diff --git a/frida-wechat.md b/frida-wechat.md
index b38a1c2..6b57ee3 100644
--- a/frida-wechat.md
+++ b/frida-wechat.md
@@ -36,8 +36,10 @@ Operation: read
 ```
 
 sub_104622628 应该是日志打印的函数        
-0x1057ee3a8 会打印输入框的文字        
+0x105a01e84 会打印输入框的文字        
 0x105B7E990 QNSView handleKeyEvent:eventType 键盘事件        
+
+
 sub_104A15520 -> sub_1049FB5BC -> sub_1049FB958->sub_1049FF850 -> sub_1049E9E68 -> sub_10461CE50 -> write 发送消息的方法        
 
 ["104565AD0", "104566E24", "1045CF820", "104590888", "1045BFED0", "104394290", "1043877CC", "104387764", "1043382C0"] 加密的方法        
diff --git a/mars.md b/mars.md
new file mode 100644
index 0000000..cd63196
--- /dev/null
+++ b/mars.md
@@ -0,0 +1,22 @@
+# 全新思路
+https://bbs.kanxue.com/thread-286611.htm    
+
+## 步骤
+1. 下载mars https://github.com/Tencent/mars/tree/master?tab=readme-ov-file#mars_cn
+ ```
+ cd mars
+ python3 build_osx.py
+ cd  cmake_build/OSX/Darwin.out
+ ar -x libxlog.a
+for f in *.o; do
+    /Applications/IDA\ Professional\ 9.1.app/Contents/MacOS/tools/flair/pmacho "$f"
+done
+
+/Applications/IDA\ Professional\ 9.1.app/Contents/MacOS/tools/flair/sigmake *pat a.sig 
+ ```
+使用flair    
+```
+/Applications/IDA\ Professional\ 9.1.app/Contents/MacOS/tools/flair/pmacho libxlog.a libxlog.pat
+
+
+```