Skip to content

Commit 4a2228f

Browse files
drwetterdrwetter
committed
Updating Android handshakes
- Android 13 and 14 were added. They are the same, see ja3 + ja4 value - as it turned out Android 11 and 12 have also the same ja3 + ja4 values (retrieved from old pcap files) - so both will be labeled 11/12 an 13/14 - old pcaps from Android 11/12 showed no ALPN --> corrected
1 parent fdb2da8 commit 4a2228f

File tree

2 files changed

+73
-13
lines changed

2 files changed

+73
-13
lines changed

‎etc/client-simulation.txt‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -262,8 +262,8 @@
262262
requiresSha2+=(false)
263263
current+=(true)
264264

265-
names+=("Android 11 (native)")
266-
short+=("android_11")
265+
names+=("Android 11/12 (native)")
266+
short+=("android_11_12")
267267
ch_ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA")
268268
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
269269
ch_sni+=("$SNI")
@@ -273,37 +273,41 @@
273273
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
274274
lowest_protocol+=("0x0301")
275275
highest_protocol+=("0x0304")
276-
alpn+=("h2,http/1.1")
276+
alpn+=("http/1.1")
277277
service+=("ANY")
278278
minDhBits+=(-1)
279279
maxDhBits+=(-1)
280280
minRsaBits+=(-1)
281281
maxRsaBits+=(-1)
282282
minEcdsaBits+=(-1)
283-
curves+=("X25519:secp256r1:secp384r1")
283+
curves+=("x25519:secp256r1:secp384r1")
284284
requiresSha2+=(false)
285+
ja3+=("9b02ebd3a43b62d825e1ac605b621dc8")
286+
ja4+=("t13d1713h1_5b57614c22b0_eca864cca44a")
285287
current+=(true)
286288

287-
names+=("Android 12 (native)")
288-
short+=("android_12")
289+
names+=("Android 13/14 (native)")
290+
short+=("android_13_14")
289291
ch_ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA")
290292
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
291293
ch_sni+=("$SNI")
292294
warning+=("")
293-
handshakebytes+=("1603010200010001fc0303ef9015ea56c63737ffffc0accb09384a436f080a39f77fe113356ae5bfd1254a20163dc9147addf7e7fdb45852fbfe8e3fb2b79ec6f725bfda838d429eba22e6670022130113021303c02bc02ccca9c02fc030cca8c009c00ac013c014009c009d002f00350100019100000010000e00000b662d64726f69642e6f726700170000ff01000100000a00080006001d00170018000b00020100002300000010000b000908687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201003300260024001d0020f209906d70ae4ba88ac3c89810eb7092be23e377f98d8c96696dec9296358c3e002d00020101002b0009080304030303020301001500ed000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
295+
handshakebytes+=("16030102330100022f0303564593a940b5d751d4cee7d4cd3ffbb68c310109b98a4a17e3ed6486d73dcee3202e82d4bbe870f4ad23988eee22f7b5c5036460e511edc31544211275bd9527960022130113021303c02bc02ccca9c02fc030cca8c009c00ac013c014009c009d002f0035010001c4000000180016000013706c61792e676f6f676c65617069732e636f6d00170000ff01000100000a00080006001d00170018000b00020100002300000010000b000908687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201003300260024001d00205551dfbfb939959b7aa673d638cd80e0ee8d202623f1a78f87741ff7bfa0c619002d00020101002b000504030403030029011c00f700f1025680712b38fc90496ec3b53ffa0ae9e00eafdaa742879902bc71a8956410ca53915661cbc5c3e60649f278b1268a6a3dfcd9be7269ae0eda3974dbad73f6368d430867a8e1d540aad8c0b9024adabb10adc58864062a0984fc03d62ad39b25d176f8500e93232446663fa256733f9b08efbce336afd2eaa090d8e20f7e53ec0a4135a83bdff4383cd1db1905377e9a5d81f41e045e6fd97d316b05f954102e6bcd3b110b0b2c2ccd1891d90057e9fe6795f4430942437ce9cad68c7a7d77c1a49eb29d33d7700c7274a552f1015dff3569a1492d746e59b372a1ecdbae650eba8771b931c648414d133f7e0e0633376d1b715cca002120dc30aa42c9d3367cce7f2bafd591d04b95e6b11081345ebd56d47b65bf89266c")
294296
protos+=("-no_ssl3 -no_ssl2")
295-
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
296-
lowest_protocol+=("0x0301")
297+
tlsvers+=("-tls1_3 -tls1_2")
298+
lowest_protocol+=("0x0303")
297299
highest_protocol+=("0x0304")
298-
alpn+=("h2,http/1.1")
300+
alpn+=("http/1.1")
299301
service+=("ANY")
300302
minDhBits+=(-1)
301303
maxDhBits+=(-1)
302304
minRsaBits+=(-1)
303305
maxRsaBits+=(-1)
304306
minEcdsaBits+=(-1)
305-
curves+=("X25519:secp256r1:secp384r1")
307+
curves+=("x25519:secp256r1:secp384r1")
306308
requiresSha2+=(false)
309+
ja3+=("c67e9dc27d283f1f89b4ebb4b4670c21")
310+
ja4+=("t13d1713h1_5b57614c22b0_352634941f3a")
307311
current+=(true)
308312

