From b30aa9b5800eefd45755c79fddcfe62978d4296d Mon Sep 17 00:00:00 2001
From: yincong <yincong@baidu.com>
Date: Thu, 26 Feb 2026 09:34:53 +0800
Subject: [PATCH] finish 55

---
 frida/image.js                   | 34 ++++++++++++++++----------------
 onebot/main.go                   |  2 +-
 wechat_version/4_1_7_55_mac.json | 22 ++++++++++-----------
 3 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/frida/image.js b/frida/image.js
index e9ef0fb..30e3a3c 100644
--- a/frida/image.js
+++ b/frida/image.js
@@ -173,7 +173,7 @@ var patchImgProtobufFunc1 = baseAddr.add(0x2455530)
 var patchImgProtobufFunc2 = baseAddr.add(0x2455550);
 var imgProtobufDeleteAddr = baseAddr.add(0x245558C);
 var CndOnCompleteAddr = baseAddr.add(0x36B03A0);
-var imgMessageCallbackFunc1 = baseAddr.add(0x8781AF8);
+var imgMessageCallbackFunc1 = baseAddr.add(0x8780AD8);
 
 var uploadImageX1;
 var imgCgiAddr = ptr(0);
@@ -741,26 +741,26 @@ function attachGetCallbackFromWrapper() {
                 return
             }
 
-            console.log("[+] GetCallbackFromWrapper x8: " + this.context.x8);
-            uploadCallback.add(0x10).writePointer(baseAddr.add(0x36AFFEC));
+            uploadCallback.add(0x10).writePointer(baseAddr.add(0x36AFBEC));
             this.context.x8 = uploadCallback;
+            console.log("[+] GetCallbackFromWrapper x8: " + this.context.x8);
         }
     })
 
-    // Interceptor.attach(baseAddr.add(0x47A3E24), {
-    //     onEnter: function (args) {
-    //         const tmpFileId = this.context.x1.readPointer().readUtf8String();
-    //         const fileId = imageIdAddr.readUtf8String();
-    //         if (tmpFileId !== fileId) {
-    //             console.log("[+] OnComplete tmpFileId: " + tmpFileId + " fileId: " + fileId);
-    //             return
-    //         }
-    //
-    //         console.log("[+] OnComplete x8: " + this.context.x8);
-    //         uploadCallback.add(0x30).writePointer(baseAddr.add(0x358E398));
-    //         this.context.x8 = uploadCallback;
-    //     }
-    // })
+    Interceptor.attach(baseAddr.add(0x4906EC8), {
+        onEnter: function (args) {
+            const tmpFileId = this.context.x1.readPointer().readUtf8String();
+            const fileId = imageIdAddr.readUtf8String();
+            if (tmpFileId !== fileId) {
+                console.log("[+] OnComplete tmpFileId: " + tmpFileId + " fileId: " + fileId);
+                return
+            }
+
+            console.log("[+] OnComplete x8: " + this.context.x8);
+            uploadCallback.add(0x30).writePointer(baseAddr.add(0x36B0DD0));
+            this.context.x8 = uploadCallback;
+        }
+    })
 }
 
 setImmediate(attachGetCallbackFromWrapper);
diff --git a/onebot/main.go b/onebot/main.go
index f586201..b1b733d 100644
--- a/onebot/main.go
+++ b/onebot/main.go
@@ -102,7 +102,7 @@ func initFlag() {
 	flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效")
 	flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: MuseBot")
 	flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
-	flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_31_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
+	flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_55_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
 	
 	flag.Parse()
 	
diff --git a/wechat_version/4_1_7_55_mac.json b/wechat_version/4_1_7_55_mac.json
index 3f0a39a..fa37678 100644
--- a/wechat_version/4_1_7_55_mac.json
+++ b/wechat_version/4_1_7_55_mac.json
@@ -6,16 +6,16 @@
   "sendFuncAddr": "0x47F1888",
   "req2bufEnterAddr": "0x36F1614",
   "req2bufExitAddr": "0x36F27EC",
-  "imgProtobufAddr": "",
-  "patchImgProtobufFunc1": "",
-  "patchImgProtobufFunc2": "",
-  "imgProtobufDeleteAddr": "",
-  "imgMessageCallbackFunc1": "",
-  "uploadImageAddr": "",
-  "CndOnCompleteAddr": "",
+  "imgProtobufAddr": "0x2455574",
+  "patchImgProtobufFunc1": "0x2455530",
+  "patchImgProtobufFunc2": "0x2455550",
+  "imgProtobufDeleteAddr": "0x245558C",
+  "imgMessageCallbackFunc1": "0x8780AD8",
+  "uploadImageAddr": "0x4938E08",
+  "CndOnCompleteAddr": "0x36B03A0",
   "buf2RespAddr": "0x37173B0",
-  "uploadGetCallbackWrapperAddr": "",
-  "uploadGetCallbackWrapperFuncAddr": "",
-  "uploadOnCompleteAddr": "",
-  "uploadOnCompleteFuncAddr": ""
+  "uploadGetCallbackWrapperAddr": "0x49068CC",
+  "uploadGetCallbackWrapperFuncAddr": "0x36AFBEC",
+  "uploadOnCompleteAddr": "0x4906EC8",
+  "uploadOnCompleteFuncAddr": "0x36B0DD0"
 }