From 607587c3cbeb5b63bb19d8a02e200ca9062c3434 Mon Sep 17 00:00:00 2001 From: yincong Date: Thu, 9 Apr 2026 09:57:34 +0800 Subject: [PATCH] add 4.1.8.104 --- .gitignore | 3 ++- frida/file.js | 26 ++++++++++++------------ frida/receiver.js | 10 +++++----- frida/run.sh | 33 +++++++++++++++++++++++++++++++ frida/text.js | 10 +++++----- frida/tmp_file.js | 2 +- onebot/main.go | 10 ++++++++-- onebot/utils.go | 32 +++++++++++++++++++++--------- succ.md | 5 ----- wechat_version/4_1_8_104_mac.json | 25 +++++++++++++++++++++++ 10 files changed, 115 insertions(+), 41 deletions(-) create mode 100755 frida/run.sh delete mode 100644 succ.md create mode 100644 wechat_version/4_1_8_104_mac.json diff --git a/.gitignore b/.gitignore index 75a943b..7c9260c 100644 --- a/.gitignore +++ b/.gitignore @@ -15,4 +15,5 @@ onebot/log .comate onebot/file onebot/videos -.comate +.claude + diff --git a/frida/file.js b/frida/file.js index 83f7fbb..d71db6b 100644 --- a/frida/file.js +++ b/frida/file.js @@ -103,14 +103,14 @@ function generateBytes(n) { // 双方公共使用的地址 var triggerX1Payload; var triggerX0; -var req2bufEnterAddr = baseAddr.add(0x380b950); -var req2bufExitAddr = baseAddr.add(0x380CA64); -var sendFuncAddr = baseAddr.add(0x4992040); +var req2bufEnterAddr = baseAddr.add(0x3885598); +var req2bufExitAddr = baseAddr.add(0x38866AC); +var sendFuncAddr = baseAddr.add(0x4a572c8); var insertMsgAddr = ptr(0); var sendMsgType = ""; // 图片消息全局变量 -var imageCallbackFuncAddr = baseAddr.add(0x251E880); +var imageCallbackFuncAddr = baseAddr.add(0x259F288); var imgProtobufAddr = imageCallbackFuncAddr.add(0x50); var patchImgProtobufFunc1 = imageCallbackFuncAddr.add(0x10); var patchImgProtobufFunc1Byte; @@ -120,7 +120,7 @@ var imgProtobufDeleteAddr = imageCallbackFuncAddr.add(0x6c); var imgProtobufDeleteAddrByte; // 视频消息全局变量 -var videoCallbackFuncAddr = baseAddr.add(0x258BB10); +var videoCallbackFuncAddr = baseAddr.add(0x259F288); var videoProtobufAddr = videoCallbackFuncAddr.add(0x50); var patchVideoProtobufFunc1 = videoCallbackFuncAddr.add(0x10); var patchVideoProtobufFunc1Byte; @@ -129,15 +129,15 @@ var patchVideoProtobufFunc2Byte; var videoProtobufDeleteAddr = videoCallbackFuncAddr.add(0x6c); var videoProtobufDeleteAddrByte; -var uploadImageAddr = baseAddr.add(0x4ad95c0); -var cndOnCompleteAddr = baseAddr.add(0x37c8f00); -var imgMessageCallbackFunc1 = baseAddr.add(0x8919A10); -var videoMessageCallbackFunc1 = baseAddr.add(0x891C7B0); +var uploadImageAddr = baseAddr.add(0x4b9e88c); +var cndOnCompleteAddr = baseAddr.add(0x3842974); +var imgMessageCallbackFunc1 = baseAddr.add(0x89FCFC8); +var videoMessageCallbackFunc1 = baseAddr.add(0x89FED48); -var uploadGetCallbackWrapperAddr = baseAddr.add(0x4aa7084); -var uploadGetCallbackWrapperFuncAddr = baseAddr.add(0x37C874C); -var uploadOnCompleteAddr = baseAddr.add(0x4AA7680); -var uploadOnCompleteFuncAddr = baseAddr.add(0x37C9930); +var uploadGetCallbackWrapperAddr = baseAddr.add(0x4b6c350); +var uploadGetCallbackWrapperFuncAddr = baseAddr.add(0x3841DC4); +var uploadOnCompleteAddr = baseAddr.add(0x4B6C94C); +var uploadOnCompleteFuncAddr = baseAddr.add(0x3841DC4); var uploadImageX1 = ptr(0); var imgCgiAddr = ptr(0); diff --git a/frida/receiver.js b/frida/receiver.js index 2dd848c..b3e46f7 100644 --- a/frida/receiver.js +++ b/frida/receiver.js @@ -5,11 +5,11 @@ if (!baseAddr) { } console.log("[+] WeChat base address: " + baseAddr); -var buf2RespAddr = baseAddr.add(0x382C1A8) -var