whalibmob 5.29.3 → 5.29.5

package/README.md

@@ -5507,6 +5507,30 @@ These variables override individual fields on top of the selected profile:
 | `WA_DEVICE_OS_VERSION` | OS version string (e.g. `14`) |
 | `WA_DEVICE_BUILD` | Build fingerprint (e.g. `UP1A.231005.007`) |
 | `WA_DEVICE_MODEL_ID` | Model ID slug (e.g. `samsung-sm-s928b`) |
+| `WA_DEVICE_RAM` | Usable RAM in GiB, as Android reports it (e.g. `7.53`). Each named profile carries its own; set this only for a different memory variant of the same model. |
+
+### Declaring your SIM
+
+Registration sends `sim_mcc` / `sim_mnc` to say which network the SIM belongs
+to. The built-in table can only name **one operator per country** — Romania is
+always Orange, Brazil always Vivo — and it cannot do better, because number
+portability broke the prefix→operator link years ago. Guessing from the number
+would be wrong more often than the table is.
+
+So say which SIM is in the phone:
+
+```js
+const store = createNewStore('40712345678', { simMcc: '226', simMnc: '01' })
+```
+
+| Variable | Description |
+|---|---|
+| `WA_SIM_MCC` | Mobile country code of the SIM (e.g. `226`) |
+| `WA_SIM_MNC` | Mobile network code. **Width matters** — `10` and `010` are different networks to the server, so write it exactly as your operator does. |
+
+Either half can be given on its own; the other keeps the table's value, and the
+country's language and locale are unaffected either way. Leave both unset and
+nothing changes from before.
 
 ### Version & Token Overrides
 
@@ -5691,6 +5715,24 @@ registered, no code is requested, and the session is never written to.
 the problem.** The difference is then in what the CLI reads and this tool does
 not — `WA_VERSION`, from `.env`. Go back to the top of this section.
 
+## Support this project
+
+If whalibmob saves you time, you can support its development.
+
+**USDT — TRC-20 (Tron network only)**
+
+```
+TNxxWvAc5m5YS89uz5uSrbXC9EKPuS27aP
+```
+
+> [!WARNING]
+> This address is **TRC-20 on the Tron network**. Send **only USDT on TRC-20** to
+> it. USDT sent on any other network — ERC-20 (Ethereum), BEP-20 (BSC), Polygon,
+> or anything else — will be **lost and cannot be recovered**. Always double-check
+> the network in your wallet before sending, and copy the address in full.
+
+The **Sponsor** button at the top of the repository leads back here.
+
 ## License
 
 MIT

package/index.d.ts

@@ -1228,7 +1228,17 @@ export declare function fetchWaWebVersion(): Promise<{ version: [number, number,
 // Stores
 // ────────────────────────────────────────────────────────────────────────────
 
-export declare function createNewStore(phoneNumber: string, opts?: { name?: string }): WhalibmobStore;
+export declare function createNewStore(phoneNumber: string, opts?: {
+  name?: string;
+  /**
+   * The MCC of the SIM actually in the phone. Without it the country table's
+   * one-operator-per-country guess stands — number portability means the
+   * number's prefix cannot tell you. Also settable as `WA_SIM_MCC`.
+   */
+  simMcc?: string;
+  /** The matching MNC. Width matters: `10` and `010` are different networks. */
+  simMnc?: string;
+}): WhalibmobStore;
 /** What the CLI uses for every new SMS session; prefer it over `createNewStore`. */
 export declare function initAuthCreds(phoneNumber: string, opts?: { name?: string }): WhalibmobStore;
 export declare function saveStore(store: WhalibmobStore, filePath: string): void;

package/lib/DeviceConfig.js

@@ -55,9 +55,13 @@ function getDeviceConfig() {
     const profileKey = _normalise(process.env.WA_DEVICE || 'samsungs24ultra');
     const found = _ANDROID_MAP[profileKey] || null;
     if (found) {
-      return Object.assign({}, found, business
+      const picked = Object.assign({}, found, business
         ? { business: true, platform: PLATFORM.ANDROID_BUSINESS }
         : { business: false });
+      // A named profile carries the handset's own RAM; WA_DEVICE_RAM overrides
+      // it for someone running the same model in a different memory variant.
+      if (process.env.WA_DEVICE_RAM) picked.ram = process.env.WA_DEVICE_RAM;
+      return picked;
     }
 
