      continue;
+    }
     const keys = keysFor(m.keyId);
 
     const encContent = m.valueBlob.subarray(0, -32);
@@ -205,7 +211,14 @@ function decodePatches(name, patches, initial, getKey, getMutation, validateMacs
       const rec = getKey(b64);
       if (!rec || !rec.keyData) throw new MissingAppStateKeyError(b64);
       const k    = mutationKeys(rec.keyData);
-      const macs = p.mutations.map(m => m.valueBlob.subarray(-32));
+      // A mutation with no value blob has no value MAC to contribute, and the
+      // server computed this patch MAC over every one of them. Leaving it out
+      // is not a repair — the MAC below simply will not match, which is the
+      // right answer for a patch we cannot reconstruct, and it is reached by
+      // the ordinary macFailed path instead of by throwing mid-run.
+      const macs = p.mutations
+        .filter(m => m && m.valueBlob)
+        .map(m => m.valueBlob.subarray(-32));
       if (!patchMac(p.snapshotMac, macs, state.version, name, k.patchMacKey)
             .equals(p.patchMac || Buffer.alloc(0))) {
         macFailed = true;

package/lib/argo/ArgoDecoder.js

@@ -106,9 +106,13 @@ class BlockQueue {
     this.inline = inlineEverything;
     this.next   = 0;
     this.byKey  = new Map();
+    // Inlined, every value comes out of the core in the one order, so they
+    // share a single list of what has been read — a backreference counts
+    // through that list and would find nothing in a fresh one.
+    this.inlineBlock = { reader: core, seen: [] };
   }
   for(key) {
-    if (this.inline) return { reader: this.core, seen: [] };
+    if (this.inline) return this.inlineBlock;
     if (!this.byKey.has(key)) {
       const buf = this.blocks[this.next++];
       if (buf === undefined) throw new Error('argo: message is missing a block for ' + key);

package/lib/image/Bmp.js

@@ -10,6 +10,20 @@ function isBmp(buf) {
   return Buffer.isBuffer(buf) && buf.length > 26 && buf[0] === 0x42 && buf[1] === 0x4d;
 }
 
+// One channel out of a packed pixel. A mask says where the channel sits and how
+// wide it is, and the width varies — 5-6-5 and 5-5-5 are both ordinary — so the
+// value is scaled by its own maximum rather than shifted by a fixed amount.
+function maskChannel(v, mask) {
+  if (!mask) return 0;
+  let shift = 0;
+  while (!((mask >>> shift) & 1)) shift++;
+  const bits = (mask >>> shift) >>> 0;
+  let width = 0;
+  while ((bits >>> width) & 1) width++;
+  const max = (1 << width) - 1;
+  return Math.round(((v >>> shift) & max) * 255 / max);
+}
+
 function decodeBmp(buf) {
   if (!isBmp(buf)) return null;
 
@@ -36,6 +50,22 @@ function decodeBmp(buf) {
   if (compression !== 0 && compression !== 3) return null;   // RLE, JPEG, PNG
   if (![1, 4, 8, 16, 24, 32].includes(bpp)) return null;
 
