From 4e787bc0212dc6fd5ec4e11599876432749bda33 Mon Sep 17 00:00:00 2001 From: yincong Date: Fri, 16 Jan 2026 12:23:59 +0800 Subject: [PATCH] support image --- frida-wechat.md | 1 + onebot/main.go | 209 ++++++++++++++++++++++++++++++++++++++--------- onebot/script.js | 178 ++++++++++++++++++++++++++++++++++++---- 3 files changed, 335 insertions(+), 53 deletions(-) diff --git a/frida-wechat.md b/frida-wechat.md index 1b5f0df..8e573bb 100644 --- a/frida-wechat.md +++ b/frida-wechat.md @@ -1,4 +1,5 @@ 触发 STNManager__MMStartTask +图片hook: startUploadMedia, OnUploadCompleted Req2Buf 构造消息的buffer入口，其中X4是消息内容，输出的是压缩后的protobuf Pack是打包函数，消息内容 cgi等信息打包进入 InitClientChannel， DoHandShakeLoop 是建立mmtls链接最重要的函数 diff --git a/onebot/main.go b/onebot/main.go index a0ad8c9..71ea9d7 100644 --- a/onebot/main.go +++ b/onebot/main.go @@ -4,16 +4,21 @@ import ( "bytes" "context" "crypto/hmac" + "crypto/md5" "crypto/sha1" + "encoding/base64" "encoding/hex" "encoding/json" "flag" "fmt" "io" "log" + "math/rand" "net/http" "os" "os/signal" + "path/filepath" + "strings" "sync/atomic" "syscall" "text/template" @@ -27,6 +32,7 @@ var ( fridaScript *frida.Script session *frida.Session taskId = int64(0x20000000) + myWechatId = "" msgChan = make(chan *SendMsg, 10) finishChan = make(chan struct{}) @@ -34,10 +40,17 @@ var ( config = &Config{} ) +type WechatMessage struct { + GroupId string `json:"group_id"` + SelfID string `json:"self_id"` + UserID string `json:"user_id"` +} + type SendMsg struct { UserId string GroupID string Content string + Type string } // SendRequest 请求结构体 @@ -55,6 +68,7 @@ type Message struct { type SendRequestData struct { Id string `json:"id"` Text string `json:"text"` + File string `json:"file"` } type Config struct { @@ -64,6 +78,7 @@ type Config struct { FridaGadgetAddr string `json:"frida_gadget_addr"` WechatPid int `json:"wechat_pid"` OnebotToken string `json:"onebot_token"` + ImagePath string `json:"image_path"` WechatConf string `json:"wechat_conf"` } @@ -75,7 +90,9 @@ func initFlag() { flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效") flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效") flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: 123456") - flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_6_12_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") + flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/") + + //flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_6_12_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") flag.Parse() @@ -85,7 +102,8 @@ func initFlag() { fmt.Println("FridaGadgetAddr", config.FridaGadgetAddr) fmt.Println("WechatPid", config.WechatPid) fmt.Println("OnebotToken", config.OnebotToken) - fmt.Println("WechatConf", config.WechatConf) + fmt.Println("ImagePath", config.ImagePath) + //fmt.Println("WechatConf", config.WechatConf) } @@ -126,16 +144,16 @@ func initFrida() { } func loadJs() { - jsonData, err := os.ReadFile(config.WechatConf) - if err != nil { - log.Fatalf("读取文件失败: %v\n", err) - } + //jsonData, err := os.ReadFile(config.WechatConf) + //if err != nil { + // log.Fatalf("读取文件失败: %v\n", err) + //} // 2. 