From 5fa73bf622606556e55245d4ba2fefda9e2b023c Mon Sep 17 00:00:00 2001 From: yincong Date: Mon, 12 Jan 2026 14:46:10 +0800 Subject: [PATCH] send image succ --- onebot/image.js | 336 ++++++++++++++++++++++++----------------------- onebot/script.js | 32 ++++- 2 files changed, 205 insertions(+), 163 deletions(-) diff --git a/onebot/image.js b/onebot/image.js index 724ef52..0edaeee 100644 --- a/onebot/image.js +++ b/onebot/image.js @@ -6,12 +6,9 @@ if (!baseAddr) { console.log("[+] WeChat base address: " + baseAddr); -// // 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来 -var sendMessageCallbackFunc = baseAddr.add(0xAA8C5B078); +// 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来 +var sendMessageCallbackFunc = ptr(0x0); var messageCallbackFunc1 = baseAddr.add(0x7fa0b18); -var messageCallbackFunc2 = baseAddr.add(0x7fa0b70); -var messageCallbackFunc3 = baseAddr.add(0x804ae78); -var messageCallbackFunc4 = baseAddr.add(0x8030a00); // 这个必须是绝对位置 var triggerX1Payload = ptr(0x175ED6600); @@ -23,6 +20,8 @@ var buf2RespAddr = baseAddr.add(0x347BD44); var patchProtobufFunc1 = baseAddr.add(0x2275BB8) var patchProtobufFunc2 = baseAddr.add(0x2275BD8); var protobufDeleteAddr = baseAddr.add(0x2275C14); +var runReadWriteAddr = baseAddr.add(0x450F518) +var runReadWriteAddr1 = baseAddr.add(0x450F51C); // 触发函数X0参数地址 var globalMessagePtr = ptr(0); @@ -35,7 +34,6 @@ var callBackFuncAddr3 = ptr(0); var sendMessageAddr = ptr(0); var messageAddr = ptr(0); -var messageContentAddr = ptr(0); var contentAddr = ptr(0); var insertMsgAddr = ptr(0); var receiverAddr = ptr(0); @@ -78,7 +76,7 @@ function setupSendMessageDynamic() { callBackFuncAddr3 = Memory.alloc(16); sendMessageAddr = Memory.alloc(256); messageAddr = Memory.alloc(512); - contentAddr = Memory.alloc(255); + contentAddr = Memory.alloc(16); receiverAddr = Memory.alloc(24); htmlContentAddr = Memory.alloc(24); @@ -131,77 +129,6 @@ function patchHex(addr, hexStr) { addr.add(bytes.length).writeU8(0); // 终止符 } -// 初始化进行内存的分配 -function setupSendMessageDynamic() { - console.log("[+] Starting Dynamic Message Patching..."); - - // 1. 动态分配内存块（按需分配大小） - // 分配原则：字符串给 64-128 字节，结构体按实际大小分配 - cgiAddr = Memory.alloc(128); - callBackFuncAddr = Memory.alloc(16); - sendMessageAddr = Memory.alloc(256); - messageAddr = Memory.alloc(256); - contentAddr = Memory.alloc(255); - receiverAddr = Memory.alloc(24); - - - // A. 