mirror of
https://github.com/yincongcyincong/wechat_chatter.git
synced 2026-07-15 10:26:52 +08:00
57
This commit is contained in:
yincong
@@ -1,16 +1,7 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 3, 29 June 2007
|
||||
|
||||
Copyright (C) 2026 yincongcyincong
|
||||
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 3, 29 June 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Copyright (C) 2026 yincongcyincong
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
|
||||
@@ -29,7 +29,7 @@ hook4是在Req2Buf，清除掉消息体的内容，因为后序在OnTaskEnd会
|
||||
|
||||
## 图片消息
|
||||
```
|
||||
发送一张图片,为了让函数找到X0寄存器的数据。
|
||||
手动发送一张图片,为了让函数找到X0寄存器的数据。
|
||||
|
||||
mkdir -p "/Users/yincong/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/wxid_xxx/temp/xxx/2026-01/Img/"
|
||||
cp /Users/yincong/Desktop/1.png /Users/yincong/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/wxid_xxx/temp/xxx/2026-01/Img/xxx.jpg
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
|
||||
function scanPatterns(patterns) {
|
||||
var module = Process.getModuleByName("WeChat");
|
||||
if (!module) {
|
||||
console.error("[!] 找不到 WeChat 模块基址，请检查进程名。");
|
||||
}
|
||||
|
||||
patterns.forEach((item, index) => {
|
||||
const { name, pattern } = item;
|
||||
|
||||
// 2. 使用 Memory.scan 进行异步扫描
|
||||
Memory.scan(module.base, module.size, pattern, {
|
||||
onMatch: function(address, size) {
|
||||
// 计算相对偏移 (RVA)
|
||||
const offset = address.sub(module.base);
|
||||
console.log(`[!] 找到特征 [${name}], 绝对地址: ${address} 相对偏移: ${offset}`);
|
||||
|
||||
// 如果你只想找第一个匹配项，可以在这里 return 'stop';
|
||||
},
|
||||
onError: function(reason) {
|
||||
console.error(`[-] 扫描 [${name}] 时出错: ${reason}`);
|
||||
},
|
||||
onComplete: function() {
|
||||
// 扫描完成的回调
|
||||
}
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
// 特征码数组：? 代表通配符，空格可选
|
||||
const myPatterns = [
|
||||
{
|
||||
name: "uploadOnCompleteAddr",
|
||||
pattern: "08 19 40 F9 E1 03 14 AA E2 03 15 AA 00 01 3F D6"
|
||||
},
|
||||
{
|
||||
name: "uploadGetCallbackWrapperAddr",
|
||||
pattern: "08 09 40 F9 E1 03 15 AA E2 03 14 AA E3 03 13 AA 00 01 3F D6 F3 07 40 F9 B3 00 00 B4"
|
||||
},
|
||||
{
|
||||
name: "req2bufEnterAddr",
|
||||
pattern: "09 0F 46 F8 C9 01 00 B4 E8 03 18 AA 2A 21 40 B9"
|
||||
},
|
||||
{
|
||||
name: "downloadImagAddr",
|
||||
pattern: "FF 07 00 B9 68 52 41 F9 15 89 41 F9 E0 03 14 AA"
|
||||
},
|
||||
{
|
||||
name: "uploadImageAddr",
|
||||
pattern: "F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 FD 7B 05 A9 FD 43 01 91 FF 43 0B D1 F3 03 01 AA F4 03 00 AA 68 E1 01 F0 08 71 44 F9 08 01 40 F9 A8 83 1A F8"
|
||||
},
|
||||
{
|
||||
name: "sendFuncAddr",
|
||||
pattern: "FF 03 05 D1 FC 6F 11 A9 F4 4F 12 A9 FD 7B 13 A9 FD C3 04 91 F3 03 01 AA F4 03 00 AA A8 EB 01 D0 08 71 44 F9 08 01 40 F9 A8 83 1D F8"
|
||||
},
|
||||
{
|
||||
name: "buf2RespAddr",
|
||||
pattern: "3C 00 80 52 E0 C3 00 91"
|
||||
}
|
||||
];
|
||||
|
||||
// 执行扫描
|
||||
scanPatterns(myPatterns);
|
||||
+1
-1
@@ -56,7 +56,7 @@ func initFlag() {
|
||||
flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效")
|
||||
flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot")
|
||||
flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
|
||||
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_55_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
|
||||
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_57_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
|
||||
flag.StringVar(&config.ConnType, "conn_type", "http", "连接类型: http | websocket")
|
||||
flag.IntVar(&config.SendInterval, "send_interval", 1000, "发送间隔: ms")
|
||||
flag.StringVar(&logLevel, "log_level", "info", "log level")
|
||||
|
||||
+2
-2
@@ -14,8 +14,8 @@ func Download(rawMsg []byte) error {
|
||||
|
||||
Info("下载文件", "file_id", downloadReq.FileID, "media_len", len(downloadReq.Media), "cdn_url", downloadReq.CDNURL[:10])
|
||||
if downloadReqInter, ok := userID2FileMsgMap.Load(downloadReq.CDNURL); ok {
|
||||
downloadReq = downloadReqInter.(*DownloadRequest)
|
||||
downloadReq.Media = append(downloadReq.Media, downloadReq.Media...)
