tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

send image succ

Browse Source
This commit is contained in:
yincong
2026-01-12 14:46:10 +08:00
parent 377a5bdd0d
commit 5fa73bf622
2 changed files with 205 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files
onebot/image.js
+175 -161
View File
@@ -6,12 +6,9 @@ if (!baseAddr) {
console.log("[+] WeChat base address: " + baseAddr);
// // 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来
var sendMessageCallbackFunc = baseAddr.add(0xAA8C5B078);
// 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来
var sendMessageCallbackFunc = ptr(0x0);
var messageCallbackFunc1 = baseAddr.add(0x7fa0b18);
var messageCallbackFunc2 = baseAddr.add(0x7fa0b70);
var messageCallbackFunc3 = baseAddr.add(0x804ae78);
var messageCallbackFunc4 = baseAddr.add(0x8030a00);
// 这个必须是绝对位置
var triggerX1Payload = ptr(0x175ED6600);
@@ -23,6 +20,8 @@ var buf2RespAddr = baseAddr.add(0x347BD44);
var patchProtobufFunc1 = baseAddr.add(0x2275BB8)
var patchProtobufFunc2 = baseAddr.add(0x2275BD8);
var protobufDeleteAddr = baseAddr.add(0x2275C14);
var runReadWriteAddr = baseAddr.add(0x450F518)
var runReadWriteAddr1 = baseAddr.add(0x450F51C);
// 触发函数X0参数地址
var globalMessagePtr = ptr(0);
@@ -35,7 +34,6 @@ var callBackFuncAddr3 = ptr(0);
var sendMessageAddr = ptr(0);
var messageAddr = ptr(0);
var messageContentAddr = ptr(0);
var contentAddr = ptr(0);
var insertMsgAddr = ptr(0);
var receiverAddr = ptr(0);
@@ -78,7 +76,7 @@ function setupSendMessageDynamic() {
callBackFuncAddr3 = Memory.alloc(16);
sendMessageAddr = Memory.alloc(256);
messageAddr = Memory.alloc(512);
contentAddr = Memory.alloc(255);
contentAddr = Memory.alloc(16);
receiverAddr = Memory.alloc(24);
htmlContentAddr = Memory.alloc(24);
@@ -131,77 +129,6 @@ function patchHex(addr, hexStr) {
addr.add(bytes.length).writeU8(0); // 终止符
}
// 初始化进行内存的分配
function setupSendMessageDynamic() {
console.log("[+] Starting Dynamic Message Patching...");
// 1. 动态分配内存块（按需分配大小）
// 分配原则：字符串给 64-128 字节，结构体按实际大小分配
cgiAddr = Memory.alloc(128);
callBackFuncAddr = Memory.alloc(16);
sendMessageAddr = Memory.alloc(256);
messageAddr = Memory.alloc(256);
contentAddr = Memory.alloc(255);
receiverAddr = Memory.alloc(24);
// A. 写入字符串内容
patchHex(cgiAddr, "2F 63 67 69 2D 62 69 6E 2F 6D 69 63 72 6F 6D 73 67 2D 62 69 6E 2F 6E 65 77 73 65 6E 64 6D 73 67");
