From b1d8dfcdbf756354f3443bcd3ff8b90fad6c26c5 Mon Sep 17 00:00:00 2001 From: yincong Date: Mon, 22 Dec 2025 19:13:15 +0800 Subject: [PATCH] update --- frida/script.js | 438 +++----------------------------- frida/trigger_send_msg.js | 47 ++++ function.md | 520 ++++++++++++++++++++++++++++++-------- idapro/analysis_x.py | 2 +- idapro/trigger_send.py | 66 +++++ idapro/trigger_task.py | 3 + 6 files changed, 568 insertions(+), 508 deletions(-) create mode 100644 frida/trigger_send_msg.js create mode 100644 idapro/trigger_send.py create mode 100644 idapro/trigger_task.py diff --git a/frida/script.js b/frida/script.js index e831f1a..69ad4ce 100644 --- a/frida/script.js +++ b/frida/script.js @@ -1,412 +1,44 @@ -// pure_js_keyboard_injector.js -console.log("Pure JS Keyboard Injector - Starting..."); +/** + * 构造内存数据并调用 sub_10481C304 + */ +function callTargetFunction() { + const mod = Process.getModuleByName("WeChat"); + const sub_10481C304_addr = ptr("0x10481C304").sub("0x100000000").add(mod.base); + const sub_10481C304 = new NativeFunction(sub_10481C304_addr, 'void', ['pointer']); -// 常量定义 -const NSEventTypeKeyDown = 10; -const NSEventTypeKeyUp = 11; -const kVK_Return = 36; // 回车键 + // 2. 准备原始字节数据 (Hex 形式) + // 注意：0x18 偏移处的 8 字节（原数据 60 E1 39 78 05 00 00 00）会被动态生成的指针覆盖 + const rawData = [ + 0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x18 指针位置 + 0x05, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x80, 0x00, 0x01, 0x11, 0x01, 0x00, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00, + 0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0x00, 0xAA, 0xAA, 0xAA, 0xFF, 0xFF, 0xFF, 0xFF, 0xAA, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + ]; -// 1. Hook QNSView的handleKeyEvent方法 -if (ObjC.available) { - const QNSView = ObjC.classes.QNSView; + // 3. 申请结构体内存 + const structPtr = Memory.alloc(rawData.length); + structPtr.writeByteArray(rawData); - if (QNSView) { - console.log("✓ Found QNSView class"); + // 4. 申请字符串内存并写入指针 (偏移 0x18) + const cgiPath = "/cgi-bin/micromsg-bin/newsendmsg"; + const pathPtr = Memory.allocUtf8String(cgiPath); + structPtr.add(0x18).writePointer(pathPtr); - // Hook方法 - const handleKeyEventMethod = QNSView['- handleKeyEvent:eventType:']; - if (handleKeyEventMethod) { - Interceptor.attach(handleKeyEventMethod.implementation, { - onEnter: function(args) { - console.log("\n[QNSView Hook]"); - const event = new ObjC.Object(args[2]); - const eventType = args[3]; - console.log(`Event Type (a4): ${eventType}`); - console.log(`KeyCode: ${event.keyCode()}`); - console.log(`Characters: ${event.characters()}`); - } - }); - console.log("✓ QNSView handleKeyEvent hooked"); - } - } -} + console.log("[+] 内存结构体已准备完毕: " + structPtr + " [+] 字符串地址: " + pathPtr + " 内容: " + cgiPath); + console.log(); -// 2. 发送回车键的函数 -function sendEnterKey() { + // 5. 调用函数 try { - console.log("\n=== 发送回车键 ==="); + console.log("[*] 结构体内存布局 (调用前):"); + sub_10481C304(structPtr); + console.log("[+] sub_10481C304 调用成功！"); - const NSApplication = ObjC.classes.NSApplication; - const NSEvent = ObjC.classes.NSEvent; - const app = NSApplication.sharedApplication(); - const keyWindow = app.keyWindow(); + console.log(hexdump(structPtr, { offset: 0, length: rawData.length, header: true, ansi: true })); - if (!keyWindow) { - console.log("❌ 没有找到活动窗口"); - return; - } - - console.log(`窗口: ${keyWindow}`); - - // 查找QNSView - function findQNSView(view) { - if (view.$className === 'QNSView') { - return view; - } - - try { - const subviews = view.subviews(); - const count = subviews.count(); - for (let i = 0; i < count; i++) { - const subview = subviews.objectAtIndex_(i); - const found = findQNSView(subview); - if (found) return found; - } - } catch (e) { - // 忽略错误 - } - return null; - } - - const contentView = keyWindow.contentView(); - const qnsView = findQNSView(contentView); - - if (!qnsView) { - console.log("❌ 没有找到QNSView，使用备用方法"); - sendEnterKeyAlternative(); - return; - } - - console.log(`✓ 找到QNSView: ${qnsView}`); - - // 创建回车键按下事件 - const keyDownEvent = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_( - NSEventTypeKeyDown, // type = 10 (按下) - { x: 100, y: 100 }, // 位置 - 0, // 修饰键 - Date.now() / 1000, // 时间戳（秒） - keyWindow.windowNumber(), // 窗口编号 - NULL, // 上下文 - '\r', // 字符（回车） - '\r', // 忽略修饰键的字符 - 0, // 是否重复 - kVK_Return // 键码36=回车 - ); - - // 创建回车键释放事件 - const keyUpEvent = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_( - NSEventTypeKeyUp, // type = 11 (释放) - { x: 100, y: 100 }, // 位置 - 0, // 修饰键 - (Date.now() / 1000) + 0.05, // 稍后的时间 - keyWindow.windowNumber(), // 窗口编号 - NULL, // 上下文 - '\r', // 字符 - '\r', // 忽略修饰键的字符 - 0, // 是否重复 - kVK_Return // 键码 - ); - - // 发送按键按下（根据逆向分析，a4=6可能是按键按下） - console.log("发送回车键按下..."); - qnsView.handleKeyEvent_eventType_(keyDownEvent, 6); - - // 延迟发送按键释放 - setTimeout(() => { - console.log("发送回车键释放..."); - qnsView.handleKeyEvent_eventType_(keyUpEvent, 7); // 猜测7是按键释放 - }, 50); - - console.log("✓ 回车键发送完成"); - - } catch (error) { - console.error(`❌ 发送回车键失败: ${error}`); + } catch (e) { + console.log("[-] 调用出错: " + e); } -} - -// 3. 