From 653c2cd4329252e63f0b49c7bed0d5d05fdd7eb7 Mon Sep 17 00:00:00 2001 From: yincong Date: Thu, 8 Jan 2026 21:01:33 +0800 Subject: [PATCH] add image --- onebot/image.js | 550 +++++++++++++++++++++++++++++++++-------------- onebot/script.js | 25 ++- 2 files changed, 400 insertions(+), 175 deletions(-) diff --git a/onebot/image.js b/onebot/image.js index ac60b01..3d65f60 100644 --- a/onebot/image.js +++ b/onebot/image.js @@ -7,19 +7,21 @@ console.log("[+] WeChat base address: " + baseAddr); // // 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来 -var triggerFuncAddr = baseAddr.add(0x444A99C); -var sendMessageCallbackFunc = baseAddr.add(0xEDB4678); -var messageCallbackFunc1 = baseAddr.add(0x7f04a38); -var messageCallbackFunc2 = baseAddr.add(0x7f04a90); -var messageCallbackFunc3 = baseAddr.add(0x7fae030); -var messageCallbackFunc4 = baseAddr.add(0x7f93d68); +var sendMessageCallbackFunc = baseAddr.add(0xAA8C5B078); +var messageCallbackFunc1 = baseAddr.add(0x7fa0b18); +var messageCallbackFunc2 = baseAddr.add(0x7fa0b70); +var messageCallbackFunc3 = baseAddr.add(0x804ae78); +var messageCallbackFunc4 = baseAddr.add(0x803ac78); // 这个必须是绝对位置 var triggerX1Payload = ptr(0x175ED6600); -var req2bufEnterAddr = baseAddr.add(0x33EE8E8); -var req2bufExitAddr = baseAddr.add(0x33EFA00); -var protobufAddr = baseAddr.add(0x223EF58); -var receiveAddr = baseAddr.add(0x23B5348); +var triggerFuncAddr = baseAddr.add(0x448A858); +var req2bufEnterAddr = baseAddr.add(0x34566C0); +var req2bufExitAddr = baseAddr.add(0x34577D8); +var protobufAddr = baseAddr.add(0x2275BFC); +var buf2RespAddr = baseAddr.add(0x347BD44); +// var patchProtobufAddr = baseAddr.add(0x2275BD8); +// var protobufDeleteAddr = baseAddr.add(0x2275C14); // 触发函数X0参数地址 var globalMessagePtr = ptr(0); @@ -30,6 +32,8 @@ var callBackFuncAddr = ptr(0); var callBackFuncAddr2 = ptr(0); var sendMessageAddr = ptr(0); +var messageAddr = ptr(0); +var messageContentAddr = ptr(0); var contentAddr = ptr(0); var insertMsgAddr = ptr(0); var receiverAddr = ptr(0); @@ -70,7 +74,8 @@ function setupSendMessageDynamic() { cgiAddr = Memory.alloc(128); callBackFuncAddr = Memory.alloc(16); callBackFuncAddr2 = Memory.alloc(16); - sendMessageAddr = Memory.alloc(512); + sendMessageAddr = Memory.alloc(256); + messageAddr = Memory.alloc(512); contentAddr = Memory.alloc(255); receiverAddr = Memory.alloc(24); htmlContentAddr = Memory.alloc(24); @@ -95,6 +100,81 @@ function setupSendMessageDynamic() { ansi: true })); + // C. 构建 Message 结构体 + messageAddr.add(0x00).writePointer(messageCallbackFunc1); + messageAddr.add(0x08).writeU32(taskIdGlobal); + messageAddr.add(0x0c).writeU32(0x6e); + messageAddr.add(0x10).writeU64(0x3); + messageAddr.add(0x18).writePointer(cgiAddr); + + // 设置一些固定值 + messageAddr.add(0x20).writeU64(uint64("0x20")); + messageAddr.add(0x28).writeU64(uint64("0x8000000000000030")); + messageAddr.add(0x30).writeU64(uint64("0x0000000001010100")); + messageAddr.add(0x58).writeU64(uint64("0x0101010100000001")); + + // 处理回调地址 + callBackFuncAddr.writePointer(messageCallbackFunc2); + messageAddr.add(0x98).writePointer(callBackFuncAddr); + + // 设置内容指针 + messageAddr.add(0xb8).writePointer(messageCallbackFunc3); + callBackFuncAddr2.writePointer(messageCallbackFunc4); + messageAddr.add(0xc0).writePointer(callBackFuncAddr2); + + + console.log(" [+] messageAddr Object: ", hexdump(messageAddr, { + offset: 0, + length: 64, + header: true, + ansi: true + })); + + console.log(" [+] Dynamic Memory Setup Complete. - Message Object: " + messageAddr); +} + +setImmediate(setupSendMessageDynamic); + +// 辅助函数：写入 Hex 字符串 +function patchHex(addr, hexStr) { + const bytes = hexStr.split(' ').map(h => parseInt(h, 16)); + addr.writeByteArray(bytes); + addr.add(bytes.length).writeU8(0); // 终止符 +} + +// 初始化进行内存的分配 +function setupSendMessageDynamic() { + console.log("[+] Starting Dynamic Message Patching..."); + + // 1. 