mirror of
https://github.com/yincongcyincong/wechat_chatter.git
synced 2026-07-15 10:26:52 +08:00
update image
This commit is contained in:
yincong
+194
-165
@@ -11,7 +11,7 @@ var sendMessageCallbackFunc = baseAddr.add(0xAA8C5B078);
|
||||
var messageCallbackFunc1 = baseAddr.add(0x7fa0b18);
|
||||
var messageCallbackFunc2 = baseAddr.add(0x7fa0b70);
|
||||
var messageCallbackFunc3 = baseAddr.add(0x804ae78);
|
||||
var messageCallbackFunc4 = baseAddr.add(0x803ac78);
|
||||
var messageCallbackFunc4 = baseAddr.add(0x8030a00);
|
||||
|
||||
// 这个必须是绝对位置
|
||||
var triggerX1Payload = ptr(0x175ED6600);
|
||||
@@ -20,8 +20,9 @@ var req2bufEnterAddr = baseAddr.add(0x34566C0);
|
||||
var req2bufExitAddr = baseAddr.add(0x34577D8);
|
||||
var protobufAddr = baseAddr.add(0x2275BFC);
|
||||
var buf2RespAddr = baseAddr.add(0x347BD44);
|
||||
// var patchProtobufAddr = baseAddr.add(0x2275BD8);
|
||||
// var protobufDeleteAddr = baseAddr.add(0x2275C14);
|
||||
var patchProtobufFunc1 = baseAddr.add(0x2275BB8)
|
||||
var patchProtobufFunc2 = baseAddr.add(0x2275BD8);
|
||||
var protobufDeleteAddr = baseAddr.add(0x2275C14);
|
||||
|
||||
// 触发函数X0参数地址
|
||||
var globalMessagePtr = ptr(0);
|
||||
@@ -30,6 +31,7 @@ var globalMessagePtr = ptr(0);
|
||||
var cgiAddr = ptr(0);
|
||||
var callBackFuncAddr = ptr(0);
|
||||
var callBackFuncAddr2 = ptr(0);
|
||||
var callBackFuncAddr3 = ptr(0);
|
||||
|
||||
var sendMessageAddr = ptr(0);
|
||||
var messageAddr = ptr(0);
|
||||
@@ -39,7 +41,6 @@ var insertMsgAddr = ptr(0);
|
||||
var receiverAddr = ptr(0);
|
||||
var htmlContentAddr = ptr(0);
|
||||
var protoX1PayloadAddr = ptr(0);
|
||||
var protoX1PayloadLen = 1024;
|
||||
|
||||
// 消息的taskId
|
||||
var taskIdGlobal = 0x20000090 // 最好比较大，不和原始的微信消息重复
|
||||
@@ -74,6 +75,7 @@ function setupSendMessageDynamic() {
|
||||
cgiAddr = Memory.alloc(128);
|
||||
callBackFuncAddr = Memory.alloc(16);
|
||||
callBackFuncAddr2 = Memory.alloc(16);
|
||||
callBackFuncAddr3 = Memory.alloc(16);
|
||||
sendMessageAddr = Memory.alloc(256);
|
||||
messageAddr = Memory.alloc(512);
|
||||
contentAddr = Memory.alloc(255);
|
||||
@@ -88,10 +90,10 @@ function setupSendMessageDynamic() {
|
||||
// B. 构建 SendMessage 结构体 (X24 基址位置)
|
||||
sendMessageAddr.add(0x00).writeU64(0);
|
||||
sendMessageAddr.add(0x08).writeU64(0);
|
||||
sendMessageAddr.add(0x10).writePointer(sendMessageCallbackFunc); // 虚表地址通常仍需硬编码或从模块基址计算
|
||||
sendMessageAddr.add(0x10).writePointer(sendMessageCallbackFunc);
|
||||
sendMessageAddr.add(0x18).writeU64(1);
|
||||
sendMessageAddr.add(0x20).writeU32(taskIdGlobal);
|
||||
sendMessageAddr.add(0x28).writePointer(messageAddr); // 指向动态分配的 Message
|
||||
sendMessageAddr.add(0x28).writePointer(messageAddr);
|
||||
|
||||
console.log(" [+] sendMessageAddr Object: ", hexdump(sendMessageAddr, {
|
||||
offset: 0,
|
||||
@@ -106,22 +108,9 @@ function setupSendMessageDynamic() {
|
||||
messageAddr.add(0x0c).writeU32(0x6e);
|
||||
messageAddr.add(0x10).writeU64(0x3);
|
||||
messageAddr.add(0x18).writePointer(cgiAddr);
|
||||
|
||||
// 设置一些固定值
|
||||
messageAddr.add(0x20).writeU64(uint64("0x20"));
|
||||
messageAddr.add(0x20).writeU64(0x22);