备用方法：使用CGEvent -function sendEnterKeyAlternative() { - try { - console.log("尝试使用CGEvent发送回车键..."); - - const CGEventCreateKeyboardEvent = Module.findExportByName('CoreGraphics', 'CGEventCreateKeyboardEvent'); - const CGEventPost = Module.findExportByName('CoreGraphics', 'CGEventPost'); - - if (CGEventCreateKeyboardEvent && CGEventPost) { - const kCGHIDEventTap = 0; - - // 发送回车键按下 - const keyDown = new NativeFunction(CGEventCreateKeyboardEvent, 'pointer', ['pointer', 'uint64', 'bool'])( - NULL, - kVK_Return, - true - ); - new NativeFunction(CGEventPost, 'void', ['uint32', 'pointer'])(kCGHIDEventTap, keyDown); - - // 延迟发送释放 - setTimeout(() => { - const keyUp = new NativeFunction(CGEventCreateKeyboardEvent, 'pointer', ['pointer', 'uint64', 'bool'])( - NULL, - kVK_Return, - false - ); - new NativeFunction(CGEventPost, 'void', ['uint32', 'pointer'])(kCGHIDEventTap, keyUp); - console.log("✓ CGEvent 回车键发送完成"); - }, 50); - } else { - console.log("❌ CGEvent API 不可用"); - } - } catch (error) { - console.error(`❌ CGEvent方法失败: ${error}`); - } -} - -// 4. 发送文本"123"的函数 -function sendText123() { - try { - console.log("\n=== 发送文本 '123' ==="); - - const NSApplication = ObjC.classes.NSApplication; - const NSEvent = ObjC.classes.NSEvent; - const app = NSApplication.sharedApplication(); - const keyWindow = app.keyWindow(); - - if (!keyWindow) { - console.log("❌ 没有找到活动窗口"); - return; - } - - // 查找QNSView - function findQNSView(view) { - if (view.$className === 'QNSView') return view; - try { - const subviews = view.subviews(); - const count = subviews.count(); - for (let i = 0; i < count; i++) { - const found = findQNSView(subviews.objectAtIndex_(i)); - if (found) return found; - } - } catch (e) {} - return null; - } - - const qnsView = findQNSView(keyWindow.contentView()); - - if (!qnsView) { - console.log("❌ 没有找到QNSView"); - return; - } - - // 要发送的字符和对应的键码 - const textToSend = [ - { char: '1', keyCode: 18 }, - { char: '2', keyCode: 19 }, - { char: '3', keyCode: 20 } - ]; - - // 逐个发送字符 - textToSend.forEach((item, index) => { - setTimeout(() => { - try { - console.log(`发送字符: ${item.char}`); - - // 创建按键按下事件 - const keyDownEvent = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_( - NSEventTypeKeyDown, - { x: 100, y: 100 }, - 0, - Date.now() / 1000, - keyWindow.windowNumber(), - NULL, - item.char, - item.char, - 0, - item.keyCode - ); - - // 创建按键释放事件 - const keyUpEvent = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_( - NSEventTypeKeyUp, - { x: 100, y: 100 }, - 0, - (Date.now() / 1000) + 0.03, - keyWindow.windowNumber(), - NULL, - item.char, - item.char, - 0, - item.keyCode - ); - - // 发送按键按下 - qnsView.handleKeyEvent_eventType_(keyDownEvent, 6); - - // 延迟发送按键释放 - setTimeout(() => { - qnsView.handleKeyEvent_eventType_(keyUpEvent, 7); - }, 30); - - } catch (error) { - console.error(`发送字符 ${item.char} 失败: ${error}`); - } - }, index * 100); // 每个字符间隔100ms - }); - - console.log("✓ 文本'123'发送中..."); - - } catch (error) { - console.error(`❌ 发送文本失败: ${error}`); - } -} - -// 5. 组合函数：先发送123，然后回车 -function send123AndEnter() { - console.log("\n=== 开始发送: 123 + 回车 ==="); - - // 先发送123 - sendText123(); - - // 延迟500ms后发送回车 - setTimeout(() => { - console.log("\n=== 发送回车键 ==="); - sendEnterKey(); - }, 500); -} - -// 6. 通用按键注入函数 -function injectKey(keyCode, eventType, characters = '') { - try { - const NSApplication = ObjC.classes.NSApplication; - const NSEvent = ObjC.classes.NSEvent; - const app = NSApplication.sharedApplication(); - const keyWindow = app.keyWindow(); - - if (!keyWindow) { - console.log("❌ 没有活动窗口"); - return false; - } - - // 查找QNSView - function findQNSView(view) { - if (view.