From a304c7e92aae886ae453961b7b4d09195bbb11aa Mon Sep 17 00:00:00 2001 From: yincong Date: Mon, 9 Mar 2026 10:35:52 +0800 Subject: [PATCH] fix text crash and auto find pid --- frida/auto.js | 6 +++- frida/text.js | 49 ++++++++++++------------- onebot/main.go | 12 ++++--- onebot/param.go | 1 - onebot/script.js | 61 ++++++++++++++++++++++---------- onebot/utils.go | 11 ++++++ wechat_version/4_1_7_57_mac.json | 4 +-- 7 files changed, 92 insertions(+), 52 deletions(-) diff --git a/frida/auto.js b/frida/auto.js index 8742730..c5007e5 100644 --- a/frida/auto.js +++ b/frida/auto.js @@ -38,7 +38,7 @@ const myPatterns = [ }, { name: "downloadImagAddr", - pattern: "FF 07 00 B9 68 52 41 F9 15 89 41 F9 E0 03 14 AA" + pattern: "68 52 41 F9 19 8D 41 F9 1A 00 14 8B 5F 03 19 EB" }, { name: "uploadImageAddr", @@ -52,6 +52,10 @@ const myPatterns = [ name: "buf2RespAddr", pattern: "3C 00 80 52 E0 C3 00 91" }, + { + name: "hdPicDownloadAddr", + pattern: "E0 63 00 91 41 00 80 52 25 5C 80 52 06 00 80 52" + } ]; // 执行扫描 diff --git a/frida/text.js b/frida/text.js index d7095af..e5ddc03 100644 --- a/frida/text.js +++ b/frida/text.js @@ -161,7 +161,6 @@ function setupSendTextMessageDynamic() { console.log("[+] Dynamic Memory Setup Complete. - Message Object: " + textMessageAddr); patchTextProtobufByte = patchTextProtobufAddr.readByteArray(4); - patchTextProtobufDeleteByte = patchTextProtobufDeleteAddr.readByteArray(4); } @@ -173,29 +172,33 @@ function patchTextProtoBuf() { Interceptor.attach(textCallbackFuncAddr, { onEnter: function (args) { var firstValue = this.context.sp.readU32(); - console.log("firstValue: " + firstValue + "taskIdGlobal:" + taskIdGlobal); if (firstValue === taskIdGlobal) { - Memory.patchCode(patchTextProtobufAddr, 4, code => { - const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr}); - cw.putNop(); - cw.flush(); - }); - Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => { - const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr}); - cw.putNop(); - cw.flush(); - }); + if (patchTextProtobufAddr.readU32() !== 3573751839) { + Memory.patchCode(patchTextProtobufAddr, 4, code => { + const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr}); + cw.putNop(); + cw.flush(); + }); + Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => { + const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr}); + cw.putNop(); + cw.flush(); + }); + } } else { - Memory.patchCode(patchTextProtobufAddr, 4, code => { - const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr}); - cw.putBytes(new Uint8Array(patchTextProtobufByte)); - cw.flush(); - }); - Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => { - const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr}); - cw.putBytes(new Uint8Array(patchTextProtobufDeleteByte)); - cw.flush(); - }); + if (patchTextProtobufAddr.readU32() === 3573751839) { + Memory.patchCode(patchTextProtobufAddr, 4, code => { + const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr}); + cw.putBytes(new Uint8Array(patchTextProtobufByte)); + cw.flush(); + }); + Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => { + const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr}); + cw.putBytes(new Uint8Array(patchTextProtobufDeleteByte)); + cw.flush(); + }); + } + } } }) @@ -323,8 +326,6 @@ function attachSendTextProto() { Interceptor.attach(protobufAddr, { onEnter: function (args) { - console.log("[+] Protobuf 拦截命中"); - var sp = this.context.sp; var firstValue = sp.readU32(); if (firstValue !== taskIdGlobal) { diff --git a/onebot/main.go b/onebot/main.go index fab95b2..db1b966 100644 --- a/onebot/main.go +++ b/onebot/main.go @@ -53,7 +53,6 @@ func initFlag() { flag.StringVar(&config.SendURL, "send_url", "http://127.0.0.1:36060/onebot", "发送消息的 URL: http://127.0.0.1:36060/onebot") flag.StringVar(&config.ReceiveHost, "receive_host", "127.0.0.1:58080", "接收消息的地址: 127.0.0.1:58080") flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效") - flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效") flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot") flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/") flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_57_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") @@ -67,13 +66,12 @@ func initFlag() { fmt.Println("SendURL", config.SendURL) fmt.Println("ReceiveHost", config.ReceiveHost) fmt.Println("FridaGadgetAddr", config.FridaGadgetAddr) - fmt.Println("WechatPid", config.WechatPid) fmt.Println("OnebotToken", config.OnebotToken) fmt.Println("ImagePath", config.ImagePath) fmt.Println("WechatConf", config.WechatConf) fmt.Println("ConnType", config.ConnType) fmt.Println("SendInterval", config.SendInterval) - fmt.Println("logLevel", logLevel) + fmt.Println("LogLevel", logLevel) err := EnsureDir("./audio") if err != nil { @@ -112,7 +110,13 @@ func initFrida() { Fatal("无法获取本地设备", "err", err) } - session, err = device.Attach(config.WechatPid, nil) + pid, err := GetWeChatPID() + if err != nil { + Fatal("未发现正在运行的微信进程") + } + Info("微信进程 PID", "PID", pid) + + session, err = device.Attach(pid, nil) if err != nil { Fatal("Attach 失败 (请检查 SIP 状态或权限)", "err", err) } diff --git a/onebot/param.go b/onebot/param.go index e313c6b..7d336ca 100644 --- a/onebot/param.go +++ b/onebot/param.go @@ -77,7 +77,6 @@ type Config struct { SendURL string `json:"send_url"` ReceiveHost string `json:"receive_host"` FridaGadgetAddr string `json:"frida_gadget_addr"` - WechatPid int `json:"wechat_pid"` OnebotToken string `json:"onebot_token"` ImagePath string `json:"image_path"` ConnType string `json:"conn_type"` diff --git a/onebot/script.js b/onebot/script.js index e5b5420..42682cf 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -252,9 +252,12 @@ function generateBytes(n) { // -------------------------全局变量分区------------------------- // 文本消息全局变量 -var protobufAddr = baseAddr.add({{.protobufAddr}}); -var patchTextProtobufAddr = baseAddr.add({{.patchTextProtobufAddr}}); -var PatchTextProtobufDeleteAddr = baseAddr.add({{.PatchTextProtobufDeleteAddr}}); +var textCallbackFuncAddr = baseAddr.add({{.textCallbackFuncAddr}}); +var protobufAddr = textCallbackFuncAddr.add(0x44); +var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20); +var patchTextProtobufByte +var patchTextProtobufDeleteAddr = textCallbackFuncAddr.add(0x5C); +var patchTextProtobufDeleteByte var textCgiAddr = ptr(0); var sendTextMessageAddr = ptr(0); var textMessageAddr = ptr(0); @@ -363,32 +366,52 @@ function setupSendTextMessageDynamic() { // })); console.log("[+] Dynamic Memory Setup Complete. - Message Object: " + textMessageAddr); + patchTextProtobufByte = patchTextProtobufAddr.readByteArray(4); + patchTextProtobufDeleteByte = patchTextProtobufDeleteAddr.readByteArray(4); } setImmediate(setupSendTextMessageDynamic); function patchTextProtoBuf() { - Memory.patchCode(patchTextProtobufAddr, 4, code => { - const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr}); - cw.putNop(); - cw.flush(); - }); - Memory.patchCode(PatchTextProtobufDeleteAddr, 4, code => { - const cw = new Arm64Writer(code, {pc: PatchTextProtobufDeleteAddr}); - cw.putNop(); - cw.flush(); - }); + Interceptor.attach(textCallbackFuncAddr, { + onEnter: function (args) { + var firstValue = this.context.sp.readU32(); + if (firstValue === taskIdGlobal) { + if (patchTextProtobufAddr.readU32() !== 3573751839) { + Memory.patchCode(patchTextProtobufAddr, 4, code => { + const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr}); + cw.putNop(); + cw.flush(); + }); + Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => { + const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr}); + cw.putNop(); + cw.flush(); + }); + } + } else { + if (patchTextProtobufAddr.readU32() === 3573751839) { + Memory.patchCode(patchTextProtobufAddr, 4, code => { + const cw = new Arm64Writer(code, {pc: patchTextProtobufAddr}); + cw.putBytes(new Uint8Array(patchTextProtobufByte)); + cw.flush(); + }); + Memory.patchCode(patchTextProtobufDeleteAddr, 4, code => { + const cw = new Arm64Writer(code, {pc: patchTextProtobufDeleteAddr}); + cw.putBytes(new Uint8Array(patchTextProtobufDeleteByte)); + cw.flush(); + }); + } + + } + } + }) - console.log("[+] Patching PatchTextProtobufDeleteAddr " + PatchTextProtobufDeleteAddr + " 成功." + - " Patching patchTextProtobufAddr " + patchTextProtobufAddr + " 成功."); } -setTimeout(function () { - console.log("[+] 3秒等待结束，准备执行 Patch..."); - patchTextProtoBuf(); -}, 3000); +setImmediate(patchTextProtoBuf); function triggerSendTextMessage(taskId, receiver, content, atUser) { console.log("[+] Manual Trigger Started..."); diff --git a/onebot/utils.go b/onebot/utils.go index 224099a..f33383f 100644 --- a/onebot/utils.go +++ b/onebot/utils.go @@ -14,6 +14,7 @@ import ( "os" "os/exec" "path/filepath" + "strconv" "strings" "time" @@ -251,3 +252,13 @@ func SaveImageToFile(ext string, data []byte) (string, error) { return targetPath, nil } + +func GetWeChatPID() (int, error) { + cmd := exec.Command("pgrep", "-x", "WeChat") + output, err := cmd.Output() + if err != nil { + return 0, fmt.Errorf("未发现正在运行的微信进程") + } + + return strconv.Atoi(strings.TrimSpace(string(output))) +} diff --git a/wechat_version/4_1_7_57_mac.json b/wechat_version/4_1_7_57_mac.json index 574095a..f7d0fb2 100644 --- a/wechat_version/4_1_7_57_mac.json +++ b/wechat_version/4_1_7_57_mac.json @@ -1,7 +1,5 @@ { - "protobufAddr": "0x24665A0", - "patchTextProtobufAddr": "0x246657C", - "PatchTextProtobufDeleteAddr": "0x24665B8", + "textCallbackFuncAddr": "0x246655C", "sendMessageCallbackFunc": "0x8791310", "sendFuncAddr": "0x47FE448", "req2bufEnterAddr": "0x36FC204",