{ "added_at": "2026-10-19", "additional_evidence_urls": [ "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/backend/whatsapp.py", "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/backend/whatsapp_binary_reader.py", "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/doc/spec/def.proto", "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/doc/spec/protobuf-extractor/index.js", "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/package.json", "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/requirements.txt", "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/shell.nix", "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/Dockerfile", "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/LICENSE", "https://github.com/sigalor/whatsapp-web-reveng/issues/372", "https://engineering.fb.com/2021/07/14/security/whatsapp-multi-device/" ], "category": "reconstruction-cases", "description_en": "Documents and reimplements the WebSocket protocol WhatsApp Web used while browser sessions mirrored a paired phone: QR pairing, Curve25519/HKDF key setup, AES/HMAC-protected binary messages, the token-based node encoding and end-to-end media encryption. A Python backend, Node.js relay and browser front end decode a logged-in session’s messages into inspectable JSON, and the README lists independent reimplementations such as Baileys and go-whatsapp. This is an older protocol generation from before WhatsApp’s 2021 multi-device architecture, not a description of current WhatsApp Web.", "description_zh": "记录并重新实现 WhatsApp Web 在浏览器会话镜像已配对手机时期使用的 WebSocket 协议：二维码配对、Curve25519/HKDF 密钥建立、经 AES/HMAC 保护的二进制报文、基于字符串令牌表的节点编码，以及端到端媒体加密。Python 后端、Node.js 中继和浏览器前端把已登录会话的报文解码成可查看的 JSON，README 还列出了 Baileys、go-whatsapp 等独立再实现。这是 WhatsApp 2021 年多设备架构之前的旧一代协议，不能当作对当前 WhatsApp Web 的描述。", "entry_url": "https://awesomerea.org/resources/whatsapp-web-reveng-legacy-protocol-case/", "entry_url_zh": "https://awesomerea.org/zh/resources/whatsapp-web-reveng-legacy-protocol-case/", "evidence_url": "https://github.com/sigalor/whatsapp-web-reveng/blob/04caed2b23680d23a3f39cf2b017c064ff1e85ed/README.md", "group": "cases", "id": "whatsapp-web-reveng-legacy-protocol-case", "json_url": "https://awesomerea.org/resources/whatsapp-web-reveng-legacy-protocol-case/record.json", "kind": "case-study", "markdown_url": "https://awesomerea.org/resources/whatsapp-web-reveng-legacy-protocol-case/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/whatsapp-web-reveng-legacy-protocol-case/index.md", "name": "whatsapp-web-reveng: documenting the legacy WhatsApp Web protocol", "name_zh": "whatsapp-web-reveng：记录旧版 WhatsApp Web 协议", "record_type": "resource", "relationship": "independent-reconstruction", "requirement_facets": [ "scope", "prerequisites", "prerequisites", "testing", "license" ], "requirements": [ "Reviewed at the 2024-04-22 master head, a README-only change; the backend and Node relay last changed in August 2021, the protobuf schema in March 2020, and there are no releases or tags. The README’s pairing flow has the phone supply session details such as its battery level, the phone-mirroring companion model that WhatsApp’s July 2021 engineering post says multi-device replaces. A 2022 issue reports the server answering a QR scan with an upgrade_md_prod command. As checked on 2026-10-20, the 2024-04-22 head is still GitHub’s last recorded push, the repository is not archived and the README does not mark it as maintained, superseded or archived.", "Use needs the user’s own WhatsApp account and phone to scan the pairing code, and the backend connects to WhatsApp’s servers. The protobuf definitions come from a helper script that parses the public WhatsApp Web JavaScript bundle. The README’s task list still names growing binary-decoding errors, writing binary messages and a less technical interface as open work.", "Bare-metal setup needs Node.js 8+ and Python 2.7 with websocket-client, simple-websocket-server, curve25519-donna, pycrypto (pycryptodome in requirements.txt), pyqrcode and protobuf; Windows also needs Visual C++ for Python 9.0 and a supplied header. A shell.nix (Python 2.7, Node.js 13) and a Dockerfile are provided, and npm start runs the backend, Node API and front end together. The README says the Docker version is not stable enough for production.", "There is no test suite: the package.json test script only starts the components. The documented correctness checks are HMAC validation of the server’s key data and of each binary message, and an in-browser JavaScript demo prints decrypted messages after a QR scan.", "MIT (LICENSE, package.json). The README states the project is unaffiliated with and not endorsed by WhatsApp, that use is at the user’s own risk, and adds a cryptography export notice; WhatsApp’s services and terms apply separately." ], "requirements_zh": [ "审阅对象为 2024-04-22 的 master 最新提交，该提交只修改了 README；后端和 Node 中继最后修改于 2021 年 8 月，protobuf 结构定义最后修改于 2020 年 3 月，没有发布版本或标签。README 描述的配对流程由手机提供电量等会话信息，也就是 WhatsApp 2021 年 7 月工程博客所说被多设备架构取代的手机镜像式配套设备模式。2022 年的一个 issue 报告扫描二维码后服务器返回 upgrade_md_prod 命令。据 2026-10-20 核查，2024-04-22 的最新提交仍是 GitHub 记录的最后一次推送，仓库未归档，README 未标注其仍在维护、已被取代或已归档。", "使用时需要用户自己的 WhatsApp 账号和手机来扫描配对码，后端会连接 WhatsApp 服务器。protobuf 定义由一个辅助脚本解析公开的 WhatsApp Web JavaScript 包生成。README 的任务清单仍把二进制解码错误增多、二进制报文写入以及更易用的界面列为待完成工作。", "直接安装需要 Node.js 8+ 和 Python 2.7，以及 websocket-client、simple-websocket-server、curve25519-donna、pycrypto（requirements.txt 中为 pycryptodome）、pyqrcode 和 protobuf；Windows 还需要 Visual C++ for Python 9.0 和仓库提供的头文件。项目提供 shell.nix（Python 2.7、Node.js 13）和 Dockerfile，npm start 会同时启动后端、Node API 和前端。README 说明 Docker 版本还不够稳定，不适合生产部署。", "项目没有测试套件：package.json 的 test 脚本只是启动各组件。文档给出的正确性检查是对服务器密钥数据和每条二进制报文做 HMAC 校验，另有浏览器内 JavaScript 演示在扫描二维码后输出解密后的报文。", "采用 MIT 许可（LICENSE、package.json）。README 声明项目与 WhatsApp 无关、未获其认可，使用风险自负，并附有加密软件出口声明；WhatsApp 的服务和条款另行适用。" ], "targets": [ "protocol", "website" ], "url": "https://github.com/sigalor/whatsapp-web-reveng", "verification": "source-reviewed", "verified_at": "2026-10-19" }