+  // BITFIELDS gives up the fixed channel layout and states the masks instead.
+  // They follow a 40-byte header, and a V4/V5 header holds them at that same
+  // place, so one offset covers both; the fourth mask is only there from V4 on.
+  let masks = null;
+  if (compression === 3 && (bpp === 16 || bpp === 32)) {
+    const m = 14 + 40;
+    if (m + 12 > buf.length) return null;
+    masks = {
+      r: buf.readUInt32LE(m),
+      g: buf.readUInt32LE(m + 4),
+      b: buf.readUInt32LE(m + 8),
+      a: (headerSize >= 56 && m + 16 <= buf.length) ? buf.readUInt32LE(m + 12) : 0
+    };
+    if (!masks.r && !masks.g && !masks.b) masks = null;   // nothing usable stated
+  }
+
   // The palette sits between the header and the pixel data.
   const paletteStart = 14 + headerSize;
   const entrySize    = headerSize === 12 ? 3 : 4;
@@ -60,20 +90,37 @@ function decodeBmp(buf) {
         if (idx >= paletteCount || p + 2 >= buf.length) { r = g = b = 0; }
         else { b = buf[p]; g = buf[p + 1]; r = buf[p + 2]; }
       } else if (bpp === 16) {
-        // 5-5-5 with the top bit unused, widened back out to eight bits each.
         const v = buf.readUInt16LE(srcRow + x * 2);
-        r = ((v >> 10) & 31) * 255 / 31;
-        g = ((v >> 5)  & 31) * 255 / 31;
-        b = (v & 31)         * 255 / 31;
-        r = Math.round(r); g = Math.round(g); b = Math.round(b);
+        if (masks) {
+          r = maskChannel(v, masks.r);
+          g = maskChannel(v, masks.g);
+          b = maskChannel(v, masks.b);
+          if (masks.a) a = maskChannel(v, masks.a);
+        } else {
+          // 5-5-5 with the top bit unused, widened back out to eight bits each.
+          r = ((v >> 10) & 31) * 255 / 31;
+          g = ((v >> 5)  & 31) * 255 / 31;
+          b = (v & 31)         * 255 / 31;
+          r = Math.round(r); g = Math.round(g); b = Math.round(b);
+        }
       } else {
         const p = srcRow + x * (bpp / 8);
-        b = buf[p]; g = buf[p + 1]; r = buf[p + 2];
-        if (bpp === 32) {
-          const alpha = buf[p + 3];
-          // A 32-bit BMP often leaves the fourth byte at zero rather than
-          // meaning fully transparent; treat an all-zero channel as opaque.
-          a = alpha;
+        if (bpp === 32 && masks) {
+          const v = buf.readUInt32LE(p);
+          r = maskChannel(v, masks.r);
+          g = maskChannel(v, masks.g);
+          b = maskChannel(v, masks.b);
+          // With no fourth mask the last byte is whatever the writer left
+          // there, which is the same position the plain layout reads.
+          a = masks.a ? maskChannel(v, masks.a) : buf[p + 3];
+        } else {
+          b = buf[p]; g = buf[p + 1]; r = buf[p + 2];
+          if (bpp === 32) {
+            const alpha = buf[p + 3];
+            // A 32-bit BMP often leaves the fourth byte at zero rather than
+            // meaning fully transparent; treat an all-zero channel as opaque.
+            a = alpha;
+          }
         }
       }
 

package/lib/image/Jpeg.js

@@ -79,6 +79,10 @@ class BitReader {
   }
   bit() {
     if (this.left === 0) {
+      // The entropy-coded data ends at the marker. Anything asked for past it
+      // is padding: reading on would take the marker byte itself for pixels,
+      // and a truncated file would finish its last unit on noise.
+      if (this.marker) return 0;
       if (this.pos >= this.buf.length) { this.marker = 0xd9; return 0; }
       let b = this.buf[this.pos++];
       if (b === 0xff) {

package/lib/messages/ReportingToken.js

@@ -180,7 +180,11 @@ function extractReportingTokenContent(data, cfg) {
 
       if (!fieldCfg) { i = valEnd; continue; }
 
-      if (fieldCfg.m || fieldCfg.children) {
+      // Only a field with subfields of its own is walked into. One marked to
+      // keep every subfield has nothing to select, so it is copied whole below
+      // — walking it with no configured subfields would select nothing and
+      // drop the field entirely.
+      if (fieldCfg.children) {
         const sub = extractReportingTokenContent(
           data.subarray(valStart, valEnd), fieldCfg.children || EMPTY_MAP
         );

package/lib/noise.js

@@ -13,15 +13,37 @@ const { encodeHandshakeClientHello, encodeHandshakeClientFinish,
 const { dbg: _whaDbg } = require('./logger');
 const { parsePhone, getCountryMeta } = require('./Registration');
 
