update frida script

2026-07-15 10:26:52 +08:00 · 2025-11-28 12:49:08 +08:00
parent 196213b302
commit 7a1f9e99a5
16 changed files with 798 additions and 0 deletions
@@ -0,0 +1,103 @@
+// ====== 配置：你想 Hook 的 WeChat 函数偏移 ======
+const WECHAT_OFFSETS = [
+    0x4565b2c,
+    0x4566f1c,
+    0x4564860,
+    0x4591ff8,
+    0x45d09cc,
+    0x45cebbc,
+    0x4591fa0,
+    0x4581834,
+    0x4581760,
+    0x4387d08,
+    0x4334e88,
+    0x4328ebc,
+    0x4384764,
+    0x43811e8
+];
+
+// ====== 统一安全打印函数 ======
+function safePrintRegister(args) {
+    for (let i = 0; i < 8; i++) {
+        try {
+            console.log(`x${i}: ${args[i]}`);
+        } catch (e) {
+            console.log(`x${i}: <无法读取> (${e})`);
+        }
+    }
+}
+
+function safePrintBacktrace(context) {
+    try {
+        let bt = Thread.backtrace(
+            context,
+            Backtracer.FUZZY       // 更稳定，遇到系统函数更不容易崩
+        ).map(DebugSymbol.fromAddress)
+            .join("\n");
+
+        console.log("\n--- 调用堆栈 ---");
+        console.log(bt);
+        console.log("-----------------\n");
+
+    } catch (e) {
+        console.log("无法获取堆栈：" + e);
+    }
+}
+
+// ====== 主逻辑：Hook 偏移量函数 ======
+function hook_wechat_internal_functions() {
+    const wechatModule = Process.findModuleByName("WeChat");
+    if (!wechatModule) {
+        console.error("❌ 找不到 WeChat 模块");
+        return;
+    }
+
+    const base = wechatModule.base;
+    console.log("📌 WeChat Base:", base);
+
+    WECHAT_OFFSETS.forEach(offset => {
+        const target = base.add(offset);
+
+        // 尝试符号化
+        let funcName = `WeChat!0x${offset.toString(16)}`;
+        try {
+            const sym = DebugSymbol.fromAddress(target);
+            if (sym && sym.name) funcName = sym.name;
+        } catch (_) {}
+
+        console.log(`\n🔧 准备 Hook: ${funcName} @ 0x${target}`);
+
+        try {
+            Interceptor.attach(target, {
+                onEnter(args) {
+                    console.log("\n==============================================");
+                    console.log(`🚀 进入函数: ${funcName}`);
+                    console.log(`📍 地址: 0x${target}`);
+
+                    console.log("\n--- 🧩 寄存器参数 x0-x7 ---");
+                    safePrintRegister(args);
+
+                    console.log("\n--- 🧵 调用堆栈 ---");
+                    safePrintBacktrace(this.context);
+
+                    console.log("==============================================\n");
+                },
+
+                onLeave(retval) {
+                    // 如果需要打印返回值，可打开：
+                    // console.log("返回值:", retval);
+                }
+            });
+
+            console.log(`✅ 已 Hook: ${funcName}`);
+
+        } catch (e) {
+            console.error(`❌ Hook 失败 @ 0x${target} ：${e}`);
+        }
+    });
+}
+
+// ====== 入口 ======
+setImmediate(() => {
+    hook_wechat_internal_functions();
+});