$className === 'QNSView') return view; - try { - const subviews = view.subviews(); - for (let i = 0; i < subviews.count(); i++) { - const found = findQNSView(subviews.objectAtIndex_(i)); - if (found) return found; - } - } catch (e) {} - return null; - } - - const qnsView = findQNSView(keyWindow.contentView()); - - if (qnsView) { - const event = NSEvent.keyEventWithType_location_modifierFlags_timestamp_windowNumber_context_characters_charactersIgnoringModifiers_isARepeat_keyCode_( - eventType, // 10=按下, 11=释放 - { x: 100, y: 100 }, - 0, - Date.now() / 1000, - keyWindow.windowNumber(), - NULL, - characters, - characters, - 0, - keyCode - ); - - // 根据逆向分析，a4参数：6可能是按下，7可能是释放 - const a4Param = eventType === NSEventTypeKeyDown ? 6 : 7; - qnsView.handleKeyEvent_eventType_(event, a4Param); - - console.log(`✓ 发送按键: keyCode=${keyCode}, type=${eventType}, a4=${a4Param}`); - return true; - } - - return false; - - } catch (error) { - console.error(`❌ 注入按键失败: ${error}`); - return false; - } -} - -// 7. 直接调用Qt事件发送（基于逆向分析） -function sendQtKeyEvent(keyCode, text, modifiers = 0) { - try { - console.log(`\n=== 直接发送Qt键盘事件: ${text} ===`); - - // 尝试找到QNSView并调用底层函数 - const NSApplication = ObjC.classes.NSApplication; - const app = NSApplication.sharedApplication(); - const keyWindow = app.keyWindow(); - - if (!keyWindow) return; - - // 查找QNSView - function findQNSView(view) { - if (view.$className === 'QNSView') return view; - try { - const subviews = view.subviews(); - for (let i = 0; i < subviews.count(); i++) { - const found = findQNSView(subviews.objectAtIndex_(i)); - if (found) return found; - } - } catch (e) {} - return null; - } - - const qnsView = findQNSView(keyWindow.contentView()); - - if (qnsView && qnsView.handleKeyEvent) { - // 创建模拟的事件对象 - const fakeEvent = { - keyCode: function() { return keyCode; }, - characters: function() { return text; }, - charactersIgnoringModifiers: function() { return text; }, - timestamp: function() { return Date.now() / 1000; }, - modifierFlags: function() { return modifiers; }, - isARepeat: function() { return 0; } - }; - - // 包装成ObjC对象 - const eventWrapper = new ObjC.Object(fakeEvent); - - // 发送事件 - qnsView.handleKeyEvent_eventType_(eventWrapper, 6); - - console.log(`✓ Qt事件发送: ${text} (keyCode: ${keyCode})`); - } - - } catch (error) { - console.error(`❌ Qt事件发送失败: ${error}`); - } -} - -// 9. 创建交互式菜单 -function showMenu() { - console.log("\n" + "=".repeat(50)); - console.log("🎹 键盘注入器 - 纯JS版本"); - console.log("=".repeat(50)); - console.log("可用命令:"); - console.log("1. sendEnterKey() - 发送回车键"); - console.log("2. sendText123() - 发送文本 '123'"); - console.log("3. send123AndEnter() - 发送 '123' 然后回车"); - console.log("4. injectKey(36, 10) - 发送回车键按下"); - console.log("5. injectKey(36, 11) - 发送回车键释放"); - console.log("6. sendQtKeyEvent(18, '1') - 直接发送Qt事件"); - console.log("=".repeat(50)); - console.log("示例: 发送 '123' 然后回车:"); - console.log(" send123AndEnter()"); - console.log("=".repeat(50)); -} - -// 10. 自动执行（可选） -// 取消下面行的注释可以自动发送 -// setTimeout(send123AndEnter, 1000); - -// 显示菜单 -showMenu(); - -console.log("\n✅ 键盘注入器加载完成！"); -console.log("📝 输入命令开始注入键盘事件..."); \ No newline at end of file +} \ No newline at end of file diff --git a/frida/trigger_send_msg.js b/frida/trigger_send_msg.js new file mode 100644 index 0000000..93a8c26 --- /dev/null +++ b/frida/trigger_send_msg.js @@ -0,0 +1,47 @@ +/** + * 构造内存数据并调用 sub_10481C304 + */ +function callTargetFunction() { + // 1. 查找函数地址 (请确保模块名正确，这里假设是 WeChat) + const moduleName = "WeChat"; + const sub_10481C304_addr = Module.findBaseAddress(moduleName).add(0x481C304); + const sub_10481C304 = new NativeFunction(sub_10481C304_addr, 'void', ['pointer']); + + // 2. 准备原始字节数据 (Hex 形式) + // 注意：0x18 偏移处的 8 字节（原数据 60 E1 39 78 05 00 00 00）会被动态生成的指针覆盖 + const rawData = [ + 0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x18 指针位置 + 0x05, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x80, 0x00, 0x01, 0x11, 0x01, 0x00, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00, + 0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0x00, 0xAA, 0xAA, 0xAA, 0xFF, 0xFF, 0xFF, 0xFF, 0xAA, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + ]; + + // 3. 申请结构体内存 + const structPtr = Memory.alloc(rawData.length); + structPtr.writeByteArray(rawData); + + // 4. 申请字符串内存并写入指针 (偏移 0x18) + const cgiPath = "/cgi-bin/micromsg-bin/newsendmsg"; + const pathPtr = Memory.allocUtf8String(cgiPath); + + // 将字符串地址写入结构体的 0x18 偏移处 (64位系统占8字节) + structPtr.add(0x18).writePointer(pathPtr); + + console.log("[+] 内存结构体已准备完毕: " + structPtr); + console.log("[+] 字符串地址: " + pathPtr + " 内容: " + cgiPath); + + // 5. 