将 JSON 解析为 Map var wechatHookConf map[string]interface{} - if err := json.Unmarshal(jsonData, &wechatHookConf); err != nil { - log.Fatalf("解析 JSON 失败: %v\n", err) - } + //if err := json.Unmarshal(jsonData, &wechatHookConf); err != nil { + // log.Fatalf("解析 JSON 失败: %v\n", err) + //} codeTemplate, err := os.ReadFile("./script.js") if err != nil { @@ -174,6 +192,9 @@ func loadJs() { if t.(string) == "send" { go SendHttpReq(msg) } else if t.(string) == "finish" { + if selfId, ok := pMap["self_id"]; ok { + myWechatId = selfId.(string) + } finishChan <- struct{}{} } } @@ -214,19 +235,24 @@ func sendHandler(w http.ResponseWriter, r *http.Request) { return } - text := "" for _, v := range req.Message { if v.Type == "text" { - text = v.Data.Text + msgChan <- &SendMsg{ + UserId: req.UserID, + GroupID: req.GroupID, + Content: v.Data.Text, + Type: v.Type, + } + } else if v.Type == "image" { + msgChan <- &SendMsg{ + UserId: req.UserID, + GroupID: req.GroupID, + Content: v.Data.File, + Type: v.Type, + } } } - msgChan <- &SendMsg{ - UserId: req.UserID, - GroupID: req.GroupID, - Content: text, - } - json.NewEncoder(w).Encode(map[string]any{ "status": "ok", }) @@ -240,34 +266,61 @@ func SendWorker() { } }() - for m := range msgChan { - currTaskId := atomic.AddInt64(&taskId, 1) - log.Printf("📩 收到任务: %d\n", currTaskId) - - // 1. 创建一个 1 秒超时的上下文 - ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second) - - // 必须在处理完后释放 context 资源 - defer cancel() - - targetId := m.UserId - if m.GroupID != "" && targetId == "" { - targetId = m.GroupID + for { + select { + case <-finishChan: + fmt.Printf("收到完成信号 \n") + case m, ok := <-msgChan: + if !ok { + return + } + SendWechatMsg(m) + } + } +} + +func SendWechatMsg(m *SendMsg) { + currTaskId := atomic.AddInt64(&taskId, 1) + log.Printf("📩 收到任务: %d\n", currTaskId) + + ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) + defer cancel() + + targetId := m.UserId + if m.GroupID != "" && targetId == "" { + targetId = m.GroupID + } + + switch m.Type { + case "text": + result := fridaScript.ExportsCall("triggerSendTextMessage", currTaskId, targetId, m.Content) + log.Printf("📩 发送文本任务执行结果：%s\n", result) + case "image": + targetPath, md5Str, err := SaveBase64Image(m.Content) + if err != nil { + log.Printf("保存图片失败: %v\n", err) + return } - // 在子协程中执行阻塞的 Frida 调用 - result := fridaScript.ExportsCall("manualTrigger", currTaskId, targetId, m.Content) - if result == nil { - log.Printf("📩 任务执行%s\n", result) - } + result := fridaScript.ExportsCall("triggerUploadImg", targetId, md5Str, targetPath) + log.Printf("📩 上传图片任务执行结果%s, 参数：targetId: %s, md5Str: %s, targetPath: %s\n", result, targetId, md5Str, targetPath) select { case <-ctx.Done(): - // 此时已经过了 1 秒，resChan 还没收到数据 - log.Printf("任务 %d 执行超时！\n", currTaskId) + log.Printf("上传图片任务 %d 执行超时！\n", currTaskId) case <-finishChan: - log.Printf("收到完成信号，任务 %d 完成\n", currTaskId) + log.Printf("收到上传图片完成信号，任务 %d 完成\n", currTaskId) } + + result = fridaScript.ExportsCall("triggerSendImgMessage", currTaskId, myWechatId, targetId) + log.Printf("📩 发送图片任务执行%s, 参数：currTaskId: %d, myWechatId: %s, targetId: %s\n", result, currTaskId, myWechatId, targetId) + } + + select { + case <-ctx.Done(): + log.Printf("任务 %d 执行超时！