|
||||
messageAddr.add(0x28).writeU64(uint64("0x8000000000000030"));
|
||||
messageAddr.add(0x30).writeU64(uint64("0x0000000001010100"));
|
||||
messageAddr.add(0x58).writeU64(uint64("0x0101010100000001"));
|
||||
|
||||
// 处理回调地址
|
||||
callBackFuncAddr.writePointer(messageCallbackFunc2);
|
||||
messageAddr.add(0x98).writePointer(callBackFuncAddr);
|
||||
|
||||
// 设置内容指针
|
||||
messageAddr.add(0xb8).writePointer(messageCallbackFunc3);
|
||||
callBackFuncAddr2.writePointer(messageCallbackFunc4);
|
||||
messageAddr.add(0xc0).writePointer(callBackFuncAddr2);
|
||||
|
||||
|
||||
console.log(" [+] messageAddr Object: ", hexdump(messageAddr, {
|
||||
offset: 0,
|
||||
@@ -215,24 +204,32 @@ setImmediate(setupSendMessageDynamic);
|
||||
|
||||
|
||||
function patchProtoBuf() {
|
||||
// Memory.patchCode(patchProtobufAddr, 4, code => {
|
||||
// const cw = new Arm64Writer(code, {pc: patchProtobufAddr});
|
||||
// cw.putNop();
|
||||
// cw.flush();
|
||||
// });
|
||||
//
|
||||
// console.log("[+] Patching BL to NOP at " + patchProtobufAddr + " completed.");
|
||||
//
|
||||
// Memory.patchCode(protobufDeleteAddr, 4, code => {
|
||||
// const cw = new Arm64Writer(code, {pc: protobufDeleteAddr});
|
||||
// cw.putNop();
|
||||
// cw.flush();
|
||||
// });
|
||||
//
|
||||
// console.log("[+] Patching BL DELETE to NOP at " + protobufDeleteAddr + " completed.");
|
||||
Memory.patchCode(patchProtobufFunc1, 4, code => {
|
||||
const cw = new Arm64Writer(code, {pc: patchProtobufFunc1});
|
||||
cw.putNop();
|
||||
cw.flush();
|
||||
});
|
||||
|
||||
console.log("[+] Patching BL to NOP at " + patchProtobufFunc1 + " completed.");
|
||||
|
||||
Memory.patchCode(patchProtobufFunc2, 4, code => {
|
||||
const cw = new Arm64Writer(code, {pc: patchProtobufFunc2});
|
||||
cw.putNop();
|
||||
cw.flush();
|
||||
});
|
||||
|
||||
console.log("[+] Patching BL to NOP at " + patchProtobufFunc2 + " completed.");
|
||||
|
||||
Memory.patchCode(protobufDeleteAddr, 4, code => {
|
||||
const cw = new Arm64Writer(code, {pc: protobufDeleteAddr});
|
||||
cw.putNop();
|
||||
cw.flush();
|
||||
});
|
||||
|
||||
console.log("[+] Patching BL DELETE to NOP at " + protobufDeleteAddr + " completed.");
|
||||
}
|
||||
|
||||
setImmediate(patchProtoBuf);
|
||||
// setImmediate(patchProtoBuf);
|
||||
|
||||
function manualTrigger(taskId, receiver, content) {
|
||||
console.log("[+] Manual Trigger Started...");
|
||||
@@ -447,7 +444,7 @@ function generateRandom5ByteVarint() {
|
||||
// 拦截 Protobuf 编码逻辑，注入自定义 Payload
|
||||
function attachProto() {
|
||||
console.log("[+] proto注入拦截目标地址: " + protobufAddr);
|
||||
protoX1PayloadAddr = Memory.alloc(protoX1PayloadLen);
|
||||
protoX1PayloadAddr = Memory.alloc(1024);
|
||||
console.log("[+] Frida 分配的 Payload 地址: " + protoX1PayloadAddr);
|
||||
|
||||
Interceptor.attach(protobufAddr, {
|
||||
@@ -470,14 +467,16 @@ function attachProto() {
|
||||
// // UnifiedPCMac 26 arm64
|
||||
// const sys = [0x55, 0x6E, 0x69, 0x66, 0x69, 0x65, 0x64, 0x50, 0x43, 0x4D, 0x61, 0x63, 0x20, 0x32, 0x36, 0x20, 0x61, 0x72, 0x6D, 0x36, 0x34]
|
||||
// const msgIdHeader = [0x30, 0x73, 0x12, 0x2E, 0x0A, 0x2C]