|
||||
beforeDownloadReq := downloadReqInter.(*DownloadRequest)
|
||||
beforeDownloadReq.Media = append(beforeDownloadReq.Media, downloadReq.Media...)
|
||||
} else {
|
||||
userID2FileMsgMap.Store(downloadReq.CDNURL, downloadReq)
|
||||
}
|
||||
|
||||
@@ -35,6 +35,7 @@ type WechatMessage struct {
|
||||
MsgResource string `json:"msgsource"`
|
||||
RawMessage string `json:"raw_message"`
|
||||
ShowContent string `json:"show_content"`
|
||||
MessageType string `json:"message_type"`
|
||||
}
|
||||
|
||||
type Sender struct {
|
||||
|
||||
@@ -65,6 +65,18 @@ func handleWebSocket(w http.ResponseWriter, r *http.Request) {
|
||||
Error("写入失败", "err", err)
|
||||
break
|
||||
}
|
||||
case "get_group_member_info":
|
||||
err = conn.WriteJSON(map[string]any{
|
||||
"echo": m.Echo,
|
||||
"status": "ok",
|
||||
"data": map[string]any{
|
||||
"nickname": userID2NicknameMap.Load(m.Params.GroupID + "_" + m.Params.UserID),
|
||||
},
|
||||
})
|
||||
if err != nil {
|
||||
Error("写入失败", "err", err)
|
||||
break
|
||||
}
|
||||
case "send_private_msg", "send_group_msg":
|
||||
err = SendWS(m.Params)
|
||||
if err != nil {
|
||||
|
||||
+1
-1
@@ -37,7 +37,7 @@ func SendWechatMsg(m *SendMsg) {
|
||||
defer cancel()
|
||||
|
||||
targetId := m.UserId
|
||||
if m.GroupID != "" && targetId == "" {
|
||||
if m.GroupID != "" {
|
||||
targetId = m.GroupID
|
||||
}
|
||||
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
1. 手动发消息为什么会导致crash
|
||||
2. 判断receiver头部
|
||||
3. 图片找出高清晰度的下载方法
|
||||
4. 自动找到微信pid进行attach
|
||||
@@ -1,22 +1,22 @@
|
||||
{
|
||||
"protobufAddr": "0x245E9B0",
|
||||
"patchTextProtobufAddr": "0x245E98C",
|
||||
"PatchTextProtobufDeleteAddr": "0x245E9C8",
|
||||
"sendMessageCallbackFunc": "0x8781010",
|
||||
"sendFuncAddr": "0x47F1888",
|
||||
"req2bufEnterAddr": "0x36F1614",
|
||||
"req2bufExitAddr": "0x36F27EC",
|
||||
"imgProtobufAddr": "0x2455574",
|
||||
"patchImgProtobufFunc1": "0x2455530",
|
||||
"patchImgProtobufFunc2": "0x2455550",
|
||||
"imgProtobufDeleteAddr": "0x245558C",
|
||||
"imgMessageCallbackFunc1": "0x8780AD8",
|
||||
"uploadImageAddr": "0x4938E08",
|
||||
"CndOnCompleteAddr": "0x36B03A0",
|
||||
"buf2RespAddr": "0x37173B0",
|
||||
"uploadGetCallbackWrapperAddr": "0x49068CC",
|
||||
"uploadGetCallbackWrapperFuncAddr": "0x36AFBEC",
|
||||
"uploadOnCompleteAddr": "0x4906EC8",
|
||||
"uploadOnCompleteFuncAddr": "0x36B0DD0",
|
||||
"downloadImagAddr": "0x49FB92C"
|
||||
}
|
||||
"protobufAddr": "0x24665A0",
|
||||
"patchTextProtobufAddr": "0x246657C",
|
||||
"PatchTextProtobufDeleteAddr": "0x24665B8",
|
||||
"sendMessageCallbackFunc": "0x8791310",
|
||||
"sendFuncAddr": "0x47FE448",
|
||||
"req2bufEnterAddr": "0x36FC204",
|
||||
"req2bufExitAddr": "0x36FD3DC",
|
||||
"imgProtobufAddr": "0x245D164",
|
||||
"patchImgProtobufFunc1": "0x245D120",
|
||||
"patchImgProtobufFunc2": "0x245D140",
|
||||
"imgProtobufDeleteAddr": "0x245D17C",
|
||||
"imgMessageCallbackFunc1": "0x8790DD8",
|
||||
"uploadImageAddr": "0x49459C8",
|
||||
"CndOnCompleteAddr": "0x36BAFC0",
|
||||
"buf2RespAddr": "0x3721FA0",
|
||||
"uploadGetCallbackWrapperAddr": "0x491348C",
|
||||
"uploadGetCallbackWrapperFuncAddr": "0x36BA7DC",
|
||||
"uploadOnCompleteAddr": "0x4913A88",
|
||||
"uploadOnCompleteFuncAddr": "0x36BB9C0",
|
||||
"downloadImagAddr": "0x4A084EC"
|
||||
}
|
||||
Reference in New Issue
Block a user