update 4.1.9.31

frida-wechat.md

@@ -1,7 +1,10 @@
 触发 STNManager__MMStartTask （ida搜 [MMStartTask]()）
 图片hook: startUploadMedia （ida搜）, OnUploadCompleted （ce查）
 startUploadMedia 上传图片，OnUploadCompleted 上传图片完成后的回调
-加密后的图片在_OnRecvFileData
+加密后的图片在 _OnRecvFileData
 download系列都是_OnRecvFileData，在不同的文件下面
+var downloadImagAddr  // image_download
+var downloadFileAddr // c2c_download
+var downloadVideoAddr // hdvideo_streaming OnRecvedData
 
-WeChatExt中会有导致idapro出问题的代码
+WeChatExt中会有导致idapro出问题的代码

frida/auto.js

@@ -1,9 +1,8 @@
-var moduleName = "wechat.dylib";
-var module = Process.findModuleByName(moduleName);
-var baseAddr = module.base;
-if (!baseAddr) {
-    console.error("[!] 找不到 WeChat 模块基址，请检查进程名。");
-}
+var targetPath = "/Applications/WeChat.app/Contents/Resources/wechat.dylib";
+var module = Process.enumerateModules().find(function(m) {
+	return m.path === targetPath;
+});
+const baseAddr = module.base
 console.log("[+] WeChat base address: " + baseAddr);
 
 function scanPatterns() {
@@ -44,9 +43,6 @@ function scanPatterns() {
                     case "downloadVideoAddr":
                         console.log(`"${name}": "${offset.sub(0x2c)}", 绝对地址: ${address.sub(0x2c)}`);
                         break;
-                    case "startUploadMedia":
-                        console.log(`"${name}": "${offset.sub(0x30)}", 绝对地址: ${address.sub(0x30)}`);
-                        break;
                 }
             },
             onError: function(reason) {
@@ -73,7 +69,7 @@ const myPatterns = [
     },
     {
         name: "downloadFileAddr",
-        pattern: "F5 03 00 AA  68 4A 41 F9 08 41 46 39 60 22 01 91 69 52 41 F9"
+        pattern: "F5 03 00 AA 68 4A 41 F9 08 41 46 39 60 22 01 91 69 52 41 F9"
     },
     {
         name: "downloadImageAddr",
@@ -85,7 +81,7 @@ const myPatterns = [
     },
     {
         name: "sendFuncAddr",
-        pattern: "E0 03 00 91 21 00 80 52 E5 03 03 AA 26 85 80 52 07 00 80 D2"
+        pattern: "E0 03 00 91 21 00 80 52 E5 03 03 AA 46 8A 80 52"
     },
     {
         name: "buf2RespAddr",
@@ -98,10 +94,6 @@ const myPatterns = [
     {
         name: "downloadVideoAddr",
         pattern: "E0 03 07 91 01 00 80 52 45 C1 80 52 06 00 80 52 07 00 80 D2"
-    },
-    {
-        name: "startUploadMedia",
-        pattern: "08 01 40 F9 A8 83 1A F8  28 9C 40 B9 1F 0D 00 71"
     }
 ];
 

frida/receiver.js

@@ -1,15 +1,18 @@
-var moduleName = "wechat.dylib";
-var baseAddr = Process.findModuleByName(moduleName).base;
+var targetPath = "/Applications/WeChat.app/Contents/Resources/wechat.dylib";
+var module = Process.enumerateModules().find(function(m) {
+	return m.path === targetPath;
+});
+const baseAddr = module.base
 if (!baseAddr) {
     console.error("[!] 找不到 WeChat 模块基址，请检查进程名。");
 }
 console.log("[+] WeChat base address: " + baseAddr);
 
-var buf2RespAddr = baseAddr.add(0x38b0a78)
-var downloadImagAddr = baseAddr.add(0x4cc945c) // image_download
-var downloadFileAddr = baseAddr.add(0x4c681e4) // c2c_download
-var downloadVideoAddr = baseAddr.add(0x4c89f68) // hdvideo_streaming
-var startDownloadMedia = baseAddr.add(0x4ba6340)
+var buf2RespAddr = baseAddr.add(0x39FAC00)
+var downloadImagAddr = baseAddr.add(0x4CFFF3C) // image_download
+var downloadFileAddr = baseAddr.add(0x4C9EF48) // c2c_download
+var downloadVideoAddr = baseAddr.add(0x4CB8070) // hdvideo_streaming
+var startDownloadMedia = baseAddr.add(0x4bdd618)
 
 var downloadGlobalX0;
 var downloadFileX1 = ptr(0)

onebot/script.js

@@ -1,5 +1,8 @@
-var moduleName = "wechat.dylib";
-var baseAddr = Process.findModuleByName(moduleName).base;
+var targetPath = "/Applications/WeChat.app/Contents/Resources/wechat.dylib";
+var module = Process.enumerateModules().find(function(m) {
+    return m.path === targetPath;
+});
+const baseAddr = module.base;
 if (!baseAddr) {
     console.error("[!] 找不到 WeChat 模块基址，请检查进程名。");
 }
@@ -39,7 +42,7 @@ function generateAESKey() {
 
 // 文本消息全局变量
 var textCallbackFuncAddr = baseAddr.add({{.textCallbackFuncAddr}});
-var protobufAddr = textCallbackFuncAddr.add(0x40);
+var protobufAddr = textCallbackFuncAddr.add(0x44);
 var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20);
 var patchTextProtobufByte
 var patchTextProtobufDeleteAddr = textCallbackFuncAddr.add(0x5C);

wechat_version/4_1_9_31_mac.json

@@ -0,0 +1,22 @@
+{
+	"textCallbackFuncAddr": "0x26779D4",
+	"sendMessageCallbackFunc": "0x8C2C880",
+	"sendFuncAddr": "0x4A61D3C",
+	"req2bufEnterAddr": "0x38cba28",
+	"req2bufExitAddr": "0x38CC97C",
+	"imageCallbackFuncAddr": "0x266E3A0",
+	"imgMessageCallbackFunc": "0x8C2C348",
+	"uploadImageAddr": "0x4bdc9b0",
+	"cndOnCompleteAddr": "0x388883c",
+	"buf2RespAddr": "0x38f1520",
+	"uploadGetCallbackWrapperAddr": "0x4b9b754",
+	"uploadGetCallbackWrapperFuncAddr": "",
+	"uploadOnCompleteAddr": "",
+	"uploadOnCompleteFuncAddr": "",
+	"downloadImagAddr": "0x4CFFF3C",
+	"startDownloadMedia": "0x4bdd618",
+	"downloadFileAddr": "0x4C9EF50",
+	"downloadVideoAddr": "0x4CB8070",
+	"videoCallbackFuncAddr": "0x26DD8C8",
+	"videoMessageCallbackFunc": "0x8C2F0F8"
+}