调用函数 + try { + sub_10481C304(structPtr); + console.log("[+] sub_10481C304 调用成功！"); + + console.log("[*] 结构体内存布局 (调用后):"); + console.log(hexdump(structPtr, { offset: 0, length: rawData.length, header: true, ansi: true })); + + } catch (e) { + console.log("[-] 调用出错: " + e); + } +} \ No newline at end of file diff --git a/function.md b/function.md index 7c60601..baf1771 100644 --- a/function.md +++ b/function.md @@ -15,110 +15,422 @@ cgi 字符串指针 sub_10481C304 taskId生成函数 ```azure -debug5059:0000000175ED6600 DCB 0x9A -debug5059:0000000175ED6601 DCB 2 -debug5059:0000000175ED6602 DCB 0 -debug5059:0000000175ED6603 DCB 0 -debug5059:0000000175ED6604 DCB 0xA -debug5059:0000000175ED6605 DCB 2 -debug5059:0000000175ED6606 DCB 0 -debug5059:0000000175ED6607 DCB 0 -debug5059:0000000175ED6608 DCB 0 -debug5059:0000000175ED6609 DCB 0 -debug5059:0000000175ED660A DCB 0 -debug5059:0000000175ED660B DCB 0 -debug5059:0000000175ED660C DCB 0 -debug5059:0000000175ED660D DCB 0 -debug5059:0000000175ED660E DCB 0 -debug5059:0000000175ED660F DCB 0 -debug5059:0000000175ED6610 DCB 3 -debug5059:0000000175ED6611 DCB 0 -debug5059:0000000175ED6612 DCB 0 -debug5059:0000000175ED6613 DCB 0 -debug5059:0000000175ED6614 DCB 1 -debug5059:0000000175ED6615 DCB 0 -debug5059:0000000175ED6616 DCB 0 -debug5059:0000000175ED6617 DCB 0 -debug5059:0000000175ED6618 DCB 0x60 ; ` -debug5059:0000000175ED6619 DCB 0xE1 -debug5059:0000000175ED661A DCB 0x39 ; 9 -debug5059:0000000175ED661B DCB 0x78 ; x -debug5059:0000000175ED661C DCB 5 -debug5059:0000000175ED661D DCB 0 -debug5059:0000000175ED661E DCB 0 -debug5059:0000000175ED661F DCB 0 -debug5059:0000000175ED6620 DCB 0x20 -debug5059:0000000175ED6621 DCB 0 -debug5059:0000000175ED6622 DCB 0 -debug5059:0000000175ED6623 DCB 0 -debug5059:0000000175ED6624 DCB 0 -debug5059:0000000175ED6625 DCB 0 -debug5059:0000000175ED6626 DCB 0 -debug5059:0000000175ED6627 DCB 0 -debug5059:0000000175ED6628 DCB 0x30 ; 0 -debug5059:0000000175ED6629 DCB 0 -debug5059:0000000175ED662A DCB 0 -debug5059:0000000175ED662B DCB 0 -debug5059:0000000175ED662C DCB 0 -debug5059:0000000175ED662D DCB 0 -debug5059:0000000175ED662E DCB 0 -debug5059:0000000175ED662F DCB 0x80 -debug5059:0000000175ED6630 DCB 0 -debug5059:0000000175ED6631 DCB 1 -debug5059:0000000175ED6632 DCB 1 -debug5059:0000000175ED6633 DCB 1 -debug5059:0000000175ED6634 DCB 0 -debug5059:0000000175ED6635 DCB 0xAA -debug5059:0000000175ED6636 DCB 0xAA -debug5059:0000000175ED6637 DCB 0xAA -debug5059:0000000175ED6638 DCB 0 -debug5059:0000000175ED6639 DCB 0 -debug5059:0000000175ED663A DCB 0 -debug5059:0000000175ED663B DCB 0 -debug5059:0000000175ED663C DCB 3 -debug5059:0000000175ED663D DCB 0 -debug5059:0000000175ED663E DCB 0 -debug5059:0000000175ED663F DCB 0 -debug5059:0000000175ED6640 DCB 1 -debug5059:0000000175ED6641 DCB 0 -debug5059:0000000175ED6642 DCB 0 -debug5059:0000000175ED6643 DCB 0 -debug5059:0000000175ED6644 DCB 0xFF -debug5059:0000000175ED6645 DCB 0xFF -debug5059:0000000175ED6646 DCB 0xFF -debug5059:0000000175ED6647 DCB 0xFF -debug5059:0000000175ED6648 DCB 0xFF -debug5059:0000000175ED6649 DCB 0xFF -debug5059:0000000175ED664A DCB 0xFF -debug5059:0000000175ED664B DCB 0xFF -debug5059:0000000175ED664C DCB 0 -debug5059:0000000175ED664D DCB 0xAA -debug5059:0000000175ED664E DCB 0xAA -debug5059:0000000175ED664F DCB 0xAA -debug5059:0000000175ED6650 DCB 0xFF -debug5059:0000000175ED6651 DCB 0xFF -debug5059:0000000175ED6652 DCB 0xFF -debug5059:0000000175ED6653 DCB 0xFF -debug5059:0000000175ED6654 DCB 0xAA -debug5059:0000000175ED6655 DCB 0xAA -debug5059:0000000175ED6656 DCB 0xAA -debug5059:0000000175ED6657 DCB 0xAA -debug5059:0000000175ED6658 DCB 0 -debug5059:0000000175ED6659 DCB 0 -debug5059:0000000175ED665A DCB 0 -debug5059:0000000175ED665B DCB 0 -debug5059:0000000175ED665C DCB 0 -debug5059:0000000175ED665D DCB 0 -debug5059:0000000175ED665E DCB 0 -debug5059:0000000175ED665F DCB 0 -debug5059:0000000175ED6660 DCB 0xA -debug5059:0000000175ED6661 DCB 2 -debug5059:0000000175ED6662 DCB 0 -debug5059:0000000175ED6663 DCB 0 -debug5059:0000000175ED6664 DCB 0 -debug5059:0000000175ED6665 DCB 0 -debug5059:0000000175ED6666 DCB 0 -debug5059:0000000175ED6667 DCB 0 +debug697:0000000175ED6600 DCB 0xE2 +debug697:0000000175ED6601 DCB 0 +debug697:0000000175ED6602 DCB 0 +debug697:0000000175ED6603 DCB 0 +debug697:0000000175ED6604 DCB 0xA +debug697:0000000175ED6605 DCB 2 +debug697:0000000175ED6606 DCB 0 +debug697:0000000175ED6607 