写入字符串内容 - patchHex(cgiAddr, "2F 63 67 69 2D 62 69 6E 2F 6D 69 63 72 6F 6D 73 67 2D 62 69 6E 2F 6E 65 77 73 65 6E 64 6D 73 67"); - patchHex(contentAddr, " "); - - // B. 构建 SendMessage 结构体 (X24 基址位置) - sendMessageAddr.add(0x00).writeU64(0); - sendMessageAddr.add(0x08).writeU64(0); - sendMessageAddr.add(0x10).writePointer(sendMessageCallbackFunc); - sendMessageAddr.add(0x18).writeU64(1); - sendMessageAddr.add(0x20).writeU32(taskIdGlobal); - sendMessageAddr.add(0x28).writePointer(messageAddr); // 指向动态分配的 Message - - console.log(" [+] sendMessageAddr Object: ", hexdump(sendMessageAddr, { - offset: 0, - length: 48, - header: true, - ansi: true - })); - - // C. 构建 Message 结构体 - messageAddr.add(0x00).writePointer(messageCallbackFunc1); - messageAddr.add(0x08).writeU32(taskIdGlobal); - messageAddr.add(0x0c).writeU32(0x20a); - messageAddr.add(0x10).writeU64(0x3); - messageAddr.add(0x18).writePointer(cgiAddr); - - // 设置一些固定值 - messageAddr.add(0x20).writeU64(uint64("0x20")); - messageAddr.add(0x28).writeU64(uint64("0x8000000000000030")); - messageAddr.add(0x30).writeU64(uint64("0x0000000001010100")); - messageAddr.add(0x58).writeU64(uint64("0x0101010100000001")); - - // 处理回调地址 - callBackFuncAddr.writePointer(messageCallbackFunc2); - messageAddr.add(0x98).writePointer(callBackFuncAddr); - - // 设置内容指针 - messageAddr.add(0xb8).writePointer(messageCallbackFunc3); - messageAddr.add(0xc0).writePointer(messageContentAddr); - messageAddr.add(0xc8).writeU64(uint64("0x0000000100000001")); - messageAddr.add(0xd0).writeU64(0x4); - messageAddr.add(0xd8).writeU64(0x1); - messageAddr.add(0xe0).writeU64(0x1); - messageAddr.add(0xe8).writePointer(messageCallbackFunc4); - - console.log(" [+] messageAddr Object: ", hexdump(messageAddr, { - offset: 0, - length: 64, - header: true, - ansi: true - })); - - console.log("[+] Dynamic Memory Setup Complete. - Message Object: " + messageAddr); -} - -setImmediate(setupSendMessageDynamic); - function patchProtoBuf() { Memory.patchCode(patchProtobufFunc1, 4, code => { @@ -229,7 +156,7 @@ function patchProtoBuf() { console.log("[+] Patching BL DELETE to NOP at " + protobufDeleteAddr + " completed."); } -// setImmediate(patchProtoBuf); +setImmediate(patchProtoBuf); function manualTrigger(taskId, receiver, content) { console.log("[+] Manual Trigger Started..."); @@ -385,7 +312,6 @@ function attachReq2buf() { } insertMsgAddr.writeU64(0x0); console.log("[+] 清空写入后内存预览: " + insertMsgAddr.readPointer()); - taskIdGlobal = 