downloadImagAddr = baseAddr.add(0x4BF85F0) // image_download -var downloadFileAddr = baseAddr.add(0x4B97378) // c2c_download -var downloadVideoAddr = baseAddr.add(0x4bb90fc) // hdvideo_streaming -var startDownloadMedia = baseAddr.add(0x4AD54D4) +var buf2RespAddr = baseAddr.add(0x38aac10) +var downloadImagAddr = baseAddr.add(0x4cc261c) // image_download +var downloadFileAddr = baseAddr.add(0x4c613a4) // c2c_download +var downloadVideoAddr = baseAddr.add(0x4c83128) // hdvideo_streaming +var startDownloadMedia = baseAddr.add(0x4b9f500) var downloadGlobalX0; var downloadFileX1 = ptr(0) diff --git a/frida/run.sh b/frida/run.sh new file mode 100755 index 0000000..80dde24 --- /dev/null +++ b/frida/run.sh @@ -0,0 +1,33 @@ +#!/bin/bash + +SCRIPT="$1" + +if [ -z "$SCRIPT" ]; then + echo "用法: $0 " + echo "示例: $0 ./frida/reply.js" + exit 1 +fi + +if [ ! -f "$SCRIPT" ]; then + echo "错误: 脚本文件 $SCRIPT 不存在" + exit 1 +fi + +echo "正在查找微信进程..." +PID=$(pgrep -x WeChat) +if [ -z "$PID" ]; then + echo "未发现微信进程，正在启动微信..." + open -a WeChat + while true; do + PID=$(pgrep -x WeChat) + if [ -n "$PID" ]; then + break + fi + echo "等待微信启动，5秒后重试..." + sleep 5 + done +fi + +echo "找到微信进程 PID: $PID" +echo "执行: frida -p $PID -l $SCRIPT" +frida -p "$PID" -l "$SCRIPT" diff --git a/frida/text.js b/frida/text.js index a6dc2c1..f1f0a6d 100644 --- a/frida/text.js +++ b/frida/text.js @@ -78,7 +78,7 @@ function patchString(addr, plainStr) { // -------------------------全局变量分区------------------------- // 文本消息全局变量 -var textCallbackFuncAddr = baseAddr.add(0x2527C80); +var textCallbackFuncAddr = baseAddr.add(0x258295C); var protobufAddr = textCallbackFuncAddr.add(0x40); var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20); var patchTextProtobufByte @@ -90,15 +90,15 @@ var sendTextMessageAddr = ptr(0); var textMessageAddr = ptr(0); var textProtoX1PayloadAddr = ptr(0); -var sendMessageCallbackFunc = baseAddr.add(0x8919F48); +var sendMessageCallbackFunc = baseAddr.add(0x89FC4E0); // 双方公共使用的地址 var triggerX1Payload; var triggerX0; -var req2bufEnterAddr = baseAddr.add(0x380b950); -var req2bufExitAddr = baseAddr.add(0x380CA64); -var sendFuncAddr = baseAddr.add(0x4992040); +var req2bufEnterAddr = baseAddr.add(0x3885598); +var req2bufExitAddr = baseAddr.add(0x38866AC); +var sendFuncAddr = baseAddr.add(0x4a572c8); var insertMsgAddr = ptr(0); var sendMsgType = ""; diff --git a/frida/tmp_file.js b/frida/tmp_file.js index 6020834..243ecff 100644 --- a/frida/tmp_file.js +++ b/frida/tmp_file.js @@ -694,7 +694,7 @@ function attachFileProto() { const targetId = fileUploadInfo.targetId; const fileName = fileUploadInfo.fileName || ""; const fileSize = fileUploadInfo.fileSize || "0"; - const appId = fileUploadInfo.appId || "wx6618f1cfc6c132f8"; + const appId = fileUploadInfo.appId || ""; const fileExt = fileUploadInfo.fileExt || ""; const fileUploadToken = fileUploadInfo.fileUploadToken || ""; diff --git a/onebot/main.go b/onebot/main.go index 31d2fde..93e41bb 100644 --- a/onebot/main.go +++ b/onebot/main.go @@ -60,7 +60,7 @@ func initFlag() { flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效") flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot") flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/") - flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_29_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") + flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_104_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") flag.StringVar(&config.ConnType, "conn_type", "http", "连接类型: http | websocket") flag.IntVar(&config.SendInterval, "send_interval", 1000, "发送间隔: ms") flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 PID，不设置则自动查找") @@ -110,7 +110,12 @@ func initFrida() { Fatal("无法获取本地设备", "err", err) } + attachWechat() +} + +func attachWechat() { var pid int + var err error if config.WechatPid > 0 { pid = config.WechatPid Info("使用指定的微信进程 PID", "PID", pid) @@ -125,14 +130,15 @@ func initFrida() { } Info("自动发现微信进程 PID", "PID", pid) } - MonitorProcessExit(pid) session, err = device.Attach(pid, nil) if err != nil { Fatal("Attach 失败 (请检查 SIP 状态或权限)", "err", err) } + Info("成功 Attach 微信进程", "PID", pid) loadJs() + MonitorProcess(pid) } func loadJs() { diff --git a/onebot/utils.go b/onebot/utils.go index 198983b..03d1f61 100644 --- a/onebot/utils.go +++ b/onebot/utils.go @@ -355,9 +355,10 @@ func DetectAndSaveImage(data []byte) (string, error) { return SaveImageToFile(ext, data) } -// MonitorProcessExit 监控指定 PID 的进程是否退出 -// 如果进程退出，则发送 SIGTERM 停止当前进程 -func MonitorProcessExit(pid int) { +// MonitorProcess 监控指定 PID 的进程是否退出 +// 如果进程退出，清理 Frida 资源并等待微信重新启动后重新 attach +func MonitorProcess(pid int) { + Info("开始监控微信进程", "PID", pid) go func() { ticker := time.NewTicker(5 * time.Second) defer ticker.Stop() @@ -365,20 +366,33 @@ func MonitorProcessExit(pid int) { for range ticker.C { proc, err := os.FindProcess(pid) if err != nil { - // 进程不存在，发送 SIGTERM 退出 - Info("监控的进程已退出，正在停止当前服务...") - syscall.Kill(syscall.Getpid(), syscall.SIGTERM) + Info("微信进程已退出，清理 Frida 资源，等待微信重新启动...") + cleanAndReattach() return } // 检查进程是否存活 err = proc.Signal(syscall.Signal(0)) if err != nil { - // 进程不存在或已退出，发送 SIGTERM 退出 - Info("监控的进程已退出，正在停止当前服务...") - syscall.Kill(syscall.Getpid(), syscall.SIGTERM) + Info("微信进程已退出，清理 Frida 资源，等待微信重新启动...") + cleanAndReattach() return } } }() } + +func cleanAndReattach() { + if fridaScript != nil { + fridaScript.Clean() + Info("Frida 脚本资源已清理") + } + if session != nil { + session.Clean() + Info("Frida 会话资源已清理") + } + + Info("等待微信重新启动...") + // 重新等待微信进程并 attach + attachWechat() +} diff --git a/succ.md b/succ.md deleted file mode 100644 index 05baa6d..0000000 --- a/succ.md +++ /dev/null @@ -1,5 +0,0 @@ -执行use_struct.py脚本 -然后执行trigger_send.py脚本，改task id， 改 cgi，改第一个指针即可，第一个指针sub_10444A99C 函数执行的x0 -在req2buf中打断点，在x0+60处，patch指针0x1120eed40 / 40 ed 0e 12 01 -更改0x1120eed40 的taskId -然后在protobuf编辑处打断点，执行脚本update_sendMsg.py \ No newline at end of file diff --git a/wechat_version/4_1_8_104_mac.json b/wechat_version/4_1_8_104_mac.json new file mode 100644 index 0000000..6c2c7a6 --- /dev/null +++ b/wechat_version/4_1_8_104_mac.json @@ -0,0 +1,25 @@ +{ + "textCallbackFuncAddr": "0x258295C", + "sendMessageCallbackFunc": "0x89FC4E0", + "sendFuncAddr": "0x4a572c8", + "req2bufEnterAddr": "0x3885598", + "req2bufExitAddr": "0x38866AC", + "imageCallbackFuncAddr": "0x259F288", + "imgMessageCallbackFunc": "0x89FCFC8", + "uploadImageAddr": "0x4b9e88c", + "cndOnCompleteAddr": "0x3842974", + "buf2RespAddr": "0x38aac10", + "uploadGetCallbackWrapperAddr": "0x4b6c350", + "uploadGetCallbackWrapperFuncAddr": "0x3841DC4", + "uploadOnCompleteAddr": "0x4B6C94C", + "uploadOnCompleteFuncAddr": "0x3841DC4", + "downloadImagAddr": "0x4cc261c", + "startDownloadMedia": "0x4b9f500", + "downloadFileAddr": "0x4c613a4", + "downloadVideoAddr": "0x4c83128", + "videoCallbackFuncAddr": "0x259F288", + "videoMessageCallbackFunc": "0x89FED48" +} + + +