From 377a5bdd0de21680aadcc034109e0c1abf08c2cd Mon Sep 17 00:00:00 2001 From: yincong Date: Fri, 9 Jan 2026 14:34:53 +0800 Subject: [PATCH] update image --- onebot/image.js | 359 +++++++++++++++++++++++++---------------------- onebot/script.js | 22 --- 2 files changed, 194 insertions(+), 187 deletions(-) diff --git a/onebot/image.js b/onebot/image.js index 317bc44..724ef52 100644 --- a/onebot/image.js +++ b/onebot/image.js @@ -11,7 +11,7 @@ var sendMessageCallbackFunc = baseAddr.add(0xAA8C5B078); var messageCallbackFunc1 = baseAddr.add(0x7fa0b18); var messageCallbackFunc2 = baseAddr.add(0x7fa0b70); var messageCallbackFunc3 = baseAddr.add(0x804ae78); -var messageCallbackFunc4 = baseAddr.add(0x803ac78); +var messageCallbackFunc4 = baseAddr.add(0x8030a00); // 这个必须是绝对位置 var triggerX1Payload = ptr(0x175ED6600); @@ -20,8 +20,9 @@ var req2bufEnterAddr = baseAddr.add(0x34566C0); var req2bufExitAddr = baseAddr.add(0x34577D8); var protobufAddr = baseAddr.add(0x2275BFC); var buf2RespAddr = baseAddr.add(0x347BD44); -// var patchProtobufAddr = baseAddr.add(0x2275BD8); -// var protobufDeleteAddr = baseAddr.add(0x2275C14); +var patchProtobufFunc1 = baseAddr.add(0x2275BB8) +var patchProtobufFunc2 = baseAddr.add(0x2275BD8); +var protobufDeleteAddr = baseAddr.add(0x2275C14); // 触发函数X0参数地址 var globalMessagePtr = ptr(0); @@ -30,6 +31,7 @@ var globalMessagePtr = ptr(0); var cgiAddr = ptr(0); var callBackFuncAddr = ptr(0); var callBackFuncAddr2 = ptr(0); +var callBackFuncAddr3 = ptr(0); var sendMessageAddr = ptr(0); var messageAddr = ptr(0); @@ -39,7 +41,6 @@ var insertMsgAddr = ptr(0); var receiverAddr = ptr(0); var htmlContentAddr = ptr(0); var protoX1PayloadAddr = ptr(0); -var protoX1PayloadLen = 1024; // 消息的taskId var taskIdGlobal = 0x20000090 // 最好比较大，不和原始的微信消息重复 @@ -74,6 +75,7 @@ function setupSendMessageDynamic() { cgiAddr = Memory.alloc(128); callBackFuncAddr = Memory.alloc(16); callBackFuncAddr2 = Memory.alloc(16); + callBackFuncAddr3 = Memory.alloc(16); sendMessageAddr = Memory.alloc(256); messageAddr = Memory.alloc(512); contentAddr = Memory.alloc(255); @@ -88,10 +90,10 @@ function setupSendMessageDynamic() { // B. 构建 SendMessage 结构体 (X24 基址位置) sendMessageAddr.add(0x00).writeU64(0); sendMessageAddr.add(0x08).writeU64(0); - sendMessageAddr.add(0x10).writePointer(sendMessageCallbackFunc); // 虚表地址通常仍需硬编码或从模块基址计算 + sendMessageAddr.add(0x10).writePointer(sendMessageCallbackFunc); sendMessageAddr.add(0x18).writeU64(1); sendMessageAddr.add(0x20).writeU32(taskIdGlobal); - sendMessageAddr.add(0x28).writePointer(messageAddr); // 指向动态分配的 Message + sendMessageAddr.add(0x28).writePointer(messageAddr); console.log(" [+] sendMessageAddr Object: ", hexdump(sendMessageAddr, { offset: 0, @@ -106,22 +108,9 @@ function setupSendMessageDynamic() { messageAddr.add(0x0c).writeU32(0x6e); messageAddr.add(0x10).writeU64(0x3); messageAddr.add(0x18).writePointer(cgiAddr); - - // 