动态分配内存块（按需分配大小） + // 分配原则：字符串给 64-128 字节，结构体按实际大小分配 + cgiAddr = Memory.alloc(128); + callBackFuncAddr = Memory.alloc(16); + sendMessageAddr = Memory.alloc(256); + messageAddr = Memory.alloc(256); + contentAddr = Memory.alloc(255); + receiverAddr = Memory.alloc(24); + + + // A. 写入字符串内容 + patchHex(cgiAddr, "2F 63 67 69 2D 62 69 6E 2F 6D 69 63 72 6F 6D 73 67 2D 62 69 6E 2F 6E 65 77 73 65 6E 64 6D 73 67"); + patchHex(contentAddr, " "); + + // B. 构建 SendMessage 结构体 (X24 基址位置) + sendMessageAddr.add(0x00).writeU64(0); + sendMessageAddr.add(0x08).writeU64(0); + sendMessageAddr.add(0x10).writePointer(sendMessageCallbackFunc); + sendMessageAddr.add(0x18).writeU64(1); + sendMessageAddr.add(0x20).writeU32(taskIdGlobal); + sendMessageAddr.add(0x28).writePointer(messageAddr); // 指向动态分配的 Message + + console.log(" [+] sendMessageAddr Object: ", hexdump(sendMessageAddr, { + offset: 0, + length: 48, + header: true, + ansi: true + })); + // C. 构建 Message 结构体 messageAddr.add(0x00).writePointer(messageCallbackFunc1); messageAddr.add(0x08).writeU32(taskIdGlobal); @@ -114,11 +194,12 @@ function setupSendMessageDynamic() { // 设置内容指针 messageAddr.add(0xb8).writePointer(messageCallbackFunc3); - callBackFuncAddr2.writePointer(messageCallbackFunc4); - messageAddr.add(0xc0).writePointer(callBackFuncAddr2); - - - + messageAddr.add(0xc0).writePointer(messageContentAddr); + messageAddr.add(0xc8).writeU64(uint64("0x0000000100000001")); + messageAddr.add(0xd0).writeU64(0x4); + messageAddr.add(0xd8).writeU64(0x1); + messageAddr.add(0xe0).writeU64(0x1); + messageAddr.add(0xe8).writePointer(messageCallbackFunc4); console.log(" [+] messageAddr Object: ", hexdump(messageAddr, { offset: 0, @@ -127,43 +208,34 @@ function setupSendMessageDynamic() { ansi: true })); - console.log(" [+] Dynamic Memory Setup Complete. - Message Object: " + messageAddr); + console.log("[+] Dynamic Memory Setup Complete. - Message Object: " + messageAddr); } setImmediate(setupSendMessageDynamic); -// 设置trigger函数的x0参数 -function setTriggerAttach() { - console.log("[+] WeChat Base: " + baseAddr + "[+] Attaching to: " + triggerFuncAddr); - // 3. 开始拦截 - Interceptor.attach(triggerFuncAddr, { - onEnter: function (args) { - console.log("[+] Entered Function: 0x10444A99C"); - - if (!globalMessagePtr.isNull()) { - return; - } - - globalMessagePtr = this.context.x0; - console.log("[+] globalMessagePtr 当前 X0 的指针值: " + globalMessagePtr); - }, - onLeave: function (retval) { - } - }); +function patchProtoBuf() { + // Memory.patchCode(patchProtobufAddr, 4, code => { + // const cw = new Arm64Writer(code, {pc: patchProtobufAddr}); + // cw.putNop(); + // cw.flush(); + // }); + // + // console.log("[+] Patching BL to NOP at " + patchProtobufAddr + " completed."); + // + // Memory.patchCode(protobufDeleteAddr, 4, code => { + // const cw = new Arm64Writer(code, {pc: protobufDeleteAddr}); + // cw.putNop(); + // cw.flush(); + // }); + // + // console.log("[+] Patching BL DELETE to NOP at " + protobufDeleteAddr + " completed."); } -// 使用 setImmediate 确保在模块加载后执行 -setImmediate(setTriggerAttach); - +setImmediate(patchProtoBuf); function manualTrigger(taskId, receiver, content) { console.log("[+] Manual