tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

add 4.1.8.104

Browse Source
This commit is contained in:
yincong
2026-04-09 09:57:34 +08:00
parent b6121ba5da
commit 607587c3cb
10 changed files with 115 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+2 -1
View File
@@ -15,4 +15,5 @@ onebot/log
.comate
onebot/file
onebot/videos
.comate
.claude
frida/file.js
+13 -13
View File
@@ -103,14 +103,14 @@ function generateBytes(n) {
// 双方公共使用的地址
var triggerX1Payload;
var triggerX0;
var req2bufEnterAddr = baseAddr.add(0x380b950);
var req2bufExitAddr = baseAddr.add(0x380CA64);
var sendFuncAddr = baseAddr.add(0x4992040);
var req2bufEnterAddr = baseAddr.add(0x3885598);
var req2bufExitAddr = baseAddr.add(0x38866AC);
var sendFuncAddr = baseAddr.add(0x4a572c8);
var insertMsgAddr = ptr(0);
var sendMsgType = "";
// 图片消息全局变量
var imageCallbackFuncAddr = baseAddr.add(0x251E880);
var imageCallbackFuncAddr = baseAddr.add(0x259F288);
var imgProtobufAddr = imageCallbackFuncAddr.add(0x50);
var patchImgProtobufFunc1 = imageCallbackFuncAddr.add(0x10);
var patchImgProtobufFunc1Byte;
@@ -120,7 +120,7 @@ var imgProtobufDeleteAddr = imageCallbackFuncAddr.add(0x6c);
var imgProtobufDeleteAddrByte;
// 视频消息全局变量
var videoCallbackFuncAddr = baseAddr.add(0x258BB10);
var videoCallbackFuncAddr = baseAddr.add(0x259F288);
var videoProtobufAddr = videoCallbackFuncAddr.add(0x50);
var patchVideoProtobufFunc1 = videoCallbackFuncAddr.add(0x10);
var patchVideoProtobufFunc1Byte;
@@ -129,15 +129,15 @@ var patchVideoProtobufFunc2Byte;
var videoProtobufDeleteAddr = videoCallbackFuncAddr.add(0x6c);
var videoProtobufDeleteAddrByte;
var uploadImageAddr = baseAddr.add(0x4ad95c0);
var cndOnCompleteAddr = baseAddr.add(0x37c8f00);
var imgMessageCallbackFunc1 = baseAddr.add(0x8919A10);
var videoMessageCallbackFunc1 = baseAddr.add(0x891C7B0);
var uploadImageAddr = baseAddr.add(0x4b9e88c);
var cndOnCompleteAddr = baseAddr.add(0x3842974);
var imgMessageCallbackFunc1 = baseAddr.add(0x89FCFC8);
var videoMessageCallbackFunc1 = baseAddr.add(0x89FED48);
var uploadGetCallbackWrapperAddr = baseAddr.add(0x4aa7084);
var uploadGetCallbackWrapperFuncAddr = baseAddr.add(0x37C874C);
var uploadOnCompleteAddr = baseAddr.add(0x4AA7680);
var uploadOnCompleteFuncAddr = baseAddr.add(0x37C9930);
var uploadGetCallbackWrapperAddr = baseAddr.add(0x4b6c350);
var uploadGetCallbackWrapperFuncAddr = baseAddr.add(0x3841DC4);
var uploadOnCompleteAddr = baseAddr.add(0x4B6C94C);
var uploadOnCompleteFuncAddr = baseAddr.add(0x3841DC4);
var uploadImageX1 = ptr(0);
var imgCgiAddr = ptr(0);
frida/receiver.js
+5 -5
View File
@@ -5,11 +5,11 @@ if (!baseAddr) {
}
console.log("[+] WeChat base address: " + baseAddr);
var buf2RespAddr = baseAddr.add(0x382C1A8)
var downloadImagAddr = baseAddr.add(0x4BF85F0) // image_download
var downloadFileAddr = baseAddr.add(0x4B97378) // c2c_download
var downloadVideoAddr = baseAddr.add(0x4bb90fc) // hdvideo_streaming
var startDownloadMedia = baseAddr.add(0x4AD54D4)
var buf2RespAddr = baseAddr.add(0x38aac10)
var downloadImagAddr = baseAddr.add(0x4cc261c) // image_download
var downloadFileAddr = baseAddr.add(0x4c613a4) // c2c_download
var downloadVideoAddr = baseAddr.add(0x4c83128) // hdvideo_streaming
var startDownloadMedia = baseAddr.add(0x4b9f500)
var downloadGlobalX0;
var downloadFileX1 = ptr(0)
frida/run.sh
Executable
+33
View File
@@ -0,0 +1,33 @@
#!/bin/bash
SCRIPT="$1"
if [ -z "$SCRIPT" ]; then
echo "用法: $0 <frida脚本路径>"
echo "示例: $0 ./frida/reply.js"
exit 1
fi
if [ ! -f "$SCRIPT" ]; then
echo "错误: 脚本文件 $SCRIPT 不存在"
exit 1
fi
echo "正在查找微信进程..."