|
||||
// // 45872025384@chatroom_176787000_60_xwechat_1
|
||||
// // 45872025384@chatroom_176787000_60_xwechat_1 只需要改这个时间戳就能重复发送
|
||||
// const receiverMsgId = [0x34, 0x35, 0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38, 0x34,
|
||||
// 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F, 0x6F, 0x6D, 0x5F, 0x31, 0x37, 0x36, 0x37, 0x38, 0x37,
|
||||
// 0x30, 0x30, 0x30, 0x30, 0x5F, 0x36, 0x30, 0x5F, 0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, 0x5F, 0x31,
|
||||
// ]
|
||||
// const senderHeader = [0x1A, 0x15, 0x0A, 0x13];
|
||||
// // wxid_xxxx 或者 chatroom
|
||||
// const sender = [0x77, 0x78, 0x69, 0x64, 0x5F, 0x6C, 0x64, 0x66, 0x74, 0x75, 0x68, 0x65, 0x33, 0x36, 0x69, 0x7A, 0x67, 0x31, 0x39];
|
||||
// const receiverHeader = [0x22, 0x16, 0x0A, 0x14]
|
||||
// // wxid_xxxx
|
||||
// const receiver = [0x34, 0x35, 0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38, 0x34, 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F, 0x6F, 0x6D]
|
||||
// const randomId1 = [0x28, 0xF4, 0x0B]
|
||||
// const type1 = [0x30, 0x00]
|
||||
@@ -632,7 +631,7 @@ function attachProto() {
|
||||
// ]
|
||||
|
||||
const finalPayload = [
|
||||
0x0A, 0x40, 0x0A, 0x01, 0x00, 0x10, 0xC6, 0xBC,
|
||||
0x0A, 0x3F, 0x0A, 0x01, 0x00, 0x10, 0xC6, 0xBC,
|
||||
0x90, 0xB9, 0x08, 0x1A, 0x10, 0x6D, 0x33, 0x30,
|
||||
0x63, 0x34, 0x36, 0x37, 0x34, 0x66, 0x35, 0x61,
|
||||
0x30, 0x62, 0x39, 0x64, 0x30, 0x20, 0xAF, 0xAC,
|
||||
@@ -640,134 +639,129 @@ function attachProto() {
|
||||
0x2A, 0x15, 0x55, 0x6E, 0x69, 0x66, 0x69, 0x65,
|
||||
0x64, 0x50, 0x43, 0x4D, 0x61, 0x63, 0x20, 0x32,
|
||||
0x36, 0x20, 0x61, 0x72, 0x6D, 0x36, 0x34, 0x30,
|
||||
0x96, 0x03, 0x12, 0x2F, 0x0A, 0x2D, 0x34, 0x35,
|
||||
0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38,
|
||||
0x34, 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F,
|
||||
0x6F, 0x6D, 0x5F, 0x31, 0x37, 0x36, 0x37, 0x38,
|
||||
0x37, 0x38, 0x30, 0x37, 0x30, 0x5F, 0x38, 0x32,
|
||||
0x5F, 0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74,
|
||||
0x5F, 0x31, 0x37, 0x1A, 0x15, 0x0A, 0x13, 0x77,
|
||||
0x78, 0x69, 0x64, 0x5F, 0x6C, 0x64, 0x66, 0x74,
|
||||
0x75, 0x68, 0x65, 0x33, 0x36, 0x69, 0x7A, 0x67,
|
||||
0x31, 0x39, 0x22, 0x16, 0x0A, 0x14, 0x34, 0x35,
|
||||
0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38,
|
||||
0x34, 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F,
|
||||
0x6F, 0x6D, 0x28, 0xF4, 0x0D, 0x30, 0x00, 0x38,
|
||||
0xF4, 0x0D, 0x42, 0x04, 0x08, 0x00, 0x12, 0x00,
|
||||
0x48, 0x03, 0x52, 0x83, 0x01, 0x3C, 0x6D, 0x73,
|
||||
0x67, 0x73, 0x6F, 0x75, 0x72, 0x63, 0x65, 0x3E,
|
||||
0x3C, 0x69, 0x6D, 0x67, 0x5F, 0x66, 0x69, 0x6C,
|
||||
0x65, 0x5F, 0x6E, 0x61, 0x6D, 0x65, 0x3E, 0x37,
|
||||
0x65, 0x32, 0x39, 0x33, 0x31, 0x61, 0x63, 0x2D,
|
||||
0x31, 0x35, 0x37, 0x65, 0x2D, 0x34, 0x31, 0x33,
|
||||
0x34, 0x2D, 0x39, 0x37, 0x33, 0x35, 0x2D, 0x36,
|
||||
0x63, 0x35, 0x39, 0x33, 0x66, 0x34, 0x35, 0x30,
|
||||
0x39, 0x65, 0x63, 0x2E, 0x70, 0x6E, 0x67, 0x3C,
|
||||
0x2F, 0x69, 0x6D, 0x67, 0x5F, 0x66, 0x69, 0x6C,
|
||||
0x65, 0x5F, 0x6E, 0x61, 0x6D, 0x65, 0x3E, 0x3C,
|
||||