Trigger Started..."); - if (globalMessagePtr.isNull()) { - console.error("[!] globalMessagePtr is NULL, cannot trigger!"); - return "fail"; - } - if (!taskId || !receiver || !content) { console.error("[!] taskId or Receiver or Content is empty!"); return "fail"; @@ -184,14 +256,15 @@ function manualTrigger(taskId, receiver, content) { messageAddr.add(0x08).writeU32(taskIdGlobal); sendMessageAddr.add(0x20).writeU32(taskIdGlobal); - messageAddrAddr.add(0x18).writeU32(timestamp); + + console.log("start init payload") const payloadData = [ - 0x0A, 0x02, 0x00, 0x00, // 0x00 + 0x6e, 0x00, 0x00, 0x00, // 0x00 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x08 0x03, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, // 0x10 0x40, 0xec, 0x0e, 0x12, 0x01, 0x00, 0x00, 0x00, // 0x18 - 0x22, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x20 + 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x20 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, // 0x28 0x00, 0x01, 0x01, 0x01, 0x00, 0xAA, 0xAA, 0xAA, // 0x30 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, // 0x38 @@ -199,7 +272,7 @@ function manualTrigger(taskId, receiver, content) { 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0xAA, 0xAA, 0xAA, // 0x48 0xFF, 0xFF, 0xFF, 0xFF, 0xAA, 0xAA, 0xAA, 0xAA, // 0x50 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x58 - 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x60 + 0x6e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x60 0x64, 0x65, 0x66, 0x61, 0x75, 0x6C, 0x74, 0x2D, // 0x68 default- 0x6C, 0x6F, 0x6E, 0x67, 0x6C, 0x69, 0x6E, 0x6B, // 0x70 longlink 0x00, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0x10, // 0x78 @@ -246,15 +319,17 @@ function manualTrigger(taskId, receiver, content) { triggerX1Payload.add(0x04).writeByteArray(payloadData); triggerX1Payload.add(0x18).writePointer(cgiAddr); - const sub_10444A99C = new NativeFunction(triggerFuncAddr, 'uint64', ['pointer', 'pointer']); + console.log("finished init payload") + + const MMStartTask = new NativeFunction(triggerFuncAddr, 'int64', ['pointer']); // 5. 调用函数 try { - const arg1 = globalMessagePtr; // 第一个指针参数 + // const arg1 = globalMessagePtr; // 第一个指针参数 const arg2 = triggerX1Payload; // 第二个参数 0x175ED6600 - console.log(`[+] Calling trigger function at ${triggerFuncAddr} with args: (${arg1}, ${arg2})`); - const result = sub_10444A99C(arg1, arg2); - console.log("[+] Execution trigger function Success. Return value: " + result); + console.log(`[+] Calling MMStartTask at ${triggerFuncAddr} with args: (${arg2})`); + const result = MMStartTask(arg2); + console.log("[+] Execution MMStartTask Success. Return value: " + result); return "ok"; } catch (e) { console.error("[!] Error trigger function during execution: " + e); @@ -280,14 +355,7 @@ function attachReq2buf() { // 3. 获取 X24 寄存器的值 const x24_base = this.context.x24; insertMsgAddr = x24_base.add(0x60); - console.log("[+] 当前 Req2Buf X24 基址: " + x24_base); - console.log("[+] 准备修改位置 Req2Buf (X24 + 0x60): " + insertMsgAddr, hexdump(insertMsgAddr, { - offset: 0, - length: 16, - header: true, - ansi: true - })); if (typeof sendMessageAddr !== 'undefined') { insertMsgAddr.writePointer(sendMessageAddr); @@ -319,7 +387,7 @@ function attachReq2buf() { return; } insertMsgAddr.writeU64(0x0); - console.log("[+] 0x1033EFA00 清空写入后内存预览: " + insertMsgAddr.readPointer()); + console.log("[+] 清空写入后内存预览: " + insertMsgAddr.readPointer()); taskIdGlobal = 0; receiverGlobal = ""; contentGlobal = ""; @@ -386,48 +454,187 @@ function attachProto() { onEnter: function (args) { console.log("[+] Protobuf 拦截命中"); - var sp = this.context.sp; - console.log("[+] Protobuf 拦截命中，SP: " + sp, hexdump(sp, { - offset: 0, - length: 16, - header: true, - ansi: true - })); + // var sp = this.context.sp; + // var firstValue = sp.readU32(); + // if (firstValue !