patchHex(contentAddr, " ");
// B. 构建 SendMessage 结构体 (X24 基址位置)
sendMessageAddr.add(0x00).writeU64(0);
sendMessageAddr.add(0x08).writeU64(0);
sendMessageAddr.add(0x10).writePointer(sendMessageCallbackFunc);
sendMessageAddr.add(0x18).writeU64(1);
sendMessageAddr.add(0x20).writeU32(taskIdGlobal);
sendMessageAddr.add(0x28).writePointer(messageAddr); // 指向动态分配的 Message
console.log(" [+] sendMessageAddr Object: ", hexdump(sendMessageAddr, {
offset: 0,
length: 48,
header: true,
ansi: true
}));
// C. 构建 Message 结构体
messageAddr.add(0x00).writePointer(messageCallbackFunc1);
messageAddr.add(0x08).writeU32(taskIdGlobal);
messageAddr.add(0x0c).writeU32(0x20a);
messageAddr.add(0x10).writeU64(0x3);
messageAddr.add(0x18).writePointer(cgiAddr);
// 设置一些固定值
messageAddr.add(0x20).writeU64(uint64("0x20"));
messageAddr.add(0x28).writeU64(uint64("0x8000000000000030"));
messageAddr.add(0x30).writeU64(uint64("0x0000000001010100"));
messageAddr.add(0x58).writeU64(uint64("0x0101010100000001"));
// 处理回调地址
callBackFuncAddr.writePointer(messageCallbackFunc2);
messageAddr.add(0x98).writePointer(callBackFuncAddr);
// 设置内容指针
messageAddr.add(0xb8).writePointer(messageCallbackFunc3);
messageAddr.add(0xc0).writePointer(messageContentAddr);
messageAddr.add(0xc8).writeU64(uint64("0x0000000100000001"));
messageAddr.add(0xd0).writeU64(0x4);
messageAddr.add(0xd8).writeU64(0x1);
messageAddr.add(0xe0).writeU64(0x1);
messageAddr.add(0xe8).writePointer(messageCallbackFunc4);
console.log(" [+] messageAddr Object: ", hexdump(messageAddr, {
offset: 0,
length: 64,
header: true,
ansi: true
}));
console.log("[+] Dynamic Memory Setup Complete. - Message Object: " + messageAddr);
}
setImmediate(setupSendMessageDynamic);
function patchProtoBuf() {
Memory.patchCode(patchProtobufFunc1, 4, code => {
@@ -229,7 +156,7 @@ function patchProtoBuf() {
console.log("[+] Patching BL DELETE to NOP at " + protobufDeleteAddr + " completed.");
}
// setImmediate(patchProtoBuf);
setImmediate(patchProtoBuf);
function manualTrigger(taskId, receiver, content) {
console.log("[+] Manual Trigger Started...");
@@ -385,7 +312,6 @@ function attachReq2buf() {
}
insertMsgAddr.writeU64(0x0);
console.log("[+] 清空写入后内存预览: " + insertMsgAddr.readPointer());
taskIdGlobal = 0;
receiverGlobal = "";
contentGlobal = "";
send({
@@ -632,18 +558,18 @@ function attachProto() {
const finalPayload = [