设置一些固定值 - messageAddr.add(0x20).writeU64(uint64("0x20")); + messageAddr.add(0x20).writeU64(0x22); messageAddr.add(0x28).writeU64(uint64("0x8000000000000030")); messageAddr.add(0x30).writeU64(uint64("0x0000000001010100")); - messageAddr.add(0x58).writeU64(uint64("0x0101010100000001")); - - // 处理回调地址 - callBackFuncAddr.writePointer(messageCallbackFunc2); - messageAddr.add(0x98).writePointer(callBackFuncAddr); - - // 设置内容指针 - messageAddr.add(0xb8).writePointer(messageCallbackFunc3); - callBackFuncAddr2.writePointer(messageCallbackFunc4); - messageAddr.add(0xc0).writePointer(callBackFuncAddr2); - console.log(" [+] messageAddr Object: ", hexdump(messageAddr, { offset: 0, @@ -215,24 +204,32 @@ setImmediate(setupSendMessageDynamic); function patchProtoBuf() { - // Memory.patchCode(patchProtobufAddr, 4, code => { - // const cw = new Arm64Writer(code, {pc: patchProtobufAddr}); - // cw.putNop(); - // cw.flush(); - // }); - // - // console.log("[+] Patching BL to NOP at " + patchProtobufAddr + " completed."); - // - // Memory.patchCode(protobufDeleteAddr, 4, code => { - // const cw = new Arm64Writer(code, {pc: protobufDeleteAddr}); - // cw.putNop(); - // cw.flush(); - // }); - // - // console.log("[+] Patching BL DELETE to NOP at " + protobufDeleteAddr + " completed."); + Memory.patchCode(patchProtobufFunc1, 4, code => { + const cw = new Arm64Writer(code, {pc: patchProtobufFunc1}); + cw.putNop(); + cw.flush(); + }); + + console.log("[+] Patching BL to NOP at " + patchProtobufFunc1 + " completed."); + + Memory.patchCode(patchProtobufFunc2, 4, code => { + const cw = new Arm64Writer(code, {pc: patchProtobufFunc2}); + cw.putNop(); + cw.flush(); + }); + + console.log("[+] Patching BL to NOP at " + patchProtobufFunc2 + " completed."); + + Memory.patchCode(protobufDeleteAddr, 4, code => { + const cw = new Arm64Writer(code, {pc: protobufDeleteAddr}); + cw.putNop(); + cw.flush(); + }); + + console.log("[+] Patching BL DELETE to NOP at " + protobufDeleteAddr + " completed."); } -setImmediate(patchProtoBuf); +// setImmediate(patchProtoBuf); function manualTrigger(taskId, receiver, content) { console.log("[+] Manual Trigger Started..."); @@ -447,7 +444,7 @@ function generateRandom5ByteVarint() { // 拦截 Protobuf 编码逻辑，注入自定义 Payload function attachProto() { console.log("[+] proto注入拦截目标地址: " + protobufAddr); - protoX1PayloadAddr = Memory.alloc(protoX1PayloadLen); + protoX1PayloadAddr = Memory.alloc(1024); console.log("[+] Frida 分配的 Payload 地址: " + protoX1PayloadAddr); Interceptor.attach(protobufAddr, { @@ -470,14 +467,16 @@ function attachProto() { // // UnifiedPCMac 26 arm64 // const sys = [0x55, 0x6E, 0x69, 0x66, 0x69, 0x65, 0x64, 0x50, 0x43, 0x4D, 0x61, 0x63, 0x20, 0x32, 0x36, 0x20, 0x61, 0x72, 0x6D, 0x36, 0x34] // const msgIdHeader = [0x30, 0x73, 0x12, 0x2E, 0x0A, 0x2C] - // // 45872025384@chatroom_176787000_60_xwechat_1 + // // 45872025384@chatroom_176787000_60_xwechat_1 只需要改这个时间戳就能重复发送 // const receiverMsgId = [0x34, 0x35, 0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38, 0x34, // 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F, 0x6F, 0x6D, 0x5F, 0x31, 0x37, 0x36, 0x37, 0x38, 0x37, // 0x30, 0x30, 0x30, 0x30, 0x5F, 0x36, 0x30, 0x5F, 0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, 0x5F, 0x31, // ] // const senderHeader = [0x1A, 0x15, 0x0A, 0x13]; + // // wxid_xxxx 或者 chatroom // const sender = [0x77, 0x78, 0x69, 0x64, 0x5F, 0x6C, 0x64, 0x66, 0x74, 0x75, 0x68, 0x65, 0x33, 0x36, 0x69, 0x7A, 0x67, 0x31, 0x39]; // const receiverHeader = [0x22, 0x16, 0x0A, 0x14] + // // wxid_xxxx // const receiver = [0x34, 0x35, 0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38, 0x34, 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F, 0x6F, 0x6D] // const randomId1 = [0x28, 0xF4, 0x0B] // const type1 = [0x30, 0x00] @@ -632,7 +631,7 @@ function attachProto() { // ] const finalPayload = [ - 0x0A, 0x40, 0x0A, 0x01, 0x00, 0x10, 0xC6, 0xBC, + 0x0A, 0x3F, 0x0A, 0x01, 0x00, 0x10, 0xC6, 0xBC, 0x90, 0xB9, 0x08, 0x1A, 0x10, 0x6D, 0x33, 0x30, 0x63, 0x34, 0x36, 0x37, 0x34, 0x66, 0x35, 0x61, 0x30, 0x62, 0x39, 0x64, 0x30, 0x20, 0xAF, 0xAC, @@ -640,134 +639,129 @@ function attachProto() { 0x2A, 0x15, 0x55, 0x6E, 0x69, 0x66, 0x69, 0x65, 0x64, 0x50, 0x43, 0x4D, 0x61, 0x63, 0x20, 0x32, 0x36, 0x20, 0x61, 0x72, 0x6D, 0x36, 0x34, 0x30, - 0x96, 0x03, 0x12, 0x2F, 0x0A, 0x2D, 0x34, 0x35, - 0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38, - 0x34, 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F, - 0x6F, 0x6D, 0x5F, 0x31, 0x37, 0x36, 0x37, 0x38, - 0x37, 0x38, 0x30, 0x37, 0x30, 0x5F, 0x38, 0x32, - 0x5F, 0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, - 0x5F, 0x31, 0x37, 0x1A, 0x15, 0x0A, 0x13, 0x77, - 0x78, 0x69, 0x64, 0x5F, 0x6C, 0x64, 0x66, 0x74, - 0x75, 0x68, 0x65, 0x33, 0x36, 0x69, 0x7A, 0x67, - 0x31, 0x39, 0x22, 0x16, 0x0A, 0x14, 0x34, 0x35, - 0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38, - 0x34, 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F, - 0x6F, 0x6D, 0x28, 0xF4, 0x0D, 0x30, 0x00, 0x38, - 0xF4, 0x0D, 0x42, 0x04, 0x08, 0x00, 0x12, 0x00, - 0x48, 0x03, 0x52, 0x83, 0x01, 0x3C, 0x6D, 0x73, - 0x67, 0x73, 0x6F, 0x75, 0x72, 0x63, 0x65, 0x3E, - 0x3C, 0x69, 0x6D, 0x67, 0x5F, 0x66, 0x69, 0x6C, - 0x65, 0x5F, 0x6E, 0x61, 0x6D, 0x65, 0x3E, 0x37, - 0x65, 0x32, 0x39, 0x33, 0x31, 0x61, 0x63, 0x2D, - 0x31, 0x35, 0x37, 0x65, 0x2D, 0x34, 0x31, 0x33, - 0x34, 0x2D, 0x39, 0x37, 0x33, 0x35, 0x2D, 0x36, - 0x63, 0x35, 0x39, 0x33, 0x66, 0x34, 0x35, 0x30, - 0x39, 0x65, 0x63, 0x2E, 0x70, 0x6E, 0x67, 0x3C, - 0x2F, 0x69, 0x6D, 0x67, 0x5F, 0x66, 0x69, 0x6C, - 0x65, 0x5F, 0x6E, 0x61, 0x6D, 0x65, 