tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix bug

Browse Source
This commit is contained in:
yincong
2025-12-31 17:27:26 +08:00
parent 999c89f785
commit 2745a1e8d8
2 changed files with 99 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
onebot/script.js
+21 -8
View File
@@ -13,6 +13,8 @@ var messageCallbackFunc2 = baseAddr.add(0x7f04fc8);
var messageCallbackFunc3 = baseAddr.add(0x7f96918);
var messageCallbackFunc4 = baseAddr.add(0x7f96a08);
var messageCallbackFunc5 = baseAddr.add(0x7f968a0);
var messageCallbackFunc6 = baseAddr.add(0x7f9dfe0);
// 这个必须是绝对位置
var triggerX1Payload = ptr(0x175ED6600);
var req2bufEnterAddr = baseAddr.add(0x33EE8E8);
@@ -32,6 +34,8 @@ var messageContentAddr = ptr(0);
var messageAddrAddr = ptr(0);
var contentAddr = ptr(0);
var insertMsgAddr = ptr(0);
var receiverAddr = ptr(0);
var htmlContentAddr = ptr(0);
var protoX1PayloadAddr = ptr(0);
var protoX1PayloadLen = 1024;
@@ -74,8 +78,10 @@ function setupSendMessageDynamic() {
sendMessageAddr = Memory.alloc(256);
messageAddr = Memory.alloc(512);
messageContentAddr = Memory.alloc(32);
messageAddrAddr = Memory.alloc(32);
messageAddrAddr = Memory.alloc(64);
contentAddr = Memory.alloc(255);
receiverAddr = Memory.alloc(24);
htmlContentAddr = Memory.alloc(24);
// A. 写入字符串内容
@@ -126,7 +132,14 @@ function setupSendMessageDynamic() {
messageContentAddr.writePointer(messageAddrAddr);
messageAddrAddr.writePointer(messageCallbackFunc5);
messageAddrAddr.add(0x08).writePointer(contentAddr);
receiverAddr.writePointer(messageCallbackFunc6);
receiverAddr.add(0x08).writePointer(contentAddr);
messageAddrAddr.add(0x08).writePointer(receiverAddr);
messageAddrAddr.add(0x10).writePointer(contentAddr);
messageAddrAddr.add(0x18).writeU32(1);
messageAddrAddr.add(0x20).writeU32(Math.floor(Date.now() / 1000));
htmlContentAddr.writePointer(contentAddr);
messageAddrAddr.add(0x28).writePointer(htmlContentAddr);
console.log(" [+] messageAddr Object: ", hexdump(messageAddr, {
offset: 0,
@@ -399,6 +412,7 @@ function attachProto() {
ansi: true
}));
var firstValue = sp.readU32();
if (firstValue !== taskIdGlobal) {
console.log("[+] Protobuf 拦截未命中，跳过...");
@@ -407,7 +421,7 @@ function attachProto() {
console.log("[+] 正在注入 Protobuf Payload...");
const type = [0x08, 0x01, 0x12]
const receiverHeader = [0x0A, 0x15, 0x0A, 0x13];
const receiverHeader = [0x0A, receiverGlobal.length + 2, 0x0A, receiverGlobal.length];
const receiverProto = stringToHexArray(receiverGlobal);
const contentProto = stringToHexArray(contentGlobal);
const contentHeader = [0x12, ...toVarint(contentProto.length)];
@@ -418,21 +432,20 @@ function attachProto() {
const suffix = [
0x32, 0x32, 0x3C, // 0x28 头部
0x6D, 0x73, 0x67, 0x73, 0x6F, 0x73, 0x75, 0x72, // 0x30 msgsour
0x6D, 0x73, 0x67, 0x73, 0x6F, 0x75, 0x72, // 0x30 msgsour
0x63, 0x65, 0x3E, 0x3C, 0x61, 0x6C, 0x6E, 0x6F, // 0x38 ce><alno
0x64, 0x65, 0x3E, 0x3C, 0x66, 0x72, 0x3E, 0x31, // 0x40 de><fr>1
0x3C, 0x2F, 0x66, 0x72, 0x3E, 0x3C, 0x2F, 0x61, // 0x48 </fr></a
0x6C, 0x6E, 0x6F, 0x64, 0x65, 0x3E, 0x3C, 0x2F, // 0x50 lnode></
0x6D, 0x73, 0x67, 0x73, 0x6F, 0x73, 0x75, 0x72, // 0x58 msgsour
0x6D, 0x73, 0x67, 0x73, 0x6F, 0x75, 0x72, // 0x58 msgsour
0x63, 0x65, 0x3E, 0x00 // 0x60 ce>.
];
const valueLen = toVarint(receiverHeader.length + receiverProto.length + contentHeader.length +
contentProto.length + tsHeader.length + tsBytes.length + msgIdHeader.length + msgId.length + suffix.length)
contentProto.length + tsHeader.length + tsBytes.length + msgIdHeader.length + msgId.length + suffix.length)
// 合并数组
const finalPayload = type.concat(valueLen).concat(receiverHeader).concat(receiverProto).concat(contentHeader).
concat(contentProto).concat(tsHeader).concat(tsBytes).concat(msgIdHeader).concat(msgId).concat(suffix);
const finalPayload = type.concat(valueLen).concat(receiverHeader).concat(receiverProto).concat(contentHeader).concat(contentProto).concat(tsHeader).concat(tsBytes).concat(msgIdHeader).concat(msgId).concat(suffix);
console.log("[+] Payload 准备写入");
protoX1PayloadAddr.writeByteArray(finalPayload);