From 3310be255370ba13b8631bfe5daa50c21af0f421 Mon Sep 17 00:00:00 2001 From: yincong Date: Mon, 1 Dec 2025 20:35:20 +0800 Subject: [PATCH] add receive --- frida/check_point_value.js | 25 ++++++--- frida/checkx26.js | 85 +++++++++++++++++++++++++++++ frida/keyword.js | 2 +- frida/other_memo_check.js | 2 +- frida/receive.js | 107 +++++++++++++++++++++++++++++++++++++ frida/script.js | 97 +++++++-------------------------- 6 files changed, 230 insertions(+), 88 deletions(-) create mode 100644 frida/checkx26.js create mode 100644 frida/receive.js diff --git a/frida/check_point_value.js b/frida/check_point_value.js index fd8a81b..afd4eae 100644 --- a/frida/check_point_value.js +++ b/frida/check_point_value.js @@ -1,5 +1,6 @@ const mod = Process.getModuleByName("WeChat"); console.log("[+] Base Address:", mod.base); +var counterMap = new Map(); function checkValid(p) { if (p.isNull()) { @@ -9,10 +10,7 @@ function checkValid(p) { if (!p.and(0x7).isNull()) { return false; } - if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) { - return true; - } - return false; + return p.compare("0x100000000") >= 0; } function handlePr(addr, keyword) { @@ -21,10 +19,12 @@ function handlePr(addr, keyword) { Interceptor.attach(realAddr, { onEnter(args) { - for (let i = 0; i < 10; i++) { + const currentCount = counterMap.get(addr) || 0; + counterMap.set(addr, currentCount + 1); + for (let i = 0; i < 30; i++) { try { if (checkValid(args[i])) { - const buf = args[i].readByteArray(128) + const buf = args[i].readByteArray(1024) if (!buf) { continue; } @@ -44,7 +44,6 @@ function handlePr(addr, keyword) { console.log(addr + "|| " + s + "\n" + Thread.backtrace(this.context, Backtracer.ACCURATE) .map(DebugSymbol.fromAddress).join('\n')); - return; } } } catch (e) { @@ -74,9 +73,19 @@ function handlePr(addr, keyword) { } -const prs = ["104565AD0", "104566E24", "1045CF820", "104590888", "1045BFED0", "104394290", "1043877CC", "104387764", "1043382C0"] +const prs = ["102454D74", "10247A138"] const k = ""; for (let pr of prs) { handlePr(pr, k); } +function ShowCount() { + for (let [addr, count] of counterMap) { + console.log(`${addr}: ${count}`); + } +} + +function clearCount() { + counterMap.clear(); + console.log("Counter cleared."); +} diff --git a/frida/checkx26.js b/frida/checkx26.js new file mode 100644 index 0000000..37f3cfc --- /dev/null +++ b/frida/checkx26.js @@ -0,0 +1,85 @@ +const mod = Process.getModuleByName("WeChat"); +console.log("[+] Base Address:", mod.base); +var counterMap = new Map(); + +function checkValid(p) { + if (p.isNull()) { + return false; + } + + if (!p.and(0x7).isNull()) { + return false; + } + if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) { + return true; + } + return false; +} + +function handlePr(addr, keyword) { + const realAddr = ptr("0x" + addr).sub("0x100000000").add(mod.base); + console.log("[+] real Address:", realAddr) + + Interceptor.attach(realAddr, { + onEnter(args) { + const currentCount = counterMap.get(addr) || 0; + counterMap.set(addr, currentCount + 1); + + try { + const x26Value = this.context.x26; + console.log(`[!] X26 Register Value: ${x26Value}`); + + + if (checkValid(x26Value)) { + console.log(`\n[+] ${addr} || X26 has a valid pointer: ${x26Value}`); + + const buf = x26Value.readByteArray(128); + if (buf) { + let s = ""; + const u8 = new Uint8Array(buf); + for (let b of u8) { + if (b >= 0x20 && b <= 0x7E) { + s += String.fromCharCode(b); + } else { + s += "."; + } + } + + if (s.includes(keyword) || keyword === "") { + console.log(addr + "|| X26 Read String: " + s + `${u8}`); + // 打印堆栈追踪 + console.log(Thread.backtrace(this.context, Backtracer.ACCURATE) + .map(DebugSymbol.fromAddress).join('\n')); + } + } + } + } catch (e) { + console.log("Enter Error:", e); + } + + + }, + + onLeave(retval) { + } + }); + +} + + +const prs = ["102454D74"] +const k = ""; +for (let pr of prs) { + handlePr(pr, k); +} + +function ShowCount() { + for (let [addr, count] of counterMap) { + console.log(`${addr}: ${count}`); + } +} + +function clearCount() { + counterMap.clear(); + console.log("Counter cleared."); +} diff --git a/frida/keyword.js b/frida/keyword.js index 9ab940c..d8eeb28 100644 --- a/frida/keyword.js +++ b/frida/keyword.js @@ -6,7 +6,7 @@ console.log(addrs); function memoGet(p) { p = "0x" + p; const idaAddr = ptr(p); - MemoryAccessMonitor.enable( + ryAccessMonitor.enable( { base: idaAddr, size: 0x40 // buffer 大小 diff --git a/frida/other_memo_check.js b/frida/other_memo_check.js index cac1b82..8acb4bd 100644 --- a/frida/other_memo_check.js +++ b/frida/other_memo_check.js @@ -8,7 +8,7 @@ MemoryAccessMonitor.enable( }, { onAccess(details) { - console.log("0x6000029C6DF0 Details:", JSON.stringify(details)); + console.log("memo