== taskIdGlobal) { + // console.log("[+] Protobuf 拦截未命中，跳过..."); + // return; + // } + const type = [0x0A, 0x3F, 0x0A, 0x01, 0x00, 0x10] + const msgId = [0xc6, 0xbc, 0x90, 0xb9, 0x08] + const cpHeader = [0x1A, 0x10] + const cp = [0x6D, 0x33, 0x30, 0x63, 0x34, 0x36, 0x37, 0x34, 0x66, 0x35, 0x61, 0x30, 0x62, 0x39, 0x64, 0x30] // m30c4674f5a0b9d0 + const randomId = [0x20, 0xAF, 0xAC, 0x90, 0x93, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01] + const sysHeader = [0x2A, 0x15] + // UnifiedPCMac 26 arm64 + const sys = [0x55, 0x6E, 0x69, 0x66, 0x69, 0x65, 0x64, 0x50, 0x43, 0x4D, 0x61, 0x63, 0x20, 0x32, 0x36, 0x20, 0x61, 0x72, 0x6D, 0x36, 0x34] + const msgIdHeader = [0x30, 0x73, 0x12, 0x2E, 0x0A, 0x2C] + // 45872025384@chatroom_176787000_60_xwechat_1 + const receiverMsgId = [0x34, 0x35, 0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38, 0x34, + 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F, 0x6F, 0x6D, 0x5F, 0x31, 0x37, 0x36, 0x37, 0x38, 0x37, + 0x30, 0x30, 0x30, 0x30, 0x5F, 0x36, 0x30, 0x5F, 0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, 0x5F, 0x31, + ] + const senderHeader = [0x1A, 0x15, 0x0A, 0x13]; + const sender = [0x77, 0x78, 0x69, 0x64, 0x5F, 0x6C, 0x64, 0x66, 0x74, 0x75, 0x68, 0x65, 0x33, 0x36, 0x69, 0x7A, 0x67, 0x31, 0x39]; + const receiverHeader = [0x22, 0x16, 0x0A, 0x14] + const receiver = [0x34, 0x35, 0x38, 0x37, 0x32, 0x30, 0x32, 0x35, 0x33, 0x38, 0x34, 0x40, 0x63, 0x68, 0x61, 0x74, 0x72, 0x6F, 0x6F, 0x6D] + const randomId1 = [0x28, 0xF4, 0x0B] + const type1 = [0x30, 0x00] + const randomId2 = [0x38, 0xF4, 0x0B] + const randomId3 = [0x42, 0x04, 0x08, 0x00, 0x12, 0x00] + const randomId4 = [0x48, 0x03] + const htmlHeader = [0x52, 0x83, 0x01]; + // + // cc357085-cbff-4968-b9fe-b4e4eab5b0ca.png + // + // 1 + // 3 + // + // + const html = [0x3C, 0x6D, 0x73, 0x67, 0x73, 0x6F, 0x75, 0x72, 0x63, 0x65, 0x3E, 0x3C, 0x69, + 0x6D, 0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, // 0xC0 + 0x6E, 0x61, 0x6D, 0x65, 0x3E, 0x63, 0x63, 0x33, // 0xC8 + 0x35, 0x37, 0x30, 0x38, 0x35, 0x2D, 0x63, 0x62, // 0xD0 + 0x66, 0x66, 0x2D, 0x34, 0x39, 0x36, 0x38, 0x2D, // 0xD8 + 0x62, 0x39, 0x66, 0x65, 0x2D, 0x62, 0x34, 0x65, // 0xE0 + 0x34, 0x65, 0x61, 0x62, 0x35, 0x62, 0x30, 0x63, // 0xE8 + 0x61, 0x2E, 0x70, 0x6E, 0x67, 0x3C, 0x2F, 0x69, // 0xF0 + 0x6D, 0x67, 0x5F, 0x66, 0x69, 0x6C, 0x65, 0x5F, // 0xF8 + 0x6E, 0x61, 0x6D, 0x65, 0x3E, 0x3C, 0x61, 0x6C, // 0x100 + 0x6E, 0x6F, 0x64, 0x65, 0x3E, 0x3C, 0x66, 0x72, // 0x108 + 0x3E, 0x31, 0x3C, 0x2F, 0x66, 0x72, 0x3E, 0x3C, // 0x110 + 0x63, 0x66, 0x3E, 0x33, 0x3C, 0x2F, 0x63, 0x66, // 0x118 + 0x3E, 0x3C, 0x2F, 0x61, 0x6C, 0x6E, 0x6F, 0x64, // 0x120 + 0x65, 0x3E, 0x3C, 0x2F, 0x6D, 0x73, 0x67, 0x73, // 0x128 + 0x6F, 0x75, 0x72, 0x63, 0x65, 0x3E, + ] - var firstValue = sp.readU32(); - if (firstValue !