0x3E, 0x3C, - 0x61, 0x6C, 0x6E, 0x6F, 0x64, 0x65, 0x3E, 0x3C, - 0x66, 0x72, 0x3E, 0x31, 0x3C, 0x2F, 0x66, 0x72, - 0x3E, 0x3C, 0x63, 0x66, 0x3E, 0x33, 0x3C, 0x2F, - 0x63, 0x66, 0x3E, 0x3C, 0x2F, 0x61, 0x6C, 0x6E, - 0x6F, 0x64, 0x65, 0x3E, 0x3C, 0x2F, 0x6D, 0x73, - 0x67, 0x73, 0x6F, 0x75, 0x72, 0x63, 0x65, 0x3E, - 0x58, 0x01, 0x60, 0x02, 0x68, 0x05, 0x7A, 0xB2, - 0x01, 0x33, 0x30, 0x35, 0x37, 0x30, 0x32, 0x30, - 0x31, 0x30, 0x30, 0x30, 0x34, 0x34, 0x62, 0x33, - 0x30, 0x34, 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, - 0x30, 0x30, 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, - 0x37, 0x30, 0x39, 0x35, 0x64, 0x30, 0x32, 0x30, - 0x33, 0x32, 0x66, 0x36, 0x30, 0x32, 0x31, 0x30, - 0x32, 0x30, 0x34, 0x62, 0x33, 0x61, 0x38, 0x33, - 0x63, 0x62, 0x37, 0x30, 0x32, 0x30, 0x34, 0x36, - 0x39, 0x35, 0x66, 0x61, 0x64, 0x62, 0x37, 0x30, - 0x34, 0x32, 0x34, 0x36, 0x35, 0x33, 0x34, 0x33, - 0x39, 0x36, 0x33, 0x33, 0x35, 0x33, 0x39, 0x33, - 0x35, 0x36, 0x31, 0x32, 0x64, 0x36, 0x35, 0x33, - 0x33, 0x33, 0x32, 0x36, 0x34, 0x32, 0x64, 0x33, - 0x34, 0x33, 0x31, 0x36, 0x35, 0x33, 0x33, 0x32, - 0x64, 0x33, 0x39, 0x36, 0x31, 0x33, 0x39, 0x33, - 0x31, 0x32, 0x64, 0x36, 0x36, 0x33, 0x35, 0x33, - 0x34, 0x36, 0x31, 0x33, 0x32, 0x33, 0x32, 0x33, - 0x30, 0x33, 0x32, 0x33, 0x36, 0x33, 0x34, 0x36, - 0x32, 0x33, 0x35, 0x30, 0x32, 0x30, 0x34, 0x30, - 0x35, 0x32, 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, - 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, - 0x35, 0x30, 0x30, 0x34, 0x63, 0x35, 0x34, 0x33, - 0x64, 0x30, 0x30, 0x82, 0x01, 0xB2, 0x01, 0x33, - 0x30, 0x35, 0x37, 0x30, 0x32, 0x30, 0x31, 0x30, - 0x30, 0x30, 0x34, 0x34, 0x62, 0x33, 0x30, 0x34, - 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, - 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, 0x37, 0x30, - 0x39, 0x35, 0x64, 0x30, 0x32, 0x30, 0x33, 0x32, - 0x66, 0x36, 0x30, 0x32, 0x31, 0x30, 0x32, 0x30, - 0x34, 0x62, 0x33, 0x61, 0x38, 0x33, 0x63, 0x62, - 0x37, 0x30, 0x32, 0x30, 0x34, 0x36, 0x39, 0x35, - 0x66, 0x61, 0x64, 0x62, 0x37, 0x30, 0x34, 0x32, - 0x34, 0x36, 0x35, 0x33, 0x34, 0x33, 0x39, 0x36, - 0x33, 0x33, 0x35, 0x33, 0x39, 0x33, 0x35, 0x36, - 0x31, 0x32, 0x64, 0x36, 0x35, 0x33, 0x33, 0x33, - 0x32, 0x36, 0x34, 0x32, 0x64, 0x33, 0x34, 0x33, - 0x31, 0x36, 0x35, 0x33, 0x33, 0x32, 0x64, 0x33, - 0x39, 0x36, 0x31, 0x33, 0x39, 0x33, 0x31, 0x32, - 0x64, 0x36, 0x36, 0x33, 0x35, 0x33, 0x34, 0x36, - 0x61, 0x33, 0x32, 0x33, 0x32, 0x33, 0x30, 0x33, - 0x32, 0x33, 0x36, 0x33, 0x34, 0x36, 0x32, 0x33, - 0x35, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35, 0x32, - 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, 0x32, 0x30, - 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, 0x35, 0x30, - 0x30, 0x34, 0x63, 0x35, 0x34, 0x33, 0x64, 0x30, - 0x30, 0x8A, 0x01, 0x20, 0x61, 0x35, 0x62, 0x61, - 0x31, 0x65, 