0x0A, 0x3F, 0x0A, 0x01, 0x00, 0x10, 0xC6, 0xBC,
0x90, 0xB9, 0x08, 0x1A, 0x10, 0x6D, 0x33, 0x30,
0x63, 0x34, 0x36, 0x37, 0x34, 0x66, 0x35, 0x61,
0x30, 0x62, 0x39, 0x64, 0x30, 0x20, 0xAF, 0xAC,
0x90, 0xB9, 0x08, 0x1A, 0x10, 0x6D, 0x64, 0x34,
0x34, 0x36, 0x34, 0x65, 0x34, 0x37, 0x36, 0x34,
0x65, 0x61, 0x61, 0x62, 0x62, 0x20, 0xAF, 0xAC,
0x90, 0x93, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
0x2A, 0x15, 0x55, 0x6E, 0x69, 0x66, 0x69, 0x65,
0x64, 0x50, 0x43, 0x4D, 0x61, 0x63, 0x20, 0x32,
0x36, 0x20, 0x61, 0x72, 0x6D, 0x36, 0x34, 0x30,
0x6F, 0x12, 0x2E, 0x0A, 0x2C, 0x77, 0x78, 0x69,
0x70, 0x12, 0x2E, 0x0A, 0x2C, 0x77, 0x78, 0x69,
0x64, 0x5F, 0x37, 0x77, 0x64, 0x31, 0x65, 0x63,
0x65, 0x39, 0x39, 0x66, 0x37, 0x69, 0x32, 0x31,
0x5F, 0x31, 0x37, 0x36, 0x37, 0x39, 0x33, 0x39,
0x31, 0x31, 0x30, 0x5F, 0x31, 0x33, 0x33, 0x5F,
0x5F, 0x31, 0x37, 0x36, 0x38, 0x32, 0x33, 0x30,
0x31, 0x38, 0x35, 0x5F, 0x31, 0x33, 0x35, 0x5F,
0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, 0x5F,
0x31, 0x1A, 0x15, 0x0A, 0x13, 0x77, 0x78, 0x69,
0x64, 0x5F, 0x6C, 0x64, 0x66, 0x74, 0x75, 0x68,
@@ -651,16 +577,16 @@ function attachProto() {
0x22, 0x15, 0x0A, 0x13, 0x77, 0x78, 0x69, 0x64,
0x5F, 0x37, 0x77, 0x64, 0x31, 0x65, 0x63, 0x65,
0x39, 0x39, 0x66, 0x37, 0x69, 0x32, 0x31, 0x28,
0x88, 0x12, 0x30, 0x00, 0x38, 0x88, 0x12, 0x42,
0xD3, 0x11, 0x30, 0x00, 0x38, 0xD3, 0x11, 0x42,
0x04, 0x08, 0x00, 0x12, 0x00, 0x48, 0x03, 0x52,
0x83, 0x01, 0x3C, 0x6D, 0x73, 0x67, 0x73, 0x6F,
0x75, 0x72, 0x63, 0x65, 0x3E, 0x3C, 0x69, 0x6D,
0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, 0x6E,
0x61, 0x6D, 0x65, 0x3E, 0x30, 0x39, 0x64, 0x32,
0x32, 0x63, 0x34, 0x63, 0x2D, 0x33, 0x38, 0x65,
0x35, 0x2D, 0x34, 0x61, 0x30, 0x34, 0x2D, 0x62,
0x30, 0x64, 0x63, 0x2D, 0x35, 0x63, 0x65, 0x30,
0x62, 0x39, 0x30, 0x37, 0x66, 0x31, 0x64, 0x64,
0x61, 0x6D, 0x65, 0x3E, 0x36, 0x35, 0x39, 0x36,
0x34, 0x33, 0x63, 0x61, 0x2D, 0x66, 0x31, 0x62,
0x63, 0x2D, 0x34, 0x39, 0x33, 0x64, 0x2D, 0x61,
0x65, 0x37, 0x38, 0x2D, 0x35, 0x62, 0x30, 0x62,
0x31, 0x65, 0x34, 0x39, 0x35, 0x33, 0x64, 0x64,
0x2E, 0x70, 0x6E, 0x67, 0x3C, 0x2F, 0x69, 0x6D,
0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, 0x6E,
0x61, 0x6D, 0x65, 0x3E, 0x3C, 0x61, 0x6C, 0x6E,
@@ -675,95 +601,95 @@ function attachProto() {
0x30, 0x34, 0x34, 0x62, 0x33, 0x30, 0x34, 0x39,
0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x32,
