search

B16f00t / whapa

WhatsApp Parser Toolset v1.59
1.1k stars 259 forks source link

can you update the new crypt 14 offset #113

Closed unknowen700 closed 3 years ago

unknowen700 commented 3 years ago

can you update the new crypt 14 offset whatsapp new crypt 14 db has been changed again ?

augustoraphael commented 3 years ago

As mentioned in the previous isssue (link below), I think it has changed again. I got success descrypting my database just after change my whacipher.py file in lines 79 and 80 to the following:

data = db_data[191:] iv = db_data[67:83]

https://github.com/B16f00t/whapa/issues/96#issuecomment-850997115

The above suggestion must be considered in the solution.

unknowen700 commented 3 years ago

how did you know the change i mean how can i get new offset if WhatsApp change it agien

unknowen700 commented 3 years ago

th you it work but how can i know the change if any update happen

augustoraphael commented 3 years ago

Actualy, I don't know about that as well. I only followed the instructions of @ElDavoo in the previous post. Maybe he can help us about your question.

ElDavoo commented 3 years ago

I made a small bruteforcer, changing a python decryptor, that tried out all possible values. Gave it some hours and called it a day. There are probably better ways

B16f00t commented 3 years ago

I'm still not sure what the correct values are and if they change based on something, if anyone has the latest good values I'll modify them in the script.

selvania commented 3 years ago

I can confirm that the values seem to be no longer valid. Also, we were forced to run the app on windows, it seems mac's don't accept the crypt14 filetype. I looked through the code but couldn't find the cause....

leosol commented 3 years ago

Just worked for me with version 2.21.12.21 (tested with w4b and regular whatsapp). I think that it would be very nice to have this in trunk: 

data = db_data[191:]
iv = db_data[67:83]
B16f00t commented 3 years ago

Someone try the new values? @ElDavoo could you share your script with the community to get the correct Data and IV?

ElDavoo commented 3 years ago

I deleted it. Lmao

The new values I wrote should work.