-// ─── CertChain validator ────────
+// ─── Server certificate validator ────────
 //
-// Server payload inside ServerHello is a CertChain protobuf:
-//   CertChain.field2 (intermediate) → NoiseCertificate
-//     NoiseCertificate.field1 (details) → NoiseCertificate.Details
-//       Details.field2 (issuerSerial) must === 0
+// ServerHello.payload carries the certificate that authenticates the static
+// Noise key the server presented in this handshake. Two shapes travel on the
+// wire, and they do not share a Details layout:
+//
+//   flat NoiseCertificate — what a native mobile server returns
+//     field1 details, field2 signature (64 bytes, by the root CA)
+//     Details{ 1 serial, 2 issuer, 3 expires, 4 subject, 5 key }
+//
+//   CertChain — what a companion server returns
+//     field1 leaf, field2 intermediate, each { 1 details, 2 signature }
+//     Details{ 1 serial, 2 issuerSerial, 3 key, 4 notBefore, 5 notAfter }
+//     the intermediate is signed by the root CA, the leaf by the intermediate
+//
+// Whichever shape arrives, two things decide whether the server is genuine:
+// the signature must chain back to the root CA below, and the certified key
+// must equal the static key from this handshake. That second check is the one
+// that binds the certificate to this connection — a signature alone only
+// proves the certificate is real, not that it belongs to whoever is talking.
+// Neither check may be skipped, so every path out of here either validates or
+// throws; there is no quiet return.
 //
 // All decoded manually to avoid a protobufjs dependency in noise.js.
 
+// The root of trust. A certificate that does not chain back to this key did
+// not come from WhatsApp.
+const NOISE_ROOT_CA_PUBLIC_KEY = Buffer.from(
+  '142375574d0a587166aae71ebe516437c4a28b73e3695c6ce1f7f9545da8ee6b', 'hex'
+);
+
 function _pbReadVarint(buf, off) {
   let v = 0, shift = 0;
   while (off.pos < buf.length) {
@@ -46,6 +68,10 @@ function _pbReadFields(buf) {
       const len = _pbReadVarint(buf, off);
       fields[fn] = buf.slice(off.pos, off.pos + len);
       off.pos += len;
+    } else if (wt === 5) {
+      off.pos += 4; // no message here uses fixed32/fixed64, but stepping over
+    } else if (wt === 1) {
+      off.pos += 8; // one costs nothing and keeps later fields readable
     } else {
       break; // unexpected wire type — stop parsing
     }
@@ -53,19 +79,97 @@ function _pbReadFields(buf) {
   return fields;
 }
 