0; receiverGlobal = ""; contentGlobal = ""; send({ @@ -632,18 +558,18 @@ function attachProto() { const finalPayload = [ 0x0A, 0x3F, 0x0A, 0x01, 0x00, 0x10, 0xC6, 0xBC, - 0x90, 0xB9, 0x08, 0x1A, 0x10, 0x6D, 0x33, 0x30, - 0x63, 0x34, 0x36, 0x37, 0x34, 0x66, 0x35, 0x61, - 0x30, 0x62, 0x39, 0x64, 0x30, 0x20, 0xAF, 0xAC, + 0x90, 0xB9, 0x08, 0x1A, 0x10, 0x6D, 0x64, 0x34, + 0x34, 0x36, 0x34, 0x65, 0x34, 0x37, 0x36, 0x34, + 0x65, 0x61, 0x61, 0x62, 0x62, 0x20, 0xAF, 0xAC, 0x90, 0x93, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x2A, 0x15, 0x55, 0x6E, 0x69, 0x66, 0x69, 0x65, 0x64, 0x50, 0x43, 0x4D, 0x61, 0x63, 0x20, 0x32, 0x36, 0x20, 0x61, 0x72, 0x6D, 0x36, 0x34, 0x30, - 0x6F, 0x12, 0x2E, 0x0A, 0x2C, 0x77, 0x78, 0x69, + 0x70, 0x12, 0x2E, 0x0A, 0x2C, 0x77, 0x78, 0x69, 0x64, 0x5F, 0x37, 0x77, 0x64, 0x31, 0x65, 0x63, 0x65, 0x39, 0x39, 0x66, 0x37, 0x69, 0x32, 0x31, - 0x5F, 0x31, 0x37, 0x36, 0x37, 0x39, 0x33, 0x39, - 0x31, 0x31, 0x30, 0x5F, 0x31, 0x33, 0x33, 0x5F, + 0x5F, 0x31, 0x37, 0x36, 0x38, 0x32, 0x33, 0x30, + 0x31, 0x38, 0x35, 0x5F, 0x31, 0x33, 0x35, 0x5F, 0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, 0x5F, 0x31, 0x1A, 0x15, 0x0A, 0x13, 0x77, 0x78, 0x69, 0x64, 0x5F, 0x6C, 0x64, 0x66, 0x74, 0x75, 0x68, @@ -651,16 +577,16 @@ function attachProto() { 0x22, 0x15, 0x0A, 0x13, 0x77, 0x78, 0x69, 0x64, 0x5F, 0x37, 0x77, 0x64, 0x31, 0x65, 0x63, 0x65, 0x39, 0x39, 0x66, 0x37, 0x69, 0x32, 0x31, 0x28, - 0x88, 0x12, 0x30, 0x00, 0x38, 0x88, 0x12, 0x42, + 0xD3, 0x11, 0x30, 0x00, 0x38, 0xD3, 0x11, 0x42, 0x04, 0x08, 0x00, 0x12, 0x00, 0x48, 0x03, 0x52, 0x83, 0x01, 0x3C, 0x6D, 0x73, 0x67, 0x73, 0x6F, 0x75, 0x72, 0x63, 0x65, 0x3E, 0x3C, 0x69, 0x6D, 0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, 0x6E, - 0x61, 0x6D, 0x65, 0x3E, 0x30, 0x39, 0x64, 0x32, - 0x32, 0x63, 0x34, 0x63, 0x2D, 0x33, 0x38, 0x65, - 0x35, 0x2D, 0x34, 0x61, 0x30, 0x34, 0x2D, 0x62, - 0x30, 0x64, 0x63, 0x2D, 0x35, 0x63, 0x65, 0x30, - 0x62, 0x39, 0x30, 0x37, 0x66, 0x31, 0x64, 0x64, + 0x61, 0x6D, 0x65, 0x3E, 0x36, 0x35, 0x39, 0x36, + 0x34, 0x33, 0x63, 0x61, 0x2D, 0x66, 0x31, 0x62, + 0x63, 0x2D, 0x34, 0x39, 0x33, 0x64, 0x2D, 0x61, + 0x65, 0x37, 0x38, 0x2D, 0x35, 0x62, 0x30, 0x62, + 0x31, 0x65, 0x34, 0x39, 0x35, 0x33, 0x64, 0x64, 0x2E, 0x70, 0x6E, 0x67, 0x3C, 0x2F, 0x69, 0x6D, 0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, 0x6E, 0x61, 0x6D, 0x65, 0x3E, 0x3C, 0x61, 0x6C, 0x6E, @@ -675,95 +601,95 @@ function attachProto() { 