From a0d9f3437f139a1bcf0151f3291f97c7d3103075 Mon Sep 17 00:00:00 2001
From: jackyin <648588267@qq.com>
Date: Fri, 28 Nov 2025 14:01:03 +0800
Subject: [PATCH 1/4] Update frida-wechat.md

---
 frida-wechat.md | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/frida-wechat.md b/frida-wechat.md
index 6aec202..1545016 100644
--- a/frida-wechat.md
+++ b/frida-wechat.md
@@ -38,4 +38,27 @@ Operation: read
 sub_104622628 应该是日志打印的函数        
 0x1057ee3a8 会打印输入框的文字        
 0x105B7E990 QNSView handleKeyEvent:eventType 键盘事件        
- sub_104A15520 -> sub_1049FB5BC -> sub_1049FB958->sub_1049FF850 -> sub_1049E9E68 -> sub_10461CE50 -> write 发送消息的方法
+sub_104A15520 -> sub_1049FB5BC -> sub_1049FB958->sub_1049FF850 -> sub_1049E9E68 -> sub_10461CE50 -> write 发送消息的方法        
+
+["104565AD0", "104566E24", "1045CF820", "104590888", "1045BFED0", "104394290", "1043877CC", "104387764", "1043382C0"] 加密的方法        
+1045BFED0 收消息 的入口之一，可以往上再追一下, 发消息也有可能是入口        
+```
+0x105527d30 WeChat!0x45bfd30 (0x1045bfd30)
+0x1052fc2cc WeChat!0x43942cc (0x1043942cc)
+0x1033c2a3c WeChat!0x245aa3c (0x10245aa3c)
+0x10535389c WeChat!0x43eb89c (0x1043eb89c)
+0x1052a0314 WeChat!0x4338314 (0x104338314)
+0x105352e9c WeChat!0x43eae9c (0x1043eae9c)
+0x103c465ac WeChat!0x2cde5ac (0x102cde5ac)
+0x1033bcdd0 WeChat!0x2454dd0 (0x102454dd0)
+0x1033e221c WeChat!0x247a21c (0x10247a21c)
+0x10535389c WeChat!0x43eb89c (0x1043eb89c)
+0x1052a0314 WeChat!0x4338314 (0x104338314)
+0x105352e9c WeChat!0x43eae9c (0x1043eae9c)
+0x103c465ac WeChat!0x2cde5ac (0x102cde5ac)
+0x1033e1c64 WeChat!0x2479c64 (0x102479c64)
+0x103d711bc WeChat!0x2e091bc (0x102e091bc)
+0x104faea1c WeChat!0x4046a1c (0x104046a1c)
+```
+
+

From b86b77bd7898824895037cbfa4e0c3f368eeeb44 Mon Sep 17 00:00:00 2001
From: jackyin <648588267@qq.com>
Date: Fri, 28 Nov 2025 15:19:33 +0800
Subject: [PATCH 2/4] Update frida-wechat.md

---
 frida-wechat.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frida-wechat.md b/frida-wechat.md
index 1545016..cd33ac9 100644
--- a/frida-wechat.md
+++ b/frida-wechat.md
@@ -61,4 +61,4 @@ sub_104A15520 -> sub_1049FB5BC -> sub_1049FB958->sub_1049FF850 -> sub_1049E9E68
 0x104faea1c WeChat!0x4046a1c (0x104046a1c)
 ```
 
-
+102454D74, 10247A138 每次发消息才执行，说明是入口，至少是入库的入口，可以作为入口作为突破 

From 62f7ea1a05ef687142fb7bb8d1c7ceb632225440 Mon Sep 17 00:00:00 2001
From: jackyin <648588267@qq.com>
Date: Fri, 28 Nov 2025 18:20:43 +0800
Subject: [PATCH 3/4] Update frida-wechat.md

---
 frida-wechat.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frida-wechat.md b/frida-wechat.md
index cd33ac9..282f51f 100644
--- a/frida-wechat.md
+++ b/frida-wechat.md
@@ -62,3 +62,4 @@ sub_104A15520 -> sub_1049FB5BC -> sub_1049FB958->sub_1049FF850 -> sub_1049E9E68
 ```
 
 102454D74, 10247A138 每次发消息才执行，说明是入口，至少是入库的入口，可以作为入口作为突破 
+102479A30 这个函数 调用 sub_103D6C730 出来的值

From ed3e582581cbfbbdd6d4512b50f0e183cca161ec Mon Sep 17 00:00:00 2001
From: jackyin <648588267@qq.com>
Date: Mon, 1 Dec 2025 16:56:15 +0800
Subject: [PATCH 4/4] Update frida-wechat.md

---
 frida-wechat.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/frida-wechat.md b/frida-wechat.md
index 282f51f..b38a1c2 100644
--- a/frida-wechat.md
+++ b/frida-wechat.md
@@ -61,5 +61,11 @@ sub_104A15520 -> sub_1049FB5BC -> sub_1049FB958->sub_1049FF850 -> sub_1049E9E68
 0x104faea1c WeChat!0x4046a1c (0x104046a1c)
 ```
 
-102454D74, 10247A138 每次发消息才执行，说明是入口，至少是入库的入口，可以作为入口作为突破 
+102454D74, 10247A138 每次发消息才执行，说明是入口，至少是入库的入口，可以作为入口作为突破   
+
 102479A30 这个函数 调用 sub_103D6C730 出来的值
+sub_103D6C7A8 -> sub_102B66BEC -> sub_104169108 这个函数拿到数据
+
+102B66C30 这个位置可以拿到消息数据
+
+