whalibmob 5.5.68 → 5.5.70

package/cli.js

@@ -174,6 +174,47 @@ function enableWireTrace() {
     }
   }
 
+  // The Noise handshake never goes through sendNode — sendNode refuses to run
+  // until the channel is secured, and the ClientHello/ClientFinish frames are
+  // written straight to the TCP socket. Wrap that socket as soon as connect()
+  // creates it so the handshake is visible too, then step aside once the
+  // channel is up and the stanza-level hooks take over.
+  const HS_OUT = ['ClientHello', 'ClientFinish'];
+  const HS_IN  = ['ServerHello'];
+  const origConnect = NoiseSocket.prototype.connect;
+  NoiseSocket.prototype.connect = function (...args) {
+    const result = origConnect.apply(this, args);
+    const sock = this.socket;
+    if (sock && !sock.__waTraced) {
+      sock.__waTraced = true;
+      let outN = 0, inN = 0;
+      trace(`\n${C.out}${stamp()} ──▶ TCP CONNECT ${sock.remoteAddress || ''}${C.off}`);
+
+      const origWrite = sock.write.bind(sock);
+      sock.write = (chunk, ...rest) => {
+        if (!this.secured && Buffer.isBuffer(chunk)) {
+          const name = HS_OUT[outN++] || 'handshake frame';
+          trace(`\n${C.out}${stamp()} ──▶ NOISE ${name}  (${chunk.length} bytes)${C.off}`);
+          trace(`  ${C.dim}${chunk.toString('hex')}${C.off}`);
+        }
+        return origWrite(chunk, ...rest);
+      };
+
+      sock.on('data', (d) => {
+        if (this.secured) return;
+        // Label positionally, but say so when the reply is plainly not a Noise
+        // frame — a proxy or captive portal answering in ASCII is worth reading
+        // as text rather than staring at its hex.
+        const ascii = isPrintable(d);
+        const name  = ascii ? 'unexpected plaintext reply' : (HS_IN[inN++] || 'handshake frame');
+        trace(`\n${C.in}${stamp()} ◀── NOISE ${name}  (${d.length} bytes)${C.off}`);
+        trace(`  ${C.dim}${d.toString('hex').slice(0, 1024)}${C.off}`);
+        if (ascii) trace(`  ${C.dim}as text: ${JSON.stringify(d.toString('utf8').slice(0, 400))}${C.off}`);
+      });
+    }
+    return result;
+  };
+
   const origSendNode = NoiseSocket.prototype.sendNode;
   NoiseSocket.prototype.sendNode = function (node) {
     try { logStanza('OUT', node); } catch (_) {}

package/lib/Attestation.js

@@ -158,19 +158,27 @@ async function iosAppAttest(noisePubB64) {
 // ENC envelope, so the Play Integrity nonce is derived from the store (a stable
 // per-session value), NOT from the ENC body. pushToken comes from the optional
 // push client — empty by default.
+// A field with no value is omitted from the body rather than sent empty.
+// buildForm drops null and keeps '', and the registration server validates the
+// shape of what it receives: an empty push_code is a malformed push_code, and
+// it answers with bad_param/bad_format naming that field. An absent field has
+// nothing to validate, which is what an unattested client should send.
+// Real values are still sent whenever a Frida attestation server supplies them.
+const orNull = (v) => (v === '' || v === undefined ? null : v);
+
 async function attestationFields(device, nonceB64, opts) {
   opts = opts || {};
-  const pushToken = opts.pushToken || '';
+  const pushToken = orNull(opts.pushToken);
 
   if (device && device.os === 'android') {
     const a = await androidIntegrity(nonceB64 || '');
     return [
-      'gpia',       a.gpia,
-      '_gg',        a.gg,
-      '_gi',        a.gi,
-      '_gp',        a.gp,
-      '_ge',        a.ge,
-      '_ga',        a.ga,
+      'gpia',       orNull(a.gpia),
+      '_gg',        orNull(a.gg),
+      '_gi',        orNull(a.gi),
+      '_gp',        orNull(a.gp),
+      '_ge',        orNull(a.ge),
+      '_ga',        orNull(a.ga),
       'push_token', pushToken
     ];
   }

package/lib/Registration.js

@@ -424,7 +424,9 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
       'manage_call_permission',     'false',
       'clicked_education_link',     'false',
       'aid',                        '',
-      'push_code',                  store.pushCode || ''
+      // Omitted unless a push client supplies a real code — an empty value is
+      // rejected as bad_format, an absent field is not validated at all.
+      'push_code',                  null
     ];
   }
 
@@ -434,7 +436,8 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
     'sim_mcc',           meta.mcc,
     'sim_mnc',           meta.mnc,
     'jailbroken',        '0',
-    'push_code',         store.pushCode || '',
+    // Omitted unless a push client supplies a real code (see above).
+    'push_code',         null,
     'cellular_strength', '1'
   ];
 }

package/lib/Store.js

@@ -64,11 +64,6 @@ function createNewStore(phoneNumber) {
   // Registration.js): advertising id (UUID) and the 20-byte backup token.
   const advertisingId  = uuidv4();
   const backupToken    = crypto.randomBytes(20);
-  // Push-notification token sent as `push_code` on /code. The server validates
-  // its shape and rejects an empty value with bad_param/bad_format, so it has
-  // to be a real 32-hex-character token. Generated once and persisted, because
-  // the value must stay the same across the /code and /register pair.
-  const pushCode       = crypto.randomBytes(16).toString('hex');
 
   const device  = getDeviceConfig();
   const version = device.os === 'android' ? ANDROID_VERSION_FALLBACK : IOS_VERSION_FALLBACK;
@@ -91,7 +86,6 @@ function createNewStore(phoneNumber) {
     identityId,
     advertisingId,
     backupToken,
-    pushCode,
     registered:    false,
     codePending:   false,  // true after /code request, cleared on successful /register
     name:          'User',
@@ -146,7 +140,6 @@ function storeToJson(store) {
     identityId:     store.identityId.toString('base64'),
     advertisingId:  store.advertisingId || null,
     backupToken:    store.backupToken ? store.backupToken.toString('base64') : null,
-    pushCode:       store.pushCode || null,
     registered:     !!store.registered,
     codePending:    store.codePending || false,
     name,
@@ -189,7 +182,6 @@ function storeFromJson(obj) {
     // enriched /code request always has stable values.
     advertisingId:  obj.advertisingId || uuidv4(),
     backupToken:    obj.backupToken ? Buffer.from(obj.backupToken, 'base64') : crypto.randomBytes(20),
-    pushCode:       obj.pushCode || crypto.randomBytes(16).toString('hex'),
     registered:     !!obj.registered,
     codePending:    obj.codePending || false,
     name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.5.68",
+  "version": "5.5.70",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",