PID=$(pgrep -x WeChat)
if [ -z "$PID" ]; then
echo "未发现微信进程，正在启动微信..."
open -a WeChat
while true; do
PID=$(pgrep -x WeChat)
if [ -n "$PID" ]; then
break
fi
echo "等待微信启动，5秒后重试..."
sleep 5
done
fi
echo "找到微信进程 PID: $PID"
echo "执行: frida -p $PID -l $SCRIPT"
frida -p "$PID" -l "$SCRIPT"
frida/text.js
+5 -5
View File
@@ -78,7 +78,7 @@ function patchString(addr, plainStr) {
// -------------------------全局变量分区-------------------------
// 文本消息全局变量
var textCallbackFuncAddr = baseAddr.add(0x2527C80);
var textCallbackFuncAddr = baseAddr.add(0x258295C);
var protobufAddr = textCallbackFuncAddr.add(0x40);
var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20);
var patchTextProtobufByte
@@ -90,15 +90,15 @@ var sendTextMessageAddr = ptr(0);
var textMessageAddr = ptr(0);
var textProtoX1PayloadAddr = ptr(0);
var sendMessageCallbackFunc = baseAddr.add(0x8919F48);
var sendMessageCallbackFunc = baseAddr.add(0x89FC4E0);
// 双方公共使用的地址
var triggerX1Payload;
var triggerX0;
var req2bufEnterAddr = baseAddr.add(0x380b950);
var req2bufExitAddr = baseAddr.add(0x380CA64);
var sendFuncAddr = baseAddr.add(0x4992040);
var req2bufEnterAddr = baseAddr.add(0x3885598);
var req2bufExitAddr = baseAddr.add(0x38866AC);
var sendFuncAddr = baseAddr.add(0x4a572c8);
var insertMsgAddr = ptr(0);
var sendMsgType = "";
frida/tmp_file.js
+1 -1
View File
@@ -694,7 +694,7 @@ function attachFileProto() {
const targetId = fileUploadInfo.targetId;
const fileName = fileUploadInfo.fileName || "";
const fileSize = fileUploadInfo.fileSize || "0";
const appId = fileUploadInfo.appId || "wx6618f1cfc6c132f8";
const appId = fileUploadInfo.appId || "";
const fileExt = fileUploadInfo.fileExt || "";
const fileUploadToken = fileUploadInfo.fileUploadToken || "";
onebot/main.go
+8 -2
View File
@@ -60,7 +60,7 @@ func initFlag() {
flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效")
flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot")
flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_29_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_104_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
flag.StringVar(&config.ConnType, "conn_type", "http", "连接类型: http | websocket")
flag.IntVar(&config.SendInterval, "send_interval", 1000, "发送间隔: ms")
flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 PID，不设置则自动查找")
@@ -110,7 +110,12 @@ func initFrida() {
Fatal("无法获取本地设备", "err", err)
}
attachWechat()
}
func attachWechat() {
var pid int
var err error
if config.WechatPid > 0 {
pid = config.WechatPid
Info("使用指定的微信进程 PID", "PID", pid)