0x30, 0x34, 0x64, 0x30, 0x61, 0x37, 0x30, 0x39,
0x35, 0x64, 0x30, 0x32, 0x30, 0x33, 0x32, 0x64,
0x64, 0x32, 0x37, 0x39, 0x30, 0x32, 0x30, 0x34,
0x37, 0x65, 0x64, 0x35, 0x36, 0x63, 0x37, 0x31,
0x30, 0x32, 0x30, 0x34, 0x36, 0x39, 0x36, 0x30,
0x39, 0x63, 0x32, 0x37, 0x30, 0x34, 0x32, 0x34,
0x33, 0x37, 0x36, 0x33, 0x36, 0x34, 0x33, 0x38,
0x33, 0x34, 0x33, 0x30, 0x33, 0x38, 0x36, 0x31,
0x32, 0x64, 0x33, 0x31, 0x36, 0x31, 0x33, 0x37,
0x33, 0x33, 0x32, 0x64, 0x33, 0x34, 0x36, 0x33,
0x33, 0x36, 0x33, 0x39, 0x32, 0x64, 0x36, 0x31,
0x33, 0x36, 0x33, 0x37, 0x36, 0x34, 0x32, 0x64,
0x33, 0x37, 0x33, 0x38, 0x36, 0x35, 0x33, 0x39,
0x33, 0x34, 0x33, 0x33, 0x33, 0x37, 0x36, 0x34,
0x36, 0x34, 0x33, 0x39, 0x36, 0x31, 0x33, 0x38,
0x35, 0x64, 0x30, 0x32, 0x30, 0x33, 0x32, 0x66,
0x38, 0x30, 0x32, 0x39, 0x30, 0x32, 0x30, 0x34,
0x64, 0x32, 0x66, 0x37, 0x33, 0x64, 0x62, 0x37,
0x30, 0x32, 0x30, 0x34, 0x36, 0x39, 0x36, 0x34,
0x39, 0x37, 0x66, 0x39, 0x30, 0x34, 0x32, 0x34,
0x33, 0x39, 0x33, 0x35, 0x36, 0x31, 0x36, 0x33,
0x33, 0x35, 0x36, 0x31, 0x33, 0x37, 0x36, 0x33,
0x32, 0x64, 0x33, 0x31, 0x33, 0x30, 0x33, 0x31,
0x33, 0x34, 0x32, 0x64, 0x33, 0x34, 0x36, 0x34,
0x33, 0x38, 0x36, 0x36, 0x32, 0x64, 0x33, 0x39,
0x33, 0x30, 0x33, 0x37, 0x36, 0x32, 0x32, 0x64,
0x36, 0x33, 0x33, 0x39, 0x33, 0x33, 0x36, 0x35,
0x36, 0x34, 0x36, 0x33, 0x33, 0x35, 0x33, 0x33,
0x33, 0x34, 0x36, 0x34, 0x36, 0x36, 0x36, 0x35,
0x30, 0x32, 0x30, 0x34, 0x30, 0x35, 0x31, 0x34,
0x33, 0x38, 0x30, 0x31, 0x30, 0x32, 0x30, 0x31,
0x30, 0x30, 0x30, 0x34, 0x30, 0x35, 0x30, 0x30,
0x34, 0x63, 0x35, 0x35, 0x63, 0x64, 0x30, 0x30,
0x34, 0x63, 0x35, 0x35, 0x30, 0x35, 0x30, 0x30,
0x82, 0x01, 0xB2, 0x01, 0x33, 0x30, 0x35, 0x37,
0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34,
0x34, 0x62, 0x33, 0x30, 0x34, 0x39, 0x30, 0x32,
0x30, 0x31, 0x30, 0x30, 0x30, 0x32, 0x30, 0x34,
0x64, 0x30, 0x61, 0x37, 0x30, 0x39, 0x35, 0x64,
0x30, 0x32, 0x30, 0x33, 0x32, 0x64, 0x64, 0x32,
0x37, 0x39, 0x30, 0x32, 0x30, 0x34, 0x37, 0x65,
0x64, 0x35, 0x36, 0x63, 0x37, 0x31, 0x30, 0x32,
0x30, 0x34, 0x36, 0x39, 0x36, 0x30, 0x39, 0x63,
0x32, 0x37, 0x30, 0x34, 0x32, 0x34, 0x33, 0x37,
0x36, 0x33, 0x36, 0x34, 0x33, 0x38, 0x33, 0x34,
0x33, 0x30, 0x33, 0x38, 0x36, 0x31, 0x32, 0x64,
0x33, 0x31, 0x36, 0x31, 0x33, 0x37, 0x33, 0x33,
0x32, 0x64, 0x33, 0x34, 0x36, 0x33, 0x33, 0x36,
0x33, 0x39, 0x32, 0x64, 0x36, 0x31, 0x33, 0x36,
