diff --git a/LICENSE b/LICENSE index 9268dc7..f0c6d24 100644 --- a/LICENSE +++ b/LICENSE @@ -1,16 +1,7 @@ -GNU GENERAL PUBLIC LICENSE - Version 3, 29 June 2007 - - Copyright (C) 2026 yincongcyincong - - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 - Copyright (C) 2007 Free Software Foundation, Inc. + Copyright (C) 2026 yincongcyincong Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. diff --git a/README.md b/README.md index 5f9a3f7..4a9f95c 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,7 @@ hook4是在Req2Buf，清除掉消息体的内容，因为后序在OnTaskEnd会 ## 图片消息 ``` -发送一张图片,为了让函数找到X0寄存器的数据。 +手动发送一张图片,为了让函数找到X0寄存器的数据。 mkdir -p "/Users/yincong/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/wxid_xxx/temp/xxx/2026-01/Img/" cp /Users/yincong/Desktop/1.png /Users/yincong/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/wxid_xxx/temp/xxx/2026-01/Img/xxx.jpg diff --git a/frida/auto.js b/frida/auto.js new file mode 100644 index 0000000..75f4001 --- /dev/null +++ b/frida/auto.js @@ -0,0 +1,64 @@ + +function scanPatterns(patterns) { + var module = Process.getModuleByName("WeChat"); + if (!module) { + console.error("[!] 找不到 WeChat 模块基址，请检查进程名。"); + } + + patterns.forEach((item, index) => { + const { name, pattern } = item; + + // 2. 使用 Memory.scan 进行异步扫描 + Memory.scan(module.base, module.size, pattern, { + onMatch: function(address, size) { + // 计算相对偏移 (RVA) + const offset = address.sub(module.base); + console.log(`[!] 找到特征 [${name}], 绝对地址: ${address} 相对偏移: ${offset}`); + + // 如果你只想找第一个匹配项，可以在这里 return 'stop'; + }, + onError: function(reason) { + console.error(`[-] 扫描 [${name}] 时出错: ${reason}`); + }, + onComplete: function() { + // 扫描完成的回调 + } + }); + }); +} + + +// 特征码数组：? 代表通配符，空格可选 +const myPatterns = [ + { + name: "uploadOnCompleteAddr", + pattern: "08 19 40 F9 E1 03 14 AA E2 03 15 AA 00 01 3F D6" + }, + { + name: "uploadGetCallbackWrapperAddr", + pattern: "08 09 40 F9 E1 03 15 AA E2 03 14 AA E3 03 13 AA 00 01 3F D6 F3 07 40 F9 B3 00 00 B4" + }, + { + name: "req2bufEnterAddr", + pattern: "09 0F 46 F8 C9 01 00 B4 E8 03 18 AA 2A 21 40 B9" + }, + { + name: "downloadImagAddr", + pattern: "FF 07 00 B9 68 52 41 F9 15 89 41 F9 E0 03 14 AA" + }, + { + name: "uploadImageAddr", + pattern: "F8 5F 02 A9 F6 57 03 A9 F4 4F 04 A9 FD 7B 05 A9 FD 43 01 91 FF 43 0B D1 F3 03 01 AA F4 03 00 AA 68 E1 01 F0 08 71 44 F9 08 01 40 F9 A8 83 1A F8" + }, + { + name: "sendFuncAddr", + pattern: "FF 03 05 D1 FC 6F 11 A9 F4 4F 12 A9 FD 7B 13 A9 FD C3 04 91 F3 03 01 AA F4 03 00 AA A8 EB 01 D0 08 71 44 F9 08 01 40 F9 A8 83 1D F8" + }, + { + name: "buf2RespAddr", + pattern: "3C 00 80 52 E0 C3 00 91" + } +]; + +// 执行扫描 +scanPatterns(myPatterns); \ No newline at end of file diff --git a/onebot/main.go b/onebot/main.go index 693da88..fab95b2 100644 --- a/onebot/main.go +++ b/onebot/main.go @@ -56,7 +56,7 @@ func initFlag() { flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效") flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot") flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/") - flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_55_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") + flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_57_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") flag.StringVar(&config.ConnType, "conn_type", "http", "连接类型: http | websocket") flag.IntVar(&config.SendInterval, "send_interval", 1000, "发送间隔: ms") flag.StringVar(&logLevel, "log_level", "info", "log level") diff --git a/onebot/msg.go b/onebot/msg.go index 98888f2..4279fd3 100644 --- a/onebot/msg.go +++ b/onebot/msg.go @@ -14,8 +14,8 @@ func Download(rawMsg []byte) error { Info("下载文件", "file_id", downloadReq.FileID, "media_len", len(downloadReq.Media), "cdn_url", downloadReq.CDNURL[:10]) if downloadReqInter, ok := userID2FileMsgMap.Load(downloadReq.CDNURL); ok { - downloadReq = downloadReqInter.