== taskIdGlobal) { - console.log("[+] Protobuf 拦截未命中，跳过..."); - return; - } - console.log("[+] 正在注入 Protobuf Payload..."); - - const type = [0x08, 0x01, 0x12] - const receiverHeader = [0x0A, receiverGlobal.length + 2, 0x0A, receiverGlobal.length]; - const receiverProto = stringToHexArray(receiverGlobal); - const contentProto = stringToHexArray(contentGlobal); - const contentHeader = [0x12, ...toVarint(contentProto.length)]; - const tsHeader = [0x18, 0x01, 0x20]; - const tsBytes = getVarintTimestampBytes(); - const msgIdHeader = [0x28] - const msgId = generateRandom5ByteVarint() - - const suffix = [ - 0x32, 0x32, 0x3C, // 0x28 头部 - 0x6D, 0x73, 0x67, 0x73, 0x6F, 0x75, 0x72, // 0x30 msgsour - 0x63, 0x65, 0x3E, 0x3C, 0x61, 0x6C, 0x6E, 0x6F, // 0x38 ce>1 - 0x3C, 0x2F, 0x66, 0x72, 0x3E, 0x3C, 0x2F, 0x61, // 0x48 . + const cdnHeader = [0x58, 0x01, 0x60, 0x02, 0x68, 0x05, 0x7A, 0xB2, 0x01] + // 3057 开头的cdn key + const cdn = [0x33, // 0x138 + 0x30, 0x35, 0x37, 0x30, 0x32, 0x30, 0x31, 0x30, // 0x140 + 0x30, 0x30, 0x34, 0x34, 0x62, 0x33, 0x30, 0x34, // 0x148 + 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, // 0x150 + 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, 0x37, 0x30, // 0x158 + 0x39, 0x35, 0x64, 0x30, 0x32, 0x30, 0x33, 0x32, // 0x160 + 0x66, 0x35, 0x61, 0x34, 0x35, 0x30, 0x32, 0x30, // 0x168 + 0x34, 0x65, 0x61, 0x38, 0x65, 0x30, 0x65, 0x37, // 0x170 + 0x39, 0x30, 0x32, 0x30, 0x34, 0x36, 0x39, 0x35, // 0x178 + 0x66, 0x38, 0x65, 0x33, 0x31, 0x30, 0x34, 0x32, // 0x180 + 0x34, 0x33, 0x37, 0x33, 0x39, 0x36, 0x35, 0x33, // 0x188 + 0x31, 0x33, 0x37, 0x33, 0x31, 0x33, 0x34, 0x33, // 0x190 + 0x35, 0x32, 0x64, 0x33, 0x34, 0x33, 0x34, 0x33, // 0x198 + 0x35, 0x33, 0x35, 0x32, 0x64, 0x33, 0x34, 0x33, // 0x1A0 + 0x33, 0x36, 0x33, 0x33, 0x32, 0x32, 0x64, 0x36, // 0x1A8 + 0x31, 0x33, 0x35, 0x33, 0x32, 0x33, 0x31, 0x32, // 0x1B0 + 0x64, 0x33, 0x39, 0x33, 0x33, 0x33, 0x32, 0x33, // 0x1B8 + 0x32, 0x36, 0x34, 0x36, 0x34, 0x36, 0x32, 0x36, // 0x1C0 + 0x31, 0x33, 0x37, 0x36, 0x36, 0x33, 0x32, 0x36, // 0x1C8 + 0x36, 0x30, 0x32, 0x30, 0x34, 0x30, 0x35, 0x32, // 0x1D0 + 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, 0x32, 0x30, // 0x1D8 + 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, 0x35, 0x30, // 0x1E0 + 0x30, 0x34, 0x63, 0x34, 0x65, 0x36, 0x31, 0x30, // 0x1E8 + 0x30, ]; - const valueLen = toVarint(receiverHeader.length + receiverProto.length + contentHeader.length + - contentProto.length + tsHeader.length + tsBytes.length + msgIdHeader.length + msgId.length + suffix.length) + const cdn2Header = [0x82, 0x01, 0xB2, 0x01] + const cdn2 = [ + 0x33, 0x30, 0x35, // 0x1F0 + 0x37, 0x30, 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, // 0x1F8 + 0x34, 0x34, 0x62, 0x33, 0x30, 0x34, 0x39, 0x30, // 0x200 + 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x32, 0x30, // 0x208 + 0x34, 0x64, 0x30, 0x61, 0x37, 0x30, 0x39, 0x35, // 0x210 + 0x64, 0x30, 0x32, 0x30, 0x33, 0x32, 0x66, 0x35, // 0x218 + 0x61, 0x34, 0x35, 0x30, 0x32, 0x30, 0x34, 0x65, // 0x220 + 0x61, 0x38, 0x65, 0x30, 0x65, 0x37, 0x39, 0x30, // 0x228 + 0x32, 0x30, 0x34, 0x36, 0x39, 0x35, 0x66, 0x38, // 0x230 + 0x65, 0x33, 0x31, 0x30, 0x34, 0x32, 0x34, 0x33, // 0x238 + 0x37, 0x33, 0x39, 0x36, 0x35, 0x33, 0x31, 0x33, // 0x240 + 0x37, 0x33, 0x31, 0x33, 0x34, 0x33, 0x35, 0x32, // 0x248 + 0x64, 0x33, 0x34, 0x33, 0x34, 0x33, 0x35, 0x33, // 0x250 + 0x35, 0x32, 0x64, 0x33, 0x34, 0x33, 0x33, 0x36, // 0x258 + 0x33, 0x33, 0x32, 0x32, 0x64, 0x36, 0x31, 0x33, // 0x260 + 0x35, 0x33, 0x32, 0x33, 0x31, 0x32, 0x64, 0x33, // 0x268 + 0x39, 0x33, 0x33, 0x33, 0x32, 0x33, 0x32, 0x36, // 0x270 + 0x34, 0x36, 0x34, 0x36, 0x32, 0x36, 0x31, 0x33, // 0x278 + 0x37, 0x36, 0x36, 0x33, 0x32, 0x36, 0x36, 0x30, // 0x280 + 0x32, 0x30, 0x34, 0x30, 0x35, 0x32, 0x34, 0x33, // 0x288 + 0x38, 0x30, 0x31, 0x30, 0x32, 0x30, 0x31, 0x30, // 0x290 + 0x30, 0x30, 0x34, 0x30, 0x35, 0x30, 0x30, 0x34, // 