@@ -125,14 +130,15 @@ func initFrida() {
}
Info("自动发现微信进程 PID", "PID", pid)
}
MonitorProcessExit(pid)
session, err = device.Attach(pid, nil)
if err != nil {
Fatal("Attach 失败 (请检查 SIP 状态或权限)", "err", err)
}
Info("成功 Attach 微信进程", "PID", pid)
loadJs()
MonitorProcess(pid)
}
func loadJs() {
onebot/utils.go
+23 -9
View File
@@ -355,9 +355,10 @@ func DetectAndSaveImage(data []byte) (string, error) {
return SaveImageToFile(ext, data)
}
// MonitorProcessExit 监控指定 PID 的进程是否退出
// 如果进程退出，则发送 SIGTERM 停止当前进程
func MonitorProcessExit(pid int) {
// MonitorProcess 监控指定 PID 的进程是否退出
// 如果进程退出，清理 Frida 资源并等待微信重新启动后重新 attach
func MonitorProcess(pid int) {
Info("开始监控微信进程", "PID", pid)
go func() {
ticker := time.NewTicker(5 * time.Second)
defer ticker.Stop()
@@ -365,20 +366,33 @@ func MonitorProcessExit(pid int) {
for range ticker.C {
proc, err := os.FindProcess(pid)
if err != nil {
// 进程不存在，发送 SIGTERM 退出
Info("监控的进程已退出，正在停止当前服务...")
syscall.Kill(syscall.Getpid(), syscall.SIGTERM)
Info("微信进程已退出，清理 Frida 资源，等待微信重新启动...")
cleanAndReattach()
return
}
// 检查进程是否存活
err = proc.Signal(syscall.Signal(0))
if err != nil {
// 进程不存在或已退出，发送 SIGTERM 退出
Info("监控的进程已退出，正在停止当前服务...")
syscall.Kill(syscall.Getpid(), syscall.SIGTERM)
Info("微信进程已退出，清理 Frida 资源，等待微信重新启动...")
cleanAndReattach()
return
}
}
}()
}
func cleanAndReattach() {
if fridaScript != nil {
fridaScript.Clean()
Info("Frida 脚本资源已清理")
}
if session != nil {
session.Clean()
Info("Frida 会话资源已清理")
}
Info("等待微信重新启动...")
// 重新等待微信进程并 attach
attachWechat()
}
succ.md
-5
View File
@@ -1,5 +0,0 @@
执行use_struct.py脚本
然后执行trigger_send.py脚本，改task id， 改 cgi，改第一个指针即可，第一个指针sub_10444A99C 函数执行的x0
在req2buf中打断点，在x0+60处，patch指针0x1120eed40 / 40 ed 0e 12 01
更改0x1120eed40 的taskId
然后在protobuf编辑处打断点，执行脚本update_sendMsg.py
wechat_version/4_1_8_104_mac.json
+25
View File
@@ -0,0 +1,25 @@
{
"textCallbackFuncAddr": "0x258295C",
"sendMessageCallbackFunc": "0x89FC4E0",
"sendFuncAddr": "0x4a572c8",
"req2bufEnterAddr": "0x3885598",
"req2bufExitAddr": "0x38866AC",
"imageCallbackFuncAddr": "0x259F288",
"imgMessageCallbackFunc": "0x89FCFC8",
"uploadImageAddr": "0x4b9e88c",
"cndOnCompleteAddr": "0x3842974",
"buf2RespAddr": "0x38aac10",
"uploadGetCallbackWrapperAddr": "0x4b6c350",
"uploadGetCallbackWrapperFuncAddr": "0x3841DC4",
"uploadOnCompleteAddr": "0x4B6C94C",
"uploadOnCompleteFuncAddr": "0x3841DC4",
"downloadImagAddr": "0x4cc261c",
"startDownloadMedia": "0x4b9f500",
"downloadFileAddr": "0x4c613a4",
"downloadVideoAddr": "0x4c83128",
"videoCallbackFuncAddr": "0x259F288",
"videoMessageCallbackFunc": "0x89FED48"
}