tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

diaphora

Browse Source
This commit is contained in:
yincong
2025-12-04 15:32:52 +08:00
parent b6c1bf13fe
commit 2d61273660
10 changed files with 160 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+3 -1
View File
@@ -1,2 +1,4 @@
.idea
__handlers__
__handlers__
*.sqlite
.DS_Store
diaphora/diaphora.sh
+5
View File
@@ -0,0 +1,5 @@
export DIAPHORA_EXPORT_FILE=/Users/yincong/go/src/github.com/yincongcyincong/weixin-macos/diaphora/database.sqlite
export DIAPHORA_AUTO=1
/Applications/IDA\ Professional\ 9.1.app/Contents/MacOS/ida -A -B -L/tmp/ida.txt -S/Users/yincong/go/src/github.com/yincongcyincong/diaphora/diaphora.py /Users/yincong/go/src/github.com/yincongcyincong/mars/mars/cmake_build/OSX/Darwin.out/mars.framework/mars
frida/check_point_value.js
+4 -14
View File
@@ -10,7 +10,7 @@ function checkValid(p) {
if (!p.and(0x7).isNull()) {
return false;
}
return p.compare("0x100000000") >= 0;
return p.compare("0x200000000000") >= 0 && p.compare("0x700000000000000") < 0;
}
function handlePr(addr, keyword) {
@@ -24,7 +24,7 @@ function handlePr(addr, keyword) {
for (let i = 0; i < 30; i++) {
try {
if (checkValid(args[i])) {
const buf = args[i].readByteArray(1024)
const buf = args[i].readByteArray(128)
if (!buf) {
continue;
}
@@ -57,24 +57,14 @@ function handlePr(addr, keyword) {
onLeave(retval) {
console.log(`===== ${addr} LEAVE =====`);
console.log(` ${addr} Return value ${retval}`);
try {
if (checkValid(retval)) {
console.log(addr + "||" + hexdump(retval, {
offset: 0,
length: 64
}));
}
} catch (_) {
}
}
});
}
const prs = ["102454D74", "10247A138"]
const k = "";
const prs = ["105831328", "1058469dc", "10587c208"]
const k = "o.o.o.o";
for (let pr of prs) {
handlePr(pr, k);
}
frida/keyword.js
+32 -13
View File
@@ -1,21 +1,20 @@
const keyword = "7.7";
const addrs = ["6000033DDE48"]
console.log(keyword);
console.log(addrs);
const mod = Process.getModuleByName("WeChat");
function memoGet(p) {
p = "0x" + p;
const idaAddr = ptr(p);
ryAccessMonitor.enable(
MemoryAccessMonitor.enable(
{
base: idaAddr,
size: 0x40 // buffer 大小
size: 0x10 // buffer 大小
},
{
onAccess(details) {
console.log("Access by:", details.from);
attach(details.from)
console.log(hexdump(idaAddr, {length: 0x40}));
if (details.from.compare(mod.base) > 0 && details.from.compare(mod.base.add(mod.size)) < 0) {
console.log("dump idaAddr", hexdump(idaAddr, {length: 0x40}));
}
}
}
);
@@ -29,14 +28,14 @@ function attach(from) {
Interceptor.attach(realAddr, {
onEnter(args) {
for (let i = 0; i < 10; i++) {
for (let i = 0; i < 30; i++) {
try {
if (args[i].isNull()) {
continue;
}
console.log(`\n[+] arg${i} ${args[i]}`);
// console.log(`\n[+] arg${i} ${args[i]}`);
if (args[i].compare(ptr("0x600000000000")) >= 0 && args[i].compare(ptr("0x700000000000")) < 0 && args[i].and(0x7).isNull()) {
if (checkValid(args[i])) {
const buf = args[i].readByteArray(128)
if (!buf) {
continue;
@@ -71,7 +70,7 @@ function attach(from) {
console.log("===== sub_105808800 LEAVE =====");
console.log("Return value:", retval);
try {
if (retval.compare(ptr("0x600000000000")) >= 0 && retval.compare(ptr("0x700000000000")) < 0 && retval.and(0x7).isNull()) {
if (checkValid(retval)) {
console.log(hexdump(retval, {
offset: 0,
length: 40
@@ -84,6 +83,26 @@ function attach(from) {
}
function checkValid(p) {
if (p.isNull()) {
return false;
}
if (!p.and(0x7).isNull()) {
return false;
}
if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) {
return true;
}
return false;
}
const keyword = "mmmmm";
const addrs = ["600001EF17DA"]
for (let addr of addrs) {
memoGet(addr);
}
}
console.log(keyword);
console.log(addrs);
frida/memcpy.js
+54 -25
View File
@@ -7,37 +7,66 @@ if (memcpy_ptr) {
console.log("[+] Hooking memcpy.");
Interceptor.attach(memcpy_ptr, {
onEnter(args) {
// args[0] = destination (目标缓冲区)
// args[1] = source (源数据)
// args[2] = length
this.src = args[1];
this.len = args[2].toInt32();
},
onLeave(retval) {
// 只检查长度适中的数据块 (防止日志爆炸)
if (this.len > 5 && this.len < 500) {
console.log("===== Enter =====");
for (let i = 0; i < 10; i++) {
try {
// 尝试将源数据读取为 C 字符串
const message = this.src.readCString();
if (checkValid(args[i])) {
const buf = args[i].readByteArray(128)
if (!buf) {
continue;
}
console.log(`\n[+] arg${i} ${args[i]}`);
let s = "";
const u8 = new Uint8Array(buf);
for (let b of u8) {
