tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix text crash and auto find pid

Browse Source
This commit is contained in:
yincong
2026-03-09 10:35:52 +08:00
parent 0ccde39dc2
commit a304c7e92a
7 changed files with 92 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frida/auto.js
+5 -1
View File
@@ -38,7 +38,7 @@ const myPatterns = [
},
{
name: "downloadImagAddr",
pattern: "FF 07 00 B9 68 52 41 F9 15 89 41 F9 E0 03 14 AA"
pattern: "68 52 41 F9 19 8D 41 F9 1A 00 14 8B 5F 03 19 EB"
},
{
name: "uploadImageAddr",
@@ -52,6 +52,10 @@ const myPatterns = [
name: "buf2RespAddr",
pattern: "3C 00 80 52 E0 C3 00 91"
},
{
name: "hdPicDownloadAddr",
pattern: "E0 63 00 91 41 00 80 52 25 5C 80 52 06 00 80 52"
}
];
// 执行扫描
frida/text.js
+25 -24
View File
@@ -161,7 +161,6 @@ function setupSendTextMessageDynamic() {
console.log("[+] Dynamic Memory Setup Complete. - Message Object: " + textMessageAddr);
patchTextProtobufByte = patchTextProtobufAddr.readByteArray(4);
patchTextProtobufDeleteByte = patchTextProtobufDeleteAddr.readByteArray(4);
}
@@ -173,29 +172,33 @@ function patchTextProtoBuf() {
Interceptor.attach(textCallbackFuncAddr, {
onEnter: function (args) {
var firstValue = this.context.sp.readU32();
console.log("firstValue: " + firstValue + "taskIdGlobal:" + taskIdGlobal);
if (firstValue === taskIdGlobal) {
Memory.patchCode(patchTextProtobufAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr});
cw.putNop();
cw.flush();
});
Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr});
cw.putNop();
cw.flush();
});
if (patchTextProtobufAddr.readU32() !== 3573751839) {
Memory.patchCode(patchTextProtobufAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr});
cw.putNop();
cw.flush();
});
Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr});
cw.putNop();
cw.flush();
});
}
} else {
Memory.patchCode(patchTextProtobufAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr});
cw.putBytes(new Uint8Array(patchTextProtobufByte));
cw.flush();
});
Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr});
cw.putBytes(new Uint8Array(patchTextProtobufDeleteByte));
cw.flush();
});
if (patchTextProtobufAddr.readU32() === 3573751839) {
Memory.patchCode(patchTextProtobufAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr});
cw.putBytes(new Uint8Array(patchTextProtobufByte));
cw.flush();
});
Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr});
cw.putBytes(new Uint8Array(patchTextProtobufDeleteByte));
cw.flush();
});
}
}
}
})
@@ -323,8 +326,6 @@ function attachSendTextProto() {
Interceptor.attach(protobufAddr, {
onEnter: function (args) {
console.log("[+] Protobuf 拦截命中");
var sp = this.context.sp;
var firstValue = sp.readU32();
if (firstValue !== taskIdGlobal) {
onebot/main.go
+8 -4
View File
@@ -53,7 +53,6 @@ func initFlag() {
flag.StringVar(&config.SendURL, "send_url", "http://127.0.0.1:36060/onebot", "发送消息的 URL: http://127.0.0.1:36060/onebot")
flag.StringVar(&config.ReceiveHost, "receive_host", "127.0.0.1:58080", "接收消息的地址: 127.0.0.1:58080")
flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效")
flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效")
flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot")
flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_57_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
@@ -67,13 +66,12 @@ func initFlag() {
fmt.Println("SendURL", config.SendURL)
fmt.Println("ReceiveHost", config.ReceiveHost)
fmt.Println("FridaGadgetAddr", config.FridaGadgetAddr)
fmt.Println("WechatPid", config.WechatPid)
fmt.Println("OnebotToken", config.OnebotToken)
fmt.Println("ImagePath", config.ImagePath)
fmt.Println("WechatConf", config.WechatConf)
fmt.Println("ConnType", config.ConnType)
fmt.Println("SendInterval", config.SendInterval)
fmt.Println("logLevel", logLevel)
fmt.Println("LogLevel", logLevel)
err := EnsureDir("./audio")
if err != nil {
@@ -112,7 +110,13 @@ func initFrida() {
Fatal("无法获取本地设备", "err", err)
}