0x298 + 0x63, 0x34, 0x65, 0x36, 0x31, 0x30, 0x30, + ] - // 合并数组 - const finalPayload = type.concat(valueLen).concat(receiverHeader).concat(receiverProto).concat(contentHeader).concat(contentProto).concat(tsHeader).concat(tsBytes).concat(msgIdHeader).concat(msgId).concat(suffix); + const aesKeyHeader = [0x8A, 0x01, 0x20] + const aesKey = [ + 0x38, 0x31, 0x66, 0x66, 0x37, 0x65, // 0x2A8 + 0x61, 0x37, 0x36, 0x37, 0x31, 0x34, 0x66, 0x33, // 0x2B0 + 0x30, 0x66, 0x36, 0x63, 0x32, 0x63, 0x33, 0x64, // 0x2B8 + 0x37, 0x37, 0x30, 0x64, 0x39, 0x38, 0x63, 0x35, // 0x2C0 + 0x64, 0x65, + ] + + const randomId5 = [0x90, 0x01, 0x01, 0x98, 0x01, 0xFF, // 0x2C8 + 0x13, 0xA0, 0x01, 0xFF, 0x13] + + const cdn3Header = [0xAA, 0x01, 0xB2, 0x01] + const cdn3 = [ + 0x33, 0x30, 0x35, 0x37, 0x30, 0x32, 0x30, // 0x2D8 + 0x31, 0x30, 0x30, 0x30, 0x34, 0x34, 0x62, 0x33, // 0x2E0 + 0x30, 0x34, 0x39, 0x30, 0x32, 0x30, 0x31, 0x30, // 0x2E8 + 0x30, 0x30, 0x32, 0x30, 0x34, 0x64, 0x30, 0x61, // 0x2F0 + 0x37, 0x30, 0x39, 0x35, 0x64, 0x30, 0x32, 0x30, // 0x2F8 + 0x33, 0x32, 0x66, 0x35, 0x61, 0x34, 0x35, 0x30, // 0x300 + 0x32, 0x30, 0x34, 0x65, 0x61, 0x38, 0x65, 0x30, // 0x308 + 0x65, 0x37, 0x39, 0x30, 0x32, 0x30, 0x34, 0x36, // 0x310 + 0x39, 0x35, 0x66, 0x38, 0x65, 0x33, 0x31, 0x30, // 0x318 + 0x34, 0x32, 0x34, 0x33, 0x37, 0x33, 0x39, 0x36, // 0x320 + 0x35, 0x33, 0x31, 0x33, 0x37, 0x33, 0x31, 0x33, // 0x328 + 0x34, 0x33, 0x35, 0x32, 0x64, 0x33, 0x34, 0x33, // 0x330 + 0x34, 0x33, 0x35, 0x33, 0x35, 0x32, 0x64, 0x33, // 0x338 + 0x34, 0x33, 0x33, 0x36, 0x33, 0x33, 0x32, 0x32, // 0x340 + 0x64, 0x36, 0x31, 0x33, 0x35, 0x33, 0x32, 0x33, // 0x348 + 0x31, 0x32, 0x64, 0x33, 0x39, 0x33, 0x33, 0x33, // 0x350 + 0x32, 0x33, 0x32, 0x36, 0x34, 0x36, 0x34, 0x36, // 0x358 + 0x32, 0x36, 0x31, 0x33, 0x37, 0x36, 0x36, 0x33, // 0x360 + 0x32, 0x36, 0x36, 0x30, 0x32, 0x30, 0x34, 0x30, // 0x368 + 0x35, 0x32, 0x34, 0x33, 0x38, 0x30, 0x31, 0x30, // 0x370 + 0x32, 0x30, 0x31, 0x30, 0x30, 0x30, 0x34, 0x30, // 0x378 + 0x35, 0x30, 0x30, 0x34, 0x63, 0x34, 0x65, 0x36, // 0x380 + 0x31, 0x30, 0x30 + ] + + const randomId6 = [0xB0, 0x01, 0xF4, 0x0B] + const randomId7 = [0xB8, 0x01, 0x68] + const randomId8 = [0xC0, 0x01, 0x3A] + const aesKey1Header = [0xCA, 0x01, 0x20] + const aesKey1 = [ + 0x38, 0x31, 0x66, 0x66, 0x37, 0x65, 0x61, 0x37, // 0x398 + 0x36, 0x37, 0x31, 0x34, 0x66, 0x33, 0x30, 0x66, // 0x3A0 + 0x36, 0x63, 0x32, 0x63, 0x33, 0x64, 0x37, 0x37, // 0x3A8 + 0x30, 0x64, 0x39, 0x38, 0x63, 0x35, 0x64, 0x65, // 0x3B0 + ] + const aesKey2Header = [0xDA, 0x01, 0x20] + const aesKey2 = [ + 0x36, 0x37, 0x36, 0x33, 0x32, // 0x3B8 + 0x35, 0x32, 0x30, 0x35, 0x36, 0x38, 0x35, 0x37, // 0x3C0 + 0x61, 0x64, 0x66, 0x65, 0x35, 0x36, 0x36, 0x31, // 0x3C8 + 0x30, 0x35, 0x37, 0x30, 0x63, 0x61, 0x34, 0x32, // 0x3D0 + 0x38, 0x34, 0x63, + ] + + const randomId9 = [0xE0, 0x01, 0xd9, 0xe7, 0xc7, 0xF3, 0x02] + + + var left0 = [ + 0xF0, 0x01, 0x00, 0xA0, 0x02, 0x00, // 0x3E0 + 0xC8, 0x02, 0x00, 0x00 // 0x3E8 + ] + + const finalPayload = type.concat(msgId, cpHeader, cp, randomId, sysHeader, sys, msgIdHeader, receiverMsgId, + senderHeader, sender, receiverHeader, receiver, randomId1, type1, randomId2, randomId3, randomId4, htmlHeader, html, cdnHeader, + cdn,cdn2Header, cdn2,aesKeyHeader,aesKey, randomId5, cdn3Header, cdn3, randomId6, randomId7, randomId8, aesKey1Header, aesKey1, + aesKey2Header, aesKey2, randomId9, left0) console.log("[+] Payload 准备写入"); protoX1PayloadAddr.writeByteArray(finalPayload); @@ -438,11 +645,11 @@ function attachProto() { console.log("[+] 寄存器修改完成: X1=" + this.context.x1 + ", X2=" + this.context.x2, hexdump(protoX1PayloadAddr, { offset: 0, - length: 128, + length: 1024, header: true, ansi: true })); - } + }, }); } @@ -459,61 +666,79 @@ function toVarint(n) { setImmediate(attachProto); function setReceiver() { - console.log("[+] setReceiver WeChat Base: " + baseAddr + "[+] Attaching to: " + receiveAddr); + console.log("[+] buf2RespAddr WeChat Base: " + baseAddr + "[+] Attaching to: " + buf2RespAddr); // 3. 