From cc30b0d4a719d87df47d4b3927b574ee79f9c8b3 Mon Sep 17 00:00:00 2001 From: yincong Date: Fri, 28 Nov 2025 13:30:12 +0800 Subject: [PATCH] delete --- .gitignore | 2 + enumhook.js | 127 ------------------------------------- frida/check_point_value.js | 82 ++++++++++++++++++++++++ frida/keydown.js | 29 --------- frida/script.js | 121 ++++++++++++++++++++--------------- function.js | 103 ------------------------------ idapro.js | 45 ------------- keyword.js | 89 -------------------------- log.js | 64 ------------------- log_memaddress.js | 64 ------------------- matchFun.js | 36 ----------- memcpy.js | 43 ------------- memo_check.js | 13 ---- other_memo_check.js | 17 ----- script.js | 63 ------------------ tracelog.js | 21 ------ writedata.js | 62 ------------------ 17 files changed, 154 insertions(+), 827 deletions(-) create mode 100644 .gitignore delete mode 100644 enumhook.js create mode 100644 frida/check_point_value.js delete mode 100644 frida/keydown.js delete mode 100644 function.js delete mode 100644 idapro.js delete mode 100644 keyword.js delete mode 100644 log.js delete mode 100644 log_memaddress.js delete mode 100644 matchFun.js delete mode 100644 memcpy.js delete mode 100644 memo_check.js delete mode 100644 other_memo_check.js delete mode 100644 script.js delete mode 100644 tracelog.js delete mode 100644 writedata.js diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d771a22 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +.idea +__handlers__ \ No newline at end of file diff --git a/enumhook.js b/enumhook.js deleted file mode 100644 index 1389da2..0000000 --- a/enumhook.js +++ /dev/null @@ -1,127 +0,0 @@ -// ====================== -// 安全参数打印 -// ====================== -function safePrintArg(ptr) { - try { - if (!ptr || ptr.isNull()) return ""; - - // 如果能包装成 ObjC 对象 - try { - try { - let o = new ObjC.Object(args[0]); - console.log(o.$className); - - desc = o.toString(); - if (desc.length > 300) desc = desc.slice(0, 300) + "..."; - return `[${cls}] ${desc}`; - } catch (_) { - console.log("raw:", args[0]); - } - } catch (_) { - // 不能包装成 OC 对象，则返回 pointer 地址 - return ptr.toString(); - } - - } catch (e) { - return ``; - } -} - -// ====================== -// Hook 方法工具 -// ====================== -function hookMethod(clsName, methodName) { - try { - const cls = ObjC.classes[clsName]; - if (!cls) return; - - const method = cls[methodName]; - if (!method || !method.implementation) return; - - console.log(`\n🔥 Hooking ${clsName} ${methodName}`); - Interceptor.attach(method.implementation, { - onEnter(args) { - console.log(`\n🚀 ${clsName} ${methodName} called`); - - // 打印参数 x0~x5 - for (let i = 0; i < 6; i++) { - try { - console.log(`arg[${i}]: ${safePrintArg(args[i])}`); - } catch (e) { - console.log(`arg[${i}]: `); - } - } - }, - onLeave(retval) { - console.log(`⬅️ return: ${safePrintArg(retval)}`); - } - }); - } catch (e) { - console.log(`❌ Hook ${clsName} ${methodName} failed: ${e}`); - } -} - -// ====================== -// WeChat 消息加密关键入口列表 -// ====================== -const HOOK_TARGETS = [ - ["WCMessageWrap", "- protobufEncode"], - ["WCMessageWrap", "- serialize"], - - // 发送消息必走 - ["WCProtoBuf", "- encodeMessage:"], - ["WCProtoBuf", "- data"], - - // 尝试抓取 key/data - ["MMEncryptMessage", "- encryptMessage:key:"], - ["WCEncryptHelper", "- encrypt:withKey:"], - ["WCEncryptHelper", "- encryptData:key:"], - - // 发送消息必走路径 - ["WCMessageMgr", "- SendAppMsg:"], - ["WCMessageMgr", "- SendTextMessage:"], - ["WCMessageMgr", "- SendImageMessage:"], - - // 底层 protobuf builder - ["PBGeneratedMessage", "- data"], - ["PBGeneratedMessage", "- serialize"], - - // 经常出现的 encode 函数 - ["MMProtoBase", "- serialize"], - ["MMProtoBase", "- encode"] -]; - -// ====================== -// 挂钩所有关键点 -// ====================== -function hookAll() { - console.log("🚀 WeChat 上层加密 Hook 正在启动...