0x30, 0x34, 0x34, 0x62, 0x33, 0x30, 0x34, 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, 0x37, 0x30, 0x39, - 0x35, 0x64, 0x30, 0x32, 0x30, 0x33, 0x32, 0x64, - 0x64, 0x32, 0x37, 0x39, 0x30, 0x32, 0x30, 0x34, - 0x37, 0x65, 0x64, 0x35, 0x36, 0x63, 0x37, 0x31, - 0x30, 0x32, 0x30, 0x34, 0x36, 0x39, 0x36, 0x30, - 0x39, 0x63, 0x32, 0x37, 0x30, 0x34, 0x32, 0x34, - 0x33, 0x37, 0x36, 0x33, 0x36, 0x34, 0x33, 0x38, - 0x33, 0x34, 0x33, 0x30, 0x33, 0x38, 0x36, 0x31, - 0x32, 0x64, 0x33, 0x31, 0x36, 0x31, 0x33, 0x37, - 0x33, 0x33, 0x32, 0x64, 0x33, 0x34, 0x36, 0x33, - 0x33, 0x36, 0x33, 0x39, 0x32, 0x64, 0x36, 0x31, - 0x33, 0x36, 0x33, 0x37, 0x36, 0x34, 0x32, 0x64, - 0x33, 0x37, 0x33, 0x38, 0x36, 0x35, 0x33, 0x39, - 0x33, 0x34, 0x33, 0x33, 0x33, 0x37, 0x36, 0x34, - 0x36, 0x34, 0x33, 0x39, 0x36, 0x31, 0x33, 0x38, + 0x35, 0x64, 0x30, 0x32, 0x30, 0x33, 0x32, 0x66, + 0x38, 0x30, 0x32, 0x39, 0x30, 0x32, 0x30, 0x34, + 0x64, 0x32, 0x66, 0x37, 0x33, 0x64, 0x62, 0x37, + 0x30, 0x32, 0x30, 0x34, 0x36, 0x39, 0x36, 0x34, + 0x39, 0x37, 0x66, 0x39, 0x30, 0x34, 0x32, 0x34, + 0x33, 0x39, 0x33, 0x35, 0x36, 0x31, 0x36, 0x33, + 0x33, 0x35, 0x36, 0x31, 0x33, 0x37, 0x36, 0x33, + 0x32, 0x64, 0x33, 0x31, 0x33, 0x30, 0x33, 0x31, + 0x33, 0x34, 0x32, 0x64, 0x33, 0x34, 0x36, 0x34, + 0x33, 0x38, 0x36, 0x36, 0x32, 0x64, 0x33, 0x39, + 0x33, 0x30, 0x33, 0x37, 0x36, 0x32, 0x32, 0x64, + 0x36, 0x33, 0x33, 0x39, 0x33, 0x33, 0x36, 0x35, + 0x36, 0x34, 0x36, 0x33, 0x33, 0x35, 0x33, 0x33, + 0x33, 0x34, 0x36, 0x34, 0x36, 0x36, 0x36, 0x35, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35, 0x31, 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, 0x35, 0x30, 0x30, - 0x34, 0x63, 0x35, 0x35, 0x63, 0x64, 0x30, 0x30, + 0x34, 0x63, 0x35, 0x35, 0x30, 0x35, 0x30, 0x30, 0x82, 0x01, 0xB2, 0x01, 0x33, 0x30, 0x35, 0x37, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x34, 0x62, 0x33, 0x30, 0x34, 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, 0x37, 0x30, 0x39, 0x35, 0x64, - 0x30, 0x32, 0x30, 0x33, 0x32, 0x64, 0x64, 0x32, - 0x37, 0x39, 0x30, 0x32, 0x30, 0x34, 0x37, 0x65, - 0x64, 0x35, 0x36, 0x63, 0x37, 0x31, 0x30, 0x32, - 0x30, 0x34, 0x36, 0x39, 0x36, 0x30, 0x39, 0x63, - 0x32, 0x37, 0x30, 0x34, 0x32, 0x34, 0x33, 0x37, - 0x36, 0x33, 0x36, 0x34, 0x33, 0x38, 0x33, 0x34, - 0x33, 0x30, 0x33, 0x38, 0x36, 0x31, 0x32, 0x64, - 0x33, 0x31, 0x36, 0x31, 0x33, 0x37, 0x33, 0x33, - 0x32, 0x64, 0x33, 0x34, 0x36, 0x33, 0x33, 0x36, - 0x33, 