tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

support image

Browse Source
This commit is contained in:
yincong
2026-01-16 12:23:59 +08:00
parent 2411296707
commit 4e787bc021
3 changed files with 335 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frida-wechat.md
+1
View File
@@ -1,4 +1,5 @@
触发 STNManager__MMStartTask
图片hook: startUploadMedia, OnUploadCompleted
Req2Buf 构造消息的buffer入口，其中X4是消息内容，输出的是压缩后的protobuf
Pack是打包函数，消息内容 cgi等信息打包进入
InitClientChannel， DoHandShakeLoop 是建立mmtls链接最重要的函数
onebot/main.go
+171 -38
View File
@@ -4,16 +4,21 @@ import (
"bytes"
"context"
"crypto/hmac"
"crypto/md5"
"crypto/sha1"
"encoding/base64"
"encoding/hex"
"encoding/json"
"flag"
"fmt"
"io"
"log"
"math/rand"
"net/http"
"os"
"os/signal"
"path/filepath"
"strings"
"sync/atomic"
"syscall"
"text/template"
@@ -27,6 +32,7 @@ var (
fridaScript *frida.Script
session *frida.Session
taskId = int64(0x20000000)
myWechatId = ""
msgChan = make(chan *SendMsg, 10)
finishChan = make(chan struct{})
@@ -34,10 +40,17 @@ var (
config = &Config{}
)
type WechatMessage struct {
GroupId string `json:"group_id"`
SelfID string `json:"self_id"`
UserID string `json:"user_id"`
}
type SendMsg struct {
UserId string
GroupID string
Content string
Type string
}
// SendRequest 请求结构体
@@ -55,6 +68,7 @@ type Message struct {
type SendRequestData struct {
Id string `json:"id"`
Text string `json:"text"`
File string `json:"file"`
}
type Config struct {
@@ -64,6 +78,7 @@ type Config struct {
FridaGadgetAddr string `json:"frida_gadget_addr"`
WechatPid int `json:"wechat_pid"`
OnebotToken string `json:"onebot_token"`
ImagePath string `json:"image_path"`
WechatConf string `json:"wechat_conf"`
}
@@ -75,7 +90,9 @@ func initFlag() {
flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效")
flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效")
flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: 123456")
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_6_12_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
//flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_6_12_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
flag.Parse()
@@ -85,7 +102,8 @@ func initFlag() {
fmt.Println("FridaGadgetAddr", config.FridaGadgetAddr)
fmt.Println("WechatPid", config.WechatPid)
fmt.Println("OnebotToken", config.OnebotToken)
fmt.Println("WechatConf", config.WechatConf)
fmt.Println("ImagePath", config.ImagePath)
//fmt.Println("WechatConf", config.WechatConf)
}
@@ -126,16 +144,16 @@ func initFrida() {
}
func loadJs() {
jsonData, err := os.ReadFile(config.WechatConf)
if err != nil {
log.Fatalf("读取文件失败: %v\n", err)
}
//jsonData, err := os.ReadFile(config.WechatConf)
//if err != nil {
// log.Fatalf("读取文件失败: %v\n", err)
//}
// 2. 将 JSON 解析为 Map
var wechatHookConf map[string]interface{}
if err := json.Unmarshal(jsonData, &wechatHookConf); err != nil {
log.Fatalf("解析 JSON 失败: %v\n", err)
}
//if err := json.Unmarshal(jsonData, &wechatHookConf); err != nil {
// log.Fatalf("解析 JSON 失败: %v\n", err)
//}
codeTemplate, err := os.ReadFile("./script.js")
if err != nil {
@@ -174,6 +192,9 @@ func loadJs() {
if t.(string) == "send" {
go SendHttpReq(msg)
} else if t.(string) == "finish" {
if selfId, ok := pMap["self_id"]; ok {
myWechatId = selfId.(string)
}
finishChan <- struct{}{}
}
}
@@ -214,19 +235,24 @@ func sendHandler(w http.ResponseWriter, r *http.Request) {
return
}
text := ""
for _, v := range req.Message {
if v.Type == "text" {
text = v.Data.Text
msgChan <- &SendMsg{
UserId: req.UserID,
GroupID: req.GroupID,
Content: v.Data.Text,
Type: v.Type,
}
} else if v.Type == "image" {
msgChan <- &SendMsg{
UserId: req.UserID,
GroupID: req.GroupID,
Content: v.Data.File,
Type: v.Type,
}
}
}
msgChan <- &SendMsg{
UserId: req.UserID,
