tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

hd file

Browse Source
This commit is contained in:
yincong
2026-03-06 10:30:00 +08:00
parent f85782242d
commit 218446256b
7 changed files with 77 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frida/auto.js
+7 -13
View File
@@ -1,28 +1,22 @@
function scanPatterns(patterns) {
function scanPatterns() {
var module = Process.getModuleByName("WeChat");
if (!module) {
console.error("[!] 找不到 WeChat 模块基址，请检查进程名。");
}
patterns.forEach((item, index) => {
myPatterns.forEach((item, index) => {
const { name, pattern } = item;
// 2. 使用 Memory.scan 进行异步扫描
Memory.scan(module.base, module.size, pattern, {
onMatch: function(address, size) {
// 计算相对偏移 (RVA)
const offset = address.sub(module.base);
console.log(`[!] 找到特征 [${name}], 绝对地址: ${address} 相对偏移: ${offset}`);
// 如果你只想找第一个匹配项，可以在这里 return 'stop';
console.log(`"${name}": "${offset}", 绝对地址: ${address}`);
},
onError: function(reason) {
console.error(`[-] 扫描 [${name}] 时出错: ${reason}`);
},
onComplete: function() {
// 扫描完成的回调
}
});
});
}
@@ -31,7 +25,7 @@ function scanPatterns(patterns) {
// 特征码数组：? 代表通配符，空格可选
const myPatterns = [
{
name: "uploadOnCompleteAddr",
name: "CndOnCompleteAddr",
pattern: "08 19 40 F9 E1 03 14 AA E2 03 15 AA 00 01 3F D6"
},
{
@@ -56,9 +50,9 @@ const myPatterns = [
},
{
name: "buf2RespAddr",
pattern: "3C 00 80 52 E0 C3 00 91"
}
pattern: "3C 00 80 52 E0 C3 00 91"
},
];
// 执行扫描
scanPatterns(myPatterns);
scanPatterns();
frida/receiver.js
+27 -2
View File
@@ -4,7 +4,8 @@ if (!baseAddr) {
}
var buf2RespAddr = baseAddr.add(0x3721FA0)
var downloadImagAddr = baseAddr.add(0x4A084EC)
var downloadImagAddr = baseAddr.add(0x4A6975C)
var hdPicDownloadAddr = baseAddr.add(0x494652C)
// -------------------------接收消息分区-------------------------
function setReceiver() {
@@ -113,11 +114,25 @@ function setReceiver() {
},
});
Interceptor.attach(hdPicDownloadAddr, {
onEnter: function (args) {
var fileIDAddr = this.context.x1.add(0x40).readPointer();
var fileId = fileIDAddr?.readUtf8String();
if (!fileId.endsWith("_1")) {
return
}
console.log(" [+] download file: ", fileId);
this.context.x1.add(0x148).writeByteArray([0xa0, 0x86, 0x01, 0x00]);
this.context.x1.add(0xA0).writeU32(0x02);
}
});
Interceptor.attach(downloadImagAddr, { // 建议使用函数起始地址或你计算出的偏移地址
onEnter: function (args) {
var dataPtr = this.context.x1;
var dataLen = this.context.x2.toInt32();
var fileId = this.context.sp.add(0x30).readPointer().readUtf8String();
var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String();
var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String();
if (dataLen > 0) {
@@ -384,3 +399,13 @@ function testGetProtobufRawBytes() {
const results = getProtobufRawBytes(pBuffer, rawMemoryData.length);
console.log(results);
}
function patchString(addr, plainStr) {
const bytes = [];
for (let i = 0; i < plainStr.length; i++) {
bytes.push(plainStr.charCodeAt(i));
}
addr.writeByteArray(bytes);
addr.add(bytes.length).writeU8(0);
}
onebot/msg.go
+4 -1
View File
@@ -2,6 +2,7 @@ package main
import (
"encoding/json"
"time"
)
func Download(rawMsg []byte) error {
@@ -12,11 +13,13 @@ func Download(rawMsg []byte) error {
return err
}
Info("下载文件", "file_id", downloadReq.FileID, "media_len", len(downloadReq.Media), "cdn_url", downloadReq.CDNURL[:10])
Info("下载文件", "file_id", downloadReq.FileID, "media_len", len(downloadReq.Media), "cdn_url", downloadReq.CDNURL[:20])
if downloadReqInter, ok := userID2FileMsgMap.Load(downloadReq.CDNURL); ok {
beforeDownloadReq := downloadReqInter.(*DownloadRequest)
beforeDownloadReq.Media = append(beforeDownloadReq.Media, downloadReq.Media...)
