package whatsapp import ( "crypto/hmac" "crypto/rand" "crypto/sha256" "encoding/base64" "encoding/json" "fmt" "strconv" "strings" "sync/atomic" "time" "github.com/Rhymen/go-whatsapp/crypto/cbc" "github.com/Rhymen/go-whatsapp/crypto/curve25519" "github.com/Rhymen/go-whatsapp/crypto/hkdf" ) //represents the WhatsAppWeb client version var waVersion = []int{0, 3, 3324} /* Session contains session individual information. To be able to resume the connection without scanning the qr code every time you should save the Session returned by Login and use RestoreWithSession the next time you want to login. Every successful created connection returns a new Session. The Session(ClientToken, ServerToken) is altered after every re-login and should be saved every time. */ type Session struct { ClientId string ClientToken string ServerToken string EncKey []byte MacKey []byte Wid string } type Info struct { Battery int Platform string Connected bool Pushname string Wid string Lc string Phone *PhoneInfo Plugged bool Tos int Lg string Is24h bool } type PhoneInfo struct { Mcc string Mnc string OsVersion string DeviceManufacturer string DeviceModel string OsBuildNumber string WaVersion string } func newInfoFromReq(info map[string]interface{}) *Info { phoneInfo := info["phone"].(map[string]interface{}) ret := &Info{ Battery: int(info["battery"].(float64)), Platform: info["platform"].(string), Connected: info["connected"].(bool), Pushname: info["pushname"].(string), Wid: info["wid"].(string), Lc: info["lc"].(string), Phone: &PhoneInfo{ phoneInfo["mcc"].(string), phoneInfo["mnc"].(string), phoneInfo["os_version"].(string), phoneInfo["device_manufacturer"].(string), phoneInfo["device_model"].(string), phoneInfo["os_build_number"].(string), phoneInfo["wa_version"].(string), }, Plugged: info["plugged"].(bool), Lg: info["lg"].(string), Tos: int(info["tos"].(float64)), } if is24h, ok := info["is24h"]; ok { ret.Is24h = is24h.(bool) } return ret } /* CheckCurrentServerVersion is based on the login method logic in order to establish the websocket connection and get the current version from the server with the `admin init` command. This can be very useful for automations in which you need to quickly perceive new versions (mostly patches) and update your application so it suddenly stops working. */ func CheckCurrentServerVersion() ([]int, error) { wac, err := NewConn(5 * time.Second) if err != nil { return nil, fmt.Errorf("fail to create connection") } clientId := make([]byte, 16) if _, err = rand.Read(clientId); err != nil { return nil, fmt.Errorf("error creating random ClientId: %v", err) } b64ClientId := base64.StdEncoding.EncodeToString(clientId) login := []interface{}{"admin", "init", waVersion, []string{wac.longClientName, wac.shortClientName}, b64ClientId, true} loginChan, err := wac.writeJson(login) if err != nil { return nil, fmt.Errorf("error writing login", err) } // Retrieve an answer from the websocket var r string select { case r = <-loginChan: case <-time.After(wac.msgTimeout): return nil, fmt.Errorf("login connection timed out") } var resp map[string]interface{} if err = json.Unmarshal([]byte(r), &resp); err != nil { return nil, fmt.Errorf("error decoding login", err) } // Take the curr property as X.Y.Z and split it into as int slice curr := resp["curr"].(string) currArray := strings.Split(curr, ".") version := make([]int, len(currArray)) for i := range version { version[i], _ = strconv.Atoi(currArray[i]) } return version, nil } /* SetClientName sets the long and short client names that are sent to WhatsApp when logging in and displayed in the WhatsApp Web device list. As the values are only sent when logging in, changing them after logging in is not possible. */ func (wac *Conn) SetClientName(long, short string) error { if wac.session != nil && (wac.session.EncKey != nil || wac.session.MacKey != nil) { return fmt.Errorf("cannot change client name after logging in") } wac.longClientName, wac.shortClientName = long, short return nil } /* SetClientVersion sets WhatsApp client version Default value is 0.3.3324 */ func (wac *Conn) SetClientVersion(major int, minor int, patch int) { waVersion = []int{major, minor, patch} } // GetClientVersion returns WhatsApp client version func (wac *Conn) GetClientVersion() []int { return waVersion } /* Login is the function that creates a new whatsapp session and logs you in. If you do not want to scan the qr code every time, you should save the returned session and use RestoreWithSession the next time. Login takes a writable channel as an parameter. This channel is used to push the data represented by the qr code back to the user. The received data should be displayed as an qr code in a way you prefer. To print a qr code to console you can use: github.com/Baozisoftware/qrcode-terminal-go