0x61, 0x33, 0x62, 0x33, 0x61, 0x31, - 0x35, 0x66, 0x33, 0x32, 0x32, 0x38, 0x34, 0x61, - 0x31, 0x37, 0x34, 0x35, 0x64, 0x35, 0x34, 0x37, - 0x36, 0x38, 0x36, 0x66, 0x90, 0x01, 0x01, 0x98, - 0x01, 0xFE, 0x16, 0xA0, 0x01, 0xFE, 0x16, 0xAA, - 0x01, 0xB2, 0x01, 0x33, 0x30, 0x35, 0x37, 0x30, - 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x34, - 0x62, 0x33, 0x30, 0x34, 0x49, 0x30, 0x32, 0x30, - 0x31, 0x30, 0x30, 0x30, 0x32, 0x30, 0x34, 0x64, - 0x30, 0x61, 0x37, 0x30, 0x39, 0x35, 0x64, 0x30, - 0x32, 0x30, 0x33, 0x32, 0x66, 0x36, 0x30, 0x32, - 0x31, 0x30, 0x32, 0x30, 0x34, 0x62, 0x33, 0x61, - 0x38, 0x33, 0x63, 0x62, 0x37, 0x30, 0x32, 0x30, - 0x34, 0x36, 0x39, 0x35, 0x66, 0x61, 0x64, 0x62, - 0x37, 0x30, 0x34, 0x32, 0x34, 0x36, 0x35, 0x33, - 0x34, 0x33, 0x39, 0x36, 0x33, 0x33, 0x35, 0x33, - 0x39, 0x33, 0x35, 0x36, 0x61, 0x32, 0x64, 0x36, - 0x35, 0x33, 0x33, 0x33, 0x32, 0x36, 0x34, 0x32, - 0x64, 0x33, 0x34, 0x33, 0x31, 0x36, 0x35, 0x33, - 0x33, 0x32, 0x64, 0x33, 0x39, 0x36, 0x31, 0x33, - 0x39, 0x33, 0x31, 0x32, 0x64, 0x36, 0x36, 0x33, - 0x35, 0x33, 0x34, 0x36, 0x31, 0x33, 0x32, 0x33, - 0x32, 0x33, 0x30, 0x33, 0x32, 0x33, 0x36, 0x33, - 0x34, 0x36, 0x32, 0x33, 0x35, 0x30, 0x32, 0x30, - 0x34, 0x30, 0x35, 0x32, 0x34, 0x33, 0x38, 0x30, - 0x31, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, - 0x34, 0x40, 0x35, 0x30, 0x30, 0x34, 0x63, 0x35, - 0x34, 0x33, 0x64, 0x30, 0x30, 0xB0, 0x01, 0xF4, - 0x0D, 0xB8, 0x01, 0x88, 0x01, 0xC0, 0x01, 0x8E, - 0x01, 0xCA, 0x01, 0x20, 0x61, 0x35, 0x62, 0x61, - 0x31, 0x65, 0x61, 0x33, 0x62, 0x33, 0x61, 0x31, - 0x35, 0x66, 0x33, 0x32, 0x32, 0x38, 0x34, 0x61, - 0x31, 0x37, 0x34, 0x35, 0x64, 0x35, 0x34, 0x37, - 0x36, 0x38, 0x36, 0x66, 0xDA, 0x01, 0x20, 0x35, - 0x37, 0x35, 0x34, 0x30, 0x30, 0x63, 0x33, 0x36, - 0x30, 0x36, 0x38, 0x61, 0x61, 0x34, 0x36, 0x37, - 0x63, 0x63, 0x37, 0x64, 0x64, 0x39, 0x34, 0x31, - 0x39, 0x62, 0x61, 0x34, 0x30, 0x36, 0x61, 0xE0, - 0x01, 0xD3, 0xBB, 0xA6, 0xB4, 0x03, 0xF0, 0x01, - 0x00, 0xA0, 0x02, 0x00, 0xC8, 0x02, 0x00, 0x00, + 0x6F, 0x12, 0x2E, 0x0A, 0x2C, 0x77, 0x78, 0x69, + 0x64, 0x5F, 0x37, 0x77, 0x64, 0x31, 0x65, 0x63, + 0x65, 0x39, 0x39, 0x66, 0x37, 0x69, 0x32, 0x31, + 0x5F, 0x31, 0x37, 0x36, 0x37, 0x39, 0x33, 0x39, + 0x31, 0x31, 0x30, 0x5F, 0x31, 0x33, 0x33, 0x5F, + 0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, 0x5F, + 0x31, 0x1A, 0x15, 0x0A, 0x13, 0x77, 0x78, 0x69, + 0x64, 0x5F, 0x6C, 0x64, 0x66, 0x74, 0x75, 0x68, + 0x65, 0x33, 0x36, 0x69, 0x7A, 0x67, 0x31, 0x39, + 0x22, 0x15, 0x0A, 0x13, 0x77, 0x78, 0x69, 0x64, + 0x5F, 0x37, 0x77, 0x64, 0x31, 0x65, 0x63, 0x65, + 0x39, 0x39, 0x66, 0x37, 0x69, 0x32, 0x31, 0x28, + 0x88, 0x12, 0x30, 0x00, 0x38, 0x88, 0x12, 0x42, + 0x04, 0x08, 0x00, 0x12, 0x00, 0x48, 0x03, 0x52, + 0x83, 0x01, 0x3C, 0x6D, 0x73, 0x67, 0x73, 0x6F, + 0x75, 0x72, 0x63, 0x65, 0x3E, 0x3C, 0x69, 0x6D, + 