0x61, 0x6C, 0x6E, 0x6F, 0x64, 0x65, 0x3E, 0x3C,
|
||||
0x66, 0x72, 0x3E, 0x31, 0x3C, 0x2F, 0x66, 0x72,
|
||||
0x3E, 0x3C, 0x63, 0x66, 0x3E, 0x33, 0x3C, 0x2F,
|
||||
0x63, 0x66, 0x3E, 0x3C, 0x2F, 0x61, 0x6C, 0x6E,
|
||||
0x6F, 0x64, 0x65, 0x3E, 0x3C, 0x2F, 0x6D, 0x73,
|
||||
0x67, 0x73, 0x6F, 0x75, 0x72, 0x63, 0x65, 0x3E,
|
||||
0x58, 0x01, 0x60, 0x02, 0x68, 0x05, 0x7A, 0xB2,
|
||||
0x01, 0x33, 0x30, 0x35, 0x37, 0x30, 0x32, 0x30,
|
||||
0x31, 0x30, 0x30, 0x30, 0x34, 0x34, 0x62, 0x33,
|
||||
0x30, 0x34, 0x39, 0x30, 0x32, 0x30, 0x31, 0x30,
|
||||
0x30, 0x30, 0x32, 0x30, 0x34, 0x64, 0x30, 0x61,
|
||||
0x37, 0x30, 0x39, 0x35, 0x64, 0x30, 0x32, 0x30,
|
||||
0x33, 0x32, 0x66, 0x36, 0x30, 0x32, 0x31, 0x30,
|
||||
0x32, 0x30, 0x34, 0x62, 0x33, 0x61, 0x38, 0x33,
|
||||
0x63, 0x62, 0x37, 0x30, 0x32, 0x30, 0x34, 0x36,
|
||||
0x39, 0x35, 0x66, 0x61, 0x64, 0x62, 0x37, 0x30,
|
||||
0x34, 0x32, 0x34, 0x36, 0x35, 0x33, 0x34, 0x33,
|
||||
0x39, 0x36, 0x33, 0x33, 0x35, 0x33, 0x39, 0x33,
|
||||
0x35, 0x36, 0x31, 0x32, 0x64, 0x36, 0x35, 0x33,
|
||||
0x33, 0x33, 0x32, 0x36, 0x34, 0x32, 0x64, 0x33,
|
||||
0x34, 0x33, 0x31, 0x36, 0x35, 0x33, 0x33, 0x32,
|
||||
0x64, 0x33, 0x39, 0x36, 0x31, 0x33, 0x39, 0x33,
|
||||
0x31, 0x32, 0x64, 0x36, 0x36, 0x33, 0x35, 0x33,
|
||||
0x34, 0x36, 0x31, 0x33, 0x32, 0x33, 0x32, 0x33,
|
||||
0x30, 0x33, 0x32, 0x33, 0x36, 0x33, 0x34, 0x36,
|
||||
0x32, 0x33, 0x35, 0x30, 0x32, 0x30, 0x34, 0x30,
|
||||
0x35, 0x32, 0x34, 0x33, 0x38, 0x30, 0x31, 0x30,
|
||||
0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x30,
|
||||
0x35, 0x30, 0x30, 0x34, 0x63, 0x35, 0x34, 0x33,
|
||||
0x64, 0x30, 0x30, 0x82, 0x01, 0xB2, 0x01, 0x33,
|
||||
0x30, 0x35, 0x37, 0x30, 0x32, 0x30, 0x31, 0x30,
|
||||
0x30, 0x30, 0x34, 0x34, 0x62, 0x33, 0x30, 0x34,
|
||||
0x39, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30,
|
||||
0x32, 0x30, 0x34, 0x64, 0x30, 0x61, 0x37, 0x30,
|
||||
0x39, 0x35, 0x64, 0x30, 0x32, 0x30, 0x33, 0x32,
|
||||
0x66, 0x36, 0x30, 0x32, 0x31, 0x30, 0x32, 0x30,
|
||||
0x34, 0x62, 0x33, 0x61, 0x38, 0x33, 0x63, 0x62,
|
||||
0x37, 0x30, 0x32, 0x30, 0x34, 0x36, 0x39, 0x35,
|
||||
0x66, 0x61, 0x64, 0x62, 0x37, 0x30, 0x34, 0x32,
|
||||
0x34, 0x36, 0x35, 0x33, 0x34, 0x33, 0x39, 0x36,
|
||||
0x33, 0x33, 0x35, 0x33, 0x39, 0x33, 0x35, 0x36,
|
||||
0x31, 0x32, 0x64, 0x36, 0x35, 0x33, 0x33, 0x33,
|
||||
0x32, 0x36, 0x34, 0x32, 0x64, 0x33, 0x34, 0x33,
|
||||
0x31, 0x36, 0x35, 0x33, 0x33, 0x32, 0x64, 0x33,
|
||||
0x39, 0x36, 0x31, 0x33, 0x39, 0x33, 0x31, 0x32,
|
||||
0x64, 0x36, 0x36, 0x33, 0x35, 0x33, 0x34, 0x36,
|
||||
0x61, 0x33, 0x32, 0x33, 0x32, 0x33, 0x30, 0x33,
|
||||
0x32, 0x33, 0x36, 0x33, 0x34, 0x36, 0x32, 0x33,
|
||||
0x35, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35, 0x32,
|
||||
0x34, 0x33, 0x38, 0x30, 0x31, 0x30, 0x32, 0x30,
|
||||
0x31, 0x30, 0x30, 0x30, 0x34, 0x30, 0x35, 0x30,
|
||||
0x30, 0x34, 0x63, 0x35, 0x34, 0x33, 0x64, 0x30,
|
||||
0x30, 0x8A, 0x01, 0x20, 0x61, 0x35, 0x62, 0x61,
|
||||
0x31, 0x65, 0x61, 0x33, 0x62, 0x33, 0x61, 0x31,
|
||||
0x35, 0x66, 0x33, 0x32, 0x32, 0x38, 0x34, 0x61,
|
||||
0x31, 0x37, 0x34, 0x35, 0x64, 0x35, 0x34, 0x37,
|
||||
0x36, 0x38, 0x36, 0x66, 0x90, 0x01, 0x01, 0x98,