     return {
@@ -69,6 +73,9 @@ function getDeviceConfig() {
       osVersion:       process.env.WA_DEVICE_OS_VERSION   || '14',
       osBuildNumber:   process.env.WA_DEVICE_BUILD        || 'UP1A.231005.007',
       modelId:         process.env.WA_DEVICE_MODEL_ID     || 'SM-S928B',
+      // What the handset reports as usable RAM, in GiB. Registration sends it,
+      // and it has to belong to the handset beside it — see deviceRam().
+      ram:             process.env.WA_DEVICE_RAM          || '11.55',
       deviceModelType: 2
     };
   }

package/lib/Registration.js

@@ -478,8 +478,32 @@ const COUNTRY_META = {
   '998':   { mcc: '434', mnc: '03', lg: 'ru', lc: 'UZ' }, // Uzbekistan (UzMobile)
 };
 
-function getCountryMeta(cc) {
-  return COUNTRY_META[cc] || { mcc: '000', mnc: '000', lg: 'en', lc: 'US' };
+// The carrier metadata for a country calling code.
+//
+// The table names one operator per country — Romania is always Orange, Brazil
+// always Vivo — because that is the best a table keyed by calling code can do.
+// It cannot be better: number portability means the prefix stopped naming the
+// operator years ago, so guessing from the number would be wrong more often
+// than the table is.
+//
+// So the caller can say instead. Whoever is registering knows which SIM is in
+// the phone, and sim_mcc/sim_mnc are meant to describe that SIM; WA_SIM_MCC and
+// WA_SIM_MNC (or `simMcc`/`simMnc` in the options) override the guess with the
+// truth. The language and locale stay with the country either way.
+//
+// MNC keeps whatever width it is given: 226/10 and 226/010 are different
+// networks to the server, and normalising them would break one of the two.
+function getCountryMeta(cc, opts) {
+  const base = COUNTRY_META[cc] || { mcc: '000', mnc: '000', lg: 'en', lc: 'US' };
+
+  const mcc = (opts && opts.simMcc) || process.env.WA_SIM_MCC;
+  const mnc = (opts && opts.simMnc) || process.env.WA_SIM_MNC;
+  if (!mcc && !mnc) return base;
+
+  const out = Object.assign({}, base);
+  if (mcc) out.mcc = String(mcc).trim();
+  if (mnc) out.mnc = String(mnc).trim();
+  return out;
 }
 
 // ---------- Phone number parsing ----------
@@ -962,18 +986,38 @@ function tryLoadAndroidMaterial(device) {
  * Silently ignoring WA_OS is how you end up watching an Android registration go
  * out under an iOS User-Agent and not knowing why.
  */
+// A session's device identity, frozen for the whole registration.
+//
+// createNewStore captures the device when the session is created and writes it
+// to disk with everything else, so a session always arrives here already
+// carrying one. From that point it is frozen: /exist, /code, /register and
+// every retry read this same identity, and no request can describe one handset
+// while a sibling request in the same flow describes another.
+//
+// The bug this closes: the gate here used to be `registered || codePending`, so
+// the very first /code of a session ignored the stored device and re-read it
+// from the environment. /exist had already gone out as the stored device — an
+// Android/Samsung, say, loaded from the session file — and /code then went out
+// as the environment default (iOS/iPhone). One number, two phones, in one flow.
+// That is precisely the shape a "download the official app" block screen looks
+// for, and it was reproducible from the logs. See
+// test/registration-device-consistency.test.js.
+//
+// WA_OS / WA_BUSINESS therefore choose the device only for a session that does
+// not have one yet — which in practice means never, since createNewStore always
+// sets it. To change the platform of an existing session, start it over: delete
+// the session file, and the next createNewStore picks up the current WA_OS.
 function deviceForRegistration(store, opts) {
   const env    = getDeviceConfig();
   const stored = store && store.device;
-  const settled = !!(store && (store.registered || store.codePending));
-  if (!settled || !stored) return env;
+  if (!stored || !stored.os) return env;
 
   const say = (opts && opts.onProgress) || (m => _whaDbg('[DBG] REG ' + m));
 
   if (stored.os !== env.os) {
     say('note: this session was started as ' + stored.os + ', so it stays ' + stored.os +
-        ' — WA_OS=' + env.os + ' does not apply to a number that is already part-way ' +
-        'through registering. Delete the session file to start it over as ' + env.os + '.');
+        ' — WA_OS=' + env.os + ' does not apply to a number that already has a ' +
+        'device. Delete the session file to start it over as ' + env.os + '.');
   }
 
