whalibmob 5.33.28 → 5.33.30

package/lib/Registration.js

@@ -1593,6 +1593,16 @@ function toBase64Url(buf) {
   return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_');
 }
 
+// The native client encodes the Signal-key and expid wire parameters with
+// Base64.encodeToString(bytes, 11) = URL_SAFE | NO_WRAP | NO_PADDING: authkey
+// (43 chars), e_ident/e_skey_val (43), e_skey_sig (86), e_regid (6), e_keytype,
+// e_skey_id (4), expid (22) — never a trailing '='. The padded form still
+// decodes server-side, but the bare '=' is a wire tell no real device emits.
+// The ENC envelope and the vname certificate keep their own encoder above.
+function toBase64UrlNoPad(buf) {
+  return toBase64Url(buf).replace(/=+$/, '');
+}
+
 // ---------- vname: the Business verified-name certificate ----------
 //
 // A Business registration carries one extra form field, `vname`, and a consumer
@@ -1712,18 +1722,18 @@ async function buildPayload(store, waVersion, useToken, extraPairs, path) {
     'rc',                String(RELEASE_CHANNEL),
     'lg',                meta.lg,
     'lc',                meta.lc,
-    'authkey',           toBase64Url(stripKeyPrefix(store.noiseKeyPair.public)),
+    'authkey',           toBase64UrlNoPad(stripKeyPrefix(store.noiseKeyPair.public)),
     // Business only; buildForm drops a null, so a consumer registration sends
     // the same body it always has.
     'vname',             buildVerifiedNameCertificate(store, device),
-    'e_regid',           toBase64Url(intToBytes(store.registrationId, 4)),
-    'e_keytype',         toBase64Url(Buffer.from([SIGNAL_KEY_TYPE])),
-    'e_ident',           toBase64Url(stripKeyPrefix(store.identityKeyPair.public)),
-    'e_skey_id',         toBase64Url(intToBytes(store.signedPreKey.id, 3)),
-    'e_skey_val',        toBase64Url(stripKeyPrefix(store.signedPreKey.public)),
-    'e_skey_sig',        toBase64Url(store.signedPreKey.signature),
+    'e_regid',           toBase64UrlNoPad(intToBytes(store.registrationId, 4)),
+    'e_keytype',         toBase64UrlNoPad(Buffer.from([SIGNAL_KEY_TYPE])),
+    'e_ident',           toBase64UrlNoPad(stripKeyPrefix(store.identityKeyPair.public)),
+    'e_skey_id',         toBase64UrlNoPad(intToBytes(store.signedPreKey.id, 3)),
+    'e_skey_val',        toBase64UrlNoPad(stripKeyPrefix(store.signedPreKey.public)),
+    'e_skey_sig',        toBase64UrlNoPad(store.signedPreKey.signature),
     'fdid',              fdid,
-    'expid',             toBase64Url(store.deviceId),
+    'expid',             toBase64UrlNoPad(store.deviceId),
     'id',                toUrlHex(store.identityId),
     'access_session_id', getAccessSessionId(store),
     'token',             token,
@@ -1920,7 +1930,7 @@ async function sendFunnelLog(store, waVersion, currentScreen, actionTaken, event
       'in',              national,
       'lg',              'en',
       'lc',              'US',
-      'expid',           toBase64Url(store.deviceId),
+      'expid',           toBase64UrlNoPad(store.deviceId),
       'fdid',            fdid,
       'id',              toUrlHex(store.identityId),
       'current_screen',  currentScreen,
@@ -1952,7 +1962,7 @@ async function sendPrePnFunnelLog(store, waVersion, actionTaken, eventName) {
     const body = buildForm([
       'lg',              'en',
       'lc',              'US',
-      'expid',           toBase64Url(store.deviceId),
+      'expid',           toBase64UrlNoPad(store.deviceId),
       'fdid',            fdid,
       'id',              toUrlHex(store.identityId),
       'current_screen',  'enter_number',