0x33, 0x37, 0x36, 0x34, 0x32, 0x64, 0x33, 0x37,
0x33, 0x38, 0x36, 0x35, 0x33, 0x39, 0x33, 0x34,
0x33, 0x33, 0x33, 0x37, 0x36, 0x34, 0x36, 0x34,
0x33, 0x39, 0x36, 0x31, 0x33, 0x38, 0x30, 0x32,
0x30, 0x32, 0x30, 0x33, 0x32, 0x66, 0x38, 0x30,
0x32, 0x39, 0x30, 0x32, 0x30, 0x34, 0x64, 0x32,
0x66, 0x37, 0x33, 0x64, 0x62, 0x37, 0x30, 0x32,
0x30, 0x34, 0x36, 0x39, 0x36, 0x34, 0x39, 0x37,
0x66, 0x39, 0x30, 0x34, 0x32, 0x34, 0x33, 0x39,
0x33, 0x35, 0x36, 0x31, 0x36, 0x33, 0x33, 0x35,
0x36, 0x31, 0x33, 0x37, 0x36, 0x33, 0x32, 0x64,
0x33, 0x31, 0x33, 0x30, 0x33, 0x31, 0x33, 0x34,
0x32, 0x64, 0x33, 0x34, 0x36, 0x34, 0x33, 0x38,
0x36, 0x36, 0x32, 0x64, 0x33, 0x39, 0x33, 0x30,
0x33, 0x37, 0x36, 0x32, 0x32, 0x64, 0x36, 0x33,
0x33, 0x39, 0x33, 0x33, 0x36, 0x35, 0x36, 0x34,
0x36, 0x33, 0x33, 0x35, 0x33, 0x33, 0x33, 0x34,
0x36, 0x34, 0x36, 0x36, 0x36, 0x35, 0x30, 0x32,
0x30, 0x34, 0x30, 0x35, 0x31, 0x34, 0x33, 0x38,
0x30, 0x31, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30,
0x30, 0x34, 0x30, 0x35, 0x30, 0x30, 0x34, 0x63,
0x35, 0x35, 0x63, 0x64, 0x30, 0x30, 0x8A, 0x01,
0x20, 0x30, 0x33, 0x39, 0x61, 0x63, 0x63, 0x32,
0x66, 0x30, 0x65, 0x33, 0x33, 0x63, 0x32, 0x66,
0x64, 0x63, 0x35, 0x38, 0x36, 0x31, 0x62, 0x66,
0x34, 0x63, 0x34, 0x62, 0x61, 0x30, 0x35, 0x30,
0x30, 0x90, 0x01, 0x01, 0x98, 0x01, 0xCD, 0x26,
0xA0, 0x01, 0xCD, 0x26, 0xAA, 0x01, 0xB2, 0x01,
0x35, 0x35, 0x30, 0x35, 0x30, 0x30, 0x8A, 0x01,
0x20, 0x65, 0x36, 0x61, 0x65, 0x33, 0x30, 0x63,
0x64, 0x61, 0x65, 0x36, 0x64, 0x31, 0x66, 0x37,
0x64, 0x61, 0x65, 0x36, 0x36, 0x33, 0x38, 0x36,
0x31, 0x36, 0x63, 0x63, 0x35, 0x64, 0x36, 0x31,
0x31, 0x90, 0x01, 0x01, 0x98, 0x01, 0x9A, 0x3E,
0xA0, 0x01, 0x9A, 0x3E, 0xAA, 0x01, 0xB2, 0x01,
0x33, 0x30, 0x35, 0x37, 0x30, 0x32, 0x30, 0x31,
0x30, 0x30, 0x30, 0x34, 0x34, 0x62, 0x33, 0x30,
0x34, 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30,
0x30, 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, 0x37,
0x30, 0x39, 0x35, 0x64, 0x30, 0x32, 0x30, 0x33,
0x32, 0x64, 0x64, 0x32, 0x37, 0x39, 0x30, 0x32,
0x30, 0x34, 0x37, 0x65, 0x64, 0x35, 0x36, 0x63,
0x37, 0x31, 0x30, 0x32, 0x30, 0x34, 0x36, 0x39,
0x36, 0x30, 0x39, 0x63, 0x32, 0x37, 0x30, 0x34,
0x32, 0x34, 0x33, 0x37, 0x36, 0x33, 0x36, 0x34,
0x33, 0x38, 0x33, 0x34, 0x33, 0x30, 0x33, 0x38,
0x36, 0x31, 0x32, 0x64, 0x33, 0x31, 0x36, 0x31,
0x33, 0x37, 0x33, 0x33, 0x32, 0x64, 0x33, 0x34,