\n"); - - HOOK_TARGETS.forEach(([cls, method]) => { - hookMethod(cls, method); - }); - - // 额外扫描所有类名包含 Encode 或 Message 的 class - console.log("\n🔍 自动扫描 Encode / Message 类..."); - for (const name in ObjC.classes) { - if (!name.includes("Encode") && !name.includes("Message")) continue; - - const cls = ObjC.classes[name]; - const methods = cls.$ownMethods; - - methods.forEach(m => { - if (m.includes("encode") || m.includes("Encrypt") || m.includes("serialize")) { - hookMethod(name, m); - } - }); - } - - console.log("\n🎉 Hook 完成，开始抓取 WeChat 消息明文 / proto / encrypt 信息...\n"); -} - -// ====================== -if (ObjC.available) { - hookAll(); -} else { - setTimeout(hookAll, 1000); -} diff --git a/frida/check_point_value.js b/frida/check_point_value.js new file mode 100644 index 0000000..fd8a81b --- /dev/null +++ b/frida/check_point_value.js @@ -0,0 +1,82 @@ +const mod = Process.getModuleByName("WeChat"); +console.log("[+] Base Address:", mod.base); + +function checkValid(p) { + if (p.isNull()) { + return false; + } + + if (!p.and(0x7).isNull()) { + return false; + } + if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) { + return true; + } + return false; +} + +function handlePr(addr, keyword) { + const realAddr = ptr("0x" + addr).sub("0x100000000").add(mod.base); + console.log("[+] real Address:", realAddr) + + Interceptor.attach(realAddr, { + onEnter(args) { + for (let i = 0; i < 10; i++) { + try { + if (checkValid(args[i])) { + const buf = args[i].readByteArray(128) + if (!buf) { + continue; + } + let s = ""; + const u8 = new Uint8Array(buf); + for (let b of u8) { + if (b >= 0x20 && b <= 0x7E) { + s += String.fromCharCode(b); + } else { + s += "."; + } + } + + if (s.includes(keyword) || keyword === "") { + console.log(`\n[+] ${addr} || arg${i} ${args[i]}`); + console.log(hexdump(args[i], {length: 64})); + console.log(addr + "|| " + s + "\n" + + Thread.backtrace(this.context, Backtracer.ACCURATE) + .map(DebugSymbol.fromAddress).join('\n')); + return; + } + } + } catch (e) { + console.log("Enter Error:", e); + } + } + + + }, + + onLeave(retval) { + console.log(`===== ${addr} LEAVE =====`); + console.log(` ${addr} Return value ${retval}`); + try { + if (checkValid(retval)) { + console.log(addr + "||" + hexdump(retval, { + offset: 0, + length: 64 + })); + } + + } catch (_) { + } + } + }); + +} + + +const prs = ["104565AD0", "104566E24", "1045CF820", "104590888", "1045BFED0", "104394290", "1043877CC", "104387764", "1043382C0"] +const k = ""; +for (let pr of prs) { + handlePr(pr, k); +} + diff --git a/frida/keydown.js b/frida/keydown.js deleted file mode 100644 index ec29c91..0000000 --- a/frida/keydown.js +++ /dev/null @@ -1,29 +0,0 @@ -// 警告：仅为演示AppKit Hooking概念，实际类名和方法可能不同 -// 尝试 Hook NSResponder 的 keyDown: 方法，所有接收键盘事件的对象都会经过它 -var NSResponder = ObjC.classes.NSResponder; - -if (NSResponder) { - console.log("NSResponder class found."); - Interceptor.attach(NSResponder['- keyDown:'].implementation, { - onEnter: function(args) { - // args[2] 是 NSEvent* 键盘事件对象 - console.log("Hooked keyDown: 方法被调用"); - var event = new ObjC.Object(args[2]); - var type = event.type().toString(); - console.log("捕获到键盘事件，类型: " + type); - - // 检查是否为按键按下事件 (NSKeyDown = 10) - if (type === '10') { - var chars = event.charactersIgnoringModifiers().toString(); - // 检查按键是否为回车 (通常chars是"\r"或"\n") - if (chars === '\r' || chars === '\n') { - console.log('>>> 🌟 捕获到 AppKit 层的回车键事件！