package/lib/Store.js

@@ -82,7 +82,11 @@ function createNewStore(phoneNumber, opts) {
 
   const registrationId = (crypto.randomBytes(2).readUInt16BE(0) & 0x3fff) + 1;
   const fdid           = uuidv4();
-  const deviceId       = crypto.randomBytes(16);
+  // expid goes on the wire as a UUID and WhatsApp reads its version/variant
+  // nibbles (the native client builds it with UUID.nameUUIDFromBytes/randomUUID).
+  // 16 fully random bytes land on a valid UUID shape only ~1 time in 16, so the
+  // server sees a malformed UUID; take the 16 bytes of a real v4 UUID instead.
+  const deviceId       = Buffer.from(uuidv4().replace(/-/g, ''), 'hex');
   const identityId     = crypto.randomBytes(16);
   // Device fingerprint fields the native client sends on /code (see
   // Registration.js): advertising id (UUID) and the 20-byte backup token.
@@ -358,7 +362,8 @@ function fromSixParts(sixParts) {
     },
     registrationId: (crypto.randomBytes(2).readUInt16BE(0) & 0x3fff) + 1,
     fdid:           uuidv4(),
-    deviceId:       crypto.randomBytes(16),
+    // expid must be a valid UUID on the wire — see createNewStore above.
+    deviceId:       Buffer.from(uuidv4().replace(/-/g, ''), 'hex'),
     identityId,
     advertisingId:  uuidv4(),
     backupToken:    crypto.randomBytes(20),

package/lib/messages/MessageSender.js

@@ -27,7 +27,7 @@ const { uploadMedia } = require('../MediaService');
 const { imageThumbnail, videoThumbnail, probeImageSize } = require('../MediaThumbnail');
 const { tcTokenExpired, shouldSendNewTcToken, normalizeJidForTcToken,
         isRegularTcTokenUser } = require('./TcTokenStore');
-const { buildReportingNode } = require('./ReportingToken');
+const { buildReportingNode, ensureMessageSecret } = require('./ReportingToken');
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 
@@ -937,6 +937,13 @@ class MessageSender {
     const recipientPhone = phoneFromJid(toJid);
     const ownPhone       = String(this._store.phoneNumber);
     const ownMainJid     = `${ownPhone}@s.whatsapp.net`;
+
+    // Stamp the message secret the native client puts on every reportable
+    // message, before the plaintext is wrapped in a DeviceSentMessage, cached
+    // for retries, or encrypted. A no-op for messages that carry no reporting
+    // token or already hold a secret (a poll), so it only ever adds the field
+    // that was missing from plain text and media. See ensureMessageSecret.
+    plaintext = ensureMessageSecret(plaintext);
     const mediaSubtype   = options._mediaSubtype || null;
     const decryptFail    = resolveDecryptFail(mediaType, options);
 
@@ -1080,8 +1087,11 @@ class MessageSender {
     // it and have the server verify the reported text is what was actually
     // sent. Sending the secret without the token is a combination no real
     // client produces.
+    // Our own identity in the same address family as the destination — the
+    // original sender half of the token's key derivation.
+    const ownReportingJid = isLidTarget ? `${ownLidUser}@lid` : ownMainJid;
     const reportingNode = buildReportingNode({
-      plaintext, msgId, remoteJid: routingToJid, BinaryNode
+      plaintext, msgId, remoteJid: routingToJid, senderJid: ownReportingJid, BinaryNode
     });
     if (reportingNode) {
       msgContent.push(reportingNode);
@@ -1233,6 +1243,12 @@ class MessageSender {
     const mediaSubtype = options._mediaSubtype || null;
     const decryptFail  = resolveDecryptFail(mediaType, options);
 
+    // Same message secret the native client stamps on reportable group
+    // messages, before the plaintext is cached or encrypted. A no-op for a poll
+    // (already carries one) or a reaction (carries no token). See
+    // ensureMessageSecret.
+    plaintext = ensureMessageSecret(plaintext);
+
     const isStatus = isStatusBroadcast(groupJid);
 
     // A Status has no group metadata; its recipients come from the account's
@@ -1495,7 +1511,7 @@ class MessageSender {
     // is the common case: it has a message secret, so it needs the token that
     // lets a report on it be verified.
     const groupReportingNode = buildReportingNode({
-      plaintext, msgId, remoteJid: groupJid, BinaryNode
+      plaintext, msgId, remoteJid: groupJid, senderJid: ownJid, BinaryNode
     });
     if (groupReportingNode) {
       msgContent.push(groupReportingNode);

package/lib/messages/ReportingToken.js

@@ -16,13 +16,17 @@
 // not change the token. REPORTING_FIELDS below is that subset, and it is the
 // part that has to match byte for byte or the token is worthless.
 //
-// The key is derived using the destination JID for both halves. Since the
-// server only checks the token when a report is actually filed, the choice is
-// not observable on send.
+// The key is derived from the message secret, keyed by the two identities of
+// the exchange: our own JID as the original sender and the destination JID as
+// the party the modification is addressed to — the same binding the native
+// client uses (origMsgSender = sender, modificationSender = recipient). The
+// server recomputes with those same two identities when a report is filed, so
+// getting them wrong leaves a token that no report could ever verify.
 