0x39, 0x32, 0x64, 0x36, 0x31, 0x33, 0x36, - 0x33, 0x37, 0x36, 0x34, 0x32, 0x64, 0x33, 0x37, - 0x33, 0x38, 0x36, 0x35, 0x33, 0x39, 0x33, 0x34, - 0x33, 0x33, 0x33, 0x37, 0x36, 0x34, 0x36, 0x34, - 0x33, 0x39, 0x36, 0x31, 0x33, 0x38, 0x30, 0x32, + 0x30, 0x32, 0x30, 0x33, 0x32, 0x66, 0x38, 0x30, + 0x32, 0x39, 0x30, 0x32, 0x30, 0x34, 0x64, 0x32, + 0x66, 0x37, 0x33, 0x64, 0x62, 0x37, 0x30, 0x32, + 0x30, 0x34, 0x36, 0x39, 0x36, 0x34, 0x39, 0x37, + 0x66, 0x39, 0x30, 0x34, 0x32, 0x34, 0x33, 0x39, + 0x33, 0x35, 0x36, 0x31, 0x36, 0x33, 0x33, 0x35, + 0x36, 0x31, 0x33, 0x37, 0x36, 0x33, 0x32, 0x64, + 0x33, 0x31, 0x33, 0x30, 0x33, 0x31, 0x33, 0x34, + 0x32, 0x64, 0x33, 0x34, 0x36, 0x34, 0x33, 0x38, + 0x36, 0x36, 0x32, 0x64, 0x33, 0x39, 0x33, 0x30, + 0x33, 0x37, 0x36, 0x32, 0x32, 0x64, 0x36, 0x33, + 0x33, 0x39, 0x33, 0x33, 0x36, 0x35, 0x36, 0x34, + 0x36, 0x33, 0x33, 0x35, 0x33, 0x33, 0x33, 0x34, + 0x36, 0x34, 0x36, 0x36, 0x36, 0x35, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35, 0x31, 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, 0x35, 0x30, 0x30, 0x34, 0x63, - 0x35, 0x35, 0x63, 0x64, 0x30, 0x30, 0x8A, 0x01, - 0x20, 0x30, 0x33, 0x39, 0x61, 0x63, 0x63, 0x32, - 0x66, 0x30, 0x65, 0x33, 0x33, 0x63, 0x32, 0x66, - 0x64, 0x63, 0x35, 0x38, 0x36, 0x31, 0x62, 0x66, - 0x34, 0x63, 0x34, 0x62, 0x61, 0x30, 0x35, 0x30, - 0x30, 0x90, 0x01, 0x01, 0x98, 0x01, 0xCD, 0x26, - 0xA0, 0x01, 0xCD, 0x26, 0xAA, 0x01, 0xB2, 0x01, + 0x35, 0x35, 0x30, 0x35, 0x30, 0x30, 0x8A, 0x01, + 0x20, 0x65, 0x36, 0x61, 0x65, 0x33, 0x30, 0x63, + 0x64, 0x61, 0x65, 0x36, 0x64, 0x31, 0x66, 0x37, + 0x64, 0x61, 0x65, 0x36, 0x36, 0x33, 0x38, 0x36, + 0x31, 0x36, 0x63, 0x63, 0x35, 0x64, 0x36, 0x31, + 0x31, 0x90, 0x01, 0x01, 0x98, 0x01, 0x9A, 0x3E, + 0xA0, 0x01, 0x9A, 0x3E, 0xAA, 0x01, 0xB2, 0x01, 0x33, 0x30, 0x35, 0x37, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x34, 0x62, 0x33, 0x30, 0x34, 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, 0x37, 0x30, 0x39, 0x35, 0x64, 0x30, 0x32, 0x30, 0x33, - 0x32, 0x64, 0x64, 0x32, 0x37, 0x39, 0x30, 0x32, - 0x30, 0x34, 0x37, 0x65, 0x64, 0x35, 0x36, 0x63, - 0x37, 0x31, 0x30, 0x32, 0x30, 0x34, 0x36, 0x39, - 0x36, 0x30, 0x39, 0x63, 0x32, 0x37, 0x30, 0x34, - 0x32, 0x34, 0x33, 0x37, 0x36, 0x33, 0x36, 0x34, - 0x33, 0x38, 0x33, 0x34, 0x33, 0x30, 0x33, 0x38, - 0x36, 0x31, 0x32, 0x64, 0x33, 0x31, 0x36, 0x31, - 0x33, 0x37, 0x33, 0x33, 0x32, 0x64, 0x33, 0x34, - 0x36, 0x33, 0x33, 0x36, 0x33, 