\n", currTaskId) + case <-finishChan: + log.Printf("收到完成信号，任务 %d 完成\n", currTaskId) } } @@ -315,6 +368,15 @@ func SendHttpReq(msg map[string]interface{}) { } fmt.Printf("发送数据: %s\n", string(jsonData)) + if myWechatId == "" { + m := new(WechatMessage) + err = json.Unmarshal(jsonData, m) + if err != nil { + log.Printf("解析消息失败: %v\n", err) + return + } + myWechatId = m.SelfID + } // 4. 创建 POST 请求 req, err := http.NewRequest("POST", config.SendURL, bytes.NewBuffer(jsonData)) @@ -349,3 +411,74 @@ func SendHttpReq(msg map[string]interface{}) { fmt.Printf("状态码: %d 返回内容: %s\n", resp.StatusCode, string(body)) } + +func SaveBase64Image(base64Data string) (string, string, error) { + rawContents := base64Data + if strings.HasPrefix(base64Data, "base64://") { + rawContents = strings.TrimPrefix(base64Data, "base64://") + } else if idx := strings.Index(base64Data, ","); idx != -1 { + rawContents = base64Data[idx+1:] + } + + data, err := base64.StdEncoding.DecodeString(rawContents) + if err != nil { + return "", "", fmt.Errorf("base64 decode failed: %v", err) + } + + r := rand.New(rand.NewSource(time.Now().UnixNano())) + randomNumber := r.Intn(1000) // 生成 0-999 的随机数 + timestamp := time.Now().Unix() + fileName := fmt.Sprintf("%d_%d.%s", randomNumber, timestamp, DetectImageFormat(data)) + targetPath := config.ImagePath + fileName + dir := filepath.Dir(targetPath) + if err := os.MkdirAll(dir, 0755); err != nil { + return "", "", fmt.Errorf("create directory failed: %v", err) + } + + err = os.WriteFile(targetPath, data, 0644) + if err != nil { + return "", "", fmt.Errorf("write file failed: %v", err) + } + + md5Str, err := GetFileMD5(targetPath) + if err != nil { + return "", "", fmt.Errorf("get file md5 failed: %v", err) + } + + return targetPath, md5Str, nil +} + +func GetFileMD5(filePath string) (string, error) { + file, err := os.Open(filePath) + if err != nil { + return "", err + } + defer file.Close() + + hash := md5.New() + if _, err := io.Copy(hash, file); err != nil { + return "", err + } + return hex.EncodeToString(hash.Sum(nil)), nil +} + +func DetectImageFormat(data []byte) string { + if len(data) < 12 { + return "unknown" + } + + switch { + case bytes.HasPrefix(data, []byte{0xFF, 0xD8, 0xFF}): + return "jpeg" + case bytes.HasPrefix(data, []byte{0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A}): + return "png" + case bytes.HasPrefix(data, []byte("GIF87a")) || bytes.HasPrefix(data, []byte("GIF89a")): + return "gif" + case bytes.HasPrefix(data, []byte{0x42, 0x4D}): + return "bmp" + case bytes.HasPrefix(data, []byte("RIFF")) && bytes.HasPrefix(data[8:], []byte("WEBP")): + return "webp" + default: + return "unknown" + } +} diff --git a/onebot/script.js b/onebot/script.js index 6cf3e1d..c4257bc 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -83,6 +83,58 @@ function generateAESKey() { } +function readVarint(addr) { + let value = 0; + let shift = 0; + let count = 0; + + while (true) { + let byte = addr.add(count).readU8(); + // 取低7位进行累加 + value |= (byte & 0x7f) << shift; + count++; // 消耗了一个字节 + + // 如果最高位是0，跳出循环 + if ((byte & 0x80) === 0) break; + + shift += 7; + if (count > 5) return -1; // 安全校验，防止死循环 + } + + return { + value: value, // 最终长度数值 (例如 251) + byteLength: count // 长度字段占用的字节数 (例如 2) + }; +} + +function isPrintableOrChinese(startPtr, maxScanLength) { + let offset = 0; + while (offset < maxScanLength) { + let b = startPtr.add(offset).readU8(); + + if (b === 0) { + // 扫描到 \0，且之前没有发现异常字节 + return offset > 0; // 如果第一个就是 \0，视为非字符串（可能是空指针） + } + + // 判定逻辑： + // 1. 