 const crypto     = require('crypto');
 const { hkdfSha256 } = require('../hkdf');
 const { sha256 } = require('@noble/hashes/sha256');
+const { encodeMessageContextInfo } = require('../proto/MessageProto');
 
 // Protobuf field numbers on Message that the token is computed over.
 //   f  field number
@@ -315,6 +319,38 @@ function shouldIncludeReportingToken(present) {
          !present.has(F_POLL_UPDATE);
 }
 
+/**
+ * Give an outgoing message the message secret the native client puts on
+ * everything reportable, so the reporting token below can actually be built.
+ *
+ * The native client mints a random 32-byte secret into
+ * MessageContextInfo.messageSecret for every message that carries a reporting
+ * token, and reuses an existing one when the message already has it (a poll
+ * writes its own secret there). Without this step ordinary text and media go
+ * out with no secret and therefore no <reporting> node at all — a shape no real
+ * client produces, and the gap this function closes.
+ *
+ * Returns the plaintext unchanged when the message is one that carries no token
+ * (reactions, poll votes) or already has a secret; otherwise returns a new
+ * buffer with field 35 appended. Field 35 is not part of REPORTING_FIELDS, so
+ * appending it never changes the token's content hash. On malformed input the
+ * plaintext is returned untouched.
+ *
+ * @param {Buffer} plaintext  encoded Message protobuf, before encryption
+ * @returns {Buffer}
+ */
+function ensureMessageSecret(plaintext) {
+  if (!Buffer.isBuffer(plaintext)) return plaintext;
+  const info = inspectMessage(plaintext);
+  if (!info.ok) return plaintext;
+  if (!shouldIncludeReportingToken(info.present)) return plaintext;
+  if (info.messageSecret && info.messageSecret.length) return plaintext;
+
+  const ctx = encodeMessageContextInfo({ messageSecret: crypto.randomBytes(32) });
+  if (!ctx || ctx.length === 0) return plaintext;
+  return Buffer.concat([plaintext, ctx]);
+}
+
 /**
  * Build the <reporting> node for an outgoing message, or null when there is
  * nothing to attach.
@@ -322,21 +358,25 @@ function shouldIncludeReportingToken(present) {
  * @param {object} opts
  *   plaintext    encoded Message protobuf, exactly as it will be encrypted
  *   msgId        the stanza id
- *   remoteJid    the destination JID
- *   participant  set only on a targeted resend; undefined otherwise
+ *   remoteJid    the destination JID (recipient for a DM, group JID for a group)
+ *   senderJid    our own JID — the original sender in the key derivation;
+ *                falls back to remoteJid when unset
  *   BinaryNode   the node constructor
  */
 function buildReportingNode(opts) {
-  const { plaintext, msgId, remoteJid, participant, BinaryNode } = opts;
+  const { plaintext, msgId, remoteJid, senderJid, BinaryNode } = opts;
   if (!Buffer.isBuffer(plaintext) || !msgId || !remoteJid) return null;
 
   const info = inspectMessage(plaintext);
   if (!info.ok || !info.messageSecret || !info.messageSecret.length) return null;
   if (!shouldIncludeReportingToken(info.present)) return null;
 
-  // fromMe is always true here — we only ever build this for our own sends.
-  const from = String(remoteJid);
-  const to   = String(participant || remoteJid);
+  // fromMe is always true here — we only ever build this for our own sends, so
+  // the original sender is us and the modification is addressed to the
+  // destination. Keyed the other way (both halves the destination), the token
+  // was present but no filed report could verify it.
+  const from = String(senderJid || remoteJid);  // origMsgSender  = us
+  const to   = String(remoteJid);                // modificationSender = destination
 
   const reportingSecret = generateMsgSecretKey(
     ENC_SECRET_REPORT_TOKEN, msgId, from, to, info.messageSecret
@@ -355,6 +395,7 @@ function buildReportingNode(opts) {
 
 module.exports = {
   buildReportingNode,
+  ensureMessageSecret,
   shouldIncludeReportingToken,
   extractReportingTokenContent,
   generateMsgSecretKey,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.33.28",
+  "version": "5.33.30",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",