From 77d1d34e5bf89c036c42928e03443224381b8693 Mon Sep 17 00:00:00 2001 From: yincong Date: Sat, 21 Mar 2026 17:34:56 +0800 Subject: [PATCH] add 8.29 --- frida/auto.js | 43 ++++++++++++++++++++++++++++---- frida/text.js | 18 ++++++------- onebot/main.go | 2 +- onebot/script.js | 1 - wechat_version/4_1_8_29_mac.json | 22 ++++++++++++++++ 5 files changed, 70 insertions(+), 16 deletions(-) create mode 100644 wechat_version/4_1_8_29_mac.json diff --git a/frida/auto.js b/frida/auto.js index 5c6734f..f56da89 100644 --- a/frida/auto.js +++ b/frida/auto.js @@ -12,9 +12,42 @@ function scanPatterns() { Memory.scan(baseAddr, module.size, pattern, { onMatch: function(address, size) { - // 计算相对偏移 (RVA) const offset = address.sub(baseAddr); - console.log(`"${name}": "${offset}", 绝对地址: ${address}`); + switch (name) { + case "cndOnCompleteAddr": + console.log(`"${name}": "${offset.sub(0xCC)}", 绝对地址: ${address.sub(0xCC)}`); + break; + case "uploadGetCallbackWrapperAddr": + console.log(`"${name}": "${offset}", 绝对地址: ${address}`); + break; + case "req2bufEnterAddr": + console.log(`"${name}": "${offset}", 绝对地址: ${address}`); + break; + case "downloadFileAddr": + console.log(`"${name}": "${offset.sub(0x3c)}", 绝对地址: ${address.sub(0x3c)}`); + break; + case "downloadImageAddr": + console.log(`"${name}": "${offset.sub(0x18)}", 绝对地址: ${address.sub(0x18)}`); + break; + case "uploadImageAddr": + console.log(`"${name}": "${offset.sub(0x30)}", 绝对地址: ${address.sub(0x30)}`); + break; + case "sendFuncAddr": + console.log(`"${name}": "${offset.sub(0x44)}", 绝对地址: ${address.sub(0x44)}`); + break; + case "buf2RespAddr": + console.log(`"${name}": "${offset.sub(0x10)}", 绝对地址: ${address.sub(0x10)}`); + break; + case "startDownloadMedia": + console.log(`"${name}": "${offset.sub(0x28)}", 绝对地址: ${address.sub(0x28)}`); + break; + case "downloadVideoAddr": + console.log(`"${name}": "${offset.sub(0x2c)}", 绝对地址: ${address.sub(0x2c)}`); + break; + case "startUploadMedia": + console.log(`"${name}": "${offset.sub(0x30)}", 绝对地址: ${address.sub(0x30)}`); + break; + } }, onError: function(reason) { console.error(`[-] 扫描 [${name}] 时出错: ${reason}`); @@ -48,11 +81,11 @@ const myPatterns = [ }, { name: "uploadImageAddr", - pattern: "F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 FD 7B 05 A9 FD 43 01 91 FF 43 0B D1 F3 03 01 AA F4 03 00 AA 68 E1 01 F0 08 71 44 F9 08 01 40 F9 A8 83 1A F8" + pattern: "08 01 40 F9 A8 83 1A F8 28 9C 40 B9 1F 0D 00 71", }, { name: "sendFuncAddr", - pattern: "FF 03 05 D1 FC 6F 11 A9 F4 4F 12 A9 FD 7B 13 A9 FD C3 04 91 F3 03 01 AA F4 03 00 AA A8 EB 01 D0 08 71 44 F9 08 01 40 F9 A8 83 1D F8" + pattern: "E0 03 00 91 21 00 80 52 E5 03 03 AA 26 85 80 52 07 00 80 D2" }, { name: "buf2RespAddr", @@ -73,4 +106,4 @@ const myPatterns = [ ]; // 执行扫描 -scanPatterns(); \ No newline at end of file +scanPatterns(); diff --git a/frida/text.js b/frida/text.js index 498a5d8..a6dc2c1 100644 --- a/frida/text.js +++ b/frida/text.js @@ -78,8 +78,8 @@ function patchString(addr, plainStr) { // -------------------------全局变量分区------------------------- // 文本消息全局变量 -var textCallbackFuncAddr = baseAddr.add(0x2524140); -var protobufAddr = textCallbackFuncAddr.add(0x44); +var textCallbackFuncAddr = baseAddr.add(0x2527C80); +var protobufAddr = textCallbackFuncAddr.add(0x40); var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20); var patchTextProtobufByte var patchTextProtobufDeleteAddr = textCallbackFuncAddr.add(0x5C); @@ -90,15 +90,15 @@ var