Case study
Inside WhatsApp Desktop’s session setup
How does a closed-source desktop application initialise an end-to-end encrypted session, and what does that process reveal to an observer? These recordings trace the cryptographic logic of WhatsApp Desktop on macOS with the LLDB debugger, verifying communication states and the triggers that start a session.
Recording 01
Technical flow analysis & debugging logic
A step-by-step methodology for using LLDB to observe the execution flow of cryptographic functions, focused on the triggers that fire during UI interactions — starting a new chat with a contact, or creating a group.
- Attach to the WhatsApp process and set a breakpoint on
session_builder_process_pre_key_bundle. - Identify the memory addresses that signal no existing conversation with a recipient.
- Take a backtrace to map the call stack of the Signal Protocol implementation.
Recording 02
End-to-end lifecycle & security analysis
Moving beyond logical tracing to a security-centric audit of the E2E session lifecycle: the boundaries around account-level events, and how communication states are managed across device transitions.
- The full lifecycle, from registration and account setup through to conversation deletion.
- The security implications of attacker re-registration and linking the desktop client to a new account.
- How the application retrieves key bundles and maintains secure state across multiple contacts.
Method
Dynamic analysis with LLDB establishes where the interesting cryptographic work happens in the binary. That region is then handed to the CryptoBAP pipeline, which lifts it, instruments it with a leakage contract and extracts a model for the verifiers.