309313
names+=("Chrome 27 Win 7")

‎etc/client-simulation.wiresharked.txt‎

Lines changed: 58 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,8 @@
9393
requiresSha2+=(false)
9494
current+=(true)
9595

96+
# Android 11+12 seems to be te same
97+
9698
names+=("Android 11 (native)")
9799
short+=("android_11")
98100
ch_ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA")
@@ -104,7 +106,7 @@
104106
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
105107
lowest_protocol+=("0x0301")
106108
highest_protocol+=("0x0304")
107-
alpn+=("h2,http/1.1")
109+
alpn+=("http/1.1")
108110
service+=("ANY")
109111
minDhBits+=(-1)
110112
maxDhBits+=(-1)
@@ -113,6 +115,8 @@
113115
minEcdsaBits+=(-1)
114116
curves+=("X25519:secp256r1:secp384r1")
115117
requiresSha2+=(false)
118+
ja3+=("9b02ebd3a43b62d825e1ac605b621dc8")
119+
ja4+=("t13d1713h1_5b57614c22b0_eca864cca44a")
116120
current+=(true)
117121

118122
names+=("Android 12 (native)")
@@ -126,7 +130,7 @@
126130
tlsvers+=("-tls1_3 -tls1_2 -tls1_1 -tls1")
127131
lowest_protocol+=("0x0301")
128132
highest_protocol+=("0x0304")
129-
alpn+=("h2,http/1.1")
133+
alpn+=("http/1.1")
130134
service+=("ANY")
131135
minDhBits+=(-1)
132136
maxDhBits+=(-1)
@@ -135,6 +139,58 @@
135139
minEcdsaBits+=(-1)
136140
curves+=("X25519:secp256r1:secp384r1")
137141
requiresSha2+=(false)
142+
ja3+=("9b02ebd3a43b62d825e1ac605b621dc8")
143+
ja4+=("t13d1713h1_5b57614c22b0_eca864cca44a")
144+
current+=(true)
145+
146+
# Android 13+14 seems to be te same
147+
148+
names+=("Android 13 (native)")
149+
short+=("android_13")
150+
ch_ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA")
151+
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
152+
ch_sni+=("$SNI")
153+
warning+=("")
154+
handshakebytes+=("16030102330100022f0303564593a940b5d751d4cee7d4cd3ffbb68c310109b98a4a17e3ed6486d73dcee3202e82d4bbe870f4ad23988eee22f7b5c5036460e511edc31544211275bd9527960022130113021303c02bc02ccca9c02fc030cca8c009c00ac013c014009c009d002f0035010001c4000000180016000013706c61792e676f6f676c65617069732e636f6d00170000ff01000100000a00080006001d00170018000b00020100002300000010000b000908687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201003300260024001d00205551dfbfb939959b7aa673d638cd80e0ee8d202623f1a78f87741ff7bfa0c619002d00020101002b000504030403030029011c00f700f1025680712b38fc90496ec3b53ffa0ae9e00eafdaa742879902bc71a8956410ca53915661cbc5c3e60649f278b1268a6a3dfcd9be7269ae0eda3974dbad73f6368d430867a8e1d540aad8c0b9024adabb10adc58864062a0984fc03d62ad39b25d176f8500e93232446663fa256733f9b08efbce336afd2eaa090d8e20f7e53ec0a4135a83bdff4383cd1db1905377e9a5d81f41e045e6fd97d316b05f954102e6bcd3b110b0b2c2ccd1891d90057e9fe6795f4430942437ce9cad68c7a7d77c1a49eb29d33d7700c7274a552f1015dff3569a1492d746e59b372a1ecdbae650eba8771b931c648414d133f7e0e0633376d1b715cca002120dc30aa42c9d3367cce7f2bafd591d04b95e6b11081345ebd56d47b65bf89266c")
