add receive

frida/check_point_value.js

@@ -1,5 +1,6 @@
 const mod = Process.getModuleByName("WeChat");
 console.log("[+] Base Address:", mod.base);
+var counterMap = new Map();
 
 function checkValid(p) {
     if (p.isNull()) {
@@ -9,10 +10,7 @@ function checkValid(p) {
     if (!p.and(0x7).isNull()) {
         return false;
     }
-    if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) {
-        return true;
-    }
-    return false;
+    return p.compare("0x100000000")  >= 0;
 }
 
 function handlePr(addr, keyword) {
@@ -21,10 +19,12 @@ function handlePr(addr, keyword) {
 
     Interceptor.attach(realAddr, {
         onEnter(args) {
-            for (let i = 0; i < 10; i++) {
+            const currentCount = counterMap.get(addr) || 0;
+            counterMap.set(addr, currentCount + 1);
+            for (let i = 0; i < 30; i++) {
                 try {
                     if (checkValid(args[i])) {
-                        const buf = args[i].readByteArray(128)
+                        const buf = args[i].readByteArray(1024)
                         if (!buf) {
                             continue;
                         }
@@ -44,7 +44,6 @@ function handlePr(addr, keyword) {
                             console.log(addr + "|| " + s + "\n" +
                                 Thread.backtrace(this.context, Backtracer.ACCURATE)
                                     .map(DebugSymbol.fromAddress).join('\n'));
-                            return;
                         }
                     }
                 } catch (e) {
@@ -74,9 +73,19 @@ function handlePr(addr, keyword) {
 }
 
 
-const prs = ["104565AD0", "104566E24", "1045CF820", "104590888", "1045BFED0", "104394290", "1043877CC", "104387764", "1043382C0"]
+const prs = ["102454D74", "10247A138"]
 const k = "";
 for (let pr of prs) {
     handlePr(pr, k);
 }
 
+function ShowCount() {
+    for (let [addr, count] of counterMap) {
+        console.log(`${addr}: ${count}`);
+    }
+}
+
+function clearCount() {
+    counterMap.clear();
+    console.log("Counter cleared.");
+}

frida/checkx26.js

@@ -0,0 +1,85 @@
+const mod = Process.getModuleByName("WeChat");
+console.log("[+] Base Address:", mod.base);
+var counterMap = new Map();
+
+function checkValid(p) {
+    if (p.isNull()) {
+        return false;
+    }
+
+    if (!p.and(0x7).isNull()) {
+        return false;
+    }
+    if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) {
+        return true;
+    }
+    return false;
+}
+
+function handlePr(addr, keyword) {
+    const realAddr = ptr("0x" + addr).sub("0x100000000").add(mod.base);
+    console.log("[+] real Address:", realAddr)
+
+    Interceptor.attach(realAddr, {
+        onEnter(args) {
+            const currentCount = counterMap.get(addr) || 0;
+            counterMap.set(addr, currentCount + 1);
+
+            try {
+                const x26Value = this.context.x26;
+                console.log(`[!] X26 Register Value: ${x26Value}`);
+
+
+                if (checkValid(x26Value)) {
+                    console.log(`\n[+] ${addr} || X26 has a valid pointer: ${x26Value}`);
+
+                    const buf = x26Value.readByteArray(128);
+                    if (buf) {
+                        let s = "";
+                        const u8 = new Uint8Array(buf);
+                        for (let b of u8) {
+                            if (b >= 0x20 && b <= 0x7E) {
+                                s += String.fromCharCode(b);
+                            } else {
+                                s += ".";
+                            }
+                        }
+
+                        if (s.includes(keyword) || keyword === "") {
+                            console.log(addr + "|| X26 Read String: " + s + `${u8}`);
+                            // 打印堆栈追踪
+                            console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
+                                .map(DebugSymbol.fromAddress).join('\n'));
+                        }
+                    }
+                }
+            } catch (e) {
+                console.log("Enter Error:", e);
+            }
+
+
+        },
+
+        onLeave(retval) {
+        }
+    });
+
+}
+
+
+const prs = ["102454D74"]
+const k = "";
+for (let pr of prs) {
+    handlePr(pr, k);
+}
+
+function ShowCount() {
+    for (let [addr, count] of counterMap) {
+        console.log(`${addr}: ${count}`);
+    }
+}
+
+function clearCount() {
+    counterMap.clear();
+    console.log("Counter cleared.");
+}

frida/keyword.js

@@ -6,7 +6,7 @@ console.log(addrs);
 function memoGet(p) {
     p = "0x" + p;
     const idaAddr = ptr(p);
-    MemoryAccessMonitor.enable(
+    ryAccessMonitor.enable(
         {
             base: idaAddr,
             size: 0x40  // buffer 大小

frida/other_memo_check.js

@@ -8,7 +8,7 @@ MemoryAccessMonitor.enable(
     },
     {
         onAccess(details) {
-            console.log("0x6000029C6DF0 Details:", JSON.stringify(details));
+            console.log("memo Details:", JSON.stringify(details));
             // console.log("0x6000029C6DF0 Access by:", DebugSymbol.fromAddress(details.from));
             console.log(hexdump(idaAddr, { length: 0x40 }));
         }

