Does it still work?

[marcinguy]

Hi,

Looking for an update from the Author or creditable answers.

Whatsapp Web Client changed JS several times since I looked in to it.

Getting Pub, Priv key is quite hard, but possible. It seems it changes (QR code) and the Priv, Pub key every ca. 10 secs.

I am pretty sure I managed to get the right key (Priv and Pub) as well as secret (Ref Object)

Than I paste base64 encoded message I sent to one of my contacts (websocket -> to server endpoint /ws). It has a format of:

ID,<binary>

In the parser.py
This goes through:

BurpExtension-WhatsApp-Decryption-CheckPoint/helper/parser.py

Line 91 in 90247f2

if check_hmac != self.secret[32:64]:

However, got a mismatch here:

BurpExtension-WhatsApp-Decryption-CheckPoint/helper/parser.py

Line 109 in 90247f2

raise ValueError("Error hmac mismatch")

As I said I am quite confident I had 32 ints each good Priv and Pub key and secret (Ref Obj).

Is this still working?

Thanks,

[marcinguy]

I got Priv and Pub key from JS. As I said they seem to be correct since the assert goes through:

BurpExtension-WhatsApp-Decryption-CheckPoint/helper/parser.py

Line 80 in 90247f2

self.public_key = self.private_key.get_public()

BurpExtension-WhatsApp-Decryption-CheckPoint/helper/parser.py

Line 82 in 90247f2

assert (self.public_key.serialize() == "".join([chr(x) for x in pub_key_list]))

Hmac on secret string is also valid

BurpExtension-WhatsApp-Decryption-CheckPoint/helper/parser.py

Line 91 in 90247f2

if check_hmac != self.secret[32:64]:

So aes_key and mac_key should be correct.

BurpExtension-WhatsApp-Decryption-CheckPoint/helper/parser.py

Line 96 in 90247f2

self.aes_key = keys_decrypted[:32]

But the encrypted message hmac fails:

BurpExtension-WhatsApp-Decryption-CheckPoint/helper/parser.py

Line 109 in 90247f2

raise ValueError("Error hmac mismatch")

So does the decryption ....

I verified WhatsApp Web Client and "core" JS parts seem to be the same and matching your Python code.

As asked in original issue, anybody has ideas what is happening here?

Thanks,