-function validateServerCert(payloadBuf) {
-  // payloadBuf is the decrypted ServerHello.payload (CertChain protobuf)
-  const chain        = _pbReadFields(payloadBuf);
-  const intermediate = chain[2]; // field 2 = intermediate NoiseCertificate
-  if (!Buffer.isBuffer(intermediate)) return; // no intermediate cert — skip
-  const cert    = _pbReadFields(intermediate);
-  const details = cert[1]; // field 1 = details bytes
-  if (!Buffer.isBuffer(details)) return;
-  const det          = _pbReadFields(details);
-  const issuerSerial = det[2]; // field 2 = issuerSerial (uint32)
-  if (issuerSerial !== undefined && issuerSerial !== 0) {
-    throw new Error('WA server cert validation failed: issuerSerial=' + issuerSerial + ' expected 0');
+function _certFail(what) {
+  throw new Error('WA server cert validation failed: ' + what);
+}
+
+function _certBytes(value, what) {
+  if (!Buffer.isBuffer(value) || value.length === 0) _certFail('missing ' + what);
+  return value;
+}
+
+// A public key travels either bare or behind the 0x05 Signal type byte. Accept
+// both spellings so an encoding difference never reads as a forged key.
+function _certKeyBytes(value, what) {
+  const key = _certBytes(value, what);
+  const bare = (key.length === 33 && key[0] === 0x05) ? key.slice(1) : key;
+  if (bare.length !== 32) _certFail(what + ' is ' + bare.length + ' bytes, expected 32');
+  return bare;
+}
+
+function _certVerifySignature(signerKey, details, signature, what) {
+  const sig = _certBytes(signature, what + ' signature');
+  if (sig.length !== 64) {
+    _certFail(what + ' signature is ' + sig.length + ' bytes, expected 64');
+  }
+  if (!curveJs.verify(signerKey, details, sig)) {
+    _certFail(what + ' has an invalid signature');
+  }
+}
+
+// The certified key is what the rest of the handshake has been talking to.
+function _certRequireBinding(certKey, serverStaticKey) {
+  if (Buffer.compare(certKey, serverStaticKey) !== 0) {
+    _certFail('certified key does not match the static key this server presented');
+  }
+}
+
+// Flat NoiseCertificate: signed by the root CA, key in Details field 5.
+function _validateFlatCert(cert, serverStaticKey) {
+  const details = _certBytes(cert[1], 'certificate details');
+  _certVerifySignature(NOISE_ROOT_CA_PUBLIC_KEY, details, cert[2], 'certificate');
+
+  const det = _pbReadFields(details);
+  _certRequireBinding(_certKeyBytes(det[5], 'certificate key'), serverStaticKey);
+}
+
+// CertChain: root CA signs the intermediate, the intermediate signs the leaf,
+// and the leaf carries the key that must match the handshake.
+function _validateCertChain(chain, serverStaticKey) {
+  const intermediate = _pbReadFields(_certBytes(chain[2], 'intermediate certificate'));
+  const intDetails   = _certBytes(intermediate[1], 'intermediate certificate details');
+  _certVerifySignature(NOISE_ROOT_CA_PUBLIC_KEY, intDetails, intermediate[2],
+    'intermediate certificate');
+
+  const intDet = _pbReadFields(intDetails);
+  if (intDet[2] !== undefined && intDet[2] !== 0) {
+    _certFail('intermediate certificate was not issued by the root CA, issuerSerial=' + intDet[2]);
+  }
+  const intKey = _certKeyBytes(intDet[3], 'intermediate certificate key');
+
+  const leaf       = _pbReadFields(_certBytes(chain[1], 'leaf certificate'));
+  const leafDetail = _certBytes(leaf[1], 'leaf certificate details');
+  _certVerifySignature(intKey, leafDetail, leaf[2], 'leaf certificate');
+
+  const leafDet = _pbReadFields(leafDetail);
+  if (leafDet[2] === undefined) _certFail('missing leaf certificate issuerSerial');
+  if (intDet[1] === undefined)  _certFail('missing intermediate certificate serial');
+  if (leafDet[2] !== intDet[1]) {
+    _certFail('leaf certificate was not issued by the intermediate');
+  }
+
+  _certRequireBinding(_certKeyBytes(leafDet[3], 'leaf certificate key'), serverStaticKey);
+}
+
+// payloadBuf is the decrypted ServerHello.payload, serverStaticKey the static
+// key decrypted out of the same ServerHello.
+function validateServerCert(payloadBuf, serverStaticKey) {
+  if (!Buffer.isBuffer(payloadBuf) || payloadBuf.length === 0) {
+    _certFail('the server sent no certificate');
   }
+  const staticKey = _certKeyBytes(serverStaticKey, 'server static key');
+  const fields    = _pbReadFields(payloadBuf);
+
+  // Tell the two shapes apart by what sits in field 2: a flat certificate keeps
+  // its own 64-byte signature there, a chain keeps a whole nested certificate,
+  // which is always longer. Reading it off the bytes rather than off the
+  // transport means neither side can be validated against the wrong layout.
+  const flat = Buffer.isBuffer(fields[1]) &&
+               Buffer.isBuffer(fields[2]) &&
+               fields[2].length === 64;
+
+  if (flat) _validateFlatCert(fields, staticKey);
+  else      _validateCertChain(fields, staticKey);
 }
 
 // ─── ClientPayload enum values ───────────────────────────────────────────────
@@ -172,28 +276,50 @@ class NoiseState {
 
 // ─── Frame helpers ────────────────────────────────────────────────────────────
 
-// writeRequestHeader: writes 6 bytes (4 for upper part + 2 for lower).
-// Used for ALL outgoing frames (client → server).
+// A frame is a 3-byte big-endian length followed by that many bytes, and the
+// wire is symmetric: what we write is shaped exactly like what we read below.
+// The only thing that travels outside this framing is the handshake prologue,
+// which the first frame is concatenated onto rather than wrapped in.
+const FRAME_HEADER_SIZE = 3;
+const MAX_FRAME_LENGTH  = 0xffffff; // what a 3-byte length can express
+
 function makeFrame(payload) {
-  const len    = payload.length;
-  const header = Buffer.alloc(6);
-  const mss    = len >> 16;
-  header[0] = (mss >> 24) & 0xff;
-  header[1] = (mss >> 16) & 0xff;
-  header[2] = (mss >>  8) & 0xff;
-  header[3] =  mss        & 0xff;
-  const lss    = len & 0xffff;
-  header[4] = (lss >> 8) & 0xff;
-  header[5] =  lss       & 0xff;
+  const len = payload.length;
+  if (len > MAX_FRAME_LENGTH) {
+    // Silently truncating the length here would desync the stream for good.
+    throw new Error('Frame length ' + len + ' exceeds ' + MAX_FRAME_LENGTH);
+  }
+  const header = Buffer.alloc(FRAME_HEADER_SIZE);
+  header[0] = (len >>> 16) & 0xff;
+  header[1] = (len >>>  8) & 0xff;
+  header[2] =  len         & 0xff;
   return Buffer.concat([header, payload]);
 }
 