0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, 0x6E, + 0x61, 0x6D, 0x65, 0x3E, 0x30, 0x39, 0x64, 0x32, + 0x32, 0x63, 0x34, 0x63, 0x2D, 0x33, 0x38, 0x65, + 0x35, 0x2D, 0x34, 0x61, 0x30, 0x34, 0x2D, 0x62, + 0x30, 0x64, 0x63, 0x2D, 0x35, 0x63, 0x65, 0x30, + 0x62, 0x39, 0x30, 0x37, 0x66, 0x31, 0x64, 0x64, + 0x2E, 0x70, 0x6E, 0x67, 0x3C, 0x2F, 0x69, 0x6D, + 0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, 0x6E, + 0x61, 0x6D, 0x65, 0x3E, 0x3C, 0x61, 0x6C, 0x6E, + 0x6F, 0x64, 0x65, 0x3E, 0x3C, 0x66, 0x72, 0x3E, + 0x31, 0x3C, 0x2F, 0x66, 0x72, 0x3E, 0x3C, 0x63, + 0x66, 0x3E, 0x33, 0x3C, 0x2F, 0x63, 0x66, 0x3E, + 0x3C, 0x2F, 0x61, 0x6C, 0x6E, 0x6F, 0x64, 0x65, + 0x3E, 0x3C, 0x2F, 0x6D, 0x73, 0x67, 0x73, 0x6F, + 0x75, 0x72, 0x63, 0x65, 0x3E, 0x58, 0x01, 0x60, + 0x02, 0x68, 0x05, 0x7A, 0xB2, 0x01, 0x33, 0x30, + 0x35, 0x37, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, + 0x30, 0x34, 0x34, 0x62, 0x33, 0x30, 0x34, 0x39, + 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x32, + 0x30, 0x34, 0x64, 0x30, 0x61, 0x37, 0x30, 0x39, + 0x35, 0x64, 0x30, 0x32, 0x30, 0x33, 0x32, 0x64, + 0x64, 0x32, 0x37, 0x39, 0x30, 0x32, 0x30, 0x34, + 0x37, 0x65, 0x64, 0x35, 0x36, 0x63, 0x37, 0x31, + 0x30, 0x32, 0x30, 0x34, 0x36, 0x39, 0x36, 0x30, + 0x39, 0x63, 0x32, 0x37, 0x30, 0x34, 0x32, 0x34, + 0x33, 0x37, 0x36, 0x33, 0x36, 0x34, 0x33, 0x38, + 0x33, 0x34, 0x33, 0x30, 0x33, 0x38, 0x36, 0x31, + 0x32, 0x64, 0x33, 0x31, 0x36, 0x31, 0x33, 0x37, + 0x33, 0x33, 0x32, 0x64, 0x33, 0x34, 0x36, 0x33, + 0x33, 0x36, 0x33, 0x39, 0x32, 0x64, 0x36, 0x31, + 0x33, 0x36, 0x33, 0x37, 0x36, 0x34, 0x32, 0x64, + 0x33, 0x37, 0x33, 0x38, 0x36, 0x35, 0x33, 0x39, + 0x33, 0x34, 0x33, 0x33, 0x33, 0x37, 0x36, 0x34, + 0x36, 0x34, 0x33, 0x39, 0x36, 0x31, 0x33, 0x38, + 0x30, 0x32, 0x30, 0x34, 0x30, 0x35, 0x31, 0x34, + 0x33, 0x38, 0x30, 0x31, 0x30, 0x32, 0x30, 0x31, + 0x30, 0x30, 0x30, 0x34, 0x30, 0x35, 0x30, 0x30, + 0x34, 0x63, 0x35, 0x35, 0x63, 0x64, 0x30, 0x30, + 0x82, 0x01, 0xB2, 0x01, 0x33, 0x30, 0x35, 0x37, + 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, + 0x34, 0x62, 0x33, 0x30, 0x34, 0x39, 0x30, 0x32, + 0x30, 0x31, 0x30, 0x30, 0x30, 0x32, 0x30, 0x34, + 0x64, 0x30, 0x61, 0x37, 0x30, 0x39, 0x35, 0x64, + 0x30, 0x32, 0x30, 0x33, 0x32, 0x64, 0x64, 0x32, + 0x37, 0x39, 0x30, 0x32, 0x30, 0x34, 0x37, 0x65, + 0x64, 0x35, 0x36, 0x63, 0x37, 0x31, 0x30, 0x32, + 0x30, 0x34, 0x36, 0x39, 0x36, 0x30, 0x39, 0x63, + 0x32, 0x37, 0x30, 0x34, 0x32, 0x34, 0x33, 0x37, + 0x36, 0x33, 0x36, 0x34, 0x33, 0x38, 0x33, 0x34, + 0x33, 0x30, 0x33, 0x38, 0x36, 0x31, 0x32, 0x64, + 0x33, 0x31, 0x36, 0x31, 0x33, 0x37, 0x33, 0x33, + 0x32, 0x64, 0x33, 0x34, 0x36, 0x33, 0x33, 0x36, + 0x33, 0x39, 0x32, 0x64, 0x36, 0x31, 0x33, 0x36, + 0x33, 0x37, 0x36, 0x34, 0x32, 0x64, 0x33, 0x37, + 0x33, 0x38, 0x36, 0x35, 0x33, 0x39, 0x33, 0x34, + 0x33, 0x33, 0x33, 