开始拦截 - Interceptor.attach(receiveAddr, { + Interceptor.attach(buf2RespAddr, { onEnter: function (args) { - console.log("[+] Entered Receive Function: 0x1023B5348"); - const x1 = this.context.x1; - var sender = x1.add(0x18).readUtf8String(); - var receiver = x1.add(0x30).readUtf8String(); - var senderUser = x1.add(0x48).readUtf8String(); - // 3. 从 0xd0 开始处理 - var d0Pos = x1.add(0xd0); - var strD0 = ""; - - if (isPrintableOrChinese(d0Pos)) { - strD0 = d0Pos.readUtf8String(); - console.log("[+] 0xd0 处不是指针，直接读取完毕"); - } else { - // 情况 B：不符合特征（如包含乱码位或指针特征），视为指针 - var ptrD0 = d0Pos.readPointer(); - if (!ptrD0.isNull() && Process.findRangeByAddress(ptrD0)) { - strD0 = ptrD0.readUtf8String(); - console.log("[+] 0xd0 识别为：指针跳转读取"); - } else { - strD0 = "Invalid Data/Pointer"; + const currentPtr = this.context.x1; + let start = 0x1e; + let senderLen = currentPtr.add(start).readU8(); + if (senderLen !== 0x14 && senderLen !== 0x13) { + start = 0x1d; + let senderLen = currentPtr.add(start).readU8(); + if (senderLen !== 0x14 && senderLen !== 0x13) { + return } } + console.log("[+] Entered Receive Function: 0x1023B5348"); + + let senderPtr = currentPtr.add(start + 1); + let sender = senderPtr.readUtf8String(senderLen); + + let receiverLenPtr = senderPtr.add(senderLen).add(3); + let receiverLen = receiverLenPtr.readU8(); + let receiverStrPtr = receiverLenPtr.add(1); + let receiver = receiverStrPtr.readUtf8String(receiverLen); + + let contentLenPtr = receiverStrPtr.add(receiverLen).add(6); + // 判断是否等于 0x77 ('w'), 如果是，则是短字段 + if (contentLenPtr.readU8() === 0x77) { + contentLenPtr = contentLenPtr.add(-1); + } + const contentLenValue = readVarint(contentLenPtr) + let contentPtr = contentLenPtr.add(contentLenValue.byteLength); + var content = contentPtr.readUtf8String(contentLenValue.value); + var selfId = receiver var msgType = "private" var groupId = "" - if (receiver.includes("@chatroom")) { - msgType = "group" - groupId = receiver - selfId = senderUser - } + var senderUser = sender + var messages = []; + messages.push({type: "text", data: {text: content}}); + if (sender.includes("@chatroom")) { msgType = "group" groupId = sender - } + let splitIndex = -1; + for (let i = 0; i < content.length; i++) { + if (content[i] === ':') { + splitIndex = i; + break; + } + } - var delimiter = ":\n"; - var index = strD0.indexOf(delimiter); - if (index !== -1) { - strD0 = strD0.substring(index + delimiter.length).trim(); - } - var parts = strD0.split('\u2005'); - var messages = []; - for (let part of parts) { - part = part.trim(); - if (part.startsWith("@")) { - messages.push({type: "at", data: {qq: selfId}}); - } else { - messages.push({type: "text", data: {text: part}}); + senderUser = content.substring(0, splitIndex).trim(); + content = content.substring(splitIndex + 2).trim(); + + messages = []; + const parts = content.split('\u2005'); + for (let part of parts) { + part = part.trim(); + if (!part.startsWith("@")) { + messages.push({type: "text", data: {text: part}}); + } + } + + const xmlPtr = contentPtr.add(contentLenValue.value).add(15); + const xmlLenValue = readVarint(xmlPtr) + const xml = xmlPtr.add(xmlLenValue.byteLength).readUtf8String(xmlLenValue.value); + const atUserMatch = xml.match(/([\s\S]*?)