Example login procedure: wac, err := whatsapp.NewConn(5 * time.Second) if err != nil { panic(err) } qr := make(chan string) go func() { terminal := qrcodeTerminal.New() terminal.Get(<-qr).Print() }() session, err := wac.Login(qr) if err != nil { fmt.Fprintf(os.Stderr, "error during login: %v\n", err) } fmt.Printf("login successful, session: %v\n", session) */ func (wac *Conn) Login(qrChan chan<- string) (Session, error) { session := Session{} //Makes sure that only a single Login or Restore can happen at the same time if !atomic.CompareAndSwapUint32(&wac.sessionLock, 0, 1) { return session, ErrLoginInProgress } defer atomic.StoreUint32(&wac.sessionLock, 0) if wac.loggedIn { return session, ErrAlreadyLoggedIn } if err := wac.connect(); err != nil && err != ErrAlreadyConnected { return session, err } //logged in?!? if wac.session != nil && (wac.session.EncKey != nil || wac.session.MacKey != nil) { return session, fmt.Errorf("already logged in") } clientId := make([]byte, 16) _, err := rand.Read(clientId) if err != nil { return session, fmt.Errorf("error creating random ClientId: %v", err) } session.ClientId = base64.StdEncoding.EncodeToString(clientId) login := []interface{}{"admin", "init", waVersion, []string{wac.longClientName, wac.shortClientName}, session.ClientId, true} loginChan, err := wac.writeJson(login) if err != nil { return session, fmt.Errorf("error writing login: %v\n", err) } var r string select { case r = <-loginChan: case <-time.After(wac.msgTimeout): return session, fmt.Errorf("login connection timed out") } var resp map[string]interface{} if err = json.Unmarshal([]byte(r), &resp); err != nil { return session, fmt.Errorf("error decoding login resp: %v\n", err) } ref := resp["ref"].(string) priv, pub, err := curve25519.GenerateKey() if err != nil { return session, fmt.Errorf("error generating keys: %v\n", err) } //listener for Login response s1 := make(chan string, 1) wac.listener.Lock() wac.listener.m["s1"] = s1 wac.listener.Unlock() qrChan <- fmt.Sprintf("%v,%v,%v", ref, base64.StdEncoding.EncodeToString(pub[:]), session.ClientId) var resp2 []interface{} select { case r1 := <-s1: wac.loginSessionLock.Lock() defer wac.loginSessionLock.Unlock() if err := json.Unmarshal([]byte(r1), &resp2); err != nil { return session, fmt.Errorf("error decoding qr code resp: %v", err) } case <-time.After(time.Duration(resp["ttl"].(float64)) * time.Millisecond): return session, fmt.Errorf("qr code scan timed out") } info := resp2[1].(map[string]interface{}) wac.Info = newInfoFromReq(info) session.ClientToken = info["clientToken"].(string) session.ServerToken = info["serverToken"].(string) session.Wid = info["wid"].(string) s := info["secret"].(string) decodedSecret, err := base64.StdEncoding.DecodeString(s) if err != nil { return session, fmt.Errorf("error decoding secret: %v", err) } var pubKey [32]byte copy(pubKey[:], decodedSecret[:32]) sharedSecret := curve25519.GenerateSharedSecret(*priv, pubKey) hash := sha256.New nullKey := make([]byte, 32) h := hmac.New(hash, nullKey) h.Write(sharedSecret) sharedSecretExtended, err := hkdf.Expand(h.Sum(nil), 80, "") if err != nil { return session, fmt.Errorf("hkdf error: %v", err) } //login validation checkSecret := make([]byte, 112) copy(checkSecret[:32], decodedSecret[:32]) copy(checkSecret[32:], decodedSecret[64:]) h2 := hmac.New(hash, sharedSecretExtended[32:64]) h2.Write(checkSecret) if !hmac.Equal(h2.Sum(nil), decodedSecret[32:64]) { return session, fmt.Errorf("abort login") } keysEncrypted := make([]byte, 96) copy(keysEncrypted[:16], sharedSecretExtended[64:]) copy(keysEncrypted[16:], decodedSecret[64:]) keyDecrypted, err := cbc.Decrypt(sharedSecretExtended[:32], nil, keysEncrypted) if err != nil { return session, fmt.Errorf("error decryptAes: %v", err) } session.EncKey = keyDecrypted[:32] session.MacKey = keyDecrypted[32:64] wac.session = &session wac.loggedIn = true return session, nil } //TODO: GoDoc /* Basically the old RestoreSession functionality */ func (wac *Conn) RestoreWithSession(session Session) (_ Session, err error) { if wac.loggedIn { return Session{}, ErrAlreadyLoggedIn } old := wac.session defer func() { if err != nil { wac.session = old } }() wac.session = &session if err = wac.Restore(); err != nil { wac.session = nil return Session{}, err } return *wac.session, nil } /*//TODO: GoDoc RestoreWithSession is the function that restores a given session. It will try to reestablish the connection to the WhatsAppWeb servers with the provided session. If it succeeds it will return a new session. This new session has to be saved because the Client and Server-Token will change after every login. Logging in with old tokens is possible, but not suggested. If so, a challenge has to be resolved which is just another possible point of