From 72464bd6d7b5aa9ebc6d9968526d2aeaa9e78131 Mon Sep 17 00:00:00 2001
From: jackyin <648588267@qq.com>
Date: Tue, 2 Dec 2025 14:37:58 +0800
Subject: [PATCH 1/4] Update frida-wechat.md

---
 frida-wechat.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/frida-wechat.md b/frida-wechat.md
index b38a1c2..c938fc6 100644
--- a/frida-wechat.md
+++ b/frida-wechat.md
@@ -38,6 +38,8 @@ Operation: read
 sub_104622628 应该是日志打印的函数        
 0x1057ee3a8 会打印输入框的文字        
 0x105B7E990 QNSView handleKeyEvent:eventType 键盘事件        
+
+
 sub_104A15520 -> sub_1049FB5BC -> sub_1049FB958->sub_1049FF850 -> sub_1049E9E68 -> sub_10461CE50 -> write 发送消息的方法        
 
 ["104565AD0", "104566E24", "1045CF820", "104590888", "1045BFED0", "104394290", "1043877CC", "104387764", "1043382C0"] 加密的方法        

From 227b9a88b0623fe9891554dccb480d21b2aaa13e Mon Sep 17 00:00:00 2001
From: jackyin <648588267@qq.com>
Date: Tue, 2 Dec 2025 18:34:12 +0800
Subject: [PATCH 2/4] Update frida-wechat.md

---
 frida-wechat.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frida-wechat.md b/frida-wechat.md
index c938fc6..6b57ee3 100644
--- a/frida-wechat.md
+++ b/frida-wechat.md
@@ -36,7 +36,7 @@ Operation: read
 ```
 
 sub_104622628 应该是日志打印的函数        
-0x1057ee3a8 会打印输入框的文字        
+0x105a01e84 会打印输入框的文字        
 0x105B7E990 QNSView handleKeyEvent:eventType 键盘事件        
 
 

From c4d80f6095c7bb93fb8a71816ec41fa02cb7871f Mon Sep 17 00:00:00 2001
From: jackyin <648588267@qq.com>
Date: Wed, 3 Dec 2025 15:56:25 +0800
Subject: [PATCH 3/4] Create mars.md

---
 mars.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 mars.md

diff --git a/mars.md b/mars.md
new file mode 100644
index 0000000..ef9fc6e
--- /dev/null
+++ b/mars.md
@@ -0,0 +1,22 @@
+# 全新思路
+https://bbs.kanxue.com/thread-286611.htm    
+
+## 步骤
+1. 下载mars https://github.com/Tencent/mars/tree/master?tab=readme-ov-file#mars_cn
+ ```
+ cd mars
+ python3 build_osx.py
+ cd  cmake_build/OSX/Darwin.out
+ ar -x *.a
+for f in *.o; do
+    /Applications/IDA\ Professional\ 9.1.app/Contents/MacOS/tools/flair/pmacho "$f"
+done
+
+/Applications/IDA\ Professional\ 9.1.app/Contents/MacOS/tools/flair/sigmake *pat a.sig 
+ ```
+使用flair    
+```
+/Applications/IDA\ Professional\ 9.1.app/Contents/MacOS/tools/flair/pmacho libxlog.a libxlog.pat
+
+
+```

From 4e718c5baf6eb5fd11c77e4cfd58f44244b671d0 Mon Sep 17 00:00:00 2001
From: jackyin <648588267@qq.com>
Date: Wed, 3 Dec 2025 19:55:27 +0800
Subject: [PATCH 4/4] Update mars.md

---
 mars.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mars.md b/mars.md
index ef9fc6e..cd63196 100644
--- a/mars.md
+++ b/mars.md
@@ -7,7 +7,7 @@ https://bbs.kanxue.com/thread-286611.htm
  cd mars
  python3 build_osx.py
  cd  cmake_build/OSX/Darwin.out
- ar -x *.a
+ ar -x libxlog.a
 for f in *.o; do
     /Applications/IDA\ Professional\ 9.1.app/Contents/MacOS/tools/flair/pmacho "$f"
 done