session, err = device.Attach(config.WechatPid, nil)
pid, err := GetWeChatPID()
if err != nil {
Fatal("未发现正在运行的微信进程")
}
Info("微信进程 PID", "PID", pid)
session, err = device.Attach(pid, nil)
if err != nil {
Fatal("Attach 失败 (请检查 SIP 状态或权限)", "err", err)
}
onebot/param.go
-1
View File
@@ -77,7 +77,6 @@ type Config struct {
SendURL string `json:"send_url"`
ReceiveHost string `json:"receive_host"`
FridaGadgetAddr string `json:"frida_gadget_addr"`
WechatPid int `json:"wechat_pid"`
OnebotToken string `json:"onebot_token"`
ImagePath string `json:"image_path"`
ConnType string `json:"conn_type"`
onebot/script.js
+42 -19
View File
@@ -252,9 +252,12 @@ function generateBytes(n) {
// -------------------------全局变量分区-------------------------
// 文本消息全局变量
var protobufAddr = baseAddr.add({{.protobufAddr}});
var patchTextProtobufAddr = baseAddr.add({{.patchTextProtobufAddr}});
var PatchTextProtobufDeleteAddr = baseAddr.add({{.PatchTextProtobufDeleteAddr}});
var textCallbackFuncAddr = baseAddr.add({{.textCallbackFuncAddr}});
var protobufAddr = textCallbackFuncAddr.add(0x44);
var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20);
var patchTextProtobufByte
var patchTextProtobufDeleteAddr = textCallbackFuncAddr.add(0x5C);
var patchTextProtobufDeleteByte
var textCgiAddr = ptr(0);
var sendTextMessageAddr = ptr(0);
var textMessageAddr = ptr(0);
@@ -363,32 +366,52 @@ function setupSendTextMessageDynamic() {
// }));
console.log("[+] Dynamic Memory Setup Complete. - Message Object: " + textMessageAddr);
patchTextProtobufByte = patchTextProtobufAddr.readByteArray(4);
patchTextProtobufDeleteByte = patchTextProtobufDeleteAddr.readByteArray(4);
}
setImmediate(setupSendTextMessageDynamic);
function patchTextProtoBuf() {
Memory.patchCode(patchTextProtobufAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr});
cw.putNop();
cw.flush();
});
Memory.patchCode(PatchTextProtobufDeleteAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: PatchTextProtobufDeleteAddr});
cw.putNop();
cw.flush();
});
Interceptor.attach(textCallbackFuncAddr, {
onEnter: function (args) {
var firstValue = this.context.sp.readU32();
if (firstValue === taskIdGlobal) {
if (patchTextProtobufAddr.readU32() !== 3573751839) {
Memory.patchCode(patchTextProtobufAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr});
cw.putNop();
cw.flush();
});
Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr});
cw.putNop();
cw.flush();
});
}
} else {
if (patchTextProtobufAddr.readU32() === 3573751839) {
Memory.patchCode(patchTextProtobufAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr});
cw.putBytes(new Uint8Array(patchTextProtobufByte));
cw.flush();
});
Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr});
cw.putBytes(new Uint8Array(patchTextProtobufDeleteByte));
cw.flush();
});
}
}
}
})
console.log("[+] Patching PatchTextProtobufDeleteAddr " + PatchTextProtobufDeleteAddr + " 成功." +
" Patching patchTextProtobufAddr " + patchTextProtobufAddr + " 成功.");
}
setTimeout(function () {
console.log("[+] 3秒等待结束，准备执行 Patch...");
patchTextProtoBuf();
}, 3000);
setImmediate(patchTextProtoBuf);
function triggerSendTextMessage(taskId, receiver, content, atUser) {
console.log("[+] Manual Trigger Started...");
onebot/utils.go
+11
View File
@@ -14,6 +14,7 @@ import (
"os"
"os/exec"
"path/filepath"
"strconv"
"strings"
"time"
@@ -251,3 +252,13 @@ func SaveImageToFile(ext string, data []byte) (string, error) {
return targetPath, nil
}
func GetWeChatPID() (int, error) {
cmd := exec.Command("pgrep", "-x", "WeChat")
output, err := cmd.Output()
if err != nil {
return 0, fmt.Errorf("未发现正在运行的微信进程")
}
return strconv.Atoi(strings.TrimSpace(string(output)))
}
wechat_version/4_1_7_57_mac.json
+1 -3
View File
@@ -1,7 +1,5 @@
{
"protobufAddr": "0x24665A0",
"patchTextProtobufAddr": "0x246657C",
"PatchTextProtobufDeleteAddr": "0x24665B8",
"textCallbackFuncAddr": "0x246655C",
"sendMessageCallbackFunc": "0x8791310",
"sendFuncAddr": "0x47FE448",
"req2bufEnterAddr": "0x36FC204",