whalibmob 5.5.67 → 5.5.70

package/cli.js

@@ -90,7 +90,19 @@ function enableWireTrace() {
   // reformat its lines on the way out. Anything that is not a pino record is
   // passed through byte-for-byte.
   const stamp = () => new Date().toISOString().slice(11, 23);
-  const trace = (s) => _origStderrWrite(s + '\n');
+  // Traffic arrives while readline owns the bottom line, so writing straight
+  // out overwrites the prompt and leaves the two interleaved. Clear the line
+  // first and redraw the prompt after, the same way the CLI's own event
+  // handlers do.
+  const trace = (s) => {
+    const live = _rl && process.stdout.isTTY;
+    if (live) {
+      readline.cursorTo(process.stdout, 0);
+      readline.clearLine(process.stdout, 0);
+    }
+    _origStderrWrite(s + '\n');
+    if (live) _rl.prompt(true);
+  };
 
   // Route the library's internal [DBG] stream through pino at full verbosity.
   // pino writes newline-delimited JSON straight to fd 1 via sonic-boom, which
@@ -162,6 +174,47 @@ function enableWireTrace() {
     }
   }
 
+  // The Noise handshake never goes through sendNode — sendNode refuses to run
+  // until the channel is secured, and the ClientHello/ClientFinish frames are
+  // written straight to the TCP socket. Wrap that socket as soon as connect()
+  // creates it so the handshake is visible too, then step aside once the
+  // channel is up and the stanza-level hooks take over.
+  const HS_OUT = ['ClientHello', 'ClientFinish'];
+  const HS_IN  = ['ServerHello'];
+  const origConnect = NoiseSocket.prototype.connect;
+  NoiseSocket.prototype.connect = function (...args) {
+    const result = origConnect.apply(this, args);
+    const sock = this.socket;
+    if (sock && !sock.__waTraced) {
+      sock.__waTraced = true;
+      let outN = 0, inN = 0;
+      trace(`\n${C.out}${stamp()} ──▶ TCP CONNECT ${sock.remoteAddress || ''}${C.off}`);
+
+      const origWrite = sock.write.bind(sock);
+      sock.write = (chunk, ...rest) => {
+        if (!this.secured && Buffer.isBuffer(chunk)) {
+          const name = HS_OUT[outN++] || 'handshake frame';
+          trace(`\n${C.out}${stamp()} ──▶ NOISE ${name}  (${chunk.length} bytes)${C.off}`);
+          trace(`  ${C.dim}${chunk.toString('hex')}${C.off}`);
+        }
+        return origWrite(chunk, ...rest);
+      };
+
+      sock.on('data', (d) => {
+        if (this.secured) return;
+        // Label positionally, but say so when the reply is plainly not a Noise
+        // frame — a proxy or captive portal answering in ASCII is worth reading
+        // as text rather than staring at its hex.
+        const ascii = isPrintable(d);
+        const name  = ascii ? 'unexpected plaintext reply' : (HS_IN[inN++] || 'handshake frame');
+        trace(`\n${C.in}${stamp()} ◀── NOISE ${name}  (${d.length} bytes)${C.off}`);
+        trace(`  ${C.dim}${d.toString('hex').slice(0, 1024)}${C.off}`);
+        if (ascii) trace(`  ${C.dim}as text: ${JSON.stringify(d.toString('utf8').slice(0, 400))}${C.off}`);
+      });
+    }
+    return result;
+  };
+
   const origSendNode = NoiseSocket.prototype.sendNode;
   NoiseSocket.prototype.sendNode = function (node) {
     try { logStanza('OUT', node); } catch (_) {}

package/lib/Attestation.js

@@ -158,19 +158,27 @@ async function iosAppAttest(noisePubB64) {
 // ENC envelope, so the Play Integrity nonce is derived from the store (a stable
 // per-session value), NOT from the ENC body. pushToken comes from the optional
 // push client — empty by default.
+// A field with no value is omitted from the body rather than sent empty.
+// buildForm drops null and keeps '', and the registration server validates the
+// shape of what it receives: an empty push_code is a malformed push_code, and
+// it answers with bad_param/bad_format naming that field. An absent field has
+// nothing to validate, which is what an unattested client should send.
+// Real values are still sent whenever a Frida attestation server supplies them.
+const orNull = (v) => (v === '' || v === undefined ? null : v);
+
 async function attestationFields(device, nonceB64, opts) {
   opts = opts || {};
-  const pushToken = opts.pushToken || '';
+  const pushToken = orNull(opts.pushToken);
 
   if (device && device.os === 'android') {
     const a = await androidIntegrity(nonceB64 || '');
     return [
-      'gpia',       a.gpia,
-      '_gg',        a.gg,
-      '_gi',        a.gi,
-      '_gp',        a.gp,
-      '_ge',        a.ge,
-      '_ga',        a.ga,
+      'gpia',       orNull(a.gpia),
+      '_gg',        orNull(a.gg),
+      '_gi',        orNull(a.gi),
+      '_gp',        orNull(a.gp),
+      '_ge',        orNull(a.ge),
+      '_ga',        orNull(a.ga),
       'push_token', pushToken
     ];
   }

package/lib/Registration.js

@@ -424,7 +424,9 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
       'manage_call_permission',     'false',
       'clicked_education_link',     'false',
       'aid',                        '',
-      'push_code',                  ''
+      // Omitted unless a push client supplies a real code — an empty value is
+      // rejected as bad_format, an absent field is not validated at all.
+      'push_code',                  null
     ];
   }
 
@@ -434,7 +436,8 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
     'sim_mcc',           meta.mcc,
     'sim_mnc',           meta.mnc,
     'jailbroken',        '0',
-    'push_code',         '',
+    // Omitted unless a push client supplies a real code (see above).
+    'push_code',         null,
     'cellular_strength', '1'
   ];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.5.67",
+  "version": "5.5.70",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",