mirror of
https://github.com/yincongcyincong/wechat_chatter.git
synced 2026-07-15 10:26:52 +08:00
add 8.29
This commit is contained in:
yincong
+38
-5
@@ -12,9 +12,42 @@ function scanPatterns() {
|
||||
|
||||
Memory.scan(baseAddr, module.size, pattern, {
|
||||
onMatch: function(address, size) {
|
||||
// 计算相对偏移 (RVA)
|
||||
const offset = address.sub(baseAddr);
|
||||
console.log(`"${name}": "${offset}", 绝对地址: ${address}`);
|
||||
switch (name) {
|
||||
case "cndOnCompleteAddr":
|
||||
console.log(`"${name}": "${offset.sub(0xCC)}", 绝对地址: ${address.sub(0xCC)}`);
|
||||
break;
|
||||
case "uploadGetCallbackWrapperAddr":
|
||||
console.log(`"${name}": "${offset}", 绝对地址: ${address}`);
|
||||
break;
|
||||
case "req2bufEnterAddr":
|
||||
console.log(`"${name}": "${offset}", 绝对地址: ${address}`);
|
||||
break;
|
||||
case "downloadFileAddr":
|
||||
console.log(`"${name}": "${offset.sub(0x3c)}", 绝对地址: ${address.sub(0x3c)}`);
|
||||
break;
|
||||
case "downloadImageAddr":
|
||||
console.log(`"${name}": "${offset.sub(0x18)}", 绝对地址: ${address.sub(0x18)}`);
|
||||
break;
|
||||
case "uploadImageAddr":
|
||||
console.log(`"${name}": "${offset.sub(0x30)}", 绝对地址: ${address.sub(0x30)}`);
|
||||
break;
|
||||
case "sendFuncAddr":
|
||||
console.log(`"${name}": "${offset.sub(0x44)}", 绝对地址: ${address.sub(0x44)}`);
|
||||
break;
|
||||
case "buf2RespAddr":
|
||||
console.log(`"${name}": "${offset.sub(0x10)}", 绝对地址: ${address.sub(0x10)}`);
|
||||
break;
|
||||
case "startDownloadMedia":
|
||||
console.log(`"${name}": "${offset.sub(0x28)}", 绝对地址: ${address.sub(0x28)}`);
|
||||
break;
|
||||
case "downloadVideoAddr":
|
||||
console.log(`"${name}": "${offset.sub(0x2c)}", 绝对地址: ${address.sub(0x2c)}`);
|
||||
break;
|
||||
case "startUploadMedia":
|
||||
console.log(`"${name}": "${offset.sub(0x30)}", 绝对地址: ${address.sub(0x30)}`);
|
||||
break;
|
||||
}
|
||||
},
|
||||
onError: function(reason) {
|
||||
console.error(`[-] 扫描 [${name}] 时出错: ${reason}`);
|
||||
@@ -48,11 +81,11 @@ const myPatterns = [
|
||||
},
|
||||
{
|
||||
name: "uploadImageAddr",
|
||||
pattern: "F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 FD 7B 05 A9 FD 43 01 91 FF 43 0B D1 F3 03 01 AA F4 03 00 AA 68 E1 01 F0 08 71 44 F9 08 01 40 F9 A8 83 1A F8"
|
||||
pattern: "08 01 40 F9 A8 83 1A F8 28 9C 40 B9 1F 0D 00 71",
|
||||
},
|
||||
{
|
||||
name: "sendFuncAddr",
|
||||
pattern: "FF 03 05 D1 FC 6F 11 A9 F4 4F 12 A9 FD 7B 13 A9 FD C3 04 91 F3 03 01 AA F4 03 00 AA A8 EB 01 D0 08 71 44 F9 08 01 40 F9 A8 83 1D F8"
|
||||
pattern: "E0 03 00 91 21 00 80 52 E5 03 03 AA 26 85 80 52 07 00 80 D2"
|
||||
},
|
||||
{
|
||||
name: "buf2RespAddr",
|
||||
@@ -73,4 +106,4 @@ const myPatterns = [
|
||||
];
|
||||
|
||||
// 执行扫描
|
||||
scanPatterns();
|
||||
scanPatterns();
|
||||
|
||||
+9
-9
@@ -78,8 +78,8 @@ function patchString(addr, plainStr) {
|
||||
// -------------------------全局变量分区-------------------------
|
||||
|
||||
// 文本消息全局变量
|
||||
var textCallbackFuncAddr = baseAddr.add(0x2524140);
|
||||
var protobufAddr = textCallbackFuncAddr.add(0x44);
|
||||
var textCallbackFuncAddr = baseAddr.add(0x2527C80);
|
||||
var protobufAddr = textCallbackFuncAddr.add(0x40);
|
||||
var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20);
|
||||
var patchTextProtobufByte
|
||||
var patchTextProtobufDeleteAddr = textCallbackFuncAddr.add(0x5C);
|
||||
@@ -90,15 +90,15 @@ var sendTextMessageAddr = ptr(0);
|
||||
var textMessageAddr = ptr(0);
|
||||
var textProtoX1PayloadAddr = ptr(0);
|
||||
|
||||