-// messageLengthBuffer: always 3 bytes (server → client).
 function readFrameLength(data) {
-  if (data.length < 3) return -1;
+  if (data.length < FRAME_HEADER_SIZE) return -1;
   return (data[0] << 16) | (data[1] << 8) | data[2];
 }
 
+// ─── Handshake trace ─────────────────────────────────────────────────────────
+//
+// The handshake runs before there are stanzas to log, so without this the debug
+// output jumps from "connecting" to either a secured channel or an error with
+// nothing in between — and when it fails, nothing to say which step it got to.
+//
+// Only public material is rendered: ephemeral and static public keys, frame and
+// field sizes, certificate outcome. Derived session keys and anything private
+// are named but never printed, because a debug trace is the thing people paste
+// into a bug report.
+function _hsKey(buf) {
+  if (!Buffer.isBuffer(buf)) return String(buf);
+  return buf.toString('hex') + ' (' + buf.length + 'B)';
+}
+
+function _hsSize(buf) {
+  return Buffer.isBuffer(buf) ? buf.length + 'B' : 'absent';
+}
+
 // ─── NoiseSocket ─────────────────────────────────────────────────────────────
 //
 // Events emitted:
@@ -288,9 +414,18 @@ class NoiseSocket extends EventEmitter {
     };
     this.noiseState.hash(this._ephemeralKeyPair.public);
 
+    _whaDbg('[DBG] NOISE handshake begin  transport=' + this.transport +
+      '  prologue=' + this._prologue.toString('hex') +
+      '  pattern=Noise_XX_25519_AESGCM_SHA256');
+    _whaDbg('[DBG] NOISE ──▶ ClientHello  ephemeral=' + _hsKey(this._ephemeralKeyPair.public));
+
     const helloPayload = encodeHandshakeClientHello(this._ephemeralKeyPair.public);
     const frame        = Buffer.concat([this._prologue, makeFrame(helloPayload)]);
+    _whaDbg('[DBG] NOISE ──▶ ClientHello  ' + frame.length + 'B on the wire = prologue ' +
+      this._prologue.length + 'B + header ' + FRAME_HEADER_SIZE + 'B + payload ' +
+      helloPayload.length + 'B');
     this.socket.write(frame);
+    _whaDbg('[DBG] NOISE     waiting for ServerHello');
   }
 
   _onData(data) {
@@ -301,11 +436,11 @@ class NoiseSocket extends EventEmitter {
 
   _processBuffer() {
     while (true) {
-      if (this.rxBuf.length < 3) break;
+      if (this.rxBuf.length < FRAME_HEADER_SIZE) break;
       const frameLen = readFrameLength(this.rxBuf);
-      if (this.rxBuf.length < 3 + frameLen) break;
-      const frame    = this.rxBuf.slice(3, 3 + frameLen);
-      this.rxBuf     = this.rxBuf.slice(3 + frameLen);
+      if (this.rxBuf.length < FRAME_HEADER_SIZE + frameLen) break;
+      const frame    = this.rxBuf.slice(FRAME_HEADER_SIZE, FRAME_HEADER_SIZE + frameLen);
+      this.rxBuf     = this.rxBuf.slice(FRAME_HEADER_SIZE + frameLen);
 
       if (!this.secured) {
         this._handleHandshakeFrame(frame);
@@ -317,28 +452,46 @@ class NoiseSocket extends EventEmitter {
 
