whalibmob 5.33.20 → 5.33.21

package/lib/Attestation.js

@@ -55,6 +55,27 @@ const GS_SERVER_KEY = Buffer.from(
 // Base stat codes for the 13 path checks; +1000 when stat() fails.
 const GS_BASE_CODES = [10, 11, 0, 100, 101, 102, 103, 104, 1, 105, 106, 107, 108];
 
+// ─── _ge: environment security flags ─────────────────────────────────────────
+// sb=false (no security bypass), sv=false (not security-verified by TEE).
+// Always false on a headless client — matching a device that passed basic
+// checks but has no hardware-backed verification.
+function generateGeToken() {
+  return encodeURIComponent('{"sb":false,"sv":false}');
+}
+
+// ─── _ga: app analytics envelope ─────────────────────────────────────────────
+// bi = SHA-512 of the session nonce (deterministic per session, unique per
+// device); ap/ai/ae are numeric constants observed across Android builds;
+// mp/mu are multi-profile/multi-user booleans (false on a single-user install).
+function generateGaToken(nonceB64) {
+  const nonceBuf = Buffer.from(
+    (nonceB64 || '').replace(/-/g, '+').replace(/_/g, '/'), 'base64'
+  );
+  const bi = crypto.createHash('sha512').update(nonceBuf).digest('base64');
+  const json = '{"bi":"' + bi + '","ap":247444,"ai":145847,"mp":false,"ae":128383,"mu":false}';
+  return encodeURIComponent(json);
+}
+
 function generateGsToken() {
   const nowMs = Date.now();
   const sec   = Math.floor(nowMs / 1000);
@@ -246,14 +267,16 @@ async function attestationFields(device, nonceB64, opts) {
   if (device && device.os === 'android') {
     const a  = await androidIntegrity(nonceB64 || '', device);
     const gs = generateGsToken();
+    const ge = generateGeToken();
+    const ga = generateGaToken(nonceB64 || '');
     _ok('_gs field generated (WASafe envelope, ' + gs.length + ' encoded chars)');
     return [
       'gpia',       orNull(a.gpia),
       '_gg',        orNull(a.gg),
       '_gi',        orNull(a.gi),
       '_gp',        orNull(a.gp),
-      '_ge',        orNull(a.ge),
-      '_ga',        orNull(a.ga),
+      '_ge',        ge,
+      '_ga',        ga,
       '_gs',        gs,
       'push_token', pushToken
     ];

package/lib/Registration.js

@@ -1389,7 +1389,7 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
       'reason',                     '',
       'mcc',                        meta.mcc,
       'mnc',                        meta.mnc,
-      'feo2_query_status',          'client_capabilities_cached',
+      'feo2_query_status',          'success_get_client_capabilities',
       'db',                         '1',
       'sim_type',                   '1',
       'recaptcha',                  '%7B%22stage%22%3A%22ABPROP_DISABLED%22%7D',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.33.20",
+  "version": "5.33.21",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",