|
||||
0x01, 0xFE, 0x16, 0xA0, 0x01, 0xFE, 0x16, 0xAA,
|
||||
0x01, 0xB2, 0x01, 0x33, 0x30, 0x35, 0x37, 0x30,
|
||||
0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x34,
|
||||
0x62, 0x33, 0x30, 0x34, 0x49, 0x30, 0x32, 0x30,
|
||||
0x31, 0x30, 0x30, 0x30, 0x32, 0x30, 0x34, 0x64,
|
||||
0x30, 0x61, 0x37, 0x30, 0x39, 0x35, 0x64, 0x30,
|
||||
0x32, 0x30, 0x33, 0x32, 0x66, 0x36, 0x30, 0x32,
|
||||
0x31, 0x30, 0x32, 0x30, 0x34, 0x62, 0x33, 0x61,
|
||||
0x38, 0x33, 0x63, 0x62, 0x37, 0x30, 0x32, 0x30,
|
||||
0x34, 0x36, 0x39, 0x35, 0x66, 0x61, 0x64, 0x62,
|
||||
0x37, 0x30, 0x34, 0x32, 0x34, 0x36, 0x35, 0x33,
|
||||
0x34, 0x33, 0x39, 0x36, 0x33, 0x33, 0x35, 0x33,
|
||||
0x39, 0x33, 0x35, 0x36, 0x61, 0x32, 0x64, 0x36,
|
||||
0x35, 0x33, 0x33, 0x33, 0x32, 0x36, 0x34, 0x32,
|
||||
0x64, 0x33, 0x34, 0x33, 0x31, 0x36, 0x35, 0x33,
|
||||
0x33, 0x32, 0x64, 0x33, 0x39, 0x36, 0x31, 0x33,
|
||||
0x39, 0x33, 0x31, 0x32, 0x64, 0x36, 0x36, 0x33,
|
||||
0x35, 0x33, 0x34, 0x36, 0x31, 0x33, 0x32, 0x33,
|
||||
0x32, 0x33, 0x30, 0x33, 0x32, 0x33, 0x36, 0x33,
|
||||
0x34, 0x36, 0x32, 0x33, 0x35, 0x30, 0x32, 0x30,
|
||||
0x34, 0x30, 0x35, 0x32, 0x34, 0x33, 0x38, 0x30,
|
||||
0x31, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30,
|
||||
0x34, 0x40, 0x35, 0x30, 0x30, 0x34, 0x63, 0x35,
|
||||
0x34, 0x33, 0x64, 0x30, 0x30, 0xB0, 0x01, 0xF4,
|
||||
0x0D, 0xB8, 0x01, 0x88, 0x01, 0xC0, 0x01, 0x8E,
|
||||
0x01, 0xCA, 0x01, 0x20, 0x61, 0x35, 0x62, 0x61,
|
||||
0x31, 0x65, 0x61, 0x33, 0x62, 0x33, 0x61, 0x31,
|
||||
0x35, 0x66, 0x33, 0x32, 0x32, 0x38, 0x34, 0x61,
|
||||
0x31, 0x37, 0x34, 0x35, 0x64, 0x35, 0x34, 0x37,
|
||||
0x36, 0x38, 0x36, 0x66, 0xDA, 0x01, 0x20, 0x35,
|
||||
0x37, 0x35, 0x34, 0x30, 0x30, 0x63, 0x33, 0x36,
|
||||
0x30, 0x36, 0x38, 0x61, 0x61, 0x34, 0x36, 0x37,
|
||||
0x63, 0x63, 0x37, 0x64, 0x64, 0x39, 0x34, 0x31,
|
||||
0x39, 0x62, 0x61, 0x34, 0x30, 0x36, 0x61, 0xE0,
|
||||
0x01, 0xD3, 0xBB, 0xA6, 0xB4, 0x03, 0xF0, 0x01,
|
||||
0x00, 0xA0, 0x02, 0x00, 0xC8, 0x02, 0x00, 0x00,
|
||||
0x6F, 0x12, 0x2E, 0x0A, 0x2C, 0x77, 0x78, 0x69,
|
||||
0x64, 0x5F, 0x37, 0x77, 0x64, 0x31, 0x65, 0x63,
|
||||
0x65, 0x39, 0x39, 0x66, 0x37, 0x69, 0x32, 0x31,
|
||||
0x5F, 0x31, 0x37, 0x36, 0x37, 0x39, 0x33, 0x39,
|
||||
0x31, 0x31, 0x30, 0x5F, 0x31, 0x33, 0x33, 0x5F,
|
||||
0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, 0x5F,
|
||||
0x31, 0x1A, 0x15, 0x0A, 0x13, 0x77, 0x78, 0x69,
|
||||
0x64, 0x5F, 0x6C, 0x64, 0x66, 0x74, 0x75, 0x68,
|
||||
0x65, 0x33, 0x36, 0x69, 0x7A, 0x67, 0x31, 0x39,
|
||||
0x22, 0x15, 0x0A, 0x13, 0x77, 0x78, 0x69, 0x64,
|
||||
0x5F, 0x37, 0x77, 0x64, 0x31, 0x65, 0x63, 0x65,
|
||||
0x39, 0x39, 0x66, 0x37, 0x69, 0x32, 0x31, 0x28,
|
||||
0x88, 0x12, 0x30, 0x00, 0x38, 0x88, 0x12, 0x42,
|
||||
0x04, 0x08, 0x00, 0x12, 0x00, 0x48, 0x03, 0x52,
|
||||
0x83, 0x01, 0x3C, 0x6D, 0x73, 0x67, 0x73, 0x6F,
|
||||
0x75, 0x72, 0x63, 0x65, 0x3E, 0x3C, 0x69, 0x6D,
|
||||
0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, 0x6E,
|
||||
0x61, 0x6D, 0x65, 0x3E, 0x30, 0x39, 0x64, 0x32,
|
||||
0x32, 0x63, 0x34, 0x63, 0x2D, 0x33, 0x38, 0x65,
|
||||
0x35, 0x2D, 0x34, 0x61, 0x30, 0x34, 0x2D, 0x62,