   _handleHandshakeFrame(frame) {
     try {
+      _whaDbg('[DBG] NOISE ◀── ServerHello  ' + frame.length + 'B frame');
       const serverHello = decodeServerHello(frame);
+      _whaDbg('[DBG] NOISE ◀── ServerHello  ephemeral=' + _hsSize(serverHello.ephemeral) +
+        '  static=' + _hsSize(serverHello.staticEnc) + ' encrypted' +
+        '  certificate=' + _hsSize(serverHello.payload) + ' encrypted');
       if (!serverHello.ephemeral) throw new Error('No server ephemeral in ServerHello');
+      _whaDbg('[DBG] NOISE ◀── server ephemeral=' + _hsKey(serverHello.ephemeral));
 
       this.noiseState.hash(serverHello.ephemeral);
       const sharedEE  = dhShared(this._ephemeralKeyPair.private, serverHello.ephemeral);
       this.noiseState.mixKey(sharedEE);
+      _whaDbg('[DBG] NOISE     mixed DH(our ephemeral, server ephemeral)');
 
       const serverStaticDec = this.noiseState.decryptWithAd(serverHello.staticEnc);
+      _whaDbg('[DBG] NOISE ◀── server static key decrypted=' + _hsKey(serverStaticDec));
       const sharedSE        = dhShared(this._ephemeralKeyPair.private, serverStaticDec);
       this.noiseState.mixKey(sharedSE);
+      _whaDbg('[DBG] NOISE     mixed DH(our ephemeral, server static)');
 
-      if (serverHello.payload) {
-        const certPlain = this.noiseState.decryptWithAd(serverHello.payload);
-        validateServerCert(certPlain);
+      // The server is authenticated here, before ClientFinish hands it our
+      // static key and payload. A ServerHello without a certificate leaves
+      // nothing to authenticate it with, so it does not get that far.
+      if (!serverHello.payload) {
+        throw new Error('WA server cert validation failed: the server sent no certificate');
       }
+      const certPlain = this.noiseState.decryptWithAd(serverHello.payload);
+      _whaDbg('[DBG] NOISE ◀── certificate decrypted=' + certPlain.length + 'B — verifying');
+      validateServerCert(certPlain, serverStaticDec);
+      _whaDbg('[DBG] NOISE ◀── certificate verified: signed by the root CA and ' +
+        'certifying the static key above — server authenticated');
 
       const noisePriv  = this.store.noiseKeyPair.private;
       // Send the raw 32-byte noise public key (no 0x05 Signal prefix)
       const noisePub   = stripKeyPrefix(this.store.noiseKeyPair.public);
       const encStatic  = this.noiseState.encryptWithAd(noisePub);
+      _whaDbg('[DBG] NOISE ──▶ our static key=' + _hsKey(noisePub) +
+        ' encrypted to ' + encStatic.length + 'B');
       const sharedSS   = dhShared(noisePriv, serverHello.ephemeral);
       this.noiseState.mixKey(sharedSS);
+      _whaDbg('[DBG] NOISE     mixed DH(our static, server ephemeral)');
 
       // Web mode hands us a finished companion payload; there is no phone
       // identity to derive anything from, and the fields below do not exist on
@@ -346,6 +499,9 @@ class NoiseSocket extends EventEmitter {
       if (this._buildPayload) {
         const encPayload = this.noiseState.encryptWithAd(this._buildPayload());
         const finish     = encodeHandshakeClientFinish(encStatic, encPayload);
+        _whaDbg('[DBG] NOISE ──▶ ClientFinish  static=' + encStatic.length + 'B  payload=' +
+          encPayload.length + 'B (companion)  ' + (finish.length + FRAME_HEADER_SIZE) +
+          'B on the wire');
         this.socket.write(makeFrame(finish));
 
         const webKeys     = this.noiseState.split();
@@ -354,6 +510,7 @@ class NoiseSocket extends EventEmitter {
         this.writeCounter = 0;
         this.readCounter  = 0;
         this.secured      = true;
+        _whaDbg('[DBG] NOISE     split() derived the send and receive keys — channel secured');
 
         if (this._expectSuccess) {
           this._awaitingAuth = true;
@@ -449,6 +606,9 @@ class NoiseSocket extends EventEmitter {
 