可见 ASCII (32-126) 或 换行/制表符 (9, 10, 13) + let isAscii = (b >= 32 && b <= 126) || (b === 9 || b === 10 || b === 13); + + // 2. 汉字 UTF-8 特征：第一个字节通常 >= 0x80 (128) + // 严谨点：UTF-8 汉字首字节通常在 0xE4-0xE9 之间，后续字节在 0x80-0xBF 之间 + // 这里简化处理：如果是高位字符，我们暂时放行，由 readUtf8String 最终处理 + let isHighBit = (b >= 0x80); + + if (!isAscii && !isHighBit) { + // 发现既不是 ASCII 也不是高位字节（如 0x01-0x1F 的控制字符），判定为指针 + return false; + } + offset++; + } + return true; +} + // -------------------------基础函数分区------------------------- // -------------------------全局变量分区------------------------- @@ -106,6 +158,7 @@ var req2bufExitAddr = baseAddr.add(0x34577D8); var sendFuncAddr = baseAddr.add(0x448A858); var insertMsgAddr = ptr(0); var sendMsgType = ""; +var buf2RespAddr = baseAddr.add(0x347BD44); // 图片消息全局变量 var sendImgMessageCallbackFunc = ptr(0x0); @@ -211,7 +264,7 @@ function patchTextProtoBuf() { console.log("[+] Patching PatchTextProtobufDeleteAddr " + PatchTextProtobufDeleteAddr + " 成功."); } -setTimeout(function() { +setTimeout(function () { console.log("[+] 3秒等待结束，准备执行 Patch..."); patchTextProtoBuf(); }, 3000); @@ -375,15 +428,9 @@ function attachSendTextProto() { setImmediate(attachSendTextProto); - -rpc.exports = { - triggerSendTextMessage: triggerSendTextMessage -}; - // -------------------------发送文本消息分区------------------------- - // -------------------------Req2Buf公共部分分区------------------------- function attachReq2buf() { console.log("[+] Target Req2buf enter Address: " + req2bufEnterAddr); @@ -528,10 +575,10 @@ function patchImgProtoBuf() { } -setTimeout(function() { - console.log("[+] 5秒等待结束，准备执行 Patch..."); +setTimeout(function () { + console.log("[+] 2秒等待结束，准备执行 Patch..."); patchImgProtoBuf(); -}, 5000); +}, 2000); function triggerSendImgMessage(taskId, sender, receiver) { console.log("[+] Manual Trigger Started..."); @@ -744,7 +791,6 @@ function attachProto() { setImmediate(attachProto); - function triggerUploadImg(receiver, md5, imagePath) { const payload = [ 0x20, 0x05, 0x33, 0x8C, 0x0B, 0x00, 0x00, 0x00, // 函数 10802b8b0 的指针 @@ -849,10 +895,10 @@ function triggerUploadImg(receiver, md5, imagePath) { const targetAddr = baseAddr.add(0x45DC834); - const startC2cUpload = new NativeFunction(targetAddr, 'int64', ['pointer', 'pointer']); + const startUploadMedia = new NativeFunction(targetAddr, 'int64', ['pointer', 'pointer']); console.log("开始手动触发 C2C 上传..."); - const result = startC2cUpload(uploadGlobalX0, uploadImagePayload); + const result = startUploadMedia(uploadGlobalX0, uploadImagePayload); console.log("调用结果: " + result); } @@ -879,7 +925,13 @@ function patchCdnOnComplete() { globalImageCdnKey = x2.add(0x60).readPointer().readUtf8String(); globalAesKey1 = x2.add(0x78).readPointer().readUtf8String(); globalMd5Key = x2.add(0x90).readPointer().readUtf8String(); - console.log("[+] globalImageCdnKey: " + globalImageCdnKey + " globalAesKey1: " + globalAesKey1 + " globalAesKey2: " + globalMd5Key); + const selfId = x2.add(0x40).readUtf8String(); + console.log("[+] globalImageCdnKey: " + globalImageCdnKey + " globalAesKey1: " + globalAesKey1 + + " globalAesKey2: " + globalMd5Key + " selfId: " + selfId); + send({ + type: "finish", + self_id: selfId, + }) } catch (e) { console.log("[-] Memory access error at onEnter: " + e); } @@ -892,7 +944,103 @@ setImmediate(patchCdnOnComplete) rpc.exports = { triggerSendImgMessage: triggerSendImgMessage, - triggerUploadImg: triggerUploadImg + triggerUploadImg: triggerUploadImg, + triggerSendTextMessage: triggerSendTextMessage }; // -------------------------发送图片消息分区------------------------- + +// -------------------------接收消息分区------------------------- +function setReceiver() { + + // 3. 开始拦截 + Interceptor.attach(buf2RespAddr, { + onEnter: function (args) { + + const currentPtr = this.context.x1; + let start = 0x1e; + let senderLen = currentPtr.add(start).readU8(); + if (senderLen !== 0x14 && senderLen !== 0x13) { + start = 0x1d; + let senderLen = currentPtr.add(start).readU8(); + if (senderLen !== 0x14 && senderLen !== 0x13) { + return + } + } + + console.log("[+] Entered Receive Function: 0x1023B5348"); + + let senderPtr = currentPtr.add(start + 1); + let sender = senderPtr.readUtf8String(senderLen); + + let receiverLenPtr = senderPtr.add(senderLen).add(3); + let receiverLen = receiverLenPtr.readU8(); + let receiverStrPtr = receiverLenPtr.add(1); + let receiver = receiverStrPtr.readUtf8String(receiverLen); + + let contentLenPtr = receiverStrPtr.add(receiverLen).add(6); + // 判断是否等于 0x77 ('w'), 如果是，则是短字段 + if (isPrintableOrChinese(contentLenPtr, 1)) { + contentLenPtr = contentLenPtr.add(-1); + } + const contentLenValue = readVarint(contentLenPtr) + let contentPtr = contentLenPtr.add(contentLenValue.byteLength); + var content = contentPtr.readUtf8String(contentLenValue.value); + + var selfId = receiver + var msgType = "private" + var groupId = "" + var senderUser = sender + var messages = []; + messages.push({type: "text", data: {text: content}}); + + if (sender.includes("@chatroom")) { + msgType = "group" + groupId = sender + let splitIndex = -1; + for (let i = 0; i < content.length; i++) { + if (content[i] === ':') { + splitIndex = i; + break; + } + } + + senderUser = content.substring(0, splitIndex).trim(); + content = content.substring(splitIndex + 2).trim(); + + messages = []; + const parts = content.split('\u2005'); + for (let part of parts) { + part = part.trim(); + if (!part.startsWith("@")) { + messages.push({type: "text", data: {text: part}}); + } + } + + const xmlPtr = contentPtr.add(contentLenValue.value).add(15); + const xmlLenValue = readVarint(xmlPtr) + const xml = xmlPtr.add(xmlLenValue.byteLength).readUtf8String(xmlLenValue.value); + const atUserMatch = xml.match(/([\s\S]*?)<\/atuserlist>/); + const atUser = atUserMatch ? atUserMatch[1] : null; + if (atUser) { + messages.push({type: "at", data: {qq: atUser}}); + } + } + + send({ + message_type: msgType, + user_id: senderUser, // 发送人的 ID + self_id: selfId, // 接收人的 ID + group_id: groupId, // 群 ID + message_id: generateAESKey(), + type: "send", + raw: {peerUid: generateAESKey()}, + message: messages + }) + }, + }); +} + +// 使用 setImmediate 确保在模块加载后执行 +setImmediate(setReceiver) +// -------------------------接收消息分区------------------------- \ No newline at end of file