tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'refs/remotes/origin/main'

Browse Source
This commit is contained in:
yincong
2025-12-01 20:36:19 +08:00
parent 3310be2553 ed3e582581
commit b6c1bf13fe
1 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frida-wechat.md
+31 -1
View File
@@ -38,4 +38,34 @@ Operation: read
sub_104622628 应该是日志打印的函数
0x1057ee3a8 会打印输入框的文字
0x105B7E990 QNSView handleKeyEvent:eventType 键盘事件
sub_104A15520 -> sub_1049FB5BC -> sub_1049FB958->sub_1049FF850 -> sub_1049E9E68 -> sub_10461CE50 -> write 发送消息的方法
sub_104A15520 -> sub_1049FB5BC -> sub_1049FB958->sub_1049FF850 -> sub_1049E9E68 -> sub_10461CE50 -> write 发送消息的方法
["104565AD0", "104566E24", "1045CF820", "104590888", "1045BFED0", "104394290", "1043877CC", "104387764", "1043382C0"] 加密的方法
1045BFED0 收消息 的入口之一，可以往上再追一下, 发消息也有可能是入口
```
0x105527d30 WeChat!0x45bfd30 (0x1045bfd30)
0x1052fc2cc WeChat!0x43942cc (0x1043942cc)
0x1033c2a3c WeChat!0x245aa3c (0x10245aa3c)
0x10535389c WeChat!0x43eb89c (0x1043eb89c)
0x1052a0314 WeChat!0x4338314 (0x104338314)
0x105352e9c WeChat!0x43eae9c (0x1043eae9c)
0x103c465ac WeChat!0x2cde5ac (0x102cde5ac)
0x1033bcdd0 WeChat!0x2454dd0 (0x102454dd0)
0x1033e221c WeChat!0x247a21c (0x10247a21c)
0x10535389c WeChat!0x43eb89c (0x1043eb89c)
0x1052a0314 WeChat!0x4338314 (0x104338314)
0x105352e9c WeChat!0x43eae9c (0x1043eae9c)
0x103c465ac WeChat!0x2cde5ac (0x102cde5ac)
0x1033e1c64 WeChat!0x2479c64 (0x102479c64)
0x103d711bc WeChat!0x2e091bc (0x102e091bc)
0x104faea1c WeChat!0x4046a1c (0x104046a1c)
```
102454D74, 10247A138 每次发消息才执行，说明是入口，至少是入库的入口，可以作为入口作为突破
102479A30 这个函数 调用 sub_103D6C730 出来的值
sub_103D6C7A8 -> sub_102B66BEC -> sub_104169108 这个函数拿到数据
102B66C30 这个位置可以拿到消息数据