GroupID: req.GroupID,
Content: text,
}
json.NewEncoder(w).Encode(map[string]any{
"status": "ok",
})
@@ -240,34 +266,61 @@ func SendWorker() {
}
}()
for m := range msgChan {
currTaskId := atomic.AddInt64(&taskId, 1)
log.Printf("📩 收到任务: %d\n", currTaskId)
// 1. 创建一个 1 秒超时的上下文
ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
// 必须在处理完后释放 context 资源
defer cancel()
targetId := m.UserId
if m.GroupID != "" && targetId == "" {
targetId = m.GroupID
for {
select {
case <-finishChan:
fmt.Printf("收到完成信号 \n")
case m, ok := <-msgChan:
if !ok {
return
}
SendWechatMsg(m)
}
}
}
func SendWechatMsg(m *SendMsg) {
currTaskId := atomic.AddInt64(&taskId, 1)
log.Printf("📩 收到任务: %d\n", currTaskId)
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
targetId := m.UserId
if m.GroupID != "" && targetId == "" {
targetId = m.GroupID
}
switch m.Type {
case "text":
result := fridaScript.ExportsCall("triggerSendTextMessage", currTaskId, targetId, m.Content)
log.Printf("📩 发送文本任务执行结果：%s\n", result)
case "image":
targetPath, md5Str, err := SaveBase64Image(m.Content)
if err != nil {
log.Printf("保存图片失败: %v\n", err)
return
}
// 在子协程中执行阻塞的 Frida 调用
result := fridaScript.ExportsCall("manualTrigger", currTaskId, targetId, m.Content)
if result == nil {
log.Printf("📩 任务执行%s\n", result)
}
result := fridaScript.ExportsCall("triggerUploadImg", targetId, md5Str, targetPath)
log.Printf("📩 上传图片任务执行结果%s, 参数：targetId: %s, md5Str: %s, targetPath: %s\n", result, targetId, md5Str, targetPath)
select {
case <-ctx.Done():
// 此时已经过了 1 秒，resChan 还没收到数据
log.Printf("任务 %d 执行超时！\n", currTaskId)
log.Printf("上传图片任务 %d 执行超时！\n", currTaskId)
case <-finishChan:
log.Printf("收到完成信号，任务 %d 完成\n", currTaskId)
log.Printf("收到上传图片完成信号，任务 %d 完成\n", currTaskId)
}
result = fridaScript.ExportsCall("triggerSendImgMessage", currTaskId, myWechatId, targetId)
log.Printf("📩 发送图片任务执行%s, 参数：currTaskId: %d, myWechatId: %s, targetId: %s\n", result, currTaskId, myWechatId, targetId)
}
select {
case <-ctx.Done():
log.Printf("任务 %d 执行超时！\n", currTaskId)
case <-finishChan:
log.Printf("收到完成信号，任务 %d 完成\n", currTaskId)
}
}
@@ -315,6 +368,15 @@ func SendHttpReq(msg map[string]interface{}) {
}
fmt.Printf("发送数据: %s\n", string(jsonData))
if myWechatId == "" {
m := new(WechatMessage)
err = json.Unmarshal(jsonData, m)
if err != nil {
log.Printf("解析消息失败: %v\n", err)
return
}
myWechatId = m.SelfID
}
// 4. 创建 POST 请求
req, err := http.NewRequest("POST", config.SendURL, bytes.NewBuffer(jsonData))
@@ -349,3 +411,74 @@ func SendHttpReq(msg map[string]interface{}) {
fmt.Printf("状态码: %d 返回内容: %s\n", resp.StatusCode, string(body))
}
func SaveBase64Image(base64Data string) (string, string, error) {
rawContents := base64Data
if strings.HasPrefix(base64Data, "base64://") {
rawContents = strings.TrimPrefix(base64Data, "base64://")
} else if idx := strings.Index(base64Data, ","); idx != -1 {
rawContents = base64Data[idx+1:]
}
data, err := base64.StdEncoding.DecodeString(rawContents)
if err != nil {
return "", "", fmt.Errorf("base64 decode failed: %v", err)
}
r := rand.New(rand.NewSource(time.Now().UnixNano()))
randomNumber := r.Intn(1000) // 生成 0-999 的随机数
timestamp := time.Now().Unix()
fileName := fmt.Sprintf("%d_%d.%s", randomNumber, timestamp, DetectImageFormat(data))
targetPath := config.ImagePath + fileName
dir := filepath.Dir(targetPath)
if err := os.MkdirAll(dir, 0755); err != nil {
return "", "", fmt.Errorf("create directory failed: %v", err)
}
err = os.WriteFile(targetPath, data, 0644)
if err != nil {
return "", "", fmt.Errorf("write file failed: %v", err)
}
md5Str, err := GetFileMD5(targetPath)
if err != nil {
return "", "", fmt.Errorf("get file md5 failed: %v", err)
}
return targetPath, md5Str, nil
}
func GetFileMD5(filePath string) (string, error) {