beforeDownloadReq.LastAppendTime = time.Now().UnixMilli()
} else {
downloadReq.LastAppendTime = time.Now().UnixMilli()
userID2FileMsgMap.Store(downloadReq.CDNURL, downloadReq)
}
onebot/param.go
+4 -3
View File
@@ -140,9 +140,10 @@ type Live struct {
}
type DownloadRequest struct {
FileID string `json:"file_id"`
Media []byte `json:"media"`
CDNURL string `json:"cdn_url"`
FileID string `json:"file_id"`
Media []byte `json:"media"`
CDNURL string `json:"cdn_url"`
LastAppendTime int64 `json:"last_append_time"`
}
type ScriptMessage struct {
onebot/script.js
+16 -1
View File
@@ -285,6 +285,7 @@ var uploadGetCallbackWrapperFuncAddr = baseAddr.add({{.uploadGetCallbackWrapperF
var uploadOnCompleteAddr = baseAddr.add({{.uploadOnCompleteAddr}});
var uploadOnCompleteFuncAddr = baseAddr.add({{.uploadOnCompleteFuncAddr}});
var downloadImagAddr = baseAddr.add({{.downloadImagAddr}});
var hdPicDownloadAddr = baseAddr.add(0x494652C)
var uploadImageX1;
var imgCgiAddr = ptr(0);
@@ -1211,11 +1212,25 @@ function setReceiver() {
},
});
Interceptor.attach(hdPicDownloadAddr, {
onEnter: function (args) {
var fileIDAddr = this.context.x1.add(0x40).readPointer();
var fileId = fileIDAddr?.readUtf8String();
if (!fileId.endsWith("_1")) {
return
}
console.log(" [+] download file: ", fileId);
this.context.x1.add(0x148).writeByteArray([0xa0, 0x86, 0x01, 0x00]);
this.context.x1.add(0xA0).writeU32(0x02);
}
});
Interceptor.attach(downloadImagAddr, { // 建议使用函数起始地址或你计算出的偏移地址
onEnter: function (args) {
var dataPtr = this.context.x1;
var dataLen = this.context.x2.toInt32();
var fileId = this.context.sp.add(0x30).readPointer().readUtf8String();
var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String();
var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String();
if (dataLen > 0) {
onebot/utils.go
+17 -9
View File
@@ -187,16 +187,24 @@ func HandleMsg(jsonData []byte) ([]byte, error) {
// 如果有图片等待图片下载完成再处理
if len(msg.Data.Media) == 0 {
if downloadMsgInter, ok := userID2FileMsgMap.Load(fileMsg.Image.ThumbURL); ok {
downloadReq := downloadMsgInter.(*DownloadRequest)
aesKey, _ := hex.DecodeString(fileMsg.Image.ThumbAesKey)
path, err := GetImagePath(downloadReq.Media, aesKey)
if err != nil {
Error("获取图片路径失败", "err", err)
return nil, err
for i := 0; i < 3; i++ {
if downloadMsgInter, ok := userID2FileMsgMap.Load(fileMsg.Image.ThumbURL); ok {
downloadReq := downloadMsgInter.(*DownloadRequest)
// 进行重试，最后一次进行兜底
if time.Now().UnixMilli()-downloadReq.LastAppendTime < 500 && i < 2 {
Info("等待图片下载完成", "times", i, "url", fileMsg.Image.ThumbURL[:20])
time.Sleep(2 * time.Second)
continue
}
aesKey, _ := hex.DecodeString(fileMsg.Image.AesKey)
path, err := GetImagePath(downloadReq.Media, aesKey)
if err != nil {
Error("获取图片路径失败", "err", err)
return nil, err
}
msg.Data.URL = "file://" + path
userID2FileMsgMap.Delete(fileMsg.Image.ThumbURL)
}
msg.Data.URL = "file://" + path
userID2FileMsgMap.Delete(fileMsg.Image.ThumbURL)
}
}
}
wechat_version/4_1_7_57_mac.json
+2 -1
View File
@@ -18,5 +18,6 @@
"uploadGetCallbackWrapperFuncAddr": "0x36BA7DC",
"uploadOnCompleteAddr": "0x4913A88",
"uploadOnCompleteFuncAddr": "0x36BB9C0",
"downloadImagAddr": "0x4A084EC"
"downloadImagAddr": "0x4A6975C",
"hdPicDownloadAddr": "0x494652C"
}