155+
protos+=("-no_ssl3 -no_ssl2")
156+
tlsvers+=("-tls1_3 -tls1_2")
157+
lowest_protocol+=("0x0303")
158+
highest_protocol+=("0x0304")
159+
alpn+=("http/1.1")
160+
service+=("ANY")
161+
minDhBits+=(-1)
162+
maxDhBits+=(-1)
163+
minRsaBits+=(-1)
164+
maxRsaBits+=(-1)
165+
minEcdsaBits+=(-1)
166+
curves+=("x25519:secp256r1:secp384r1")
167+
requiresSha2+=(false)
168+
ja3+=("c67e9dc27d283f1f89b4ebb4b4670c21")
169+
ja4+=("t13d1713h1_5b57614c22b0_352634941f3a")
170+
current+=(true)
171+
172+
names+=("Android 14 (native)")
173+
short+=("android_14")
174+
ch_ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA")
175+
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
176+
ch_sni+=("$SNI")
177+
warning+=("")
178+
handshakebytes+=("16030102330100022f0303564593a940b5d751d4cee7d4cd3ffbb68c310109b98a4a17e3ed6486d73dcee3202e82d4bbe870f4ad23988eee22f7b5c5036460e511edc31544211275bd9527960022130113021303c02bc02ccca9c02fc030cca8c009c00ac013c014009c009d002f0035010001c4000000180016000013706c61792e676f6f676c65617069732e636f6d00170000ff01000100000a00080006001d00170018000b00020100002300000010000b000908687474702f312e31000500050100000000000d00140012040308040401050308050501080606010201003300260024001d00205551dfbfb939959b7aa673d638cd80e0ee8d202623f1a78f87741ff7bfa0c619002d00020101002b000504030403030029011c00f700f1025680712b38fc90496ec3b53ffa0ae9e00eafdaa742879902bc71a8956410ca53915661cbc5c3e60649f278b1268a6a3dfcd9be7269ae0eda3974dbad73f6368d430867a8e1d540aad8c0b9024adabb10adc58864062a0984fc03d62ad39b25d176f8500e93232446663fa256733f9b08efbce336afd2eaa090d8e20f7e53ec0a4135a83bdff4383cd1db1905377e9a5d81f41e045e6fd97d316b05f954102e6bcd3b110b0b2c2ccd1891d90057e9fe6795f4430942437ce9cad68c7a7d77c1a49eb29d33d7700c7274a552f1015dff3569a1492d746e59b372a1ecdbae650eba8771b931c648414d133f7e0e0633376d1b715cca002120dc30aa42c9d3367cce7f2bafd591d04b95e6b11081345ebd56d47b65bf89266c")
179+
protos+=("-no_ssl3 -no_ssl2")
180+
tlsvers+=("-tls1_3 -tls1_2")
181+
lowest_protocol+=("0x0303")
182+
highest_protocol+=("0x0304")
183+
alpn+=("http/1.1")
184+
service+=("ANY")
185+
minDhBits+=(-1)
186+
maxDhBits+=(-1)
187+
minRsaBits+=(-1)
188+
maxRsaBits+=(-1)
189+
minEcdsaBits+=(-1)
190+
curves+=("x25519:secp256r1:secp384r1")
191+
requiresSha2+=(false)
192+
ja3+=("c67e9dc27d283f1f89b4ebb4b4670c21")
193+
ja4+=("t13d1713h1_5b57614c22b0_352634941f3a")
138194
current+=(true)
139195

140196
names+=("Edge 17 Win 10")

0 commit comments

Comments
 (0)