if (b >= 0x20 && b <= 0x7E) {
s += String.fromCharCode(b);
} else {
s += ".";
}
}
if (message && message.length > 1) {
console.log(`\n======================================================`);
console.log(`[+] ⚠️ 明文捕获于 memcpy!`);
console.log(`[+] 长度: ${this.len} 字节`);
console.log(`[+] 消息内容 (ASCII): ${message}`);
// 打印 Hexdump 验证
console.log(`--- Hexdump 验证 ---`);
console.log(hexdump(this.src, { length: this.len > 128 ? 128 : this.len }));
console.log(`======================================================`);
if (s.includes("3.3.3.3")) {
console.log(`\n[+] arg${i} ${args[i]}`);
console.log(hexdump(args[i], { length: 64 }));
console.log(
Thread.backtrace(this.context, Backtracer.ACCURATE)
.map(DebugSymbol.fromAddress).join('\n'));
return;
}
}
} catch (e) {
// 忽略读取错误
}
}
},
onLeave(retval) {
// console.log("===== LEAVE =====");
// console.log("Return value:", retval);
// try {
// if (checkValid(retval)) {
// console.log("Return hexdump:");
// console.log(hexdump(retval, {
// offset: 0,
// length: 128
// }));
// }
// } catch (_) {
// }
}
});
} else {
console.log("[!] memcpy symbol not found.");
}
function checkValid(p) {
if (p.isNull()) {
return false;
}
if (!p.and(0x7).isNull()) {
return false;
}
if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) {
return true;
}
return false;
}
frida/memo_check.js
+33 -13
View File
@@ -1,13 +1,33 @@
MemoryAccessMonitor.enable(
{
base: ptr("0x6000034c1000"),
size: 0x40 // buffer 大小
},
{
onAccess(details) {
console.log("Access by:", details.from);
console.log("Operation:", details.operation);
console.log(hexdump(idaAddr, { length: 0x40 }));
}
}
);
const targetModule = Process.findModuleByName("WeChat"); // 仅关注主二进制文件
console.log("Module:", targetModule.base);
function dectectPr(p) {
const targetPtr = ptr("0x" + p);
MemoryAccessMonitor.enable(
{
base: targetPtr,
size: 0x10
},
{
onAccess(details) {
console.log("from:", details.from);
if (details.from.compare("0x180000000") < 0) {
console.log("Operation:", details.operation, p); // read / write / exec
console.log("From:", details.from.sub(targetModule.base).add(0x100000000).toString(), p);
console.log("Address:", details.address, p);
console.log(
Thread.backtrace(details.context, Backtracer.ACCURATE)
.map(DebugSymbol.fromAddress)
.join("\n")
);
}
}
});
}
const ps = ["60000132EC32"]
for (let i = 0; i < ps.length; i++) {
dectectPr(ps[i]);
}
frida/other_memo_check.js
+1 -1
View File
@@ -9,7 +9,7 @@ MemoryAccessMonitor.enable(
{
onAccess(details) {
console.log("memo Details:", JSON.stringify(details));
// console.log("0x6000029C6DF0 Access by:", DebugSymbol.fromAddress(details.from));
console.log("0x6000029C6DF0 Access by:", DebugSymbol.fromAddress(details.from));
console.log(hexdump(idaAddr, { length: 0x40 }));
}
}
frida/protobuf.js
+27
View File
@@ -0,0 +1,27 @@
const mod = Process.getModuleByName("ilink_protobuf");
var addr = mod.base.add(0x12DD4);
console.log("Hooking SerializeToArray at", addr);
Interceptor.attach(addr, {
onEnter(args) {
this.buf = args[1];
this.size = args[2].toInt32();
console.log("[+] SerializeToArray called");
console.log("Buffer:", this.buf, "Size:", this.size);
console.log(
Thread.backtrace(this.context, Backtracer.ACCURATE)
.map(DebugSymbol.fromAddress)
.join("\n")
);
},
onLeave() {
try {
console.log("Data:");
console.log(hexdump(Memory.readByteArray(this.buf, this.size)));
} catch (e) {
console.log("Error:", e);
}
}
});
frida/script.js
-23
View File
@@ -1,23 +0,0 @@
const targetModule = Process.findModuleByName("WeChat"); // 仅关注主二进制文件
const targetPtr = ptr("0x600000EF1648"); // 你想监控的地址
MemoryAccessMonitor.enable(
{
base: targetPtr,
size: 0x40
},
{
onAccess(details) {
console.log("==== Memory Access ====");
console.log("Operation:", details.operation); // read / write / exec
console.log("From:", details.from.sub(targetModule.from).add(0x100000000).toString());
console.log("Address:", details.address);
console.log("=== Backtrace ===");
console.log(
Thread.backtrace(details.context, Backtracer.ACCURATE)
.map(DebugSymbol.fromAddress)
.join("\n")
);
}
});
frida/writedata.js
+1 -1
View File
@@ -1,5 +1,5 @@
const mod = Process.getModuleByName("WeChat");
const realAddr = ptr("0x1057ee3a8").sub("0x100000000").add(mod.base);
const realAddr = ptr("0x105835e84").sub("0x100000000").add(mod.base);
console.log("[+] Real Function Address:", realAddr);