add frida-gadget

frida-gadget/FridaGadget.config

@@ -0,0 +1,8 @@
+{
+  "interaction": {
+    "type": "listen",
+    "address": "127.0.0.1",
+    "port": 27042,
+    "on_load": "resume"
+  }
+}

frida-gadget/readme.md

@@ -0,0 +1,16 @@
+# 克隆源码
+git clone https://github.com/Tyilo/insert_dylib
+
+# 进入目录
+cd insert_dylib
+
+# 使用 Xcode 命令行工具进行编译
+xcodebuild
+
+# 将生成的二进制文件移动到系统路径，方便全局调用
+cp build/Release/insert_dylib /usr/local/bin/       
+cd /Applications/WeChat.app/Contents/MacOS/     
+/usr/local/bin/insert_dylib --inplace --strip-codesig "@executable_path/../Frameworks/FridaGadget.dylib" WeChat     
+./sign.sh        
+cp frida-gadget/FridaGadget.config /Applications/WeChat.app/Contents/Frameworks/        
+frida -H 127.0.0.1:27042 -n Gadget -l ./frida/script.js   

frida-gadget/sign.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+APP_PATH="/Applications/WeChat.app"
+GADGET_PATH="$APP_PATH/Contents/Frameworks/FridaGadget.dylib"
+ENTITLEMENTS="temp.entitlements" # 确保你已经创建了这个文件
+
+echo "开始对 Gadget 签名..."
+codesign -f -s - --timestamp=none "$GADGET_PATH"
+
+echo "开始对所有子框架进行深层签名..."
+# 遍历微信内部所有的 Frameworks 和 dylib 进行签名
+find "$APP_PATH/Contents" -name "*.framework" -or -name "*.dylib" -or -name "*.bundle" | xargs codesign -f -s - --timestamp=none
+
+echo "最后对主程序进行签名并注入 Entitlements..."
+codesign -f -s - --timestamp=none --entitlements "$ENTITLEMENTS" --force "$APP_PATH"
+
+echo "完成！"

frida-gadget/temp.entitlements

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>get-task-allow</key>
+    <true/>
+</dict>
+</plist>

frida/succ.js

@@ -33,7 +33,7 @@ var contentAddr = ptr(0);
 var insertMsgAddr = ptr(0);
 // 消息的taskId
 var taskId = 0x20000090
-var receiver = "wxid_7wd1ece99f7i21"
+var receiver = "wxid_"
 var content = "hello world";
 
 // 打印消息的地址，便于查询问题