(*DownloadRequest) - downloadReq.Media = append(downloadReq.Media, downloadReq.Media...) + beforeDownloadReq := downloadReqInter.(*DownloadRequest) + beforeDownloadReq.Media = append(beforeDownloadReq.Media, downloadReq.Media...) } else { userID2FileMsgMap.Store(downloadReq.CDNURL, downloadReq) } diff --git a/onebot/param.go b/onebot/param.go index 1ffa3c8..8b63909 100644 --- a/onebot/param.go +++ b/onebot/param.go @@ -35,6 +35,7 @@ type WechatMessage struct { MsgResource string `json:"msgsource"` RawMessage string `json:"raw_message"` ShowContent string `json:"show_content"` + MessageType string `json:"message_type"` } type Sender struct { diff --git a/onebot/websocket.go b/onebot/websocket.go index 4860ea1..e0f9c10 100644 --- a/onebot/websocket.go +++ b/onebot/websocket.go @@ -65,6 +65,18 @@ func handleWebSocket(w http.ResponseWriter, r *http.Request) { Error("写入失败", "err", err) break } + case "get_group_member_info": + err = conn.WriteJSON(map[string]any{ + "echo": m.Echo, + "status": "ok", + "data": map[string]any{ + "nickname": userID2NicknameMap.Load(m.Params.GroupID + "_" + m.Params.UserID), + }, + }) + if err != nil { + Error("写入失败", "err", err) + break + } case "send_private_msg", "send_group_msg": err = SendWS(m.Params) if err != nil { diff --git a/onebot/worker.go b/onebot/worker.go index 040f208..da66f4b 100644 --- a/onebot/worker.go +++ b/onebot/worker.go @@ -37,7 +37,7 @@ func SendWechatMsg(m *SendMsg) { defer cancel() targetId := m.UserId - if m.GroupID != "" && targetId == "" { + if m.GroupID != "" { targetId = m.GroupID } diff --git a/todo_list b/todo_list index 7027bb2..95397f8 100644 --- a/todo_list +++ b/todo_list @@ -1,3 +1,4 @@ 1. 手动发消息为什么会导致crash 2. 判断receiver头部 3. 图片找出高清晰度的下载方法 +4. 自动找到微信pid进行attach \ No newline at end of file diff --git a/wechat_version/4_1_7_57_mac.json b/wechat_version/4_1_7_57_mac.json index 6113ff6..b2caf9b 100644 --- a/wechat_version/4_1_7_57_mac.json +++ b/wechat_version/4_1_7_57_mac.json @@ -1,22 +1,22 @@ { - "protobufAddr": "0x245E9B0", - "patchTextProtobufAddr": "0x245E98C", - "PatchTextProtobufDeleteAddr": "0x245E9C8", - "sendMessageCallbackFunc": "0x8781010", - "sendFuncAddr": "0x47F1888", - "req2bufEnterAddr": "0x36F1614", - "req2bufExitAddr": "0x36F27EC", - "imgProtobufAddr": "0x2455574", - "patchImgProtobufFunc1": "0x2455530", - "patchImgProtobufFunc2": "0x2455550", - "imgProtobufDeleteAddr": "0x245558C", - "imgMessageCallbackFunc1": "0x8780AD8", - "uploadImageAddr": "0x4938E08", - "CndOnCompleteAddr": "0x36B03A0", - "buf2RespAddr": "0x37173B0", - "uploadGetCallbackWrapperAddr": "0x49068CC", - "uploadGetCallbackWrapperFuncAddr": "0x36AFBEC", - "uploadOnCompleteAddr": "0x4906EC8", - "uploadOnCompleteFuncAddr": "0x36B0DD0", - "downloadImagAddr": "0x49FB92C" -} + "protobufAddr": "0x24665A0", + "patchTextProtobufAddr": "0x246657C", + "PatchTextProtobufDeleteAddr": "0x24665B8", + "sendMessageCallbackFunc": "0x8791310", + "sendFuncAddr": "0x47FE448", + "req2bufEnterAddr": "0x36FC204", + "req2bufExitAddr": "0x36FD3DC", + "imgProtobufAddr": "0x245D164", + "patchImgProtobufFunc1": "0x245D120", + "patchImgProtobufFunc2": "0x245D140", + "imgProtobufDeleteAddr": "0x245D17C", + "imgMessageCallbackFunc1": "0x8790DD8", + "uploadImageAddr": "0x49459C8", + "CndOnCompleteAddr": "0x36BAFC0", + "buf2RespAddr": "0x3721FA0", + "uploadGetCallbackWrapperAddr": "0x491348C", + "uploadGetCallbackWrapperFuncAddr": "0x36BA7DC", + "uploadOnCompleteAddr": "0x4913A88", + "uploadOnCompleteFuncAddr": "0x36BB9C0", + "downloadImagAddr": "0x4A084EC" +} \ No newline at end of file