0x39, 0x32, 0x64, - 0x36, 0x31, 0x33, 0x36, 0x33, 0x37, 0x36, 0x34, - 0x32, 0x64, 0x33, 0x37, 0x33, 0x38, 0x36, 0x35, - 0x33, 0x39, 0x33, 0x34, 0x33, 0x33, 0x33, 0x37, - 0x36, 0x34, 0x36, 0x34, 0x33, 0x39, 0x36, 0x31, - 0x33, 0x38, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35, + 0x32, 0x66, 0x38, 0x30, 0x32, 0x39, 0x30, 0x32, + 0x30, 0x34, 0x64, 0x32, 0x66, 0x37, 0x33, 0x64, + 0x62, 0x37, 0x30, 0x32, 0x30, 0x34, 0x36, 0x39, + 0x36, 0x34, 0x39, 0x37, 0x66, 0x39, 0x30, 0x34, + 0x32, 0x34, 0x33, 0x39, 0x33, 0x35, 0x36, 0x31, + 0x36, 0x33, 0x33, 0x35, 0x36, 0x31, 0x33, 0x37, + 0x36, 0x33, 0x32, 0x64, 0x33, 0x31, 0x33, 0x30, + 0x33, 0x31, 0x33, 0x34, 0x32, 0x64, 0x33, 0x34, + 0x36, 0x34, 0x33, 0x38, 0x36, 0x36, 0x32, 0x64, + 0x33, 0x39, 0x33, 0x30, 0x33, 0x37, 0x36, 0x32, + 0x32, 0x64, 0x36, 0x33, 0x33, 0x39, 0x33, 0x33, + 0x36, 0x35, 0x36, 0x34, 0x36, 0x33, 0x33, 0x35, + 0x33, 0x33, 0x33, 0x34, 0x36, 0x34, 0x36, 0x36, + 0x36, 0x35, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35, 0x31, 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, 0x35, - 0x30, 0x30, 0x34, 0x63, 0x35, 0x35, 0x63, 0x64, - 0x30, 0x30, 0xB0, 0x01, 0x88, 0x12, 0xB8, 0x01, - 0x5E, 0xC0, 0x01, 0xB4, 0x01, 0xCA, 0x01, 0x20, - 0x30, 0x33, 0x39, 0x61, 0x63, 0x63, 0x32, 0x66, - 0x30, 0x65, 0x33, 0x33, 0x63, 0x32, 0x66, 0x64, - 0x63, 0x35, 0x38, 0x36, 0x31, 0x62, 0x66, 0x34, - 0x63, 0x34, 0x62, 0x61, 0x30, 0x35, 0x30, 0x30, - 0xDA, 0x01, 0x20, 0x30, 0x66, 0x37, 0x37, 0x35, - 0x63, 0x33, 0x39, 0x65, 0x65, 0x30, 0x33, 0x33, - 0x33, 0x63, 0x65, 0x66, 0x39, 0x31, 0x62, 0x37, - 0x66, 0x37, 0x35, 0x34, 0x65, 0x38, 0x35, 0x64, - 0x39, 0x63, 0x63, 0xE0, 0x01, 0xF6, 0x95, 0xDF, - 0xBA, 0x09, 0xF0, 0x01, 0x00, 0xA0, 0x02, 0x00, + 0x30, 0x30, 0x34, 0x63, 0x35, 0x35, 0x30, 0x35, + 0x30, 0x30, 0xB0, 0x01, 0xD3, 0x11, 0xB8, 0x01, + 0x66, 0xC0, 0x01, 0xB4, 0x01, 0xCA, 0x01, 0x20, + 0x65, 0x36, 0x61, 0x65, 0x33, 0x30, 0x63, 0x64, + 0x61, 0x65, 0x36, 0x64, 0x31, 0x66, 0x37, 0x64, + 0x61, 0x65, 0x36, 0x36, 0x33, 0x38, 0x36, 0x31, + 0x36, 0x63, 0x63, 0x35, 0x64, 0x36, 0x31, 0x31, + 0xDA, 0x01, 0x20, 0x31, 0x63, 0x63, 0x64, 0x35, + 0x63, 0x35, 0x32, 0x37, 0x31, 0x62, 0x34, 0x61, + 0x30, 0x37, 0x62, 0x39, 0x65, 0x64, 0x30, 0x33, + 0x36, 0x64, 0x65, 0x65, 0x61, 0x38, 0x35, 0x63, + 0x38, 0x63, 0x33, 0xE0, 0x01, 0xD2, 0xE4, 0xD1, + 0xC3, 0x04, 0xF0, 0x01, 0x00, 0xA0, 0x02, 0x00, 0xC8, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ] + console.log("[+] Payload 准备写入"); // dumpMemoryToHex(this.context.x1, 1024) - console.log("[+] Payload 准备写入"); protoX1PayloadAddr.writeByteArray(finalPayload); console.log("[+] Payload 已写入，长度: " + finalPayload.length); @@ -798,7 +724,6 @@ function setReceiver() { // 3. 