file, err := os.Open(filePath)
if err != nil {
return "", err
}
defer file.Close()
hash := md5.New()
if _, err := io.Copy(hash, file); err != nil {
return "", err
}
return hex.EncodeToString(hash.Sum(nil)), nil
}
func DetectImageFormat(data []byte) string {
if len(data) < 12 {
return "unknown"
}
switch {
case bytes.HasPrefix(data, []byte{0xFF, 0xD8, 0xFF}):
return "jpeg"
case bytes.HasPrefix(data, []byte{0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A}):
return "png"
case bytes.HasPrefix(data, []byte("GIF87a")) || bytes.HasPrefix(data, []byte("GIF89a")):
return "gif"
case bytes.HasPrefix(data, []byte{0x42, 0x4D}):
return "bmp"
case bytes.HasPrefix(data, []byte("RIFF")) && bytes.HasPrefix(data[8:], []byte("WEBP")):
return "webp"
default:
return "unknown"
}
}
onebot/script.js
+163 -15
View File
@@ -83,6 +83,58 @@ function generateAESKey() {
}
function readVarint(addr) {
let value = 0;
let shift = 0;
let count = 0;
while (true) {
let byte = addr.add(count).readU8();
// 取低7位进行累加
value |= (byte & 0x7f) << shift;
count++; // 消耗了一个字节
// 如果最高位是0，跳出循环
if ((byte & 0x80) === 0) break;
shift += 7;
if (count > 5) return -1; // 安全校验，防止死循环
}
return {
value: value, // 最终长度数值 (例如 251)
byteLength: count // 长度字段占用的字节数 (例如 2)
};
}
function isPrintableOrChinese(startPtr, maxScanLength) {
let offset = 0;
while (offset < maxScanLength) {
let b = startPtr.add(offset).readU8();
if (b === 0) {
// 扫描到 \0，且之前没有发现异常字节
return offset > 0; // 如果第一个就是 \0，视为非字符串（可能是空指针）
}
// 判定逻辑：
// 1. 可见 ASCII (32-126) 或 换行/制表符 (9, 10, 13)
let isAscii = (b >= 32 && b <= 126) || (b === 9 || b === 10 || b === 13);
// 2. 汉字 UTF-8 特征：第一个字节通常 >= 0x80 (128)
// 严谨点：UTF-8 汉字首字节通常在 0xE4-0xE9 之间，后续字节在 0x80-0xBF 之间
// 这里简化处理：如果是高位字符，我们暂时放行，由 readUtf8String 最终处理
let isHighBit = (b >= 0x80);
if (!isAscii && !isHighBit) {
// 发现既不是 ASCII 也不是高位字节（如 0x01-0x1F 的控制字符），判定为指针
return false;
}
offset++;
}
return true;
}
// -------------------------基础函数分区-------------------------
// -------------------------全局变量分区-------------------------
@@ -106,6 +158,7 @@ var req2bufExitAddr = baseAddr.add(0x34577D8);
var sendFuncAddr = baseAddr.add(0x448A858);
var insertMsgAddr = ptr(0);
var sendMsgType = "";
var buf2RespAddr = baseAddr.add(0x347BD44);
// 图片消息全局变量
var sendImgMessageCallbackFunc = ptr(0x0);
@@ -211,7 +264,7 @@ function patchTextProtoBuf() {
console.log("[+] Patching PatchTextProtobufDeleteAddr " + PatchTextProtobufDeleteAddr + " 成功.");
}
setTimeout(function() {
setTimeout(function () {
console.log("[+] 3秒等待结束，准备执行 Patch...");
patchTextProtoBuf();
}, 3000);
@@ -375,15 +428,9 @@ function attachSendTextProto() {
setImmediate(attachSendTextProto);
rpc.exports = {
triggerSendTextMessage: triggerSendTextMessage
};
// -------------------------发送文本消息分区-------------------------
// -------------------------Req2Buf公共部分分区-------------------------
function attachReq2buf() {
console.log("[+] Target Req2buf enter Address: " + req2bufEnterAddr);
@@ -528,10 +575,10 @@ function patchImgProtoBuf() {
}
setTimeout(function() {
console.log("[+] 5秒等待结束，准备执行 Patch...");
setTimeout(function () {
console.log("[+] 2秒等待结束，准备执行 Patch...");
patchImgProtoBuf();
}, 5000);
}, 2000);
function triggerSendImgMessage(taskId, sender, receiver) {
console.log("[+] Manual Trigger Started...");
@@ -744,7 +791,6 @@ function attachProto() {
setImmediate(attachProto);
function triggerUploadImg(receiver, md5, imagePath) {
const payload = [
0x20, 0x05, 0x33, 0x8C, 0x0B, 0x00, 0x00, 0x00, // 函数 10802b8b0 的指针
@@ -849,10 +895,10 @@ function triggerUploadImg(receiver, md5, imagePath) {
const targetAddr = baseAddr.add(0x45DC834);
const startC2cUpload = new NativeFunction(targetAddr, 'int64', ['pointer', 'pointer']);
const startUploadMedia = new NativeFunction(targetAddr, 'int64', ['pointer', 'pointer']);
