use json

onebot/main.go

@@ -16,6 +16,7 @@ import (
 	"os/signal"
 	"sync/atomic"
 	"syscall"
+	"text/template"
 	"time"
 	
 	"github.com/frida/frida-go/frida"
@@ -63,6 +64,8 @@ type Config struct {
 	FridaGadgetAddr string `json:"frida_gadget_addr"`
 	WechatPid       int    `json:"wechat_pid"`
 	OnebotToken     string `json:"onebot_token"`
+	
+	WechatConf string `json:"wechat_conf"`
 }
 
 func initFlag() {
@@ -72,6 +75,7 @@ func initFlag() {
 	flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效")
 	flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效")
 	flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: 123456")
+	flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_6_12_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
 	
 	flag.Parse()
 	
@@ -81,6 +85,7 @@ func initFlag() {
 	fmt.Println("FridaGadgetAddr", config.FridaGadgetAddr)
 	fmt.Println("WechatPid", config.WechatPid)
 	fmt.Println("OnebotToken", config.OnebotToken)
+	fmt.Println("WechatConf", config.WechatConf)
 	
 }
 
@@ -121,8 +126,35 @@ func initFrida() {
 }
 
 func loadJs() {
-	js, _ := os.ReadFile("./script.js")
-	script, err := session.CreateScript(string(js))
+	jsonData, err := os.ReadFile(config.WechatConf)
+	if err != nil {
+		log.Fatalf("读取文件失败: %v\n", err)
+	}
+	
+	// 2. 将 JSON 解析为 Map
+	var wechatHookConf map[string]interface{}
+	if err := json.Unmarshal(jsonData, &wechatHookConf); err != nil {
+		log.Fatalf("解析 JSON 失败: %v\n", err)
+	}
+	
+	codeTemplate, err := os.ReadFile("./script.js")
+	if err != nil {
+		log.Fatalf("读取脚本失败: %v\n", err)
+	}
+	
+	tmpl, err := template.New("fridaScript").Parse(string(codeTemplate))
+	if err != nil {
+		fmt.Printf("解析模板失败: %v\n", err)
+		return
+	}
+	
+	var buf bytes.Buffer
+	err = tmpl.Execute(&buf, wechatHookConf)
+	if err != nil {
+		log.Fatalf("执行模板失败: %v\n", err)
+	}
+	
+	script, err := session.CreateScript(buf.String())
 	if err != nil {
 		log.Fatalf("❌ 创建脚本失败: %v\n", err)
 	}

onebot/script.js

@@ -6,21 +6,38 @@ if (!baseAddr) {
 console.log("[+] WeChat base address: " + baseAddr);
 
 // 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来
-var triggerFuncAddr = baseAddr.add(0x444A99C);
-var sendMessageCallbackFunc = baseAddr.add(0xEDB4678);
-var messageCallbackFunc1 = baseAddr.add(0x7f04f70);
-var messageCallbackFunc2 = baseAddr.add(0x7f04fc8);
-var messageCallbackFunc3 = baseAddr.add(0x7f96918);
-var messageCallbackFunc4 = baseAddr.add(0x7f96a08);
-var messageCallbackFunc5 = baseAddr.add(0x7f968a0);
-var messageCallbackFunc6 = baseAddr.add(0x7f9dfe0);
+var triggerFuncAddr = baseAddr.add({{.triggerFuncAddr}});
+var sendMessageCallbackFunc = baseAddr.add({{.sendMessageCallbackFunc}});
+var messageCallbackFunc1 = baseAddr.add({{.messageCallbackFunc1}});
+var messageCallbackFunc2 = baseAddr.add({{.messageCallbackFunc2}});
+var messageCallbackFunc3 = baseAddr.add({{.messageCallbackFunc3}});
+var messageCallbackFunc4 = baseAddr.add({{.messageCallbackFunc4}});
+var messageCallbackFunc5 = baseAddr.add({{.messageCallbackFunc5}});
+var messageCallbackFunc6 = baseAddr.add({{.messageCallbackFunc6}});
 
 // 这个必须是绝对位置
-var triggerX1Payload = ptr(0x175ED6600);
-var req2bufEnterAddr = baseAddr.add(0x33EE8E8);
-var req2bufExitAddr = baseAddr.add(0x33EFA00);
-var protobufAddr = baseAddr.add(0x223EF58);
-var receiveAddr = baseAddr.add(0x23B5348);
+var triggerX1Payload = ptr({{.triggerX1Payload}});
+var req2bufEnterAddr = baseAddr.add({{.req2bufEnterAddr}});
+var req2bufExitAddr = baseAddr.add({{.req2bufExitAddr}});
+var protobufAddr = baseAddr.add({{.protobufAddr}});
+var receiveAddr = baseAddr.add({{.receiveAddr}});
+
+// // 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来
+// var triggerFuncAddr = baseAddr.add(0x444A99C);
+// var sendMessageCallbackFunc = baseAddr.add(0xEDB4678);
+// var messageCallbackFunc1 = baseAddr.add(0x7f04f70);
+// var messageCallbackFunc2 = baseAddr.add(0x7f04fc8);
+// var messageCallbackFunc3 = baseAddr.add(0x7f96918);
+// var messageCallbackFunc4 = baseAddr.add(0x7f96a08);
+// var messageCallbackFunc5 = baseAddr.add(0x7f968a0);
+// var messageCallbackFunc6 = baseAddr.add(0x7f9dfe0);
+//
+// // 这个必须是绝对位置
+// var triggerX1Payload = ptr(0x175ED6600);
+// var req2bufEnterAddr = baseAddr.add(0x33EE8E8);
+// var req2bufExitAddr = baseAddr.add(0x33EFA00);
+// var protobufAddr = baseAddr.add(0x223EF58);
+// var receiveAddr = baseAddr.add(0x23B5348);
 
 // 触发函数X0参数地址
 var globalMessagePtr = ptr(0);

wechat_version/4_1_6_12_mac.json

@@ -6,8 +6,10 @@
   "messageCallbackFunc3": "0x7f96918",
   "messageCallbackFunc4": "0x7f96a08",
   "messageCallbackFunc5": "0x7f968a0",
+  "messageCallbackFunc6": "0x7f9dfe0",
   "triggerX1Payload": "0x175ED6600",
   "req2bufEnterAddr": "0x33EE8E8",
   "req2bufExitAddr": "0x33EFA00",
-  "protobufAddr": "0x223EF58"
-}
+  "protobufAddr": "0x223EF58",
+  "receiveAddr": "0x23B5348"
+}