开始拦截 Interceptor.attach(buf2RespAddr, { onEnter: function (args) { - const currentPtr = this.context.x1; let start = 0x1e; let senderLen = currentPtr.add(start).readU8(); @@ -810,8 +735,6 @@ function setReceiver() { } } - console.log("[+] Entered Receive Function: 0x1023B5348"); - let senderPtr = currentPtr.add(start + 1); let sender = senderPtr.readUtf8String(senderLen); @@ -821,8 +744,7 @@ function setReceiver() { let receiver = receiverStrPtr.readUtf8String(receiverLen); let contentLenPtr = receiverStrPtr.add(receiverLen).add(6); - // 判断是否等于 0x77 ('w'), 如果是，则是短字段 - if (contentLenPtr.readU8() === 0x77) { + if (isPrintableOrChinese(contentLenPtr, 1)) { contentLenPtr = contentLenPtr.add(-1); } const contentLenValue = readVarint(contentLenPtr) @@ -945,6 +867,98 @@ function dumpMemoryToHex(ptr, size) { } } +function isPrintableOrChinese(startPtr, maxScanLength) { + let offset = 0; + while (offset < maxScanLength) { + let b = startPtr.add(offset).readU8(); + + if (b === 0) { + // 扫描到 \0，且之前没有发现异常字节 + return offset > 0; // 如果第一个就是 \0，视为非字符串（可能是空指针） + } + + // 判定逻辑： + // 1. 可见 ASCII (32-126) 或 换行/制表符 (9, 10, 13) + let isAscii = (b >= 32 && b <= 126) || (b === 9 || b === 10 || b === 13); + + // 2. 汉字 UTF-8 特征：第一个字节通常 >= 0x80 (128) + // 严谨点：UTF-8 汉字首字节通常在 0xE4-0xE9 之间，后续字节在 0x80-0xBF 之间 + // 这里简化处理：如果是高位字符，我们暂时放行，由 readUtf8String 最终处理 + let isHighBit = (b >= 0x80); + + if (!isAscii && !isHighBit) { + // 发现既不是 ASCII 也不是高位字节（如 0x01-0x1F 的控制字符），判定为指针 + return false; + } + offset++; + } + return true; +} + + +var runReadX0 = ptr(0) +var originCgiPtr = ptr(0) + +function patchRunReadWrite() { + Interceptor.attach(runReadWriteAddr, { + onEnter: function (args) { + try { + if (this.context.x5.isNull() || this.context.x5.compare(baseAddr) <= 0) { + return + } + + const x5 = this.context.x5; + const cTaskId = x5.add(0x308).readU32(); + if (cTaskId !