sendTextMessageAddr = ptr(0); var textMessageAddr = ptr(0); var textProtoX1PayloadAddr = ptr(0); -var sendMessageCallbackFunc = baseAddr.add(0x8915F28); +var sendMessageCallbackFunc = baseAddr.add(0x8919F48); // 双方公共使用的地址 var triggerX1Payload; var triggerX0; -var req2bufEnterAddr = baseAddr.add(0x3806b30); -var req2bufExitAddr = baseAddr.add(0x3807C44); -var sendFuncAddr = baseAddr.add(0x498D2E0); +var req2bufEnterAddr = baseAddr.add(0x380b950); +var req2bufExitAddr = baseAddr.add(0x380CA64); +var sendFuncAddr = baseAddr.add(0x4992040); var insertMsgAddr = ptr(0); var sendMsgType = ""; @@ -124,6 +124,7 @@ function setupSendTextMessageDynamic() { textCgiAddr = Memory.alloc(128); sendTextMessageAddr = Memory.alloc(256); textMessageAddr = Memory.alloc(256); + triggerX1Payload = Memory.alloc(1024) // A. 写入字符串内容 patchString(textCgiAddr, "/cgi-bin/micromsg-bin/newsendmsg"); @@ -305,13 +306,12 @@ function triggerSendTextMessage(taskId, receiver, content, atUser) { function AttachSendTextProto() { Interceptor.attach(sendFuncAddr.add(0x10), { onEnter: function (args) { - if (triggerX1Payload) { + if (triggerX0) { return } triggerX0 = this.context.x0; - triggerX1Payload = this.context.x1; - console.log(`[+] 捕获到 MMStartTask 调用，X0地址：${triggerX0}, Payload 地址: ${triggerX1Payload}`); + console.log(`[+] 捕获到 MMStartTask 调用，X0地址：${triggerX0}`); } }) } diff --git a/onebot/main.go b/onebot/main.go index 7c0a73b..cfd3e38 100644 --- a/onebot/main.go +++ b/onebot/main.go @@ -59,7 +59,7 @@ func initFlag() { flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效") flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot") flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/") - flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_28_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") + flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_8_29_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") flag.StringVar(&config.ConnType, "conn_type", "http", "连接类型: http | websocket") flag.IntVar(&config.SendInterval, "send_interval", 1000, "发送间隔: ms") flag.StringVar(&logLevel, "log_level", "info", "log level") diff --git a/onebot/script.js b/onebot/script.js index c0f8a35..add4388 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -724,7 +724,6 @@ setImmediate(attachReq2buf); // 初始化进行内存的分配 function setupSendImgMessageDynamic() { - console.log("[+] Starting setupSendImgMessageDynamic Dynamic Message Patching..."); // 1. 动态分配内存块（按需分配大小） // 分配原则：字符串给 64-128 字节，结构体按实际大小分配 diff --git a/wechat_version/4_1_8_29_mac.json b/wechat_version/4_1_8_29_mac.json new file mode 100644 index 0000000..c17e5f1 --- /dev/null +++ b/wechat_version/4_1_8_29_mac.json @@ -0,0 +1,22 @@ +{ + "textCallbackFuncAddr": "0x2527C80", + "sendMessageCallbackFunc": "0x8919F48", + "sendFuncAddr": "0x4992040", + "req2bufEnterAddr": "0x380b950", + "req2bufExitAddr": "0x380CA64", + "imageCallbackFuncAddr": "0x251E880", + "imgMessageCallbackFunc": "0x8919A10", + "uploadImageAddr": "0x4ad95c0", + "cndOnCompleteAddr": "0x37c8f00", + "buf2RespAddr": "0x3830fc8", + "uploadGetCallbackWrapperAddr": "0x4aa7084", + "uploadGetCallbackWrapperFuncAddr": "0x37C874C", + "uploadOnCompleteAddr": "0x4AA7680", + "uploadOnCompleteFuncAddr": "0x37C9930", + "downloadImagAddr": "0x4bfd350", + "startDownloadMedia": "0x4ada234", + "downloadFileAddr": "0x4b9c0d8", + "downloadVideoAddr": "0x4bbde5c", + "videoCallbackFuncAddr": "0x258BB10", + "videoMessageCallbackFunc": "0x891C7B0" +}