0

我正在对 WhatsApp 网站进行逆向工程。我在 python 中创建了一个自定义客户端，以使用 websocket 连接到 WhatsApp，生成 QR 码，并将登录凭据保存到文件中。当我尝试使用它时，我意识到 WhatsApp 的端到端加密是真实的。我使用这个python 模块生成了 2 个信号协议密钥：pre_key_pair = curve.KeyPair.generate()，我使用生成的二维码将公钥发送到手机上的 WhatsApp。

#!/usr/bin/python3
import websockets as WSocket
import asyncio, json, requests
import base64, random
import qrcode
from io import BytesIO
from tkinter import *
import signal_protocol

wsurl = "wss://web.whatsapp.com/ws"

async def whatsapp(uri):
    async with WSocket.connect(uri, extra_headers={"Origin": "https://web.whatsapp.com"}) as ws:
        keys = signal_protocol.curve.KeyPair.generate()

        pubkey = base64.b64encode(keys.public_key().serialize()[1:]).decode()
                                                            #   ^ I removed the first byte, bc it is every time \x05
                                                            #   (it is the key type)
        browserid = "8TDLL9cktZvZvMiicMrubw=="
        
        await ws.send('1633259071.--1,["admin","init",[2,2138,13],["Python","-","x86_64"],"{}",true]'.format(browserid))
        data = await ws.recv()
        print(data)
        lst = data.split(',')
        idk = lst[0]
        del lst[0]
        parsed = json.loads(','.join(lst))
        auth = parsed["ref"]
        
        qrtext = '{},{},{}'.format(auth, pubkey, browserid)
        print(qrtext)
        #await ws.send('1633276651.--1,["admin","Conn","reref"]') #retry
        
        code = qrcode.make(qrtext) #.show()
        root = Tk()
        w, h = root.winfo_screenwidth(), root.winfo_screenheight()
        m = min(w, h) // 2
        root.resizable(False, False)
        root.geometry(f'{m}x{m}+{w//2-m//2}+{h//2-m//2}')
        buffer = BytesIO()
        code.resize((m, m)).save(buffer, format="png")
        buffer.seek(0)
        img = PhotoImage(data=buffer.read())
        lable = Button(root, image=img).place(x=0, y=0)
        root.attributes('-topmost', True)
        root.overrideredirect(True)
        root.update()
        
        res = await ws.recv()
        print(res)
        with open("token", "wt") as o:
            o.write(res)
            o.write('\n')
            o.write(browserid)
            o.write(',')
            o.write(base64.b64encode(keys.private_key().serialize()).decode())
            o.close()
        root.destroy()

if __name__ == '__main__':
    asyncio.run(whatsapp(wsurl))

我的问题是，如何解密将我发回 WhatsApp 的密文。这是我的客户：

#!/usr/bin/python3
import websockets as WSocket
import asyncio, json, requests
import base64, random, hmac, hashlib
import signal_protocol

wsurl = "wss://web.whatsapp.com/ws"

def parse(token):
    lines = token.strip().split('\n')
    chunks = lines[0].strip().split(',')
    del chunks[0]
    jdata = json.loads(','.join(chunks))
    print(jdata[0])
    plus = lines[1].strip().split(',')
    jdata[1]["browserID"] = plus[0]
    jdata[1]["key"] = signal_protocol.curve.PrivateKey.deserialize(base64.b64decode(plus[1]))
    return jdata[1]

def processdata(data):
    print(data)

async def whatsapp(uri, token):
    async with WSocket.connect(uri, extra_headers={"Origin": "https://web.whatsapp.com"}) as ws:
        print("Logging in...")
        await ws.send('1633521509.--0,["admin","init",[2,2138,13],["Python","-","x86_64"],"{}",true]'.format(token["browserID"]))
        print(await ws.recv())
        await ws.send('1633521518.--1,["admin","login","{}","{}","{}","takeover"]'.format(token["clientToken"],
                                                                                          token["serverToken"],
                                                                                          token["browserID"])
                      )
        data = await ws.recv()
        print(data)
        chunks = data.split(',')
        del chunks[0]
        jdata = json.loads(','.join(chunks))
        if type(jdata) == list and jdata[0] == "Cmd" and jdata[1]["type"] == "challenge":
            print("Solve challange...")
            await ws.send('1633521518.--1,["admin","login","{}","{}","{}","takeover"]'.format(token["clientToken"],
                                                                                              token["serverToken"],
                                                                                              token["browserID"])
                          )
            #print(jdata)
            resolve = base64.b64encode(hmac.new(token["key"].serialize(), base64.b64decode(jdata[1]["challenge"]), hashlib.sha256).digest())
            ready = '1633521544.--2,["admin","challenge","{}","{}","{}"]'.format(resolve.decode(), token["serverToken"], token["browserID"])
            print(ready)
            await ws.send(ready)
        elif type(jdata) == list and jdata[0] == "Conn" or jdata["status"] == 200:
            print("OK")
        else:
            raise ValueError("Invalid token")
            
        processdata(data)
        
        # 1633415961.--2,["admin","challenge","nJOSG/8l6ee33hVSyqhWwGTlEnGDxiSXwGGK9+zAB+w=","1@LV3dAbOqdpPZPnitEw1xI67X7fBTFHUnINQ8ZUdzpmUPWm0pKkJIN/sgxRSog1jqIt+f3AfePp5k1A==","8TDLL9cktZvZvMiicMrubw=="]
        # 1633415954.--1,["admin","login","u5a7azVDJzsr7Vpmpkga4sf5LbSpRW7jqdx6/j9GBGs=","1@LV3dAbOqdpPZPnitEw1xI67X7fBTFHUnINQ8ZUdzpmUPWm0pKkJIN/sgxRSog1jqIt+f3AfePp5k1A==","8TDLL9cktZvZvMiicMrubw==","takeover"]
        while True:
            data = await ws.recv()
            processdata(data)

if __name__ == '__main__':
    with open("token", "rt") as o:
        token = o.read()
        o.close()
    asyncio.run(whatsapp(wsurl, parse(token)))
4

0 回答 0