tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

update 107

Browse Source
This commit is contained in:
yincong
2026-04-16 09:56:22 +08:00
parent 3fdeb0f742
commit 360d0a30da
5 changed files with 46 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frida/file.js
+13 -13
View File
@@ -103,14 +103,14 @@ function generateBytes(n) {
// 双方公共使用的地址
var triggerX1Payload;
var triggerX0;
var req2bufEnterAddr = baseAddr.add(0x3885598);
var req2bufExitAddr = baseAddr.add(0x38866AC);
var sendFuncAddr = baseAddr.add(0x4a572c8);
var req2bufEnterAddr = baseAddr.add(0x388b400);
var req2bufExitAddr = baseAddr.add(0x388C514);
var sendFuncAddr = baseAddr.add(0x4a5e108);
var insertMsgAddr = ptr(0);
var sendMsgType = "";
// 图片消息全局变量
var imageCallbackFuncAddr = baseAddr.add(0x259F288);
var imageCallbackFuncAddr = baseAddr.add(0x25A3944);
var imgProtobufAddr = imageCallbackFuncAddr.add(0x50);
var patchImgProtobufFunc1 = imageCallbackFuncAddr.add(0x10);
var patchImgProtobufFunc1Byte;
@@ -120,7 +120,7 @@ var imgProtobufDeleteAddr = imageCallbackFuncAddr.add(0x6c);
var imgProtobufDeleteAddrByte;
// 视频消息全局变量
var videoCallbackFuncAddr = baseAddr.add(0x259F288);
var videoCallbackFuncAddr = baseAddr.add(0x25EC2D4);
var videoProtobufAddr = videoCallbackFuncAddr.add(0x50);
var patchVideoProtobufFunc1 = videoCallbackFuncAddr.add(0x10);
var patchVideoProtobufFunc1Byte;
@@ -129,15 +129,15 @@ var patchVideoProtobufFunc2Byte;
var videoProtobufDeleteAddr = videoCallbackFuncAddr.add(0x6c);
var videoProtobufDeleteAddrByte;
var uploadImageAddr = baseAddr.add(0x4b9e88c);
var cndOnCompleteAddr = baseAddr.add(0x3842974);
var imgMessageCallbackFunc1 = baseAddr.add(0x89FCFC8);
var videoMessageCallbackFunc1 = baseAddr.add(0x89FED48);
var uploadImageAddr = baseAddr.add(0x4ba56cc);
var cndOnCompleteAddr = baseAddr.add(0x38487b8);
var imgMessageCallbackFunc1 = baseAddr.add(0x8A05298);
var videoMessageCallbackFunc1 = baseAddr.add(0x8A07018);
var uploadGetCallbackWrapperAddr = baseAddr.add(0x4B6C350);
var uploadGetCallbackWrapperFuncAddr = baseAddr.add(0x38421C0);
var uploadOnCompleteAddr = baseAddr.add(0x4B6C94C);
var uploadOnCompleteFuncAddr = baseAddr.add(0x38433A4);
var uploadGetCallbackWrapperAddr = baseAddr.add(0x4b73190);
var uploadGetCallbackWrapperFuncAddr = baseAddr.add(0x3848004);
var uploadOnCompleteAddr = baseAddr.add(0x4B7378C);
var uploadOnCompleteFuncAddr = baseAddr.add(0x38491E8);
var uploadImageX1 = ptr(0);
var imgCgiAddr = ptr(0);
frida/receiver.js
+5 -5
View File
@@ -5,11 +5,11 @@ if (!baseAddr) {
}
console.log("[+] WeChat base address: " + baseAddr);
var buf2RespAddr = baseAddr.add(0x38aac10)
var downloadImagAddr = baseAddr.add(0x4cc261c) // image_download
var downloadFileAddr = baseAddr.add(0x4c613a4) // c2c_download
var downloadVideoAddr = baseAddr.add(0x4c83128) // hdvideo_streaming
var startDownloadMedia = baseAddr.add(0x4b9f500)
var buf2RespAddr = baseAddr.add(0x38b0a78)
var downloadImagAddr = baseAddr.add(0x4cc945c) // image_download
var downloadFileAddr = baseAddr.add(0x4c681e4) // c2c_download
var downloadVideoAddr = baseAddr.add(0x4c89f68) // hdvideo_streaming
var startDownloadMedia = baseAddr.add(0x4ba6340)
var downloadGlobalX0;
var downloadFileX1 = ptr(0)
frida/text.js
+5 -5
View File
@@ -78,7 +78,7 @@ function patchString(addr, plainStr) {
// -------------------------全局变量分区-------------------------
// 文本消息全局变量
var textCallbackFuncAddr = baseAddr.add(0x258295C);
var textCallbackFuncAddr = baseAddr.add(0x2587018);
var protobufAddr = textCallbackFuncAddr.add(0x40);
var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20);
var patchTextProtobufByte
@@ -90,15 +90,15 @@ var sendTextMessageAddr = ptr(0);
var textMessageAddr = ptr(0);
var textProtoX1PayloadAddr = ptr(0);
var sendMessageCallbackFunc = baseAddr.add(0x89FC4E0);
var sendMessageCallbackFunc = baseAddr.add(0x8A047B0);
// 双方公共使用的地址
var triggerX1Payload;
var triggerX0;
var req2bufEnterAddr = baseAddr.add(0x3885598);
var req2bufExitAddr = baseAddr.add(0x38866AC);
var sendFuncAddr = baseAddr.add(0x4a572c8);
var req2bufEnterAddr = baseAddr.add(0x388b400);
var req2bufExitAddr = baseAddr.add(0x388C514);
var sendFuncAddr = baseAddr.add(0x4a5e108);
var insertMsgAddr = ptr(0);
var sendMsgType = "";
onebot/main.go
+1 -1
View File
@@ -60,7 +60,7 @@ func initFlag() {
flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效")
flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot")
flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_104_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_107_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
flag.StringVar(&config.ConnType, "conn_type", "http", "连接类型: http | websocket")
flag.IntVar(&config.SendInterval, "send_interval", 1000, "发送间隔: ms")
flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 PID，不设置则自动查找")
wechat_version/4_1_8_107_mac.json
+22
View File
@@ -0,0 +1,22 @@
{
"textCallbackFuncAddr": "0x2587018",
"sendMessageCallbackFunc": "0x8A047B0",
"sendFuncAddr": "0x4a5e108",
"req2bufEnterAddr": "0x388b400",
"req2bufExitAddr": "0x388C514",
"imageCallbackFuncAddr": "0x25A3944",
"imgMessageCallbackFunc": "0x8A05298",
"uploadImageAddr": "0x4ba56cc",
"cndOnCompleteAddr": "0x38487b8",
"buf2RespAddr": "0x38b0a78",
"uploadGetCallbackWrapperAddr": "0x4b73190",
"uploadGetCallbackWrapperFuncAddr": "0x3848004",
"uploadOnCompleteAddr": "0x4B7378C",
"uploadOnCompleteFuncAddr": "0x38491E8",
"downloadImagAddr": "0x4cc945c",
"startDownloadMedia": "0x4ba6340",
"downloadFileAddr": "0x4c681e4",
"downloadVideoAddr": "0x4c89f68",
"videoCallbackFuncAddr": "0x25EC2D4",
"videoMessageCallbackFunc": "0x8A07018"
}