       const encPayload = this.noiseState.encryptWithAd(payload);
       const finish     = encodeHandshakeClientFinish(encStatic, encPayload);
+      _whaDbg('[DBG] NOISE ──▶ ClientFinish  static=' + encStatic.length + 'B  payload=' +
+        encPayload.length + 'B (username=' + this.store.phoneNumber + ' version=' +
+        _version + ')  ' + (finish.length + FRAME_HEADER_SIZE) + 'B on the wire');
       this.socket.write(makeFrame(finish));
 
       const keys        = this.noiseState.split();
@@ -456,6 +616,8 @@ class NoiseSocket extends EventEmitter {
       this.readKey      = keys.readKey;
       this.writeCounter = 0;
       this.readCounter  = 0;
+      _whaDbg('[DBG] NOISE     split() derived the send and receive keys — channel secured');
+      _whaDbg('[DBG] NOISE     waiting for the server to accept the payload');
       this.secured      = true;
 
       // Wait for the server's <success> or <failure> confirmation before
@@ -464,6 +626,8 @@ class NoiseSocket extends EventEmitter {
       this._awaitingAuth = true;
 
     } catch (err) {
+      // The step that failed is the one after the last line traced above.
+      _whaDbg('[DBG] NOISE ✗ handshake failed: ' + (err && err.message));
       if (this._connectReject) {
         this._connectReject(err);
         this._connectResolve = null;
@@ -485,6 +649,8 @@ class NoiseSocket extends EventEmitter {
       if (this._awaitingAuth) {
         this._awaitingAuth = false;
         const tag = node && node.description;
+        _whaDbg('[DBG] NOISE ◀── <' + tag + '> — the first frame over the secured channel, ' +
+          'and the server\'s answer on the payload');
 
         if (tag === 'success') {
           if (this._connectResolve) {

package/lib/signal/SenderKey.js

@@ -90,7 +90,10 @@ class SenderKeyStore {
   constructor() {
     this._data      = {};
     this._filePath  = null;
+    // _rev counts mutations so an async write that started before a mutation
+    // landed cannot clear _dirty on its behalf.
     this._dirty     = false;
+    this._rev       = 0;
     this._saveTimer = null;
 
     // Detachable, for the same reason as in SignalStore: a replaced store must
@@ -159,13 +162,22 @@ class SenderKeyStore {
 
   _save() {
     this._dirty = true;
+    this._rev++;
     if (!this._filePath) return;
     if (this._saveTimer) clearTimeout(this._saveTimer);
     this._saveTimer = setTimeout(() => {
       this._saveTimer = null;
+      // The revision this write is a snapshot of.
+      const rev  = this._rev;
       const data = JSON.stringify(this._data, null, 2);
       fs.mkdirSync(path.dirname(this._filePath), { recursive: true });
-      fs.writeFile(this._filePath, data, 'utf8', () => { this._dirty = false; });
+      // Only clear the flag when nothing changed while the write was running.
+      // A mutation that arrived after the snapshot is not in `data`, and its
+      // own debounce timer may never fire — clearing here would make the
+      // exit-time _flushSync() skip it and lose it.
+      fs.writeFile(this._filePath, data, 'utf8', () => {
+        if (this._rev === rev) this._dirty = false;
+      });
     }, _SK_DEBOUNCE_MS);
   }
 

package/lib/signal/SignalStore.js

@@ -32,8 +32,10 @@ class SignalStore {
     // a freshly serialised object) invalidates the entry by identity.
     this._openSessionMemo  = new Map();
 
-    // Debounce state
+    // Debounce state.  _rev counts mutations so an async write that started
+    // before a mutation landed cannot clear _dirty on its behalf.
     this._dirty            = false;
+    this._rev              = 0;
     this._saveTimer        = null;
 
     // Flush synchronously on exit so no state is ever lost.
@@ -121,10 +123,13 @@ class SignalStore {
   // Called on every in-memory mutation — replaces the old synchronous _save().
   _save() {
     this._dirty = true;
+    this._rev++;
     if (!this._filePath) return;
     if (this._saveTimer) clearTimeout(this._saveTimer);
     this._saveTimer = setTimeout(() => {
       this._saveTimer = null;
+      // The revision this write is a snapshot of.
+      const rev  = this._rev;
       const data = JSON.stringify({
         sessions:      this._sessions,
         preKeys:       this._preKeys,
@@ -134,7 +139,13 @@ class SignalStore {
       });
       const dir = path.dirname(this._filePath);
       if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-      fs.writeFile(this._filePath, data, 'utf8', () => { this._dirty = false; });
+      // Only clear the flag when nothing changed while the write was running.
+      // A mutation that arrived after the snapshot is not in `data`, and its
+      // own debounce timer may never fire — clearing here would make the
+      // exit-time _flushSync() skip it and lose it.
+      fs.writeFile(this._filePath, data, 'utf8', () => {
+        if (this._rev === rev) this._dirty = false;
+      });
     }, DEBOUNCE_MS);
   }
 