|
||||
0x30, 0x64, 0x63, 0x2D, 0x35, 0x63, 0x65, 0x30,
|
||||
0x62, 0x39, 0x30, 0x37, 0x66, 0x31, 0x64, 0x64,
|
||||
0x2E, 0x70, 0x6E, 0x67, 0x3C, 0x2F, 0x69, 0x6D,
|
||||
0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, 0x6E,
|
||||
0x61, 0x6D, 0x65, 0x3E, 0x3C, 0x61, 0x6C, 0x6E,
|
||||
0x6F, 0x64, 0x65, 0x3E, 0x3C, 0x66, 0x72, 0x3E,
|
||||
0x31, 0x3C, 0x2F, 0x66, 0x72, 0x3E, 0x3C, 0x63,
|
||||
0x66, 0x3E, 0x33, 0x3C, 0x2F, 0x63, 0x66, 0x3E,
|
||||
0x3C, 0x2F, 0x61, 0x6C, 0x6E, 0x6F, 0x64, 0x65,
|
||||
0x3E, 0x3C, 0x2F, 0x6D, 0x73, 0x67, 0x73, 0x6F,
|
||||
0x75, 0x72, 0x63, 0x65, 0x3E, 0x58, 0x01, 0x60,
|
||||
0x02, 0x68, 0x05, 0x7A, 0xB2, 0x01, 0x33, 0x30,
|
||||
0x35, 0x37, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30,
|
||||
0x30, 0x34, 0x34, 0x62, 0x33, 0x30, 0x34, 0x39,
|
||||
0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x32,
|
||||
0x30, 0x34, 0x64, 0x30, 0x61, 0x37, 0x30, 0x39,
|
||||
0x35, 0x64, 0x30, 0x32, 0x30, 0x33, 0x32, 0x64,
|
||||
0x64, 0x32, 0x37, 0x39, 0x30, 0x32, 0x30, 0x34,
|
||||
0x37, 0x65, 0x64, 0x35, 0x36, 0x63, 0x37, 0x31,
|
||||
0x30, 0x32, 0x30, 0x34, 0x36, 0x39, 0x36, 0x30,
|
||||
0x39, 0x63, 0x32, 0x37, 0x30, 0x34, 0x32, 0x34,
|
||||
0x33, 0x37, 0x36, 0x33, 0x36, 0x34, 0x33, 0x38,
|
||||
0x33, 0x34, 0x33, 0x30, 0x33, 0x38, 0x36, 0x31,
|
||||
0x32, 0x64, 0x33, 0x31, 0x36, 0x31, 0x33, 0x37,
|
||||
0x33, 0x33, 0x32, 0x64, 0x33, 0x34, 0x36, 0x33,
|
||||
0x33, 0x36, 0x33, 0x39, 0x32, 0x64, 0x36, 0x31,
|
||||
0x33, 0x36, 0x33, 0x37, 0x36, 0x34, 0x32, 0x64,
|
||||
0x33, 0x37, 0x33, 0x38, 0x36, 0x35, 0x33, 0x39,
|
||||
0x33, 0x34, 0x33, 0x33, 0x33, 0x37, 0x36, 0x34,
|
||||
0x36, 0x34, 0x33, 0x39, 0x36, 0x31, 0x33, 0x38,
|
||||
0x30, 0x32, 0x30, 0x34, 0x30, 0x35, 0x31, 0x34,
|
||||
0x33, 0x38, 0x30, 0x31, 0x30, 0x32, 0x30, 0x31,
|
||||
0x30, 0x30, 0x30, 0x34, 0x30, 0x35, 0x30, 0x30,
|
||||
0x34, 0x63, 0x35, 0x35, 0x63, 0x64, 0x30, 0x30,
|
||||
0x82, 0x01, 0xB2, 0x01, 0x33, 0x30, 0x35, 0x37,
|
||||
0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34,
|
||||
0x34, 0x62, 0x33, 0x30, 0x34, 0x39, 0x30, 0x32,
|
||||
0x30, 0x31, 0x30, 0x30, 0x30, 0x32, 0x30, 0x34,
|
||||
0x64, 0x30, 0x61, 0x37, 0x30, 0x39, 0x35, 0x64,
|
||||
0x30, 0x32, 0x30, 0x33, 0x32, 0x64, 0x64, 0x32,
|
||||
0x37, 0x39, 0x30, 0x32, 0x30, 0x34, 0x37, 0x65,
|
||||
0x64, 0x35, 0x36, 0x63, 0x37, 0x31, 0x30, 0x32,
|
||||
0x30, 0x34, 0x36, 0x39, 0x36, 0x30, 0x39, 0x63,
|
||||
0x32, 0x37, 0x30, 0x34, 0x32, 0x34, 0x33, 0x37,
|
||||
0x36, 0x33, 0x36, 0x34, 0x33, 0x38, 0x33, 0x34,
|
||||
0x33, 0x30, 0x33, 0x38, 0x36, 0x31, 0x32, 0x64,
|
||||
0x33, 0x31, 0x36, 0x31, 0x33, 0x37, 0x33, 0x33,
|
||||
0x32, 0x64, 0x33, 0x34, 0x36, 0x33, 0x33, 0x36,
|
||||
0x33, 0x39, 0x32, 0x64, 0x36, 0x31, 0x33, 0x36,
|
||||
0x33, 0x37, 0x36, 0x34, 0x32, 0x64, 0x33, 0x37,
|
||||
0x33, 0x38, 0x36, 0x35, 0x33, 0x39, 0x33, 0x34,
|
||||
0x33, 0x33, 0x33, 0x37, 0x36, 0x34, 0x36, 0x34,
|
||||
0x33, 0x39, 0x36, 0x31, 0x33, 0x38, 0x30, 0x32,
|
||||
0x30, 0x34, 0x30, 0x35, 0x31, 0x34, 0x33, 0x38,
|
||||
0x30, 0x31, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30,
|
||||