   // The same rule for the variant: an account is created as Business or as
@@ -983,13 +1027,36 @@ function deviceForRegistration(store, opts) {
   if (!!stored.business !== !!env.business) {
     say('note: this session was started as ' + (stored.business ? 'Business' : 'consumer') +
         ', so it stays that — WA_BUSINESS=' + (env.business ? '1' : '0') +
-        ' does not apply to a number that is already part-way through registering. ' +
+        ' does not apply to a number that already has a device. ' +
         'Delete the session file to start it over.');
   }
 
   return stored;
 }
 
+// The device identity a request is about to go out with, logged so /exist and
+// /code can be compared side by side. Gated behind the debug channel — it costs
+// nothing when debug is off, and when a registration misbehaves it is the first
+// thing worth seeing. The User-Agent is built the same way the real request
+// builds it, so what this prints is what actually goes on the wire.
+function logDeviceIdentity(tag, store, waVersion) {
+  const stored = store && store.device;
+  const d      = stored || getDeviceConfig();
+  const ver    = waVersion || (store && store.version) || '';
+  let ua = '';
+  try { ua = registrationHeaders(d, ver)['User-Agent']; } catch (_) {}
+  _whaDbg('[DBG] DEVICE_IDENTITY ' + tag +
+    ' os=' + d.os +
+    ' osVersion=' + d.osVersion +
+    ' manufacturer=' + (d.manufacturer || '-') +
+    ' model=' + (d.model || d.modelId || '-') +
+    ' modelId=' + (d.modelId || '-') +
+    ' business=' + !!d.business +
+    ' waVersion=' + (ver || '-') +
+    ' source=' + (stored ? 'store.device (frozen)' : 'getDeviceConfig() (env/default)') +
+    ' ua="' + ua + '"');
+}
+
 /**
  * Have the Android token material ready, fetching the APK if it is not.
  *
@@ -1201,6 +1268,57 @@ function waitHint(response, method) {
   return retry > 0 ? retry : null;
 }
 
+// ---------- device_ram ----------
+//
+// What the handset reports as usable RAM, in GiB, from
+// ActivityManager.MemoryInfo.totalMem — which is always below the nominal
+// figure on the box, because the kernel, the GPU and the secure world reserve a
+// slice before Android ever sees it. A 12 GB phone reports around 11.5.
+//
+// This was the constant 3.57 on every request, while the same payload declared
+// a Galaxy S24 Ultra beside it. There is no such handset: the S24 Ultra ships
+// with 12 GB and no variant of it has ever had 3.57. Two fields of one request
+// describing two different phones is not a fingerprint worth defending — it is
+// simply wrong, in the way a wrong `os_version` would be. It now comes off the
+// declared profile, so whichever handset the caller says they are on, the
+// memory belongs to it.
+const DEFAULT_DEVICE_RAM = '5.62';
+
+function deviceRam(device) {
+  const ram = device && device.ram;
+  if (ram == null) return DEFAULT_DEVICE_RAM;
+  const n = Number(ram);
+  // Two decimals, the way the client formats it.
+  return Number.isFinite(n) && n > 0 ? n.toFixed(2) : DEFAULT_DEVICE_RAM;
+}
+
+// ---------- pid ----------
+//
+// The process id of the app making the request.
+//
+// This sent `process.pid` — the Node process. Inside a container that is 1, and
+// pid 1 on Android is `init`; no application process is ever 1. Elsewhere it is
+// whatever the host happened to hand out, which is as likely to be 7 as 24000.
+//
+// Android hands out pids from a counter that starts near 300 and wraps at
+// /proc/sys/kernel/pid_max, 32768 by default, so an app launched on a phone
+// that has been up any length of time lands well inside that range. One is
+// derived per store here, from the same identity material everything else in
+// the payload comes from — deterministic on purpose, because /exist, /code and
+// /register are three requests from one running app and a process does not
+// change its pid between them. Restoring a saved session keeps the pid it had,
+// for the same reason.
+function getAppPid(store) {
+  if (store._appPid) return store._appPid;
+  const seed = (store.identityId && Buffer.isBuffer(store.identityId))
+    ? store.identityId
+    : Buffer.from(String(store.phoneNumber || ''), 'utf8');
+  const h = crypto.createHash('sha256').update(seed).update('pid').digest();
+  // 1024..32767 — clear of the kernel and early-boot range, inside pid_max.
+  store._appPid = String(1024 + (h.readUInt32BE(0) % (32768 - 1024)));
+  return store._appPid;
+}
+
 function buildClientMetrics(attempt) {
   const json = '{"attempts":' + (attempt || 1)
     + ',"app_campaign_download_source":"google-play|unknown"'
@@ -1250,9 +1368,9 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
       'advertising_id',             store.advertisingId || '',
       'hasinrc',                    '1',
       'roaming_type',               '0',
-      'device_ram',                 '3.57',
+      'device_ram',                 deviceRam(device),
       'education_screen_displayed', 'true',
-      'pid',                        String(process.pid),
+      'pid',                        getAppPid(store),
       'cellular_strength',          '5',
       'backup_token',               store.backupToken ? toUrlHex(store.backupToken) : '',
       'tos_version',                '5',
@@ -1354,7 +1472,7 @@ function buildVerifiedNameCertificate(store, device) {
 