failure. */ func (wac *Conn) Restore() error { //Makes sure that only a single Login or Restore can happen at the same time if !atomic.CompareAndSwapUint32(&wac.sessionLock, 0, 1) { return ErrLoginInProgress } defer atomic.StoreUint32(&wac.sessionLock, 0) if wac.session == nil { return ErrInvalidSession } if err := wac.connect(); err != nil && err != ErrAlreadyConnected { return err } if wac.loggedIn { return ErrAlreadyLoggedIn } //listener for Conn or challenge; s1 is not allowed to drop s1 := make(chan string, 1) wac.listener.Lock() wac.listener.m["s1"] = s1 wac.listener.Unlock() //admin init init := []interface{}{"admin", "init", waVersion, []string{wac.longClientName, wac.shortClientName}, wac.session.ClientId, true} initChan, err := wac.writeJson(init) if err != nil { return fmt.Errorf("error writing admin init: %v\n", err) } //admin login with takeover login := []interface{}{"admin", "login", wac.session.ClientToken, wac.session.ServerToken, wac.session.ClientId, "takeover"} loginChan, err := wac.writeJson(login) if err != nil { return fmt.Errorf("error writing admin login: %v\n", err) } select { case r := <-initChan: var resp map[string]interface{} if err = json.Unmarshal([]byte(r), &resp); err != nil { return fmt.Errorf("error decoding login connResp: %v\n", err) } if int(resp["status"].(float64)) != 200 { return fmt.Errorf("init responded with %d", resp["status"]) } case <-time.After(wac.msgTimeout): return fmt.Errorf("restore session init timed out") } //wait for s1 var connResp []interface{} select { case r1 := <-s1: if err := json.Unmarshal([]byte(r1), &connResp); err != nil { return fmt.Errorf("error decoding s1 message: %v\n", err) } case <-time.After(wac.msgTimeout): //check for an error message select { case r := <-loginChan: var resp map[string]interface{} if err = json.Unmarshal([]byte(r), &resp); err != nil { return fmt.Errorf("error decoding login connResp: %v\n", err) } if int(resp["status"].(float64)) != 200 { return fmt.Errorf("admin login responded with %d", int(resp["status"].(float64))) } default: // not even an error message – assume timeout return fmt.Errorf("restore session connection timed out") } } //check if challenge is present if len(connResp) == 2 && connResp[0] == "Cmd" && connResp[1].(map[string]interface{})["type"] == "challenge" { s2 := make(chan string, 1) wac.listener.Lock() wac.listener.m["s2"] = s2 wac.listener.Unlock() if err := wac.resolveChallenge(connResp[1].(map[string]interface{})["challenge"].(string)); err != nil { return fmt.Errorf("error resolving challenge: %v\n", err) } select { case r := <-s2: if err := json.Unmarshal([]byte(r), &connResp); err != nil { return fmt.Errorf("error decoding s2 message: %v\n", err) } case <-time.After(wac.msgTimeout): return fmt.Errorf("restore session challenge timed out") } } //check for login 200 --> login success select { case r := <-loginChan: var resp map[string]interface{} if err = json.Unmarshal([]byte(r), &resp); err != nil { return fmt.Errorf("error decoding login connResp: %v\n", err) } if int(resp["status"].(float64)) != 200 { return fmt.Errorf("admin login responded with %d", resp["status"]) } case <-time.After(wac.msgTimeout): return fmt.Errorf("restore session login timed out") } info := connResp[1].(map[string]interface{}) wac.Info = newInfoFromReq(info) //set new tokens wac.session.ClientToken = info["clientToken"].(string) wac.session.ServerToken = info["serverToken"].(string) wac.session.Wid = info["wid"].(string) wac.loggedIn = true return nil } func (wac *Conn) resolveChallenge(challenge string) error { decoded, err := base64.StdEncoding.DecodeString(challenge) if err != nil { return err } h2 := hmac.New(sha256.New, wac.session.MacKey) h2.Write([]byte(decoded)) ch := []interface{}{"admin", "challenge", base64.StdEncoding.EncodeToString(h2.Sum(nil)), wac.session.ServerToken, wac.session.ClientId} challengeChan, err := wac.writeJson(ch) if err != nil { return fmt.Errorf("error writing challenge: %v\n", err) } select { case r := <-challengeChan: var resp map[string]interface{} if err := json.Unmarshal([]byte(r), &resp); err != nil { return fmt.Errorf("error decoding login resp: %v\n", err) } if int(resp["status"].(float64)) != 200 { return fmt.Errorf("challenge responded with %d\n", resp["status"]) } case <-time.After(wac.msgTimeout): return fmt.Errorf("connection timed out") } return nil } /* Logout is the function to logout from a WhatsApp session. Logging out means invalidating the current session. The session can not be resumed and will disappear on your phone in the WhatsAppWeb client list. */ func (wac *Conn) Logout() error { login := []interface{}{"admin", "Conn", "disconnect"} _, err := wac.writeJson(login) if err != nil { return fmt.Errorf("error writing logout: %v\n", err) } return nil }