0x36, 0x33, 0x33, 0x36, 0x33, 0x39, 0x32, 0x64,
0x36, 0x31, 0x33, 0x36, 0x33, 0x37, 0x36, 0x34,
0x32, 0x64, 0x33, 0x37, 0x33, 0x38, 0x36, 0x35,
0x33, 0x39, 0x33, 0x34, 0x33, 0x33, 0x33, 0x37,
0x36, 0x34, 0x36, 0x34, 0x33, 0x39, 0x36, 0x31,
0x33, 0x38, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35,
0x32, 0x66, 0x38, 0x30, 0x32, 0x39, 0x30, 0x32,
0x30, 0x34, 0x64, 0x32, 0x66, 0x37, 0x33, 0x64,
0x62, 0x37, 0x30, 0x32, 0x30, 0x34, 0x36, 0x39,
0x36, 0x34, 0x39, 0x37, 0x66, 0x39, 0x30, 0x34,
0x32, 0x34, 0x33, 0x39, 0x33, 0x35, 0x36, 0x31,
0x36, 0x33, 0x33, 0x35, 0x36, 0x31, 0x33, 0x37,
0x36, 0x33, 0x32, 0x64, 0x33, 0x31, 0x33, 0x30,
0x33, 0x31, 0x33, 0x34, 0x32, 0x64, 0x33, 0x34,
0x36, 0x34, 0x33, 0x38, 0x36, 0x36, 0x32, 0x64,
0x33, 0x39, 0x33, 0x30, 0x33, 0x37, 0x36, 0x32,
0x32, 0x64, 0x36, 0x33, 0x33, 0x39, 0x33, 0x33,
0x36, 0x35, 0x36, 0x34, 0x36, 0x33, 0x33, 0x35,
0x33, 0x33, 0x33, 0x34, 0x36, 0x34, 0x36, 0x36,
0x36, 0x35, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35,
0x31, 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, 0x32,
0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, 0x35,
0x30, 0x30, 0x34, 0x63, 0x35, 0x35, 0x63, 0x64,
0x30, 0x30, 0xB0, 0x01, 0x88, 0x12, 0xB8, 0x01,
0x5E, 0xC0, 0x01, 0xB4, 0x01, 0xCA, 0x01, 0x20,
0x30, 0x33, 0x39, 0x61, 0x63, 0x63, 0x32, 0x66,
0x30, 0x65, 0x33, 0x33, 0x63, 0x32, 0x66, 0x64,
0x63, 0x35, 0x38, 0x36, 0x31, 0x62, 0x66, 0x34,
0x63, 0x34, 0x62, 0x61, 0x30, 0x35, 0x30, 0x30,
0xDA, 0x01, 0x20, 0x30, 0x66, 0x37, 0x37, 0x35,
0x63, 0x33, 0x39, 0x65, 0x65, 0x30, 0x33, 0x33,
0x33, 0x63, 0x65, 0x66, 0x39, 0x31, 0x62, 0x37,
0x66, 0x37, 0x35, 0x34, 0x65, 0x38, 0x35, 0x64,
0x39, 0x63, 0x63, 0xE0, 0x01, 0xF6, 0x95, 0xDF,
0xBA, 0x09, 0xF0, 0x01, 0x00, 0xA0, 0x02, 0x00,
0x30, 0x30, 0x34, 0x63, 0x35, 0x35, 0x30, 0x35,
0x30, 0x30, 0xB0, 0x01, 0xD3, 0x11, 0xB8, 0x01,
0x66, 0xC0, 0x01, 0xB4, 0x01, 0xCA, 0x01, 0x20,
0x65, 0x36, 0x61, 0x65, 0x33, 0x30, 0x63, 0x64,
0x61, 0x65, 0x36, 0x64, 0x31, 0x66, 0x37, 0x64,
0x61, 0x65, 0x36, 0x36, 0x33, 0x38, 0x36, 0x31,
0x36, 0x63, 0x63, 0x35, 0x64, 0x36, 0x31, 0x31,
0xDA, 0x01, 0x20, 0x31, 0x63, 0x63, 0x64, 0x35,
0x63, 0x35, 0x32, 0x37, 0x31, 0x62, 0x34, 0x61,
0x30, 0x37, 0x62, 0x39, 0x65, 0x64, 0x30, 0x33,
0x36, 0x64, 0x65, 0x65, 0x61, 0x38, 0x35, 0x63,
0x38, 0x63, 0x33, 0xE0, 0x01, 0xD2, 0xE4, 0xD1,
