From 999c89f785e19f145edd337da5984e601134ca8d Mon Sep 17 00:00:00 2001 From: yincong Date: Wed, 31 Dec 2025 14:05:21 +0800 Subject: [PATCH] final --- frida/succ.js | 31 +++++++++++++++++++++++++------ onebot/main.go | 17 +++++++++-------- onebot/script.js | 31 +++++++++++++++++++++++++------ 3 files changed, 59 insertions(+), 20 deletions(-) diff --git a/frida/succ.js b/frida/succ.js index 9e66534..b33448d 100644 --- a/frida/succ.js +++ b/frida/succ.js @@ -300,12 +300,19 @@ function attachReq2buf() { if (typeof sendMessageAddr !== 'undefined') { insertMsgAddr.writePointer(sendMessageAddr); console.log("[+] 成功! Req2Buf 已将 X24+0x60 指向新地址: " + sendMessageAddr + - "[+] Req2Buf 写入后内存预览: " + insertMsgAddr, hexdump(insertMsgAddr, { + "[+] Req2Buf 写入后内存预览: " + insertMsgAddr); + console.log(hexdump(insertMsgAddr, { offset: 0, length: 16, header: true, ansi: true - })); + })) + console.log(hexdump(sendMessageAddr, { + offset: 0, + length: 48, + header: true, + ansi: true + })) } else { console.error("[!] 错误: 变量 sendMessageAddr 未定义，请确保已运行分配逻辑。"); } @@ -382,10 +389,22 @@ function attachProto() { Interceptor.attach(protobufAddr, { onEnter: function (args) { - if (lastSendTime === 0) { - console.error("[+] 首次发送时间未记录，跳过注入"); + console.log("[+] Protobuf 拦截命中"); + + var sp = this.context.sp; + console.log("[+] Protobuf 拦截命中，SP: " + sp, hexdump(sp, { + offset: 0, + length: 16, + header: true, + ansi: true + })); + + var firstValue = sp.readU32(); + if (firstValue !== taskIdGlobal) { + console.log("[+] Protobuf 拦截未命中，跳过..."); return; } + console.log("[+] 正在注入 Protobuf Payload..."); const type = [0x08, 0x01, 0x12] const receiverHeader = [0x0A, 0x15, 0x0A, 0x13]; @@ -415,7 +434,7 @@ function attachProto() { const finalPayload = type.concat(valueLen).concat(receiverHeader).concat(receiverProto).concat(contentHeader). concat(contentProto).concat(tsHeader).concat(tsBytes).concat(msgIdHeader).concat(msgId).concat(suffix); - + console.log("[+] Payload 准备写入"); protoX1PayloadAddr.writeByteArray(finalPayload); console.log("[+] Payload 已写入，长度: " + finalPayload.length); @@ -445,7 +464,7 @@ function toVarint(n) { setImmediate(attachProto); function setReceiver() { - console.log("[+] WeChat Base: " + baseAddr + "[+] Attaching to: " + receiveAddr); + console.log("[+] setReceiver WeChat Base: " + baseAddr + "[+] Attaching to: " + receiveAddr); // 3. 开始拦截 Interceptor.attach(receiveAddr, { diff --git a/onebot/main.go b/onebot/main.go index 16b4480..c872196 100644 --- a/onebot/main.go +++ b/onebot/main.go @@ -72,7 +72,7 @@ func initFrida() { } fmt.Println("正在尝试 Attach 到微信...") - session, err = device.Attach(51873, nil) + session, err = device.Attach(47516, nil) if err != nil { log.Fatalf("Attach 失败 (请检查 SIP 状态或权限): %v", err) } @@ -97,7 +97,7 @@ func loadJs() { switch msgType { case "send": - SendHttpReq(msg) + go SendHttpReq(msg) case "log": // 这里处理 console.log fmt.Printf("[JS日志] %s\n", msg["payload"]) @@ -167,12 +167,6 @@ func main() { go func() { <-stop fmt.Println("\n正在释放 Frida 资源并退出...") - if fridaScript != nil { - fridaScript.Unload() // 卸载脚本 - } - if session != nil { - session.Detach() // 断开连接 - } os.Exit(0) // 强制结束进程 }() @@ -186,6 +180,13 @@ func main() { } func SendHttpReq(msg map[string]interface{}) { + defer func() { + if r := recover(); r != nil { + fmt.Printf("panic: %v\n", r) + } + }() + + time.Sleep(1 * time.Second) // 这里处理你的 X1 数据 jsonData, err := json.Marshal(msg["payload"]) if err != nil { diff --git a/onebot/script.js b/onebot/script.js index da6ebf5..dc07fe2 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -300,12 +300,19 @@ function attachReq2buf() { if (typeof sendMessageAddr !== 'undefined') { insertMsgAddr.writePointer(sendMessageAddr); console.log("[+] 成功! Req2Buf 已将 X24+0x60 指向新地址: " + sendMessageAddr + - "[+] Req2Buf 写入后内存预览: " + insertMsgAddr, hexdump(insertMsgAddr, { + "[+] Req2Buf 写入后内存预览: " + insertMsgAddr); + console.log(hexdump(insertMsgAddr, { offset: 0, length: 16, header: true, ansi: true - })); + })) + console.log(hexdump(sendMessageAddr, { + offset: 0, + length: 48, + header: true, + ansi: true + })) } else { console.error("[!] 错误: 变量 sendMessageAddr 未定义，请确保已运行分配逻辑。"); } @@ -382,10 +389,22 @@ function attachProto() { Interceptor.attach(protobufAddr, { onEnter: function (args) { - if (lastSendTime === 0) { - console.error("[+] 首次发送时间未记录，跳过注入"); + console.log("[+] Protobuf 拦截命中"); + + var sp = this.context.sp; + console.log("[+] Protobuf 拦截命中，SP: " + sp, hexdump(sp, { + offset: 0, + length: 16, + header: true, + ansi: true + })); + + var firstValue = sp.readU32(); + if (firstValue !== taskIdGlobal) { + console.log("[+] Protobuf 拦截未命中，跳过..."); return; } + console.log("[+] 正在注入 Protobuf Payload..."); const type = [0x08, 0x01, 0x12] const receiverHeader = [0x0A, 0x15, 0x0A, 0x13]; @@ -415,7 +434,7 @@ function attachProto() { const finalPayload = type.concat(valueLen).concat(receiverHeader).concat(receiverProto).concat(contentHeader). concat(contentProto).concat(tsHeader).concat(tsBytes).concat(msgIdHeader).concat(msgId).concat(suffix); - + console.log("[+] Payload 准备写入"); protoX1PayloadAddr.writeByteArray(finalPayload); console.log("[+] Payload 已写入，长度: " + finalPayload.length); @@ -445,7 +464,7 @@ function toVarint(n) { setImmediate(attachProto); function setReceiver() { - console.log("[+] WeChat Base: " + baseAddr + "[+] Attaching to: " + receiveAddr); + console.log("[+] setReceiver WeChat Base: " + baseAddr + "[+] Attaching to: " + receiveAddr); // 3. 开始拦截 Interceptor.attach(receiveAddr, {