Go-whatsapp: Debugging Binary Data

[orangehaired]

Hi @Rhymen, @houstondapaz, @kaxap =)

How do you debug binary data?

I can read json from websocket, but I can't read binary data. I'm grpc developer and very good on protobuffer.

For example ban request data:

Thank u so much for project =)

[kaxap]

Hi @orangehaired,

Please refer to decryptBinaryMessage function in read.go https://github.com/Rhymen/go-whatsapp/blob/4c0e263c801b8b5bd7fad1577786ab6c32c2c042/read.go#L98

[0xhex]

How can i decrypt this?
3438 382E 2D2D 3331 2C07 80B0 6C18 1D41 5753 2F90 3983 04CF 585C D751 693B CC76 3A2E 3D1C 2056 3D64 741A A0AA FC0A 07D9 8C45 3A0A 389F FE25 61AC 6E04 E750 F179 3776 42A3 E9FA B24E 3B09 C250 C9FC 3627 6169 EEE1 A008 9F53 4D10 B5AC 7ACD F31E C0D7 2F4E 28A8 CFBB D2A7 8EE9 FFA6 4C0E BB75 9E43 6B2A C92C E8BE E1

I Tried this but not working

    msg, err := wac.decryptBinaryMessage([]byte("3438 382E 2D2D 3331 2C07 80B0 6C18 1D41 5753 2F90 3983 04CF 585C D751 693B CC76 3A2E 3D1C 2056 3D64 741A A0AA FC0A 07D9 8C45 3A0A 389F FE25 61AC 6E04 E750 F179 3776 42A3 E9FA B24E 3B09 C250 C9FC 3627 6169 EEE1 A008 9F53 4D10 B5AC 7ACD F31E C0D7 2F4E 28A8 CFBB D2A7 8EE9 FFA6 4C0E BB75 9E43 6B2A C92C E8BE E1"))
    if err != nil {
        return nil, err
    }

[kaxap]

It should be

msg, err := wac.decryptBinaryMessage([]byte{0x34, 0x38, 0x38, 0x2E, 0x2D, 0x2D, 0x33,...})

[beshoo]

@0xhex @kaxap
how can we use decryptBinaryMessage while we are using the chorme?
I want to decode the chrome outgoing/ incoming messages, Is there a way? since I believe we need te token key!

[kaxap]

@beshoo
just place appropriate break points in JS code, where encrypted messages are already decoded and deserialized.

[beshoo]

Please can you show me an example

On Thu, 28 May 2020, 7:14 pm kaxap, [e-mail] wrote:

@beshoo https://github.com/beshoo
just place appropriate break points in JS code, where encrypted messages
are already decoded and deserialized.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/Rhymen/go-whatsapp/issues/189#issuecomment-635446447,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ABDLT25CI6VWJ45JBUXIESTRT2EVTANCNFSM4H663YAA
.

[beshoo]

Please note i want to see the sent and received message.

On Thu, 28 May 2020, 7:58 pm beshoo, [e-mail] wrote:

Please can you show me an example

On Thu, 28 May 2020, 7:14 pm kaxap, [e-mail] wrote:

@beshoo https://github.com/beshoo
just place appropriate break points in JS code, where encrypted messages
are already decoded and deserialized.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/Rhymen/go-whatsapp/issues/189#issuecomment-635446447,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ABDLT25CI6VWJ45JBUXIESTRT2EVTANCNFSM4H663YAA
.

[shekohex]

I'm not using that lib, but I keep an eye on it because I have mine but it is written in Rust instead.
I have a one rust binary for analyzing the packets between Whatsapp web and Whatsapp server.
and I'll share it with you all:

use crate::settings::Settings;
use anyhow::Result;
use dialoguer::{theme::ColorfulTheme, Confirmation, Input};
use libwa::internal::{verify_and_decrypt_message, Node, NodeContent};
use waproto::{ProstMessage, WebMessageInfo};
mod settings;
fn main() -> Result<()> {
    println!("Loading Settings form ./config/packet-analyzer.toml ..");
    let settings = Settings::new()?;
    let enc = base64::decode(&settings.secrets.enc)?;
    let mac = base64::decode(&settings.secrets.mac)?;
    let theme = ColorfulTheme::default();
    loop {
        let packet = Input::<String>::new()
            .with_prompt("Enter the Packet (in base64)")
            .interact()?;
        let message = base64::decode(&packet)?;
        let sent = Confirmation::with_theme(&theme)
            .with_text("is this a sent packet ?")
            .default(true)
            .show_default(true)
            .interact()?;
        let pad = if sent {
            3 // these there bytes for the [metric, b',', flag]
        } else {
            1 // one for the , it self
        };
        let sep = message
            .iter()
            .position(|x| x == &b',')
            .expect("we should have the `,` separator!")
            + pad;
        let message_tag = std::str::from_utf8(&message[..(sep - pad)])?;
        println!("Message Tag: {}", message_tag);
        let message =
            verify_and_decrypt_message(&enc[..], &mac[..], &message[sep..])?;
        let payload = Node::deserialize(&message)?;
        if let NodeContent::List(nodes) = &payload.content {
            for node in nodes {
                match node.desc.as_ref() {
                    "message" => {
                        handle_message(&node.content)?;
                    },
                    unknown => {
                        eprintln!("got unhandled node of desc: {}", unknown);
                        println!("{:#?}", payload);
                    },
                }
            }
        } else {
            println!("{:#?}", payload);
        }
    }
}

fn handle_message(content: &NodeContent) -> Result<()> {
    if let NodeContent::Binary(ref content) = content {
        let msg = WebMessageInfo::decode(content.as_slice())?;
        println!("{:#?}", msg);
    }
    Ok(())
}

// some crypto things
pub fn verify_and_decrypt_message(
    enc: &[u8],
    mac: &[u8],
    message_encrypted: &[u8],
) -> Result<Vec<u8>> {
    let mut h = HmacSha256::new_varkey(mac)
        .map_err(|e| WAError::Other(e.to_string()))?; // return the error ..

    h.input(&message_encrypted[32..]);
    h.verify(&&message_encrypted[..32])
        .map_err(|e| WAError::Other(e.to_string()))?; // return the error ...
    aes_decrypt(enc, &message_encrypted[32..48], &message_encrypted[48..])
}

Some Notes:

1. Settings: is just a struct to hold the mac key and enc key, these keys you should find them stored somewhere in the browser (PS: see Application Tab in devtools)
2. I'm using a dialoguer package to make it interactive while debugging.
3. verify_and_decrypt_message function is the same as decryptBinaryMessage but my code is very decoupled, so I have pure functions that work without depending on Whatsapp session.
4. WebMessageInfo generated from the proto file.

[Ased2235]

It should be

msg, err := wac.decryptBinaryMessage([]byte{0x34, 0x38, 0x38, 0x2E, 0x2D, 0x2D, 0x33,...})

Can you tell me how get that from binary?

[shekohex]

Hey all I made a tool to help with that here https://github.com/shekohex/wadump