From 2d612736607dfdb37e201260cb5132932ee18e7d Mon Sep 17 00:00:00 2001 From: yincong Date: Thu, 4 Dec 2025 15:32:52 +0800 Subject: [PATCH] diaphora --- .gitignore | 4 +- diaphora/diaphora.sh | 5 +++ frida/check_point_value.js | 18 ++------- frida/keyword.js | 45 +++++++++++++++------- frida/memcpy.js | 79 ++++++++++++++++++++++++++------------ frida/memo_check.js | 46 +++++++++++++++------- frida/other_memo_check.js | 2 +- frida/protobuf.js | 27 +++++++++++++ frida/script.js | 23 ----------- frida/writedata.js | 2 +- 10 files changed, 160 insertions(+), 91 deletions(-) create mode 100644 diaphora/diaphora.sh create mode 100644 frida/protobuf.js diff --git a/.gitignore b/.gitignore index d771a22..38d2f2b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ .idea -__handlers__ \ No newline at end of file +__handlers__ +*.sqlite +.DS_Store \ No newline at end of file diff --git a/diaphora/diaphora.sh b/diaphora/diaphora.sh new file mode 100644 index 0000000..aaedfb8 --- /dev/null +++ b/diaphora/diaphora.sh @@ -0,0 +1,5 @@ + + +export DIAPHORA_EXPORT_FILE=/Users/yincong/go/src/github.com/yincongcyincong/weixin-macos/diaphora/database.sqlite +export DIAPHORA_AUTO=1 +/Applications/IDA\ Professional\ 9.1.app/Contents/MacOS/ida -A -B -L/tmp/ida.txt -S/Users/yincong/go/src/github.com/yincongcyincong/diaphora/diaphora.py /Users/yincong/go/src/github.com/yincongcyincong/mars/mars/cmake_build/OSX/Darwin.out/mars.framework/mars diff --git a/frida/check_point_value.js b/frida/check_point_value.js index afd4eae..56cce56 100644 --- a/frida/check_point_value.js +++ b/frida/check_point_value.js @@ -10,7 +10,7 @@ function checkValid(p) { if (!p.and(0x7).isNull()) { return false; } - return p.compare("0x100000000") >= 0; + return p.compare("0x200000000000") >= 0 && p.compare("0x700000000000000") < 0; } function handlePr(addr, keyword) { @@ -24,7 +24,7 @@ function handlePr(addr, keyword) { for (let i = 0; i < 30; i++) { try { if (checkValid(args[i])) { - const buf = args[i].readByteArray(1024) + const buf = args[i].readByteArray(128) if (!buf) { continue; } @@ -57,24 +57,14 @@ function handlePr(addr, keyword) { onLeave(retval) { console.log(`===== ${addr} LEAVE =====`); console.log(` ${addr} Return value ${retval}`); - try { - if (checkValid(retval)) { - console.log(addr + "||" + hexdump(retval, { - offset: 0, - length: 64 - })); - } - - } catch (_) { - } } }); } -const prs = ["102454D74", "10247A138"] -const k = ""; +const prs = ["105831328", "1058469dc", "10587c208"] +const k = "o.o.o.o"; for (let pr of prs) { handlePr(pr, k); } diff --git a/frida/keyword.js b/frida/keyword.js index d8eeb28..6a4311d 100644 --- a/frida/keyword.js +++ b/frida/keyword.js @@ -1,21 +1,20 @@ -const keyword = "7.7"; -const addrs = ["6000033DDE48"] -console.log(keyword); -console.log(addrs); +const mod = Process.getModuleByName("WeChat"); + function memoGet(p) { p = "0x" + p; const idaAddr = ptr(p); - ryAccessMonitor.enable( + MemoryAccessMonitor.enable( { base: idaAddr, - size: 0x40 // buffer 大小 + size: 0x10 // buffer 大小 }, { onAccess(details) { console.log("Access by:", details.from); - attach(details.from) - console.log(hexdump(idaAddr, {length: 0x40})); + if (details.from.compare(mod.base) > 0 && details.from.compare(mod.base.add(mod.size)) < 0) { + console.log("dump idaAddr", hexdump(idaAddr, {length: 0x40})); + } } } ); @@ -29,14 +28,14 @@ function attach(from) { Interceptor.attach(realAddr, { onEnter(args) { - for (let i = 0; i < 10; i++) { + for (let i = 0; i < 30; i++) { try { if (args[i].isNull()) { continue; } - console.log(`\n[+] arg${i} ${args[i]}`); + // console.log(`\n[+] arg${i} ${args[i]}`); - if (args[i].compare(ptr("0x600000000000")) >= 0 && args[i].compare(ptr("0x700000000000")) < 0 && args[i].and(0x7).isNull()) { + if (checkValid(args[i])) { const buf = args[i].readByteArray(128) if (!buf) { continue; @@ -71,7 +70,7 @@ function attach(from) { console.log("===== sub_105808800 LEAVE ====="); console.log("Return value:", retval); try { - if (retval.compare(ptr("0x600000000000")) >= 0 && retval.compare(ptr("0x700000000000")) < 0 && retval.and(0x7).isNull()) { + if (checkValid(retval)) { console.log(hexdump(retval, { offset: 0, length: 40 @@ -84,6 +83,26 @@ function attach(from) { } +function checkValid(p) { + if (p.isNull()) { + return false; + } + + if (!p.and(0x7).isNull()) { + return false; + } + if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) { + return true; + } + return false; +} + +const keyword = "mmmmm"; + +const addrs = ["600001EF17DA"] for (let addr of addrs) { memoGet(addr); -} \ No newline at end of file +} + +console.log(keyword); +console.log(addrs); \ No newline at end of file diff --git a/frida/memcpy.js b/frida/memcpy.js index dc4a768..23df56f 100644 --- a/frida/memcpy.js +++ b/frida/memcpy.js @@ -7,37 +7,66 @@ if (memcpy_ptr) { console.log("[+] Hooking memcpy."); Interceptor.attach(memcpy_ptr, { onEnter(args) { - // args[0] = destination (目标缓冲区) - // args[1] = source (源数据) - // args[2] = length - this.src = args[1]; - this.len = args[2].toInt32(); - }, - onLeave(retval) { - // 只检查长度适中的数据块 (防止日志爆炸) - if (this.len > 5 && this.len < 500) { + console.log("===== Enter ====="); + for (let i = 0; i < 10; i++) { try { - // 尝试将源数据读取为 C 字符串 - const message = this.src.readCString(); + if (checkValid(args[i])) { + const buf = args[i].readByteArray(128) + if (!buf) { + continue; + } + console.log(`\n[+] arg${i} ${args[i]}`); + let s = ""; + const u8 = new Uint8Array(buf); + for (let b of u8) { + if (b >= 0x20 && b <= 0x7E) { + s += String.fromCharCode(b); + } else { + s += "."; + } + } - if (message && message.length > 1) { - console.log(`\n======================================================`); - console.log(`[+] ⚠️ 明文捕获于 memcpy!`); - console.log(`[+] 长度: ${this.len} 字节`); - console.log(`[+] 消息内容 (ASCII): ${message}`); - - // 打印 Hexdump 验证 - console.log(`--- Hexdump 验证 ---`); - console.log(hexdump(this.src, { length: this.len > 128 ? 128 : this.len })); - - console.log(`======================================================`); + if (s.includes("3.3.3.3")) { + console.log(`\n[+] arg${i} ${args[i]}`); + console.log(hexdump(args[i], { length: 64 })); + console.log( + Thread.backtrace(this.context, Backtracer.ACCURATE) + .map(DebugSymbol.fromAddress).join('\n')); + return; + } } } catch (e) { - // 忽略读取错误 + } } + }, + onLeave(retval) { + // console.log("===== LEAVE ====="); + // console.log("Return value:", retval); + // try { + // if (checkValid(retval)) { + // console.log("Return hexdump:"); + // console.log(hexdump(retval, { + // offset: 0, + // length: 128 + // })); + // } + // } catch (_) { + // } } }); -} else { - console.log("[!] memcpy symbol not found."); +} + +function checkValid(p) { + if (p.isNull()) { + return false; + } + + if (!p.and(0x7).isNull()) { + return false; + } + if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) { + return true; + } + return false; } \ No newline at end of file diff --git a/frida/memo_check.js b/frida/memo_check.js index de04e16..e43f6fc 100644 --- a/frida/memo_check.js +++ b/frida/memo_check.js @@ -1,13 +1,33 @@ -MemoryAccessMonitor.enable( - { - base: