From ae3d26bc0cb12d85df126b59ff240e56af7db24b Mon Sep 17 00:00:00 2001
From: yincong <yincong@baidu.com>
Date: Tue, 24 Feb 2026 11:08:32 +0800
Subject: [PATCH] clear trash

---
 frida/mmtls_payload.js           | 62 --------------------------------
 frida/protobuf.js                | 27 --------------
 frida/receiver.js                | 11 +++---
 wechat_version/4_1_7_55_mac.json | 22 ++++++++++++
 4 files changed, 26 insertions(+), 96 deletions(-)
 delete mode 100644 frida/mmtls_payload.js
 delete mode 100644 frida/protobuf.js
 create mode 100644 wechat_version/4_1_7_55_mac.json

diff --git a/frida/mmtls_payload.js b/frida/mmtls_payload.js
deleted file mode 100644
index 4dcdfa9..0000000
--- a/frida/mmtls_payload.js
+++ /dev/null
@@ -1,62 +0,0 @@
-var runReadX0 = ptr(0)
-var originCgiPtr = ptr(0)
-
-function patchRunReadWrite() {
-    Interceptor.attach(runReadWriteAddr, {
-        onEnter: function (args) {
-            try {
-                if (this.context.x5.isNull() || this.context.x5.compare(baseAddr) <= 0) {
-                    return
-                }
-
-                const x5 = this.context.x5;
-                const cTaskId = x5.add(0x308).readU32();
-                if (cTaskId !== taskIdGlobal) {
-                    return
-                }
-                console.log("[+] enter runReadWriteAddr: " + runReadWriteAddr)
-                const domainAddr = x5.add(0xd8);
-                const domainBytes = [
-                    0x73, 0x7A, 0x73, 0x68, 0x6F, 0x72, 0x74, 0x2E, // szshort.
-                    0x77, 0x65, 0x69, 0x78, 0x69, 0x6E, 0x2E, 0x71, // weixin.q
-                    0x71, 0x2E, 0x63, 0x6F, 0x6D                    // q.com
-                ];
-
-                domainAddr.writeByteArray(domainBytes);
-                domainAddr.add(domainBytes.length).writeU8(0);
-                domainAddr.add(23).writeU8(0x15);
-
-                runReadX0 = this.context.x0;
-                originCgiPtr = runReadX0.add(0x1018).readPointer();
-                runReadX0.add(0x1018).writePointer(cgiAddr);
-                runReadX0.add(0x1020).writeU64(0x22);
-                console.log("[+] enter runReadWriteAddr finished: " + domainAddr.readUtf8String())
-            } catch (e) {
-                console.log("[-] Memory access error at onEnter: " + e);
-            }
-
-        }
-    })
-
-    Interceptor.attach(runReadWriteAddr1, {
-        onEnter: function (args) {
-            try {
-                if (this.context.x20.isNull() || this.context.x20.compare(baseAddr) <= 0) {
-                    return
-                }
-
-                const cTaskId = this.context.x20.add(0x308).readU32();
-                if (cTaskId !== taskIdGlobal) {
-                    return
-                }
-                runReadX0.add(0x1018).writePointer(originCgiPtr);
-                console.log("[+] leave runReadWriteAddr finished: " + runReadWriteAddr)
-            } catch (e) {
-                console.log("[-] Memory access error at onLeave: " + e);
-            }
-        }
-    })
-    runReadWriteAddr1
-}
-
-setImmediate(patchRunReadWrite)
\ No newline at end of file
diff --git a/frida/protobuf.js b/frida/protobuf.js
deleted file mode 100644
index 25fac8c..0000000
--- a/frida/protobuf.js
+++ /dev/null
@@ -1,27 +0,0 @@
-const mod = Process.getModuleByName("ilink_protobuf");
-var addr = mod.base.add(0x12DD4);
-console.log("Hooking SerializeToArray at", addr);
-
-Interceptor.attach(addr, {
-    onEnter(args) {
-        this.buf = args[1];
-        this.size = args[2].toInt32();
-
-        console.log("[+] SerializeToArray called");
-        console.log("Buffer:", this.buf, "Size:", this.size);
-
-        console.log(
-            Thread.backtrace(this.context, Backtracer.ACCURATE)
-                .map(DebugSymbol.fromAddress)
-                .join("\n")
-        );
-    },
-    onLeave() {
-        try {
-            console.log("Data:");
-            console.log(hexdump(Memory.readByteArray(this.buf, this.size)));
-        } catch (e) {
-            console.log("Error:", e);
-        }
-    }
-});
\ No newline at end of file
diff --git a/frida/receiver.js b/frida/receiver.js
index 6261e71..5962b7e 100644
--- a/frida/receiver.js
+++ b/frida/receiver.js
@@ -48,14 +48,12 @@ function setReceiver() {
             var messages = [];
             var senderNickname = ""
 
-            let splitIndex = content.indexOf(':')
-            let pureContent = content.substring(splitIndex + 1).trim();
-
             if (sender.includes("@chatroom")) {
                 msgType = "group"
                 groupId = sender
 
-                senderUser = content.substring(0, splitIndex).trim();
+                let splitIndex = content.indexOf(':')
+                let pureContent = content.substring(splitIndex + 1).trim();
                 const parts = pureContent.split('\u2005');
                 for (let part of parts) {
                     part = part.trim();
@@ -91,7 +89,7 @@ function setReceiver() {
                 // 处理用户的名称
                 const splitIndex = userContent.indexOf(':')
                 senderNickname = userContent.substring(0, splitIndex).trim();
-                messages.push({type: "text", data: {text: pureContent}});
+                messages.push({type: "text", data: {text: content}});
             }
 
             const msgId = generateAESKey()
@@ -208,8 +206,7 @@ function getCleanString(uint8Array) {
                     out += String.fromCharCode(charCode);
                 }
             }
-        }
-        else if ((c & 0xF8) === 0xF0 && i + 2 < len) {
+        } else if ((c & 0xF8) === 0xF0 && i + 2 < len) {
             var c2 = uint8Array[i++];
             var c3 = uint8Array[i++];
             var c4 = uint8Array[i++];
diff --git a/wechat_version/4_1_7_55_mac.json b/wechat_version/4_1_7_55_mac.json
new file mode 100644
index 0000000..1bbd5b9
--- /dev/null
+++ b/wechat_version/4_1_7_55_mac.json
@@ -0,0 +1,22 @@
+{
+  "protobufAddr": "",
+  "patchTextProtobufAddr": "",
+  "PatchTextProtobufDeleteAddr": "",
+  "sendMessageCallbackFunc": "",
+  "sendFuncAddr": "",
+  "req2bufEnterAddr": "",
+  "req2bufExitAddr": "",
+  "imgProtobufAddr": "",
+  "patchImgProtobufFunc1": "",
+  "patchImgProtobufFunc2": " ",
+  "imgProtobufDeleteAddr": "",
+  "uploadImageAddr": "",
+  "CndOnCompleteAddr": "",
+  "sendImgMessageCallbackFunc": "",
+  "buf2RespAddr": "",
+  "imgMessageCallbackFunc1": "",
+  "uploadGetCallbackWrapperAddr": "",
+  "uploadGetCallbackWrapperFuncAddr": "",
+  "uploadOnCompleteAddr": "",
+  "uploadOnCompleteFuncAddr": ""
+}