0x30, 0x34, 0x30, 0x35, 0x30, 0x30, 0x34, 0x63,
|
||||
0x35, 0x35, 0x63, 0x64, 0x30, 0x30, 0x8A, 0x01,
|
||||
0x20, 0x30, 0x33, 0x39, 0x61, 0x63, 0x63, 0x32,
|
||||
0x66, 0x30, 0x65, 0x33, 0x33, 0x63, 0x32, 0x66,
|
||||
0x64, 0x63, 0x35, 0x38, 0x36, 0x31, 0x62, 0x66,
|
||||
0x34, 0x63, 0x34, 0x62, 0x61, 0x30, 0x35, 0x30,
|
||||
0x30, 0x90, 0x01, 0x01, 0x98, 0x01, 0xCD, 0x26,
|
||||
0xA0, 0x01, 0xCD, 0x26, 0xAA, 0x01, 0xB2, 0x01,
|
||||
0x33, 0x30, 0x35, 0x37, 0x30, 0x32, 0x30, 0x31,
|
||||
0x30, 0x30, 0x30, 0x34, 0x34, 0x62, 0x33, 0x30,
|
||||
0x34, 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30,
|
||||
0x30, 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, 0x37,
|
||||
0x30, 0x39, 0x35, 0x64, 0x30, 0x32, 0x30, 0x33,
|
||||
0x32, 0x64, 0x64, 0x32, 0x37, 0x39, 0x30, 0x32,
|
||||
0x30, 0x34, 0x37, 0x65, 0x64, 0x35, 0x36, 0x63,
|
||||
0x37, 0x31, 0x30, 0x32, 0x30, 0x34, 0x36, 0x39,
|
||||
0x36, 0x30, 0x39, 0x63, 0x32, 0x37, 0x30, 0x34,
|
||||
0x32, 0x34, 0x33, 0x37, 0x36, 0x33, 0x36, 0x34,
|
||||
0x33, 0x38, 0x33, 0x34, 0x33, 0x30, 0x33, 0x38,
|
||||
0x36, 0x31, 0x32, 0x64, 0x33, 0x31, 0x36, 0x31,
|
||||
0x33, 0x37, 0x33, 0x33, 0x32, 0x64, 0x33, 0x34,
|
||||
0x36, 0x33, 0x33, 0x36, 0x33, 0x39, 0x32, 0x64,
|
||||
0x36, 0x31, 0x33, 0x36, 0x33, 0x37, 0x36, 0x34,
|
||||
0x32, 0x64, 0x33, 0x37, 0x33, 0x38, 0x36, 0x35,
|
||||
0x33, 0x39, 0x33, 0x34, 0x33, 0x33, 0x33, 0x37,
|
||||
0x36, 0x34, 0x36, 0x34, 0x33, 0x39, 0x36, 0x31,
|
||||
0x33, 0x38, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35,
|
||||
0x31, 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, 0x32,
|
||||
0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, 0x35,
|
||||
0x30, 0x30, 0x34, 0x63, 0x35, 0x35, 0x63, 0x64,
|
||||
0x30, 0x30, 0xB0, 0x01, 0x88, 0x12, 0xB8, 0x01,
|
||||
0x5E, 0xC0, 0x01, 0xB4, 0x01, 0xCA, 0x01, 0x20,
|
||||
0x30, 0x33, 0x39, 0x61, 0x63, 0x63, 0x32, 0x66,
|
||||
0x30, 0x65, 0x33, 0x33, 0x63, 0x32, 0x66, 0x64,
|
||||
0x63, 0x35, 0x38, 0x36, 0x31, 0x62, 0x66, 0x34,
|
||||
0x63, 0x34, 0x62, 0x61, 0x30, 0x35, 0x30, 0x30,
|
||||
0xDA, 0x01, 0x20, 0x30, 0x66, 0x37, 0x37, 0x35,
|
||||
0x63, 0x33, 0x39, 0x65, 0x65, 0x30, 0x33, 0x33,
|
||||
0x33, 0x63, 0x65, 0x66, 0x39, 0x31, 0x62, 0x37,
|
||||
0x66, 0x37, 0x35, 0x34, 0x65, 0x38, 0x35, 0x64,
|
||||
0x39, 0x63, 0x63, 0xE0, 0x01, 0xF6, 0x95, 0xDF,
|
||||
0xBA, 0x09, 0xF0, 0x01, 0x00, 0xA0, 0x02, 0x00,
|
||||
0xC8, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
||||
]
|
||||
|
||||
console.log(hexdump(this.context.x1, {
|
||||
offset: 0,
|
||||
length: 1024,
|
||||
header: true,
|
||||
ansi: true
|
||||
}))
|
||||
// dumpMemoryToHex(this.context.x1, 1024)
|
||||
|
||||
console.log("[+] Payload 准备写入");
|
||||
protoX1PayloadAddr.writeByteArray(finalPayload);
|
||||
@@ -786,6 +780,8 @@ function attachProto() {
|
||||
});
|
||||
}
|
||||
|
||||
setImmediate(attachProto);
|
||||
|
||||
function toVarint(n) {
|
||||
let res = [];
|
||||
while (n >= 128) {
|
||||
@@ -796,8 +792,6 @@ function toVarint(n) {
|
||||
return res;
|
||||
}
|
||||
|
||||
setImmediate(attachProto);
|
||||
|
||||
function setReceiver() {
|
||||
