Whtasapp 2.8.22, build 37716, NEW password logging method !?

[FAlbanni]

Installing Whatsapp 2.8.22 build 37716, changes the password authentication method... the reverse imei to md5, or the double mac address, doesn't work anymore

Any reverse engineer out there ? We need to know the new algorithm to generate the right password

this was the previous method http://i47.tinypic.com/2z4gvmp.png hope it helps

[manufuentescr]

but only changed the method in iPhone, or also in android??

[FAlbanni]

it was changed for all devices

[varundave]

It is not changed. I still get an "ok" response for the md5 (reverse imei)

https://r.whatsapp.net/v1/exist.php?cc=".$countrycode."&in=".$phonenumber."&udid=md5(reverse imei)

The Login method works fine for Android...Not sure about other devices.

[FAlbanni]

The password method changes when you update to the lastest whatsapp, you can try it, download the very last whatsapp build, then try to log in again and you will get

response status="fail" result="incorrect"

[varundave]

I have 2.8.7326 updated a couple of days ago(just chekced and there are no updates available right now)....i still get "ok" response...

[varundave]

Also, If you might be doing wrong, the "in" parameter should have the phone number without the country code...

[FAlbanni]

I am on Nokia symbian maybe for android the method of reverse IMEI to md5 still works, but not for nokia, i know because the Whatsapi worked flawlessly before and after upgrading the password method changed, i am trying to reverse engineer whatapp.exe with IDA Pro, but my skills are limited, maybe i will try to arp poison my cellphone and sniff every packet to get a clue

[scotchies]

I can confirm what MartinGraws says. After the WA upgrade on my Symbian phone to Version 2.8.22 the WhatApp Api doesnt work any more... The response status is "fail" result="incorrect". Before the upgrade it worked fine...

[manufuentescr]

I confirm that Android still works, I tested 29/11/2012 at 8:16 today, register the account from the official app version 2.8.7326

[davidcsi]

hola manufuentescr,

Yo estoy usando Blackberry. Me explicas por favor cómo lo has hecho?

Yo utilizando el IMEI con y sin los puntos:

https://r.whatsapp.net/v1/exist.php?cc=34&in=MY_NUMBER_NO_CC&udid=md5(strrev($imei))

y no va

gracias

[manufuentescr]

No se si para BlackBerry ya hicieron la actualizacion yo estuve averiguando y parece que la actualizacion del metodo del password lo implementaron en iphone pero para android todavia no la han implementado(claro es cuestion de tiempo) yo registré mi numero con el app oficial desde android puedes hacerlo con un emulador de android como BlueStacks

[davidcsi]

Sí, el de iphone no va ni pa´trás... md5(mac+mac)... (tengo iphone y bb) Pero me dices cómo usaste el imei? con o sin puntos?

gracias!

[manufuentescr]

marcas en el telefono *#06# y lo utilizas asi como te lo despliega, para utilizarlo en la url tienes que darle vuelta y hacerle un md5 ejemplo si tu ime es 1234 tienes que darle vuelta a 4321 y a eso hacerle un md5 este script de php te puede ayudar a hacer eso:

<?php

echo md5(strrev("tu_imei"));

?>

Espero que te sirva!!!

[davidcsi]

Me parece que sólo funciona con android, voy a probarlo ahora... con bb desde luego no va...

gracias!

[davidcsi]

Efectivamente va bien (al menos el "exists") sólo con Android... pero de momento no he logrado mandar un mensaje... estoy con eso ahora.

Guys, it seems it only works with Android!

Gracias!

[YoSev]

keep it english.. so the hashing method changed, and someone has to find the new method.. lets be pateient..

[FAlbanni]

Yes password hashing method changed with the last whatsapp update

What we have to do is live reverse engineer with IDA Pro or sniff every packet and decode it, i am trying the second way, sniffing all the packets ... hope to have some luck

[alsebawe9999]

I'm trying to understand the idea of the program I ask you to help me How do I download the interface and how to access it please help me, I do not mastered English well

[fheft]

Today the new version for Android was released and WhatsAPI auth stopped working for users who installed the new WhatsApp version as well…

[jonnywilliamson]

I hate to say it but finally! Now that everyone is in the same boat, there'll be more effort to work out how to capture the new password for our devices to allow us to use this script again!

[FAlbanni]

I tried to reverse the android "java" code but is obfuscated as fuck Whatsapp uses a class called q8 (obfuscated name) to create the password hashing algorithm

Here is the java code decompiled with JD-GUI, as you can see is HEAVILY obfuscated q8 = http://pastebin.com/0cyH04sn

Here is the smali code q8 = http://pastebin.com/8eYH6Zdd

This is NOT an easy job, well at least for me, however i will keep trying

[Sputuks3]

If you want to reverse the android version, I suggest using DJ and Androchef in addition to JD-GUI. It'll be much easier to get a hang on the flow control. Might have to rewrite certain methods though. PM me for the other 2 tools.

[alanwo]

we don't have to care what q8 does, as long as we can contruct q8 function in php or c# and apply q8 on mac/imei, authentication pass will. any idea to convert decompiled q8 to a c# function?