0x37, 0x36, 0x34, 0x36, 0x34, + 0x33, 0x39, 0x36, 0x31, 0x33, 0x38, 0x30, 0x32, + 0x30, 0x34, 0x30, 0x35, 0x31, 0x34, 0x33, 0x38, + 0x30, 0x31, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, + 0x30, 0x34, 0x30, 0x35, 0x30, 0x30, 0x34, 0x63, + 0x35, 0x35, 0x63, 0x64, 0x30, 0x30, 0x8A, 0x01, + 0x20, 0x30, 0x33, 0x39, 0x61, 0x63, 0x63, 0x32, + 0x66, 0x30, 0x65, 0x33, 0x33, 0x63, 0x32, 0x66, + 0x64, 0x63, 0x35, 0x38, 0x36, 0x31, 0x62, 0x66, + 0x34, 0x63, 0x34, 0x62, 0x61, 0x30, 0x35, 0x30, + 0x30, 0x90, 0x01, 0x01, 0x98, 0x01, 0xCD, 0x26, + 0xA0, 0x01, 0xCD, 0x26, 0xAA, 0x01, 0xB2, 0x01, + 0x33, 0x30, 0x35, 0x37, 0x30, 0x32, 0x30, 0x31, + 0x30, 0x30, 0x30, 0x34, 0x34, 0x62, 0x33, 0x30, + 0x34, 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, + 0x30, 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, 0x37, + 0x30, 0x39, 0x35, 0x64, 0x30, 0x32, 0x30, 0x33, + 0x32, 0x64, 0x64, 0x32, 0x37, 0x39, 0x30, 0x32, + 0x30, 0x34, 0x37, 0x65, 0x64, 0x35, 0x36, 0x63, + 0x37, 0x31, 0x30, 0x32, 0x30, 0x34, 0x36, 0x39, + 0x36, 0x30, 0x39, 0x63, 0x32, 0x37, 0x30, 0x34, + 0x32, 0x34, 0x33, 0x37, 0x36, 0x33, 0x36, 0x34, + 0x33, 0x38, 0x33, 0x34, 0x33, 0x30, 0x33, 0x38, + 0x36, 0x31, 0x32, 0x64, 0x33, 0x31, 0x36, 0x31, + 0x33, 0x37, 0x33, 0x33, 0x32, 0x64, 0x33, 0x34, + 0x36, 0x33, 0x33, 0x36, 0x33, 0x39, 0x32, 0x64, + 0x36, 0x31, 0x33, 0x36, 0x33, 0x37, 0x36, 0x34, + 0x32, 0x64, 0x33, 0x37, 0x33, 0x38, 0x36, 0x35, + 0x33, 0x39, 0x33, 0x34, 0x33, 0x33, 0x33, 0x37, + 0x36, 0x34, 0x36, 0x34, 0x33, 0x39, 0x36, 0x31, + 0x33, 0x38, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35, + 0x31, 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, 0x32, + 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, 0x35, + 0x30, 0x30, 0x34, 0x63, 0x35, 0x35, 0x63, 0x64, + 0x30, 0x30, 0xB0, 0x01, 0x88, 0x12, 0xB8, 0x01, + 0x5E, 0xC0, 0x01, 0xB4, 0x01, 0xCA, 0x01, 0x20, + 0x30, 0x33, 0x39, 0x61, 0x63, 0x63, 0x32, 0x66, + 0x30, 0x65, 0x33, 0x33, 0x63, 0x32, 0x66, 0x64, + 0x63, 0x35, 0x38, 0x36, 0x31, 0x62, 0x66, 0x34, + 0x63, 0x34, 0x62, 0x61, 0x30, 0x35, 0x30, 0x30, + 0xDA, 0x01, 0x20, 0x30, 0x66, 0x37, 0x37, 0x35, + 0x63, 0x33, 0x39, 0x65, 0x65, 0x30, 0x33, 0x33, + 0x33, 0x63, 0x65, 0x66, 0x39, 0x31, 0x62, 0x37, + 0x66, 0x37, 0x35, 0x34, 0x65, 0x38, 0x35, 0x64, + 0x39, 0x63, 0x63, 0xE0, 0x01, 0xF6, 0x95, 0xDF, + 0xBA, 0x09, 0xF0, 0x01, 0x00, 0xA0, 0x02, 0x00, + 0xC8, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ] - console.log(hexdump(this.context.x1, { - offset: 0, - length: 1024, - header: true, - ansi: true - })) + // dumpMemoryToHex(this.context.x1, 1024) console.log("[+] Payload 准备写入"); protoX1PayloadAddr.writeByteArray(finalPayload); @@ -786,6 +780,8 @@ function attachProto() { }); } +setImmediate(attachProto); + function toVarint(n) { let res = []; while (n >= 128) { @@ -796,8 +792,6 @@ function toVarint(n) { return res; } -setImmediate(attachProto); - function setReceiver() { console.log("[+] buf2RespAddr WeChat Base: " + baseAddr + "[+] Attaching to: " + buf2RespAddr); @@ -916,6 +910,41 @@ function readVarint(addr) { }; } +function dumpMemoryToHex(ptr, size) { + try { + // 1. 