console.log("[+] buf2RespAddr WeChat Base: " + baseAddr + "[+] Attaching to: " + buf2RespAddr);
|
||||
|
||||
@@ -916,6 +910,41 @@ function readVarint(addr) {
|
||||
};
|
||||
}
|
||||
|
||||
function dumpMemoryToHex(ptr, size) {
|
||||
try {
|
||||
// 1. 读取内存数据
|
||||
const buffer = ptr.readByteArray(size);
|
||||
const data = new Uint8Array(buffer);
|
||||
|
||||
let output = "";
|
||||
let line = "";
|
||||
|
||||
for (let i = 0; i < data.length; i++) {
|
||||
// 格式化为 0x00 形式
|
||||
const hex = "0x" + data[i].toString(16).padStart(2, '0').toUpperCase();
|
||||
line += hex;
|
||||
|
||||
// 如果不是最后一个元素，添加逗号和空格
|
||||
if (i < data.length - 1) {
|
||||
line += ", ";
|
||||
}
|
||||
|
||||
// 每 8 个字节输出一行
|
||||
if ((i + 1) % 8 === 0 || i === data.length - 1) {
|
||||
output += line + "\n";
|
||||
line = "";
|
||||
}
|
||||
}
|
||||
|
||||
console.log("==================== MEMORY DUMP ====================");
|
||||
console.log(output);
|
||||
console.log("=====================================================");
|
||||
|
||||
} catch (e) {
|
||||
console.log("[-] Dump 失败: " + e.message);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
rpc.exports = {
|
||||
manualTrigger: manualTrigger
|
||||
|
||||
@@ -8,9 +8,6 @@ console.log("[+] WeChat base address: " + baseAddr);
|
||||
// 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来
|
||||
var sendMessageCallbackFunc = ptr(0);
|
||||
var messageCallbackFunc1 = baseAddr.add(0x7fa1050);
|
||||
var messageCallbackFunc2 = baseAddr.add(0x7fa10a8);
|
||||
var messageCallbackFunc3 = baseAddr.add(0x80335b0);
|
||||
var messageCallbackFunc4 = baseAddr.add(0x80336a0);
|
||||
|
||||
// 这个必须是绝对位置
|
||||
var triggerX1Payload = ptr(0x175ED6600);
|
||||
@@ -35,7 +32,6 @@ var contentAddr = ptr(0);
|
||||
var insertMsgAddr = ptr(0);
|
||||
var receiverAddr = ptr(0)
|
||||
var protoX1PayloadAddr = ptr(0);
|
||||
var messageContentAddr = ptr(0);
|
||||
var protoX1PayloadLen = 1024;
|
||||
|
||||
// 消息的taskId
|
||||
@@ -100,25 +96,7 @@ function setupSendMessageDynamic() {
|
||||
messageAddr.add(0x0c).writeU32(0x20a);
|
||||
messageAddr.add(0x10).writeU64(0x3);
|
||||
messageAddr.add(0x18).writePointer(cgiAddr);
|
||||
|
||||
// 设置一些固定值
|
||||
messageAddr.add(0x20).writeU64(uint64("0x20"));
|
||||
messageAddr.add(0x28).writeU64(uint64("0x8000000000000030"));
|
||||
messageAddr.add(0x30).writeU64(uint64("0x0000000001010100"));
|
||||
messageAddr.add(0x58).writeU64(uint64("0x0101010100000001"));
|
||||
|
||||
// 处理回调地址
|
||||
callBackFuncAddr.writePointer(messageCallbackFunc2);
|
||||
messageAddr.add(0x98).writePointer(callBackFuncAddr);
|
||||
|
||||
// 设置内容指针
|
||||
messageAddr.add(0xb8).writePointer(messageCallbackFunc3);
|
||||
messageAddr.add(0xc0).writePointer(messageContentAddr);
|
||||
messageAddr.add(0xc8).writeU64(uint64("0x0000000100000001"));
|
||||
messageAddr.add(0xd0).writeU64(0x4);
|
||||
messageAddr.add(0xd8).writeU64(0x1);
|
||||
messageAddr.add(0xe0).writeU64(0x1);
|
||||
messageAddr.add(0xe8).writePointer(messageCallbackFunc4);
|
||||
|
||||
console.log(" [+] messageAddr Object: ", hexdump(messageAddr, {
|
||||
offset: 0,
|
||||
|
||||
Reference in New Issue
Block a user