From 9ca8af76d6226c52f76b5041a43685a003c81b2d Mon Sep 17 00:00:00 2001
From: jackyin <648588267@qq.com>
Date: Thu, 20 Nov 2025 20:14:46 +0800
Subject: [PATCH] Update README.md

---
 README.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 5ca213c..687ee8e 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,9 @@
 frida -f /Applications/WeChat.app/Contents/MacOS/WeChat -l script.js        
 
 ### 报错：Failed to attach: unable to access process with pid 43649 from the current user account
+重启进入recovery模式，然后关闭安全模式    
 
-
+frida-trace -p 进程号 -i "*Message*" --decorate 比较好用    
+frida-trace -p 17894 -i "*Message*" -i "*Send*" -x '*objc_msgSend_noarg*' -x '*objc_msgSend_debug*' -x '*objc_msgSend*' -x "*_HIDisableSuddenTerminationForSendEvent*" -x "*_HIEnableSuddenTerminationForSendEvent*" -x "*SendEventToEventTarget*" -x "*s10RTCUtility10XPCMessageV4dictAA16RTCXPCDictionaryVvg*" -x "*MTLMessageContextEnd*" -x "*ictAA16RTCXPCDictionaryVvg*" -x "*_MTLMessageContextBegin_*" -x "*CFMachMessageCheckForAndDestroyUnsentMessag*" -x "*SLEventCopyAuthenticationMessage*" -x "*SendTextInputEvent_WithCompletionHandler*"  --decorate    
+会有一个http页面，进去之后，会有一些微信的代码，这些代码中能分析出微信是怎么发送消息的