diff --git a/onebot/main.go b/onebot/main.go index 9c7717c..a0ad8c9 100644 --- a/onebot/main.go +++ b/onebot/main.go @@ -16,6 +16,7 @@ import ( "os/signal" "sync/atomic" "syscall" + "text/template" "time" "github.com/frida/frida-go/frida" @@ -63,6 +64,8 @@ type Config struct { FridaGadgetAddr string `json:"frida_gadget_addr"` WechatPid int `json:"wechat_pid"` OnebotToken string `json:"onebot_token"` + + WechatConf string `json:"wechat_conf"` } func initFlag() { @@ -72,6 +75,7 @@ func initFlag() { flag.StringVar(&config.FridaGadgetAddr, "gadget_addr", "127.0.0.1:27042", "Gadget 地址: 127.0.0.1:27042 仅当 type 为 gadget 时有效") flag.IntVar(&config.WechatPid, "wechat_pid", 0, "微信进程 ID: 58183, 仅当 type 为 local 时有效") flag.StringVar(&config.OnebotToken, "token", "MuseBot", "OneBot Token: 123456") + flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_6_12_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json") flag.Parse() @@ -81,6 +85,7 @@ func initFlag() { fmt.Println("FridaGadgetAddr", config.FridaGadgetAddr) fmt.Println("WechatPid", config.WechatPid) fmt.Println("OnebotToken", config.OnebotToken) + fmt.Println("WechatConf", config.WechatConf) } @@ -121,8 +126,35 @@ func initFrida() { } func loadJs() { - js, _ := os.ReadFile("./script.js") - script, err := session.CreateScript(string(js)) + jsonData, err := os.ReadFile(config.WechatConf) + if err != nil { + log.Fatalf("读取文件失败: %v\n", err) + } + + // 2. 将 JSON 解析为 Map + var wechatHookConf map[string]interface{} + if err := json.Unmarshal(jsonData, &wechatHookConf); err != nil { + log.Fatalf("解析 JSON 失败: %v\n", err) + } + + codeTemplate, err := os.ReadFile("./script.js") + if err != nil { + log.Fatalf("读取脚本失败: %v\n", err) + } + + tmpl, err := template.New("fridaScript").Parse(string(codeTemplate)) + if err != nil { + fmt.Printf("解析模板失败: %v\n", err) + return + } + + var buf bytes.Buffer + err = tmpl.Execute(&buf, wechatHookConf) + if err != nil { + log.Fatalf("执行模板失败: %v\n", err) + } + + script, err := session.CreateScript(buf.String()) if err != nil { log.Fatalf("❌ 创建脚本失败: %v\n", err) } diff --git a/onebot/script.js b/onebot/script.js index 39a4a30..28f91f4 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -6,21 +6,38 @@ if (!baseAddr) { console.log("[+] WeChat base address: " + baseAddr); // 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来 -var triggerFuncAddr = baseAddr.add(0x444A99C); -var sendMessageCallbackFunc = baseAddr.add(0xEDB4678); -var messageCallbackFunc1 = baseAddr.add(0x7f04f70); -var messageCallbackFunc2 = baseAddr.add(0x7f04fc8); -var messageCallbackFunc3 = baseAddr.add(0x7f96918); -var messageCallbackFunc4 = baseAddr.add(0x7f96a08); -var messageCallbackFunc5 = baseAddr.add(0x7f968a0); -var messageCallbackFunc6 = baseAddr.add(0x7f9dfe0); +var triggerFuncAddr = baseAddr.add({{.triggerFuncAddr}}); +var sendMessageCallbackFunc = baseAddr.add({{.sendMessageCallbackFunc}}); +var messageCallbackFunc1 = baseAddr.add({{.messageCallbackFunc1}}); +var messageCallbackFunc2 = baseAddr.add({{.messageCallbackFunc2}}); +var messageCallbackFunc3 = baseAddr.add({{.messageCallbackFunc3}}); +var messageCallbackFunc4 = baseAddr.add({{.messageCallbackFunc4}}); +var messageCallbackFunc5 = baseAddr.add({{.messageCallbackFunc5}}); +var messageCallbackFunc6 = baseAddr.add({{.messageCallbackFunc6}}); // 这个必须是绝对位置 -var triggerX1Payload = ptr(0x175ED6600); -var req2bufEnterAddr = baseAddr.add(0x33EE8E8); -var req2bufExitAddr = baseAddr.add(0x33EFA00); -var protobufAddr = baseAddr.add(0x223EF58); -var receiveAddr = baseAddr.add(0x23B5348); +var triggerX1Payload = ptr({{.triggerX1Payload}}); +var req2bufEnterAddr = baseAddr.add({{.req2bufEnterAddr}}); +var req2bufExitAddr = baseAddr.add({{.req2bufExitAddr}}); +var protobufAddr = baseAddr.add({{.protobufAddr}}); +var receiveAddr = baseAddr.add({{.receiveAddr}}); + +// // 触发函数地址,不同版本的地址看wechat_version 中的json文件复制过来 +// var triggerFuncAddr = baseAddr.add(0x444A99C); +// var sendMessageCallbackFunc = baseAddr.add(0xEDB4678); +// var messageCallbackFunc1 = baseAddr.add(0x7f04f70); +// var messageCallbackFunc2 = baseAddr.add(0x7f04fc8); +// var messageCallbackFunc3 = baseAddr.add(0x7f96918); +// var messageCallbackFunc4 = baseAddr.add(0x7f96a08); +// var messageCallbackFunc5 = baseAddr.add(0x7f968a0); +// var messageCallbackFunc6 = baseAddr.add(0x7f9dfe0); +// +// // 这个必须是绝对位置 +// var triggerX1Payload = ptr(0x175ED6600); +// var req2bufEnterAddr = baseAddr.add(0x33EE8E8); +// var req2bufExitAddr = baseAddr.add(0x33EFA00); +// var protobufAddr = baseAddr.add(0x223EF58); +// var receiveAddr = baseAddr.add(0x23B5348); // 触发函数X0参数地址 var globalMessagePtr = ptr(0); diff --git a/wechat_version/4_1_6_12.json b/wechat_version/4_1_6_12_mac.json similarity index 78% rename from wechat_version/4_1_6_12.json rename to wechat_version/4_1_6_12_mac.json index 62f738a..5fbd970 100755 --- a/wechat_version/4_1_6_12.json +++ b/wechat_version/4_1_6_12_mac.json @@ -6,8 +6,10 @@ "messageCallbackFunc3": "0x7f96918", "messageCallbackFunc4": "0x7f96a08", "messageCallbackFunc5": "0x7f968a0", + "messageCallbackFunc6": "0x7f9dfe0", "triggerX1Payload": "0x175ED6600", "req2bufEnterAddr": "0x33EE8E8", "req2bufExitAddr": "0x33EFA00", - "protobufAddr": "0x223EF58" -} \ No newline at end of file + "protobufAddr": "0x223EF58", + "receiveAddr": "0x23B5348" +}