console.log("开始手动触发 C2C 上传...");
const result = startC2cUpload(uploadGlobalX0, uploadImagePayload);
const result = startUploadMedia(uploadGlobalX0, uploadImagePayload);
console.log("调用结果: " + result);
}
@@ -879,7 +925,13 @@ function patchCdnOnComplete() {
globalImageCdnKey = x2.add(0x60).readPointer().readUtf8String();
globalAesKey1 = x2.add(0x78).readPointer().readUtf8String();
globalMd5Key = x2.add(0x90).readPointer().readUtf8String();
console.log("[+] globalImageCdnKey: " + globalImageCdnKey + " globalAesKey1: " + globalAesKey1 + " globalAesKey2: " + globalMd5Key);
const selfId = x2.add(0x40).readUtf8String();
console.log("[+] globalImageCdnKey: " + globalImageCdnKey + " globalAesKey1: " + globalAesKey1 +
" globalAesKey2: " + globalMd5Key + " selfId: " + selfId);
send({
type: "finish",
self_id: selfId,
})
} catch (e) {
console.log("[-] Memory access error at onEnter: " + e);
}
@@ -892,7 +944,103 @@ setImmediate(patchCdnOnComplete)
rpc.exports = {
triggerSendImgMessage: triggerSendImgMessage,
triggerUploadImg: triggerUploadImg
triggerUploadImg: triggerUploadImg,
triggerSendTextMessage: triggerSendTextMessage
};
// -------------------------发送图片消息分区-------------------------
// -------------------------接收消息分区-------------------------
function setReceiver() {
// 3. 开始拦截
Interceptor.attach(buf2RespAddr, {
onEnter: function (args) {
const currentPtr = this.context.x1;
let start = 0x1e;
let senderLen = currentPtr.add(start).readU8();
if (senderLen !== 0x14 && senderLen !== 0x13) {
start = 0x1d;
let senderLen = currentPtr.add(start).readU8();
if (senderLen !== 0x14 && senderLen !== 0x13) {
return
}
}
console.log("[+] Entered Receive Function: 0x1023B5348");
let senderPtr = currentPtr.add(start + 1);
let sender = senderPtr.readUtf8String(senderLen);
let receiverLenPtr = senderPtr.add(senderLen).add(3);
let receiverLen = receiverLenPtr.readU8();
let receiverStrPtr = receiverLenPtr.add(1);
let receiver = receiverStrPtr.readUtf8String(receiverLen);
let contentLenPtr = receiverStrPtr.add(receiverLen).add(6);
// 判断是否等于 0x77 ('w'), 如果是，则是短字段
if (isPrintableOrChinese(contentLenPtr, 1)) {
contentLenPtr = contentLenPtr.add(-1);
}
const contentLenValue = readVarint(contentLenPtr)
let contentPtr = contentLenPtr.add(contentLenValue.byteLength);
var content = contentPtr.readUtf8String(contentLenValue.value);
var selfId = receiver
var msgType = "private"
var groupId = ""
var senderUser = sender
var messages = [];
messages.push({type: "text", data: {text: content}});
if (sender.includes("@chatroom")) {
msgType = "group"
groupId = sender
let splitIndex = -1;
for (let i = 0; i < content.length; i++) {
if (content[i] === ':') {
splitIndex = i;
break;
}
}
senderUser = content.substring(0, splitIndex).trim();
content = content.substring(splitIndex + 2).trim();
messages = [];
const parts = content.split('\u2005');
for (let part of parts) {
part = part.trim();
if (!part.startsWith("@")) {
messages.push({type: "text", data: {text: part}});
}
}
const xmlPtr = contentPtr.add(contentLenValue.value).add(15);
const xmlLenValue = readVarint(xmlPtr)
const xml = xmlPtr.add(xmlLenValue.byteLength).readUtf8String(xmlLenValue.value);
const atUserMatch = xml.match(/<atuserlist>([\s\S]*?)<\/atuserlist>/);
const atUser = atUserMatch ? atUserMatch[1] : null;
if (atUser) {
messages.push({type: "at", data: {qq: atUser}});
}
}
send({
message_type: msgType,
user_id: senderUser, // 发送人的 ID
self_id: selfId, // 接收人的 ID
group_id: groupId, // 群 ID
message_id: generateAESKey(),
type: "send",
raw: {peerUid: generateAESKey()},
message: messages
})
},
});
}
// 使用 setImmediate 确保在模块加载后执行
setImmediate(setReceiver)
// -------------------------接收消息分区-------------------------