 async function buildPayload(store, waVersion, useToken, extraPairs) {
   const { cc, national } = parsePhone(store.phoneNumber);
-  const meta   = getCountryMeta(cc);
+  const meta   = getCountryMeta(cc, store);
   const device = store.device || getDeviceConfig();
   const token  = useToken ? computeToken(waVersion, national, device) : null;
   // Android formats fdid lowercase, iOS uppercase (matches the native clients).
@@ -1826,7 +1944,7 @@ async function checkNumberStatus(phoneNumber) {
   const store     = createNewStore(phoneNumber);
   const waVersion = await fetchWaVersion(_device);
   const { cc }    = parsePhone(phoneNumber);
-  const meta      = getCountryMeta(cc);
+  const meta      = getCountryMeta(cc, store);
 
   function hasBlock(r) {
     return r && !!r.custom_block_screen;
@@ -1908,6 +2026,7 @@ async function assertRegistrationKeys(store, waVersion) {
 
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
+      logDeviceIdentity('before /exist', store, waVersion);
       const result = await sendRequest('/exist', store, waVersion, false, null);
       // reason === 'incorrect' → keys not found → fresh
       if (result && result.reason === 'incorrect') {
@@ -1988,7 +2107,7 @@ async function requestSmsCode(store, method, opts) {
 
   // Derive real MCC/MNC from the phone number being registered.
   const { cc: _regCc } = parsePhone(store.phoneNumber);
-  const _regMeta       = getCountryMeta(_regCc);
+  const _regMeta       = getCountryMeta(_regCc, store);
 
   async function _tryMethod(m) {
     // Retry loop:
@@ -2012,6 +2131,7 @@ async function requestSmsCode(store, method, opts) {
       const verifyScreen = currentVerifyScreen(store);
       await sendFunnelLog(store, waVersion, verifyScreen, 'request_code', 'request_code_attempt');
 
+      logDeviceIdentity('before /code', store, waVersion);
       const result = await sendRequest('/code', store, waVersion, true, extra);
 
       const status = result.status;

package/lib/Store.js

@@ -113,6 +113,12 @@ function createNewStore(phoneNumber, opts) {
     registered:    false,
     codePending:   false,  // true after /code request, cleared on successful /register
     name:          normalizePushName(opts.name) || 'User',
+    // Which SIM is actually in the phone. The country table can only guess one
+    // operator per calling code — number portability broke the prefix→operator
+    // link long ago — so whoever is registering can name theirs instead. Null
+    // leaves the table's guess in place. See getCountryMeta in Registration.js.
+    simMcc:        opts.simMcc ? String(opts.simMcc).trim() : null,
+    simMnc:        opts.simMnc ? String(opts.simMnc).trim() : null,
     version,
     device,
     // ADVSignedDeviceIdentity bytes received from server <success> node.
@@ -194,6 +200,8 @@ function storeToJson(store) {
     advertisingId:  store.advertisingId || null,
     backupToken:    store.backupToken ? store.backupToken.toString('base64') : null,
     registered:     !!store.registered,
+    simMcc:         store.simMcc || null,
+    simMnc:         store.simMnc || null,
     codePending:    store.codePending || false,
     // Which delivery method the pending code actually went out by. The two
     // registration steps are normally separate commands, so the confirmation
@@ -246,6 +254,10 @@ function storeFromJson(obj) {
     advertisingId:  obj.advertisingId || uuidv4(),
     backupToken:    obj.backupToken ? Buffer.from(obj.backupToken, 'base64') : crypto.randomBytes(20),
     registered:     !!obj.registered,
+    // Null on stores written before the SIM could be declared, which simply
+    // means the country table's guess stands.
+    simMcc:         obj.simMcc || null,
+    simMnc:         obj.simMnc || null,
     codePending:    obj.codePending || false,
     codeMethod:     obj.codeMethod || null,
     // Absent on stores written before push tokens existed; null simply means