读取内存数据 + const buffer = ptr.readByteArray(size); + const data = new Uint8Array(buffer); + + let output = ""; + let line = ""; + + for (let i = 0; i < data.length; i++) { + // 格式化为 0x00 形式 + const hex = "0x" + data[i].toString(16).padStart(2, '0').toUpperCase(); + line += hex; + + // 如果不是最后一个元素，添加逗号和空格 + if (i < data.length - 1) { + line += ", "; + } + + // 每 8 个字节输出一行 + if ((i + 1) % 8 === 0 || i === data.length - 1) { + output += line + "\n"; + line = ""; + } + } + + console.log("==================== MEMORY DUMP ===================="); + console.log(output); + console.log("====================================================="); + + } catch (e) { + console.log("[-] Dump 失败: " + e.message); + } +} + rpc.exports = { manualTrigger: manualTrigger diff --git a/onebot/script.js b/onebot/script.js index 5bd655c..40920b3 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -8,9 +8,6 @@ console.log("[+] WeChat base address: " + baseAddr); // 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来 var sendMessageCallbackFunc = ptr(0); var messageCallbackFunc1 = baseAddr.add(0x7fa1050); -var messageCallbackFunc2 = baseAddr.add(0x7fa10a8); -var messageCallbackFunc3 = baseAddr.add(0x80335b0); -var messageCallbackFunc4 = baseAddr.add(0x80336a0); // 这个必须是绝对位置 var triggerX1Payload = ptr(0x175ED6600); @@ -35,7 +32,6 @@ var contentAddr = ptr(0); var insertMsgAddr = ptr(0); var receiverAddr = ptr(0) var protoX1PayloadAddr = ptr(0); -var messageContentAddr = ptr(0); var protoX1PayloadLen = 1024; // 消息的taskId @@ -100,25 +96,7 @@ function setupSendMessageDynamic() { messageAddr.add(0x0c).writeU32(0x20a); messageAddr.add(0x10).writeU64(0x3); messageAddr.add(0x18).writePointer(cgiAddr); - - // 设置一些固定值 messageAddr.add(0x20).writeU64(uint64("0x20")); - messageAddr.add(0x28).writeU64(uint64("0x8000000000000030")); - messageAddr.add(0x30).writeU64(uint64("0x0000000001010100")); - messageAddr.add(0x58).writeU64(uint64("0x0101010100000001")); - - // 处理回调地址 - callBackFuncAddr.writePointer(messageCallbackFunc2); - messageAddr.add(0x98).writePointer(callBackFuncAddr); - - // 设置内容指针 - messageAddr.add(0xb8).writePointer(messageCallbackFunc3); - messageAddr.add(0xc0).writePointer(messageContentAddr); - messageAddr.add(0xc8).writeU64(uint64("0x0000000100000001")); - messageAddr.add(0xd0).writeU64(0x4); - messageAddr.add(0xd8).writeU64(0x1); - messageAddr.add(0xe0).writeU64(0x1); - messageAddr.add(0xe8).writePointer(messageCallbackFunc4); console.log(" [+] messageAddr Object: ", hexdump(messageAddr, { offset: 0,