ptr("0x6000034c1000"), - size: 0x40 // buffer 大小 - }, - { - onAccess(details) { - console.log("Access by:", details.from); - console.log("Operation:", details.operation); - console.log(hexdump(idaAddr, { length: 0x40 })); - } - } -); +const targetModule = Process.findModuleByName("WeChat"); // 仅关注主二进制文件 +console.log("Module:", targetModule.base); + +function dectectPr(p) { + const targetPtr = ptr("0x" + p); + + MemoryAccessMonitor.enable( + { + base: targetPtr, + size: 0x10 + }, + { + onAccess(details) { + console.log("from:", details.from); + if (details.from.compare("0x180000000") < 0) { + console.log("Operation:", details.operation, p); // read / write / exec + console.log("From:", details.from.sub(targetModule.base).add(0x100000000).toString(), p); + console.log("Address:", details.address, p); + console.log( + Thread.backtrace(details.context, Backtracer.ACCURATE) + .map(DebugSymbol.fromAddress) + .join("\n") + ); + } + } + }); + +} + +const ps = ["60000132EC32"] +for (let i = 0; i < ps.length; i++) { + dectectPr(ps[i]); +} \ No newline at end of file diff --git a/frida/other_memo_check.js b/frida/other_memo_check.js index 8acb4bd..c32be8b 100644 --- a/frida/other_memo_check.js +++ b/frida/other_memo_check.js @@ -9,7 +9,7 @@ MemoryAccessMonitor.enable( { onAccess(details) { console.log("memo Details:", JSON.stringify(details)); - // console.log("0x6000029C6DF0 Access by:", DebugSymbol.fromAddress(details.from)); + console.log("0x6000029C6DF0 Access by:", DebugSymbol.fromAddress(details.from)); console.log(hexdump(idaAddr, { length: 0x40 })); } } diff --git a/frida/protobuf.js b/frida/protobuf.js new file mode 100644 index 0000000..25fac8c --- /dev/null +++ b/frida/protobuf.js @@ -0,0 +1,27 @@ +const mod = Process.getModuleByName("ilink_protobuf"); +var addr = mod.base.add(0x12DD4); +console.log("Hooking SerializeToArray at", addr); + +Interceptor.attach(addr, { + onEnter(args) { + this.buf = args[1]; + this.size = args[2].toInt32(); + + console.log("[+] SerializeToArray called"); + console.log("Buffer:", this.buf, "Size:", this.size); + + console.log( + Thread.backtrace(this.context, Backtracer.ACCURATE) + .map(DebugSymbol.fromAddress) + .join("\n") + ); + }, + onLeave() { + try { + console.log("Data:"); + console.log(hexdump(Memory.readByteArray(this.buf, this.size))); + } catch (e) { + console.log("Error:", e); + } + } +}); \ No newline at end of file diff --git a/frida/script.js b/frida/script.js index fa64030..e69de29 100644 --- a/frida/script.js +++ b/frida/script.js @@ -1,23 +0,0 @@ -const targetModule = Process.findModuleByName("WeChat"); // 仅关注主二进制文件 - -const targetPtr = ptr("0x600000EF1648"); // 你想监控的地址 - -MemoryAccessMonitor.enable( - { - base: targetPtr, - size: 0x40 - }, - { - onAccess(details) { - console.log("==== Memory Access ===="); - console.log("Operation:", details.operation); // read / write / exec - console.log("From:", details.from.sub(targetModule.from).add(0x100000000).toString()); - console.log("Address:", details.address); - console.log("=== Backtrace ==="); - console.log( - Thread.backtrace(details.context, Backtracer.ACCURATE) - .map(DebugSymbol.fromAddress) - .join("\n") - ); - } - }); diff --git a/frida/writedata.js b/frida/writedata.js index d89a762..9a1ac79 100644 --- a/frida/writedata.js +++ b/frida/writedata.js @@ -1,5 +1,5 @@ const mod = Process.getModuleByName("WeChat"); -const realAddr = ptr("0x1057ee3a8").sub("0x100000000").add(mod.base); +const realAddr = ptr("0x105835e84").sub("0x100000000").add(mod.base); console.log("[+] Real Function Address:", realAddr);