package/lib/constants.js

@@ -169,91 +169,91 @@ const ANDROID_DEVICE_PROFILES = {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Samsung Galaxy S24 Ultra', manufacturer: 'Samsung',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'SM-S928B', deviceModelType: 2
+    modelId: 'SM-S928B', deviceModelType: 2, ram: '11.55'
   },
   'samsung-s24': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Samsung Galaxy S24', manufacturer: 'Samsung',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'SM-S921B', deviceModelType: 2
+    modelId: 'SM-S921B', deviceModelType: 2, ram: '7.63'
   },
   'samsung-s23': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Samsung Galaxy S23', manufacturer: 'Samsung',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'SM-S911B', deviceModelType: 2
+    modelId: 'SM-S911B', deviceModelType: 2, ram: '7.63'
   },
   'samsung-s23-ultra': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Samsung Galaxy S23 Ultra', manufacturer: 'Samsung',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'SM-S918B', deviceModelType: 2
+    modelId: 'SM-S918B', deviceModelType: 2, ram: '11.55'
   },
   'samsung-a55': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Samsung Galaxy A55', manufacturer: 'Samsung',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'SM-A556B', deviceModelType: 1
+    modelId: 'SM-A556B', deviceModelType: 1, ram: '7.44'
   },
   'pixel8pro': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Pixel 8 Pro', manufacturer: 'Google',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'Pixel 8 Pro', deviceModelType: 2
+    modelId: 'Pixel 8 Pro', deviceModelType: 2, ram: '11.44'
   },
   'pixel8': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Pixel 8', manufacturer: 'Google',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'Pixel 8', deviceModelType: 2
+    modelId: 'Pixel 8', deviceModelType: 2, ram: '7.53'
   },
   'pixel7': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Pixel 7', manufacturer: 'Google',
     osVersion: '14', osBuildNumber: 'TP1A.221005.002',
-    modelId: 'Pixel 7', deviceModelType: 2
+    modelId: 'Pixel 7', deviceModelType: 2, ram: '7.53'
   },
   'pixel7a': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Pixel 7a', manufacturer: 'Google',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'Pixel 7a', deviceModelType: 1
+    modelId: 'Pixel 7a', deviceModelType: 1, ram: '7.44'
   },
   'xiaomi14': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Xiaomi 14', manufacturer: 'Xiaomi',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: '23127PN0CG', deviceModelType: 2
+    modelId: '23127PN0CG', deviceModelType: 2, ram: '11.36'
   },
   'xiaomi13': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'Xiaomi 13', manufacturer: 'Xiaomi',
     osVersion: '13', osBuildNumber: 'TQ3A.230901.001',
-    modelId: '2211133G', deviceModelType: 2
+    modelId: '2211133G', deviceModelType: 2, ram: '7.51'
   },
   'oneplus12': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'OnePlus 12', manufacturer: 'OnePlus',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'CPH2573', deviceModelType: 2
+    modelId: 'CPH2573', deviceModelType: 2, ram: '11.48'
   },
   'oneplus11': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'OnePlus 11', manufacturer: 'OnePlus',
     osVersion: '13', osBuildNumber: 'TQ3A.230901.001',
-    modelId: 'CPH2449', deviceModelType: 2
+    modelId: 'CPH2449', deviceModelType: 2, ram: '15.32'
   },
   'oppo-find-x7': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'OPPO Find X7', manufacturer: 'OPPO',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'CPH2599', deviceModelType: 2
+    modelId: 'CPH2599', deviceModelType: 2, ram: '11.40'
   },
   'realme-gt5': {
     os: 'android', platform: PLATFORM.ANDROID,
     model: 'realme GT 5 Pro', manufacturer: 'realme',
     osVersion: '14', osBuildNumber: 'UP1A.231005.007',
-    modelId: 'RMX3888', deviceModelType: 2
+    modelId: 'RMX3888', deviceModelType: 2, ram: '15.28'
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.29.3",
+  "version": "5.29.5",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",