DCB 0 +debug697:0000000175ED6608 DCB 0 +debug697:0000000175ED6609 DCB 0 +debug697:0000000175ED660A DCB 0 +debug697:0000000175ED660B DCB 0 +debug697:0000000175ED660C DCB 0 +debug697:0000000175ED660D DCB 0 +debug697:0000000175ED660E DCB 0 +debug697:0000000175ED660F DCB 0 +debug697:0000000175ED6610 DCB 3 +debug697:0000000175ED6611 DCB 0 +debug697:0000000175ED6612 DCB 0 +debug697:0000000175ED6613 DCB 0 +debug697:0000000175ED6614 DCB 1 +debug697:0000000175ED6615 DCB 0 +debug697:0000000175ED6616 DCB 0 +debug697:0000000175ED6617 DCB 0 +debug697:0000000175ED6618 DCB 0x30 ; 0 +debug697:0000000175ED6619 DCB 0x5B ; +debug697:0000000175ED661A DCB 0x58 ; X +debug697:0000000175ED661B DCB 0xD9 +debug697:0000000175ED661C DCB 0xC +debug697:0000000175ED661D DCB 0 +debug697:0000000175ED661E DCB 0 +debug697:0000000175ED661F DCB 0 +debug697:0000000175ED6620 DCB 0x20 +debug697:0000000175ED6621 DCB 0 +debug697:0000000175ED6622 DCB 0 +debug697:0000000175ED6623 DCB 0 +debug697:0000000175ED6624 DCB 0 +debug697:0000000175ED6625 DCB 0 +debug697:0000000175ED6626 DCB 0 +debug697:0000000175ED6627 DCB 0 +debug697:0000000175ED6628 DCB 0x30 ; 0 +debug697:0000000175ED6629 DCB 0 +debug697:0000000175ED662A DCB 0 +debug697:0000000175ED662B DCB 0 +debug697:0000000175ED662C DCB 0 +debug697:0000000175ED662D DCB 0 +debug697:0000000175ED662E DCB 0 +debug697:0000000175ED662F DCB 0x80 +debug697:0000000175ED6630 DCB 0 +debug697:0000000175ED6631 DCB 1 +debug697:0000000175ED6632 DCB 1 +debug697:0000000175ED6633 DCB 1 +debug697:0000000175ED6634 DCB 0 +debug697:0000000175ED6635 DCB 0xAA +debug697:0000000175ED6636 DCB 0xAA +debug697:0000000175ED6637 DCB 0xAA +debug697:0000000175ED6638 DCB 0 +debug697:0000000175ED6639 DCB 0 +debug697:0000000175ED663A DCB 0 +debug697:0000000175ED663B DCB 0 +debug697:0000000175ED663C DCB 3 +debug697:0000000175ED663D DCB 0 +debug697:0000000175ED663E DCB 0 +debug697:0000000175ED663F DCB 0 +debug697:0000000175ED6640 DCB 1 +debug697:0000000175ED6641 DCB 0 +debug697:0000000175ED6642 DCB 0 +debug697:0000000175ED6643 DCB 0 +debug697:0000000175ED6644 DCB 0xFF +debug697:0000000175ED6645 DCB 0xFF +debug697:0000000175ED6646 DCB 0xFF +debug697:0000000175ED6647 DCB 0xFF +debug697:0000000175ED6648 DCB 0xFF +debug697:0000000175ED6649 DCB 0xFF +debug697:0000000175ED664A DCB 0xFF +debug697:0000000175ED664B DCB 0xFF +debug697:0000000175ED664C DCB 0 +debug697:0000000175ED664D DCB 0xAA +debug697:0000000175ED664E DCB 0xAA +debug697:0000000175ED664F DCB 0xAA +debug697:0000000175ED6650 DCB 0xFF +debug697:0000000175ED6651 DCB 0xFF +debug697:0000000175ED6652 DCB 0xFF +debug697:0000000175ED6653 DCB 0xFF +debug697:0000000175ED6654 DCB 0xAA +debug697:0000000175ED6655 DCB 0xAA +debug697:0000000175ED6656 DCB 0xAA +debug697:0000000175ED6657 DCB 0xAA +debug697:0000000175ED6658 DCB 0 +debug697:0000000175ED6659 DCB 0 +debug697:0000000175ED665A DCB 0 +debug697:0000000175ED665B DCB 0 +debug697:0000000175ED665C DCB 0 +debug697:0000000175ED665D DCB 0 +debug697:0000000175ED665E DCB 0 +debug697:0000000175ED665F DCB 0 +debug697:0000000175ED6660 DCB 0xA +debug697:0000000175ED6661 DCB 2 +debug697:0000000175ED6662 DCB 0 +debug697:0000000175ED6663 DCB 0 +debug697:0000000175ED6664 DCB 0 +debug697:0000000175ED6665 DCB 0 +debug697:0000000175ED6666 DCB 0 +debug697:0000000175ED6667 DCB 0 +debug697:0000000175ED6668 DCB 0x64 ; d +debug697:0000000175ED6669 DCB 0x65 ; e +debug697:0000000175ED666A DCB 0x66 ; f +debug697:0000000175ED666B DCB 0x61 ; a +debug697:0000000175ED666C DCB 0x75 ; u +debug697:0000000175ED666D DCB 0x6C ; l +debug697:0000000175ED666E DCB 0x74 ; t +debug697:0000000175ED666F DCB 0x2D ; - +debug697:0000000175ED6670 DCB 0x6C ; l +debug697:0000000175ED6671 DCB 0x6F ; o +debug697:0000000175ED6672 DCB 0x6E ; n +debug697:0000000175ED6673 DCB 0x67 ; g +debug697:0000000175ED6674 DCB 0x6C ; l +debug697:0000000175ED6675 DCB 0x69 ; i +debug697:0000000175ED6676 DCB 0x6E ; n +debug697:0000000175ED6677 DCB 0x6B ; k +debug697:0000000175ED6678 DCB 0 +debug697:0000000175ED6679 DCB 0xAA +debug697:0000000175ED667A DCB 0xAA +debug697:0000000175ED667B DCB 0xAA +debug697:0000000175ED667C DCB 0xAA +debug697:0000000175ED667D DCB 0xAA +debug697:0000000175ED667E DCB 0xAA +debug697:0000000175ED667F DCB 0x10 +debug697:0000000175ED6680 DCB 0 +debug697:0000000175ED6681 DCB 0 +debug697:0000000175ED6682 DCB 0 +debug697:0000000175ED6683 DCB 0 +debug697:0000000175ED6684 DCB 0 +debug697:0000000175ED6685 DCB 0 +debug697:0000000175ED6686 DCB 0 +debug697:0000000175ED6687 DCB 0 +debug697:0000000175ED6688 DCB 0 +debug697:0000000175ED6689 DCB 0 +debug697:0000000175ED668A DCB 0 +debug697:0000000175ED668B DCB 0 +debug697:0000000175ED668C DCB 0 +debug697:0000000175ED668D DCB 0 +debug697:0000000175ED668E DCB 0 +debug697:0000000175ED668F DCB 0 +debug697:0000000175ED6690 DCB 0 +debug697:0000000175ED6691 DCB 0 +debug697:0000000175ED6692 DCB 0 +debug697:0000000175ED6693 DCB 0 +debug697:0000000175ED6694 DCB 0 +debug697:0000000175ED6695 DCB 0 +debug697:0000000175ED6696 DCB 0 +debug697:0000000175ED6697 DCB 0 +debug697:0000000175ED6698 DCB 0 +debug697:0000000175ED6699 DCB 0 +debug697:0000000175ED669A DCB 0 +debug697:0000000175ED669B DCB 0 +debug697:0000000175ED669C DCB 0 +debug697:0000000175ED669D DCB 0 +debug697:0000000175ED669E DCB 0 +debug697:0000000175ED669F DCB 0 +debug697:0000000175ED66A0 DCB 0 +debug697:0000000175ED66A1 DCB 0 +debug697:0000000175ED66A2 DCB 0 +debug697:0000000175ED66A3 DCB 0 +debug697:0000000175ED66A4 DCB 0 +debug697:0000000175ED66A5 DCB 0 +debug697:0000000175ED66A6 DCB 0 +debug697:0000000175ED66A7 DCB 0 +debug697:0000000175ED66A8 DCB 0 +debug697:0000000175ED66A9 DCB 0 +debug697:0000000175ED66AA DCB 0 +debug697:0000000175ED66AB DCB 0 +debug697:0000000175ED66AC DCB 0 +debug697:0000000175ED66AD DCB 0 +debug697:0000000175ED66AE DCB 0 +debug697:0000000175ED66AF DCB 0 +debug697:0000000175ED66B0 DCB 0 +debug697:0000000175ED66B1 DCB 0 +debug697:0000000175ED66B2 DCB 0 +debug697:0000000175ED66B3 DCB 0 +debug697:0000000175ED66B4 DCB 0xAA +debug697:0000000175ED66B5 DCB 0xAA +debug697:0000000175ED66B6 DCB 0xAA +debug697:0000000175ED66B7 DCB 0xAA +debug697:0000000175ED66B8 DCB 0xC0 +debug697:0000000175ED66B9 DCB 0x66 ; f +debug697:0000000175ED66BA DCB 0xED +debug697:0000000175ED66BB DCB 0x75 ; u +debug697:0000000175ED66BC DCB 1 +debug697:0000000175ED66BD DCB 0 +debug697:0000000175ED66BE DCB 0 +debug697:0000000175ED66BF DCB 0 +debug697:0000000175ED66C0 DCB 0 +debug697:0000000175ED66C1 DCB 0 +debug697:0000000175ED66C2 DCB 0 +debug697:0000000175ED66C3 DCB 0 +debug697:0000000175ED66C4 DCB 0 +debug697:0000000175ED66C5 DCB 0 +debug697:0000000175ED66C6 DCB 0 +debug697:0000000175ED66C7 DCB 0 +debug697:0000000175ED66C8 DCB 0 +debug697:0000000175ED66C9 DCB 0 +debug697:0000000175ED66CA DCB 0 +debug697:0000000175ED66CB DCB 0 +debug697:0000000175ED66CC DCB 0 +debug697:0000000175ED66CD DCB 0 +debug697:0000000175ED66CE DCB 0 +debug697:0000000175ED66CF DCB 0 +debug697:0000000175ED66D0 DCB 0 +debug697:0000000175ED66D1 DCB 0 +debug697:0000000175ED66D2 DCB 0 +debug697:0000000175ED66D3 DCB 0 +debug697:0000000175ED66D4 DCB 0 +debug697:0000000175ED66D5 DCB 0 +debug697:0000000175ED66D6 DCB 0 +debug697:0000000175ED66D7 DCB 0 +debug697:0000000175ED66D8 DCB 0 +debug697:0000000175ED66D9 DCB 0 +debug697:0000000175ED66DA DCB 0 +debug697:0000000175ED66DB DCB 0 +debug697:0000000175ED66DC DCB 0 +debug697:0000000175ED66DD DCB 0 +debug697:0000000175ED66DE DCB 0 +debug697:0000000175ED66DF DCB 0 +debug697:0000000175ED66E0 DCB 0 +debug697:0000000175ED66E1 DCB 0 +debug697:0000000175ED66E2 DCB 0 +debug697:0000000175ED66E3 DCB 0 +debug697:0000000175ED66E4 DCB 0 +debug697:0000000175ED66E5 DCB 0 +debug697:0000000175ED66E6 DCB 0 +debug697:0000000175ED66E7 DCB 0 +debug697:0000000175ED66E8 DCB 0 +debug697:0000000175ED66E9 DCB 0 +debug697:0000000175ED66EA DCB 0 +debug697:0000000175ED66EB DCB 0 +debug697:0000000175ED66EC DCB 0 +debug697:0000000175ED66ED DCB 0 +debug697:0000000175ED66EE DCB 0 +debug697:0000000175ED66EF DCB 0 +debug697:0000000175ED66F0 DCB 0 +debug697:0000000175ED66F1 DCB 0 +debug697:0000000175ED66F2 DCB 0 +debug697:0000000175ED66F3 DCB 0 +debug697:0000000175ED66F4 DCB 0 +debug697:0000000175ED66F5 DCB 0 +debug697:0000000175ED66F6 DCB 0 +debug697:0000000175ED66F7 DCB 0 +debug697:0000000175ED66F8 DCB 0 +debug697:0000000175ED66F9 DCB 0 +debug697:0000000175ED66FA DCB 0 +debug697:0000000175ED66FB DCB 0 +debug697:0000000175ED66FC DCB 0 +debug697:0000000175ED66FD DCB 0 +debug697:0000000175ED66FE DCB 0 +debug697:0000000175ED66FF DCB 0 +debug697:0000000175ED6700 DCB 0 +debug697:0000000175ED6701 DCB 0 +debug697:0000000175ED6702 DCB 0 +debug697:0000000175ED6703 DCB 0 +debug697:0000000175ED6704 DCB 0 +debug697:0000000175ED6705 DCB 0 +debug697:0000000175ED6706 DCB 0 +debug697:0000000175ED6707 DCB 0 +debug697:0000000175ED6708 DCB 0 +debug697:0000000175ED6709 DCB 0 +debug697:0000000175ED670A DCB 0 +debug697:0000000175ED670B DCB 0 +debug697:0000000175ED670C DCB 0 +debug697:0000000175ED670D DCB 0 +debug697:0000000175ED670E DCB 0 +debug697:0000000175ED670F DCB 0 +debug697:0000000175ED6710 DCB 0 +debug697:0000000175ED6711 DCB 0 +debug697:0000000175ED6712 DCB 0 +debug697:0000000175ED6713 DCB 0 +debug697:0000000175ED6714 DCB 0 +debug697:0000000175ED6715 DCB 0 +debug697:0000000175ED6716 DCB 0 +debug697:0000000175ED6717 DCB 0 +debug697:0000000175ED6718 DCB 0 +debug697:0000000175ED6719 DCB 0 +debug697:0000000175ED671A DCB 0 +debug697:0000000175ED671B DCB 0 +debug697:0000000175ED671C DCB 0 +debug697:0000000175ED671D DCB 0 +debug697:0000000175ED671E DCB 0 +debug697:0000000175ED671F DCB 0 +debug697:0000000175ED6720 DCB 0 +debug697:0000000175ED6721 DCB 0 +debug697:0000000175ED6722 DCB 0 +debug697:0000000175ED6723 DCB 0 +debug697:0000000175ED6724 DCB 0 +debug697:0000000175ED6725 DCB 0 +debug697:0000000175ED6726 DCB 0 +debug697:0000000175ED6727 DCB 0 +debug697:0000000175ED6728 DCB 0 +debug697:0000000175ED6729 DCB 0 +debug697:0000000175ED672A DCB 0 +debug697:0000000175ED672B DCB 0 +debug697:0000000175ED672C DCB 0 +debug697:0000000175ED672D DCB 0 +debug697:0000000175ED672E DCB 0 +debug697:0000000175ED672F DCB 0 +debug697:0000000175ED6730 DCB 0 +debug697:0000000175ED6731 DCB 0 +debug697:0000000175ED6732 DCB 0 +debug697:0000000175ED6733 DCB 0 +debug697:0000000175ED6734 DCB 0 +debug697:0000000175ED6735 DCB 0 +debug697:0000000175ED6736 DCB 0 +debug697:0000000175ED6737 DCB 0 +debug697:0000000175ED6738 DCB 0 +debug697:0000000175ED6739 DCB 0 +debug697:0000000175ED673A DCB 0 +debug697:0000000175ED673B DCB 0 +debug697:0000000175ED673C DCB 0 +debug697:0000000175ED673D DCB 0 +debug697:0000000175ED673E DCB 0 +debug697:0000000175ED673F DCB 0 +debug697:0000000175ED6740 DCB 0 +debug697:0000000175ED6741 DCB 0 +debug697:0000000175ED6742 DCB 0 +debug697:0000000175ED6743 DCB 0 +debug697:0000000175ED6744 DCB 0 +debug697:0000000175ED6745 DCB 0 +debug697:0000000175ED6746 DCB 0 +debug697:0000000175ED6747 DCB 0 +debug697:0000000175ED6748 DCB 1 +debug697:0000000175ED6749 DCB 0 +debug697:0000000175ED674A DCB 0 +debug697:0000000175ED674B DCB 0 +debug697:0000000175ED674C DCB 0xAA +debug697:0000000175ED674D DCB 0xAA +debug697:0000000175ED674E DCB 0xAA +debug697:0000000175ED674F DCB 0xAA +debug697:0000000175ED6750 DCB 0 +debug697:0000000175ED6751 DCB 0 +debug697:0000000175ED6752 DCB 0 +debug697:0000000175ED6753 DCB 0 +debug697:0000000175ED6754 DCB 0 +debug697:0000000175ED6755 DCB 0 +debug697:0000000175ED6756 DCB 0 +debug697:0000000175ED6757 DCB 0 +debug697:0000000175ED6758 DCB 0 +debug697:0000000175ED6759 DCB 0 +debug697:0000000175ED675A DCB 0 +debug697:0000000175ED675B DCB 0 +debug697:0000000175ED675C DCB 0 +debug697:0000000175ED675D DCB 0 +debug697:0000000175ED675E DCB 0 +debug697:0000000175ED675F DCB 0 +debug697:0000000175ED6760 DCB 0 +debug697:0000000175ED6761 DCB 0 +debug697:0000000175ED6762 DCB 0 +debug697:0000000175ED6763 DCB 0 +debug697:0000000175ED6764 DCB 0 +debug697:0000000175ED6765 DCB 0 +debug697:0000000175ED6766 DCB 0 +debug697:0000000175ED6767 DCB 0 +debug697:0000000175ED6768 DCB 0 +debug697:0000000175ED6769 DCB 0 +debug697:0000000175ED676A DCB 0 +debug697:0000000175ED676B DCB 0 +debug697:0000000175ED676C DCB 0 +debug697:0000000175ED676D DCB 0 +debug697:0000000175ED676E DCB 0 +debug697:0000000175ED676F DCB 0 +debug697:0000000175ED6770 DCB 0 +debug697:0000000175ED6771 DCB 0 +debug697:0000000175ED6772 DCB 0 +debug697:0000000175ED6773 DCB 0 +debug697:0000000175ED6774 DCB 0 +debug697:0000000175ED6775 DCB 0 +debug697:0000000175ED6776 DCB 0 +debug697:0000000175ED6777 DCB 0 +debug697:0000000175ED6778 DCB 0 +debug697:0000000175ED6779 DCB 0 +debug697:0000000175ED677A DCB 0 +debug697:0000000175ED677B DCB 0 +debug697:0000000175ED677C DCB 0 +debug697:0000000175ED677D DCB 0 +debug697:0000000175ED677E DCB 0 +debug697:0000000175ED677F DCB 0 +debug697:0000000175ED6780 DCB 3 +debug697:0000000175ED6781 DCB 0 +debug697:0000000175ED6782 DCB 0 +debug697:0000000175ED6783 DCB 0 +debug697:0000000175ED6784 DCB 0 +debug697:0000000175ED6785 DCB 0 +debug697:0000000175ED6786 DCB 0 +debug697:0000000175ED6787 DCB 0 +debug697:0000000175ED6788 DCB 0 +debug697:0000000175ED6789 DCB 0 +debug697:0000000175ED678A DCB 0xAA +debug697:0000000175ED678B DCB 0xAA +debug697:0000000175ED678C DCB 0xAA +debug697:0000000175ED678D DCB 0xAA +debug697:0000000175ED678E DCB 0xAA +debug697:0000000175ED678F DCB 0xAA +debug697:0000000175ED6790 DCB 0x98 +debug697:0000000175ED6791 DCB 0x67 ; g +debug697:0000000175ED6792 DCB 0xED +debug697:0000000175ED6793 DCB 0x75 ; u +debug697:0000000175ED6794 DCB 1 +debug697:0000000175ED6795 DCB 0 +debug697:0000000175ED6796 DCB 0 +debug697:0000000175ED6797 DCB 0 +debug697:0000000175ED6798 DCB 0 +debug697:0000000175ED6799 DCB 0 +debug697:0000000175ED679A DCB 0 +debug697:0000000175ED679B DCB 0 +debug697:0000000175ED679C DCB 0 +debug697:0000000175ED679D DCB 0 +debug697:0000000175ED679E DCB 0 +debug697:0000000175ED679F DCB 0 ``` diff --git a/idapro/analysis_x.py b/idapro/analysis_x.py index 20a627e..d7bb07f 100644 --- a/idapro/analysis_x.py +++ b/idapro/analysis_x.py @@ -193,4 +193,4 @@ analyze_all_args() example_usage() """ -print_register_struct("X2", 128, 4) \ No newline at end of file +print_register_struct("X1", 128, 4) \ No newline at end of file diff --git a/idapro/trigger_send.py b/idapro/trigger_send.py new file mode 100644 index 0000000..ac5b63a --- /dev/null +++ b/idapro/trigger_send.py @@ -0,0 +1,66 @@ +import ida_idd +import ida_bytes + +# 改task id， 改 cgi，改第一个指针即可 + +payload = ( + b"\xFF\x00\x00\x00\x0A\x02\x00\x00" # 0x00 // task id / cmd id 175ED6600 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x08 + b"\x03\x00\x00\x00\x10\x00\x00\x00" # 0x10 + b"\x70\xa9\x07\xb8\x0c\x00\x00\x00" # 0x18 // cgi + b"\x20\x00\x00\x00\x00\x00\x00\x00" # 0x20 + b"\x30\x00\x00\x00\x00\x00\x00\x80" # 0x28 + b"\x00\x01\x01\x01\x00\xAA\xAA\xAA" # 0x30 + b"\x00\x00\x00\x00\x03\x00\x00\x00" # 0x38 + b"\x01\x00\x00\x00\xFF\xFF\xFF\xFF" # 0x40 + b"\xFF\xFF\xFF\xFF\x00\xAA\xAA\xAA" # 0x48 + b"\xFF\xFF\xFF\xFF\xAA\xAA\xAA\xAA" # 0x50 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x58 + b"\x0A\x02\x00\x00\x00\x00\x00\x00" # 0x60 + b"\x64\x65\x66\x61\x75\x6C\x74\x2D" # 0x68 (default-) + b"\x6C\x6F\x6E\x67\x6C\x69\x6E\x6B" # 0x70 (longlink) + b"\x00\xAA\xAA\xAA\xAA\xAA\xAA\x10" # 0x78 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x80 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x88 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x90 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x98 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xA0 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xA8 + b"\x00\x00\x00\x00\xAA\xAA\xAA\xAA" # 0xB0 + b"\xC0\x66\xED\x75\x01\x00\x00\x00" # 0xB8 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xC0 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xC8 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xD0 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xD8 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xE0 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xE8 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xF0 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0xF8 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x100 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x108 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x110 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x118 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x120 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x128 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x130 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x138 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x140 + b"\x01\x00\x00\x00\xAA\xAA\xAA\xAA" # 0x148 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x150 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x158 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x160 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x168 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x170 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x178 + b"\x03\x00\x00\x00\x00\x00\x00\x00" # 0x180 + b"\x00\x00\xAA\xAA\xAA\xAA\xAA\xAA" # 0x188 + b"\x98\x67\xED\x75\x01\x00\x00\x00" # 0x190 + b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x198 +) +ida_bytes.patch_bytes(0x175ED6600, payload) + +try: + Appcall.sub_10444B75C(0x8776FE800, 0x175ED6600) + print("Executed with manually set X0.") +except Exception as e: + print(f"Error: {e}") \ No newline at end of file diff --git a/idapro/trigger_task.py b/idapro/trigger_task.py new file mode 100644 index 0000000..9f4decb --- /dev/null +++ b/idapro/trigger_task.py @@ -0,0 +1,3 @@ + + +Appcall.netimplement_StartTask_1033EEC84(0xC374FC818, 0xC3813F200) \ No newline at end of file