== taskIdGlobal) { + return + } + console.log("[+] enter runReadWriteAddr: " + runReadWriteAddr) + const domainAddr = x5.add(0xd8); + const domainBytes = [ + 0x73, 0x7A, 0x73, 0x68, 0x6F, 0x72, 0x74, 0x2E, // szshort. + 0x77, 0x65, 0x69, 0x78, 0x69, 0x6E, 0x2E, 0x71, // weixin.q + 0x71, 0x2E, 0x63, 0x6F, 0x6D // q.com + ]; + + domainAddr.writeByteArray(domainBytes); + domainAddr.add(domainBytes.length).writeU8(0); + domainAddr.add(23).writeU8(0x15); + + runReadX0 = this.context.x0; + originCgiPtr = runReadX0.add(0x1018).readPointer(); + runReadX0.add(0x1018).writePointer(cgiAddr); + runReadX0.add(0x1020).writeU64(0x22); + console.log("[+] enter runReadWriteAddr finished: " + domainAddr.readUtf8String()) + } catch (e) { + console.log("[-] Memory access error at onEnter: " + e); + } + + } + }) + + Interceptor.attach(runReadWriteAddr1, { + onEnter: function (args) { + try { + if (this.context.x20.isNull() || this.context.x20.compare(baseAddr) <= 0) { + return + } + + const cTaskId = this.context.x20.add(0x308).readU32(); + if (cTaskId !== taskIdGlobal) { + return + } + runReadX0.add(0x1018).writePointer(originCgiPtr); + console.log("[+] leave runReadWriteAddr finished: " + runReadWriteAddr) + } catch (e) { + console.log("[-] Memory access error at onLeave: " + e); + } + } + }) + runReadWriteAddr1 +} + +setImmediate(patchRunReadWrite) + rpc.exports = { manualTrigger: manualTrigger diff --git a/onebot/script.js b/onebot/script.js index 40920b3..9f96650 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -445,7 +445,7 @@ function setReceiver() { let contentLenPtr = receiverStrPtr.add(receiverLen).add(6); // 判断是否等于 0x77 ('w'), 如果是，则是短字段 - if (contentLenPtr.readU8() === 0x77) { + if (isPrintableOrChinese(contentLenPtr, 1)) { contentLenPtr = contentLenPtr.add(-1); } const contentLenValue = readVarint(contentLenPtr) @@ -536,4 +536,32 @@ function readVarint(addr) { rpc.exports = { manualTrigger: manualTrigger -}; \ No newline at end of file +}; + +function isPrintableOrChinese(startPtr, maxScanLength) { + let offset = 0; + while (offset < maxScanLength) { + let b = startPtr.add(offset).readU8(); + + if (b === 0) { + // 扫描到 \0，且之前没有发现异常字节 + return offset > 0; // 如果第一个就是 \0，视为非字符串（可能是空指针） + } + + // 判定逻辑： + // 1. 可见 ASCII (32-126) 或 换行/制表符 (9, 10, 13) + let isAscii = (b >= 32 && b <= 126) || (b === 9 || b === 10 || b === 13); + + // 2. 汉字 UTF-8 特征：第一个字节通常 >= 0x80 (128) + // 严谨点：UTF-8 汉字首字节通常在 0xE4-0xE9 之间，后续字节在 0x80-0xBF 之间 + // 这里简化处理：如果是高位字符，我们暂时放行，由 readUtf8String 最终处理 + let isHighBit = (b >= 0x80); + + if (!isAscii && !isHighBit) { + // 发现既不是 ASCII 也不是高位字节（如 0x01-0x1F 的控制字符），判定为指针 + return false; + } + offset++; + } + return true; +} \ No newline at end of file