frida/receive.js

@@ -0,0 +1,107 @@
+const mod = Process.getModuleByName("WeChat");
+console.log("[+] Base Address:", mod.base);
+var counterMap = new Map();
+
+function checkValid(p) {
+    if (p.isNull()) {
+        return false;
+    }
+
+    if (!p.and(0x7).isNull()) {
+        return false;
+    }
+    if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) {
+        return true;
+    }
+    return false;
+}
+
+function handlePr(addr, keyword) {
+    const realAddr = ptr("0x" + addr).sub("0x100000000").add(mod.base);
+    console.log("[+] real Address:", realAddr)
+
+    Interceptor.attach(realAddr, {
+        onEnter(args) {
+            const currentCount = counterMap.get(addr) || 0;
+            counterMap.set(addr, currentCount + 1);
+            console.log(`${addr} called ${currentCount} times`);
+
+            try {
+                if (this.context.x0.compare(ptr("0x100000000")) >= 0) {
+                    console.log(`[!] X3 Register Value: ${this.context.x3}`);
+                    dump(this.context.x0)
+                }
+
+                if (this.context.x20.compare(ptr("0x100000000")) >= 0) {
+                    console.log(`[!] X20 Register Value: ${this.context.x20}`);
+                    dump(this.context.x20)
+                }
+            } catch (e) {
+                console.log("Enter Error:", e);
+            }
+        },
+
+        onLeave(retval) {
+        }
+    });
+
+}
+
+
+const prs = ["102B66C30"]
+const k = "";
+for (let pr of prs) {
+    handlePr(pr, k);
+}
+
+function ShowCount() {
+    for (let [addr, count] of counterMap) {
+        console.log(`${addr}: ${count}`);
+    }
+}
+
+function clearCount() {
+    counterMap.clear();
+    console.log("Counter cleared.");
+}
+
+
+function dump(xValue) {
+    console.log(`X has a pointer: ${xValue}`);
+
+    let buf = null;
+
+    try {
+        const buf = xValue.readByteArray(512)
+        let s = "";
+        const u8 = new Uint8Array(buf);
+        for (let b of u8) {
+            if (b >= 0x20 && b <= 0x7E) {
+                s += String.fromCharCode(b);
+            } else {
+                s += ".";
+            }
+        }
+
+        console.log(s);
+
+    } catch (e) {
+        console.warn(`[!] 首次读取失败，尝试修改权限... 错误: ${e.message}`);
+
+    }
+
+    // --- 内存读取成功，进行解码 ---
+    if (buf) {
+        let s = "";
+        const u8 = new Uint8Array(buf);
+        // ... (您的解码逻辑)
+        for (let b of u8) {
+            if (b >= 0x20 && b <= 0x7E) {
+                s += String.fromCharCode(b);
+            } else {
+                s += ".";
+            }
+        }
+        console.log(`||  Read String: ${s} \n||  Raw Data: ${u8}`);
+    }
+}

frida/script.js

@@ -1,82 +1,23 @@
-const mod = Process.getModuleByName("WeChat");
-console.log("[+] Base Address:", mod.base);
+const targetModule = Process.findModuleByName("WeChat"); // 仅关注主二进制文件
 
-function checkValid(p) {
-    if (p.isNull()) {
-        return false;
-    }
+const targetPtr = ptr("0x600000EF1648");  // 你想监控的地址
 
-    if (!p.and(0x7).isNull()) {
-        return false;
-    }
-    if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) {
-        return true;
-    }
-    return false;
-}
-
-function handlePr(addr, keyword) {
-    const realAddr = ptr("0x" + addr).sub("0x100000000").add(mod.base);
-    console.log("[+] real Address:", realAddr)
-
-    Interceptor.attach(realAddr, {
-        onEnter(args) {
-            for (let i = 0; i < 10; i++) {
-                try {
-                    if (checkValid(args[i])) {
-                        const buf = args[i].readByteArray(128)
-                        if (!buf) {
-                            continue;
-                        }
-                        let s = "";
-                        const u8 = new Uint8Array(buf);
-                        for (let b of u8) {
-                            if (b >= 0x20 && b <= 0x7E) {
-                                s += String.fromCharCode(b);
-                            } else {
-                                s += ".";
-                            }
-                        }
-
-                        if (s.includes(keyword) || keyword === "") {
-                            console.log(`\n[+] ${addr} || arg${i} ${args[i]}`);
-                            console.log(hexdump(args[i], {length: 64}));
-                            console.log(addr + "|| " + s + "\n" +
-                                Thread.backtrace(this.context, Backtracer.ACCURATE)
-                                    .map(DebugSymbol.fromAddress).join('\n'));
-                            return;
-                        }
-                    }
-                } catch (e) {
-                    console.log("Enter Error:", e);
-                }
-            }
-
-
-        },
-
-        onLeave(retval) {
-            console.log(`===== ${addr} LEAVE =====`);
-            console.log(` ${addr}  Return value ${retval}`);
-            try {
-                if (checkValid(retval)) {
-                    console.log(addr + "||" + hexdump(retval, {
-                        offset: 0,
-                        length: 64
-                    }));
-                }
-
-            } catch (_) {
-            }
+MemoryAccessMonitor.enable(
+    {
+        base: targetPtr,
+        size: 0x40
+    },
+    {
+        onAccess(details) {
+            console.log("==== Memory Access ====");
+            console.log("Operation:", details.operation); // read / write / exec
+            console.log("From:", details.from.sub(targetModule.from).add(0x100000000).toString());
+            console.log("Address:", details.address);
+            console.log("=== Backtrace ===");
+            console.log(
+                Thread.backtrace(details.context, Backtracer.ACCURATE)
+                    .map(DebugSymbol.fromAddress)
+                    .join("\n")
+            );
         }
     });
-
-}
-
-
-const prs = ["1045BFED0"]
-const k = "";
-for (let pr of prs) {
-    handlePr(pr, k);
-}
-