Details:", JSON.stringify(details)); // console.log("0x6000029C6DF0 Access by:", DebugSymbol.fromAddress(details.from)); console.log(hexdump(idaAddr, { length: 0x40 })); } diff --git a/frida/receive.js b/frida/receive.js new file mode 100644 index 0000000..9f9b51c --- /dev/null +++ b/frida/receive.js @@ -0,0 +1,107 @@ +const mod = Process.getModuleByName("WeChat"); +console.log("[+] Base Address:", mod.base); +var counterMap = new Map(); + +function checkValid(p) { + if (p.isNull()) { + return false; + } + + if (!p.and(0x7).isNull()) { + return false; + } + if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) { + return true; + } + return false; +} + +function handlePr(addr, keyword) { + const realAddr = ptr("0x" + addr).sub("0x100000000").add(mod.base); + console.log("[+] real Address:", realAddr) + + Interceptor.attach(realAddr, { + onEnter(args) { + const currentCount = counterMap.get(addr) || 0; + counterMap.set(addr, currentCount + 1); + console.log(`${addr} called ${currentCount} times`); + + try { + if (this.context.x0.compare(ptr("0x100000000")) >= 0) { + console.log(`[!] X3 Register Value: ${this.context.x3}`); + dump(this.context.x0) + } + + if (this.context.x20.compare(ptr("0x100000000")) >= 0) { + console.log(`[!] X20 Register Value: ${this.context.x20}`); + dump(this.context.x20) + } + } catch (e) { + console.log("Enter Error:", e); + } + }, + + onLeave(retval) { + } + }); + +} + + +const prs = ["102B66C30"] +const k = ""; +for (let pr of prs) { + handlePr(pr, k); +} + +function ShowCount() { + for (let [addr, count] of counterMap) { + console.log(`${addr}: ${count}`); + } +} + +function clearCount() { + counterMap.clear(); + console.log("Counter cleared."); +} + + +function dump(xValue) { + console.log(`X has a pointer: ${xValue}`); + + let buf = null; + + try { + const buf = xValue.readByteArray(512) + let s = ""; + const u8 = new Uint8Array(buf); + for (let b of u8) { + if (b >= 0x20 && b <= 0x7E) { + s += String.fromCharCode(b); + } else { + s += "."; + } + } + + console.log(s); + + } catch (e) { + console.warn(`[!] 首次读取失败，尝试修改权限... 错误: ${e.message}`); + + } + + // --- 内存读取成功，进行解码 --- + if (buf) { + let s = ""; + const u8 = new Uint8Array(buf); + // ... (您的解码逻辑) + for (let b of u8) { + if (b >= 0x20 && b <= 0x7E) { + s += String.fromCharCode(b); + } else { + s += "."; + } + } + console.log(`|| Read String: ${s} \n|| Raw Data: ${u8}`); + } +} \ No newline at end of file diff --git a/frida/script.js b/frida/script.js index 470b847..fa64030 100644 --- a/frida/script.js +++ b/frida/script.js @@ -1,82 +1,23 @@ -const mod = Process.getModuleByName("WeChat"); -console.log("[+] Base Address:", mod.base); +const targetModule = Process.findModuleByName("WeChat"); // 仅关注主二进制文件 -function checkValid(p) { - if (p.isNull()) { - return false; - } +const targetPtr = ptr("0x600000EF1648"); // 你想监控的地址 - if (!p.and(0x7).isNull()) { - return false; - } - if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) { - return true; - } - return false; -} - -function handlePr(addr, keyword) { - const realAddr = ptr("0x" + addr).sub("0x100000000").add(mod.base); - console.log("[+] real Address:", realAddr) - - Interceptor.attach(realAddr, { - onEnter(args) { - for (let i = 0; i < 10; i++) { - try { - if (checkValid(args[i])) { - const buf = args[i].readByteArray(128) - if (!buf) { - continue; - } - let s = ""; - const u8 = new Uint8Array(buf); - for (let b of u8) { - if (b >= 0x20 && b <= 0x7E) { - s += String.fromCharCode(b); - } else { - s += "."; - } - } - - if (s.includes(keyword) || keyword === "") { - console.log(`\n[+] ${addr} || arg${i} ${args[i]}`); - console.log(hexdump(args[i], {length: 64})); - console.log(addr + "|| " + s + "\n" + - Thread.backtrace(this.context, Backtracer.ACCURATE) - .map(DebugSymbol.fromAddress).join('\n')); - return; - } - } - } catch (e) { - console.log("Enter Error:", e); - } - } - - - }, - - onLeave(retval) { - console.log(`===== ${addr} LEAVE =====`); - console.log(` ${addr} Return value ${retval}`); - try { - if (checkValid(retval)) { - console.log(addr + "||" + hexdump(retval, { - offset: 0, - length: 64 - })); - } - - } catch (_) { - } +MemoryAccessMonitor.enable( + { + base: targetPtr, + size: 0x40 + }, + { + onAccess(details) { + console.log("==== Memory Access ===="); + console.log("Operation:", details.operation); // read / write / exec + console.log("From:", details.from.sub(targetModule.from).add(0x100000000).toString()); + console.log("Address:", details.address); + console.log("=== Backtrace ==="); + console.log( + Thread.backtrace(details.context, Backtracer.ACCURATE) + .map(DebugSymbol.fromAddress) + .join("\n") + ); } }); - -} - - -const prs = ["1045BFED0"] -const k = ""; -for (let pr of prs) { - handlePr(pr, k); -} -