<\/atuserlist>/); + const atUser = atUserMatch ? atUserMatch[1] : null; + if (atUser) { + messages.push({type: "at", data: {qq: atUser}}); } } @@ -534,37 +759,28 @@ function setReceiver() { // 使用 setImmediate 确保在模块加载后执行 setImmediate(setReceiver) -/** - * 扫描内存直到 \0，判断中间内容是否全部为可见字符或汉字 - */ -function isPrintableOrChinese(startPtr) { - let offset = 0; - const maxScanLength = 8; +function readVarint(addr) { + let value = 0; + let shift = 0; + let count = 0; - while (offset < maxScanLength) { - let b = startPtr.add(offset).readU8(); + while (true) { + let byte = addr.add(count).readU8(); + // 取低7位进行累加 + value |= (byte & 0x7f) << shift; + count++; // 消耗了一个字节 - if (b === 0) { - // 扫描到 \0，且之前没有发现异常字节 - return offset > 0; // 如果第一个就是 \0，视为非字符串（可能是空指针） - } + // 如果最高位是0，跳出循环 + if ((byte & 0x80) === 0) break; - // 判定逻辑： - // 1. 可见 ASCII (32-126) 或 换行/制表符 (9, 10, 13) - let isAscii = (b >= 32 && b <= 126) || (b === 9 || b === 10 || b === 13); - - // 2. 汉字 UTF-8 特征：第一个字节通常 >= 0x80 (128) - // 严谨点：UTF-8 汉字首字节通常在 0xE4-0xE9 之间，后续字节在 0x80-0xBF 之间 - // 这里简化处理：如果是高位字符，我们暂时放行，由 readUtf8String 最终处理 - let isHighBit = (b >= 0x80); - - if (!isAscii && !isHighBit) { - // 发现既不是 ASCII 也不是高位字节（如 0x01-0x1F 的控制字符），判定为指针 - return false; - } - offset++; + shift += 7; + if (count > 5) return -1; // 安全校验，防止死循环 } - return true; + + return { + value: value, // 最终长度数值 (例如 251) + byteLength: count // 长度字段占用的字节数 (例如 2) + }; } diff --git a/onebot/script.js b/onebot/script.js index cf3d8b5..5bd655c 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -445,14 +445,19 @@ function setReceiver() { onEnter: function (args) { const currentPtr = this.context.x1; - let senderLen = currentPtr.add(0x1e).readU8(); + let start = 0x1e; + let senderLen = currentPtr.add(start).readU8(); if (senderLen !== 0x14 && senderLen !== 0x13) { - return + start = 0x1d; + let senderLen = currentPtr.add(start).readU8(); + if (senderLen !== 0x14 && senderLen !== 0x13) { + return + } } console.log("[+] Entered Receive Function: 0x1023B5348"); - let senderPtr = currentPtr.add(0x1e + 1); + let senderPtr = currentPtr.add(start + 1); let sender = senderPtr.readUtf8String(senderLen); let receiverLenPtr = senderPtr.add(senderLen).add(3); @@ -460,10 +465,14 @@ function setReceiver() { let receiverStrPtr = receiverLenPtr.add(1); let receiver = receiverStrPtr.readUtf8String(receiverLen); - let contentLenPtr = receiverStrPtr.add(receiverLen).add(5); - let contentLen = contentLenPtr.readU8(); - let contentPtr = contentLenPtr.add(1); - var content = contentPtr.readUtf8String(contentLen); + let contentLenPtr = receiverStrPtr.add(receiverLen).add(6); + // 判断是否等于 0x77 ('w'), 如果是，则是短字段 + if (contentLenPtr.readU8() === 0x77) { + contentLenPtr = contentLenPtr.add(-1); + } + const contentLenValue = readVarint(contentLenPtr) + let contentPtr = contentLenPtr.add(contentLenValue.byteLength); + var content = contentPtr.readUtf8String(contentLenValue.value); var selfId = receiver var msgType = "private" @@ -495,7 +504,7 @@ function setReceiver() { } } - const xmlPtr = contentPtr.add(contentLen).add(15); + const xmlPtr = contentPtr.add(contentLenValue.value).add(15); const xmlLenValue = readVarint(xmlPtr) const xml = xmlPtr.add(xmlLenValue.byteLength).readUtf8String(xmlLenValue.value); const atUserMatch = xml.match(/([\s\S]*?)<\/atuserlist>/);