tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

finish 55

Browse Source
This commit is contained in:
yincong
2026-02-26 09:34:53 +08:00
parent e9abe629dc
commit b30aa9b580
3 changed files with 29 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frida/image.js
+17 -17
View File
@@ -173,7 +173,7 @@ var patchImgProtobufFunc1 = baseAddr.add(0x2455530)
var patchImgProtobufFunc2 = baseAddr.add(0x2455550);
var imgProtobufDeleteAddr = baseAddr.add(0x245558C);
var CndOnCompleteAddr = baseAddr.add(0x36B03A0);
var imgMessageCallbackFunc1 = baseAddr.add(0x8781AF8);
var imgMessageCallbackFunc1 = baseAddr.add(0x8780AD8);
var uploadImageX1;
var imgCgiAddr = ptr(0);
@@ -741,26 +741,26 @@ function attachGetCallbackFromWrapper() {
return
}
console.log("[+] GetCallbackFromWrapper x8: " + this.context.x8);
uploadCallback.add(0x10).writePointer(baseAddr.add(0x36AFFEC));
uploadCallback.add(0x10).writePointer(baseAddr.add(0x36AFBEC));
this.context.x8 = uploadCallback;
console.log("[+] GetCallbackFromWrapper x8: " + this.context.x8);
}
})
// Interceptor.attach(baseAddr.add(0x47A3E24), {
// onEnter: function (args) {
// const tmpFileId = this.context.x1.readPointer().readUtf8String();
// const fileId = imageIdAddr.readUtf8String();
// if (tmpFileId !== fileId) {
// console.log("[+] OnComplete tmpFileId: " + tmpFileId + " fileId: " + fileId);
// return
// }
//
// console.log("[+] OnComplete x8: " + this.context.x8);
// uploadCallback.add(0x30).writePointer(baseAddr.add(0x358E398));
// this.context.x8 = uploadCallback;
// }
// })
Interceptor.attach(baseAddr.add(0x4906EC8), {
onEnter: function (args) {
const tmpFileId = this.context.x1.readPointer().readUtf8String();
const fileId = imageIdAddr.readUtf8String();
if (tmpFileId !== fileId) {
console.log("[+] OnComplete tmpFileId: " + tmpFileId + " fileId: " + fileId);
return
}
console.log("[+] OnComplete x8: " + this.context.x8);
uploadCallback.add(0x30).writePointer(baseAddr.add(0x36B0DD0));
this.context.x8 = uploadCallback;
}
})
}
setImmediate(attachGetCallbackFromWrapper);
onebot/main.go
+1 -1
View File
@@ -102,7 +102,7 @@ func initFlag() {
flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效")
flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot")
flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_31_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_55_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
flag.Parse()
wechat_version/4_1_7_55_mac.json
+11 -11
View File
@@ -6,16 +6,16 @@
"sendFuncAddr": "0x47F1888",
"req2bufEnterAddr": "0x36F1614",
"req2bufExitAddr": "0x36F27EC",
"imgProtobufAddr": "",
"patchImgProtobufFunc1": "",
"patchImgProtobufFunc2": "",
"imgProtobufDeleteAddr": "",
"imgMessageCallbackFunc1": "",
"uploadImageAddr": "",
"CndOnCompleteAddr": "",
"imgProtobufAddr": "0x2455574",
"patchImgProtobufFunc1": "0x2455530",
"patchImgProtobufFunc2": "0x2455550",
"imgProtobufDeleteAddr": "0x245558C",
"imgMessageCallbackFunc1": "0x8780AD8",
"uploadImageAddr": "0x4938E08",
"CndOnCompleteAddr": "0x36B03A0",
"buf2RespAddr": "0x37173B0",
"uploadGetCallbackWrapperAddr": "",
"uploadGetCallbackWrapperFuncAddr": "",
"uploadOnCompleteAddr": "",
"uploadOnCompleteFuncAddr": ""
"uploadGetCallbackWrapperAddr": "0x49068CC",
"uploadGetCallbackWrapperFuncAddr": "0x36AFBEC",
"uploadOnCompleteAddr": "0x4906EC8",
"uploadOnCompleteFuncAddr": "0x36B0DD0"
}