0xC3, 0x04, 0xF0, 0x01, 0x00, 0xA0, 0x02, 0x00,
0xC8, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
]
console.log("[+] Payload 准备写入");
// dumpMemoryToHex(this.context.x1, 1024)
console.log("[+] Payload 准备写入");
protoX1PayloadAddr.writeByteArray(finalPayload);
console.log("[+] Payload 已写入，长度: " + finalPayload.length);
@@ -798,7 +724,6 @@ function setReceiver() {
// 3. 开始拦截
Interceptor.attach(buf2RespAddr, {
onEnter: function (args) {
const currentPtr = this.context.x1;
let start = 0x1e;
let senderLen = currentPtr.add(start).readU8();
@@ -810,8 +735,6 @@ function setReceiver() {
}
}
console.log("[+] Entered Receive Function: 0x1023B5348");
let senderPtr = currentPtr.add(start + 1);
let sender = senderPtr.readUtf8String(senderLen);
@@ -821,8 +744,7 @@ function setReceiver() {
let receiver = receiverStrPtr.readUtf8String(receiverLen);
let contentLenPtr = receiverStrPtr.add(receiverLen).add(6);
// 判断是否等于 0x77 ('w'), 如果是，则是短字段
if (contentLenPtr.readU8() === 0x77) {
if (isPrintableOrChinese(contentLenPtr, 1)) {
contentLenPtr = contentLenPtr.add(-1);
}
const contentLenValue = readVarint(contentLenPtr)
@@ -945,6 +867,98 @@ function dumpMemoryToHex(ptr, size) {
}
}
function isPrintableOrChinese(startPtr, maxScanLength) {
let offset = 0;
while (offset < maxScanLength) {
let b = startPtr.add(offset).readU8();
if (b === 0) {
// 扫描到 \0，且之前没有发现异常字节
return offset > 0; // 如果第一个就是 \0，视为非字符串（可能是空指针）
}
// 判定逻辑：
// 1. 可见 ASCII (32-126) 或 换行/制表符 (9, 10, 13)
let isAscii = (b >= 32 && b <= 126) || (b === 9 || b === 10 || b === 13);
// 2. 汉字 UTF-8 特征：第一个字节通常 >= 0x80 (128)
// 严谨点：UTF-8 汉字首字节通常在 0xE4-0xE9 之间，后续字节在 0x80-0xBF 之间
// 这里简化处理：如果是高位字符，我们暂时放行，由 readUtf8String 最终处理
let isHighBit = (b >= 0x80);
if (!isAscii && !isHighBit) {
// 发现既不是 ASCII 也不是高位字节（如 0x01-0x1F 的控制字符），判定为指针
return false;
}
offset++;
}
return true;
}
var runReadX0 = ptr(0)
var originCgiPtr = ptr(0)
function patchRunReadWrite() {
Interceptor.attach(runReadWriteAddr, {
onEnter: function (args) {
try {
if (this.context.x5.isNull() || this.context.x5.compare(baseAddr) <= 0) {
return
}
const x5 = this.context.x5;
const cTaskId = x5.add(0x308).readU32();
if (cTaskId !== taskIdGlobal) {
return
}
console.log("[+] enter runReadWriteAddr: " + runReadWriteAddr)
const domainAddr = x5.add(0xd8);
const domainBytes = [
0x73, 0x7A, 0x73, 0x68, 0x6F, 0x72, 0x74, 0x2E, // szshort.