package/lib/signal/libsignal/curve.js

@@ -129,7 +129,7 @@ exports.calculateSignature = function(privKey, message) {
     return Buffer.from(curveJs.sign(privKey, message));
 };
 
-exports.verifySignature = function(pubKey, msg, sig, isInit) {
+exports.verifySignature = function(pubKey, msg, sig) {
     pubKey = scrubPubKeyFormat(pubKey);
     if (!pubKey || pubKey.byteLength != 32) {
         throw new Error("Invalid public key");
@@ -140,5 +140,5 @@ exports.verifySignature = function(pubKey, msg, sig, isInit) {
     if (!sig || sig.byteLength != 64) {
         throw new Error("Invalid signature");
     }
-    return isInit ? true : curveJs.verify(pubKey, msg, sig);
+    return curveJs.verify(pubKey, msg, sig);
 };

package/lib/signal/libsignal/numeric_fingerprint.js

@@ -4,8 +4,20 @@ const crypto = require('./crypto.js');
 var VERSION = 0;
 
 
+// Inputs arrive as ArrayBuffers (createFor requires them) and as strings for
+// the identifiers, neither of which Buffer.concat or crypto.hash accept.
+function toBuffer(value) {
+    if (Buffer.isBuffer(value)) return value;
+    if (typeof value === 'string') return Buffer.from(value, 'utf8');
+    if (ArrayBuffer.isView(value)) {
+        return Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    }
+    return Buffer.from(value);
+}
+
+
 async function iterateHash(data, key, count) {
-    const combined = (new Uint8Array(Buffer.concat([data, key]))).buffer;
+    const combined = Buffer.concat([toBuffer(data), toBuffer(key)]);
     const result = crypto.hash(combined);
     if (--count === 0) {
         return result;
@@ -34,12 +46,11 @@ function getEncodedChunk(hash, offset) {
 
 async function getDisplayStringFor(identifier, key, iterations) {
     const bytes = Buffer.concat([
-        shortToArrayBuffer(VERSION),
-        key,
-        identifier
+        toBuffer(shortToArrayBuffer(VERSION)),
+        toBuffer(key),
+        toBuffer(identifier)
     ]);
-    const arraybuf = (new Uint8Array(bytes)).buffer;
-    const output = new Uint8Array(await iterateHash(arraybuf, key, iterations));
+    const output = new Uint8Array(await iterateHash(bytes, key, iterations));
     return getEncodedChunk(output, 0) +
         getEncodedChunk(output, 5) +
         getEncodedChunk(output, 10) +

package/lib/signal/libsignal/session_builder.js

@@ -25,8 +25,13 @@ class SessionBuilder {
             if (!await this.storage.isTrustedIdentity(this.addr.id, device.identityKey)) {
                 throw new errors.UntrustedIdentityKeyError(this.addr.id, device.identityKey);
             }
-            curve.verifySignature(device.identityKey, device.signedPreKey.publicKey,
-                                  device.signedPreKey.signature, true);
+            // The signed pre-key is what ties this bundle to the identity key we
+            // just decided to trust. Taking it unverified would let anyone who
+            // can answer for this address hand us a key of their choosing.
+            if (!curve.verifySignature(device.identityKey, device.signedPreKey.publicKey,
+                                       device.signedPreKey.signature)) {
+                throw new errors.PreKeyError('Signed pre-key signature does not verify against the identity key');
+            }
             const baseKey = curve.generateKeyPair();
             const devicePreKey = device.preKey && device.preKey.publicKey;
             const session = await this.initSession(true, baseKey, undefined, device.identityKey,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.14.3",
+  "version": "5.14.5",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API and web ",
   "author": "Kunboruto20",
   "main": "index.js",