var sendMessageCallbackFunc = baseAddr.add(0x8915F28);
|
||||
var sendMessageCallbackFunc = baseAddr.add(0x8919F48);
|
||||
|
||||
|
||||
// 双方公共使用的地址
|
||||
var triggerX1Payload;
|
||||
var triggerX0;
|
||||
var req2bufEnterAddr = baseAddr.add(0x3806b30);
|
||||
var req2bufExitAddr = baseAddr.add(0x3807C44);
|
||||
var sendFuncAddr = baseAddr.add(0x498D2E0);
|
||||
var req2bufEnterAddr = baseAddr.add(0x380b950);
|
||||
var req2bufExitAddr = baseAddr.add(0x380CA64);
|
||||
var sendFuncAddr = baseAddr.add(0x4992040);
|
||||
var insertMsgAddr = ptr(0);
|
||||
var sendMsgType = "";
|
||||
|
||||
@@ -124,6 +124,7 @@ function setupSendTextMessageDynamic() {
|
||||
textCgiAddr = Memory.alloc(128);
|
||||
sendTextMessageAddr = Memory.alloc(256);
|
||||
textMessageAddr = Memory.alloc(256);
|
||||
triggerX1Payload = Memory.alloc(1024)
|
||||
|
||||
// A. 写入字符串内容
|
||||
patchString(textCgiAddr, "/cgi-bin/micromsg-bin/newsendmsg");
|
||||
@@ -305,13 +306,12 @@ function triggerSendTextMessage(taskId, receiver, content, atUser) {
|
||||
function AttachSendTextProto() {
|
||||
Interceptor.attach(sendFuncAddr.add(0x10), {
|
||||
onEnter: function (args) {
|
||||
if (triggerX1Payload) {
|
||||
if (triggerX0) {
|
||||
return
|
||||
}
|
||||
|
||||
triggerX0 = this.context.x0;
|
||||
triggerX1Payload = this.context.x1;
|
||||
console.log(`[+] 捕获到 MMStartTask 调用，X0地址：${triggerX0}, Payload 地址: ${triggerX1Payload}`);
|
||||
console.log(`[+] 捕获到 MMStartTask 调用，X0地址：${triggerX0}`);
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
+1
-1
@@ -59,7 +59,7 @@ func initFlag() {
|
||||
flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效")
|
||||
flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot")
|
||||
flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
|
||||
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_28_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
|
||||
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_29_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
|
||||
flag.StringVar(&config.ConnType, "conn_type", "http", "连接类型: http | websocket")
|
||||
flag.IntVar(&config.SendInterval, "send_interval", 1000, "发送间隔: ms")
|
||||
flag.StringVar(&logLevel, "log_level", "info", "log level")
|
||||
|
||||
@@ -724,7 +724,6 @@ setImmediate(attachReq2buf);
|
||||
|
||||
// 初始化进行内存的分配
|
||||
function setupSendImgMessageDynamic() {
|
||||
console.log("[+] Starting setupSendImgMessageDynamic Dynamic Message Patching...");
|
||||
|
||||
// 1. 动态分配内存块（按需分配大小）
|
||||
// 分配原则：字符串给 64-128 字节，结构体按实际大小分配
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"textCallbackFuncAddr": "0x2527C80",
|
||||
"sendMessageCallbackFunc": "0x8919F48",
|
||||
"sendFuncAddr": "0x4992040",
|
||||
"req2bufEnterAddr": "0x380b950",
|
||||
"req2bufExitAddr": "0x380CA64",
|
||||
"imageCallbackFuncAddr": "0x251E880",
|
||||
"imgMessageCallbackFunc": "0x8919A10",
|
||||
"uploadImageAddr": "0x4ad95c0",
|
||||
"cndOnCompleteAddr": "0x37c8f00",
|
||||
"buf2RespAddr": "0x3830fc8",
|
||||
"uploadGetCallbackWrapperAddr": "0x4aa7084",
|
||||
"uploadGetCallbackWrapperFuncAddr": "0x37C874C",
|
||||
"uploadOnCompleteAddr": "0x4AA7680",
|
||||
"uploadOnCompleteFuncAddr": "0x37C9930",
|
||||
"downloadImagAddr": "0x4bfd350",
|
||||
"startDownloadMedia": "0x4ada234",
|
||||
"downloadFileAddr": "0x4b9c0d8",
|
||||
"downloadVideoAddr": "0x4bbde5c",
|
||||
"videoCallbackFuncAddr": "0x258BB10",
|
||||
"videoMessageCallbackFunc": "0x891C7B0"
|
||||
}
|
||||
Reference in New Issue
Block a user