0x77, 0x65, 0x69, 0x78, 0x69, 0x6E, 0x2E, 0x71, // weixin.q
0x71, 0x2E, 0x63, 0x6F, 0x6D // q.com
];
domainAddr.writeByteArray(domainBytes);
domainAddr.add(domainBytes.length).writeU8(0);
domainAddr.add(23).writeU8(0x15);
runReadX0 = this.context.x0;
originCgiPtr = runReadX0.add(0x1018).readPointer();
runReadX0.add(0x1018).writePointer(cgiAddr);
runReadX0.add(0x1020).writeU64(0x22);
console.log("[+] enter runReadWriteAddr finished: " + domainAddr.readUtf8String())
} catch (e) {
console.log("[-] Memory access error at onEnter: " + e);
}
}
})
Interceptor.attach(runReadWriteAddr1, {
onEnter: function (args) {
try {
if (this.context.x20.isNull() || this.context.x20.compare(baseAddr) <= 0) {
return
}
const cTaskId = this.context.x20.add(0x308).readU32();
if (cTaskId !== taskIdGlobal) {
return
}
runReadX0.add(0x1018).writePointer(originCgiPtr);
console.log("[+] leave runReadWriteAddr finished: " + runReadWriteAddr)
} catch (e) {
console.log("[-] Memory access error at onLeave: " + e);
}
}
})
runReadWriteAddr1
}
setImmediate(patchRunReadWrite)
rpc.exports = {
manualTrigger: manualTrigger
onebot/script.js
+30 -2
View File
@@ -445,7 +445,7 @@ function setReceiver() {
let contentLenPtr = receiverStrPtr.add(receiverLen).add(6);
// 判断是否等于 0x77 ('w'), 如果是，则是短字段
if (contentLenPtr.readU8() === 0x77) {
if (isPrintableOrChinese(contentLenPtr, 1)) {
contentLenPtr = contentLenPtr.add(-1);
}
const contentLenValue = readVarint(contentLenPtr)
@@ -536,4 +536,32 @@ function readVarint(addr) {
rpc.exports = {
manualTrigger: manualTrigger
};
};
function isPrintableOrChinese(startPtr, maxScanLength) {
let offset = 0;
while (offset < maxScanLength) {
let b = startPtr.add(offset).readU8();
if (b === 0) {
// 扫描到 \0，且之前没有发现异常字节
return offset > 0; // 如果第一个就是 \0，视为非字符串（可能是空指针）
}
// 判定逻辑：
// 1. 可见 ASCII (32-126) 或 换行/制表符 (9, 10, 13)
let isAscii = (b >= 32 && b <= 126) || (b === 9 || b === 10 || b === 13);
// 2. 汉字 UTF-8 特征：第一个字节通常 >= 0x80 (128)
// 严谨点：UTF-8 汉字首字节通常在 0xE4-0xE9 之间，后续字节在 0x80-0xBF 之间
// 这里简化处理：如果是高位字符，我们暂时放行，由 readUtf8String 最终处理
let isHighBit = (b >= 0x80);
if (!isAscii && !isHighBit) {
// 发现既不是 ASCII 也不是高位字节（如 0x01-0x1F 的控制字符），判定为指针
return false;
}
offset++;
}
return true;
}