🌟 <<<'); - // 可以在这里执行您的自定义代码 - } - } - } - }); - console.log("AppKit NSResponder hook loaded."); -} else { - console.log("Failed to find NSResponder class."); -} \ No newline at end of file diff --git a/frida/script.js b/frida/script.js index e5d3915..470b847 100644 --- a/frida/script.js +++ b/frida/script.js @@ -1,63 +1,82 @@ const mod = Process.getModuleByName("WeChat"); -const realAddr = ptr("0x1057ee3a8").sub("0x100000000").add(mod.base); +console.log("[+] Base Address:", mod.base); -console.log("[+] Real Function Address:", realAddr); +function checkValid(p) { + if (p.isNull()) { + return false; + } -Interceptor.attach(realAddr, { - onEnter(args) { - for (let i = 0; i < 10; i++) { - try { - if (args[i].isNull()) { - continue; - } + if (!p.and(0x7).isNull()) { + return false; + } + if (p.compare(ptr("0x600000000000")) >= 0 && p.compare(ptr("0x700000000000")) < 0) { + return true; + } + return false; +} - // console.log(`\n[+] arg${i} ${args[i]}`); - if (args[i].compare(ptr("0x600000000000")) >= 0 && args[i].compare(ptr("0x700000000000")) < 0 && args[i].and(0x7).isNull()) { - const buf = args[i].readByteArray(128) - if (!buf) { - continue; - } - let s = ""; - const u8 = new Uint8Array(buf); - for (let b of u8) { - if (b >= 0x20 && b <= 0x7E) { - s += String.fromCharCode(b); - } else { - s += "."; +function handlePr(addr, keyword) { + const realAddr = ptr("0x" + addr).sub("0x100000000").add(mod.base); + console.log("[+] real Address:", realAddr) + + Interceptor.attach(realAddr, { + onEnter(args) { + for (let i = 0; i < 10; i++) { + try { + if (checkValid(args[i])) { + const buf = args[i].readByteArray(128) + if (!buf) { + continue; + } + let s = ""; + const u8 = new Uint8Array(buf); + for (let b of u8) { + if (b >= 0x20 && b <= 0x7E) { + s += String.fromCharCode(b); + } else { + s += "."; + } + } + + if (s.includes(keyword) || keyword === "") { + console.log(`\n[+] ${addr} || arg${i} ${args[i]}`); + console.log(hexdump(args[i], {length: 64})); + console.log(addr + "|| " + s + "\n" + + Thread.backtrace(this.context, Backtracer.ACCURATE) + .map(DebugSymbol.fromAddress).join('\n')); + return; } } - - - if (s.includes("3.3.3.3")) { - console.log(`\n[+] arg${i} ${args[i]}`); - console.log(hexdump(args[i], { length: 64 })); - // args[i].add(0x18).writeUtf16String("5555"); - // console.log(hexdump(args[i], { length: 64 })); - console.log( - Thread.backtrace(this.context, Backtracer.ACCURATE) - .map(DebugSymbol.fromAddress).join('\n')); - return; - } + } catch (e) { + console.log("Enter Error:", e); } - } catch (e) { - console.log("Enter Error:", e); + } + + + }, + + onLeave(retval) { + console.log(`===== ${addr} LEAVE =====`); + console.log(` ${addr} Return value ${retval}`); + try { + if (checkValid(retval)) { + console.log(addr + "||" + hexdump(retval, { + offset: 0, + length: 64 + })); + } + + } catch (_) { } } + }); + +} - }, - - onLeave(retval) { - // console.log("===== sub_105808800 LEAVE ====="); - // console.log("Return value:", retval); - // try { - // console.log("Return hexdump:"); - // console.log(hexdump(retval, { - // offset: 0, - // length: 128 - // })); - // } catch (_) { - // } - } -}); +const prs = ["1045BFED0"] +const k = ""; +for (let pr of prs) { + handlePr(pr, k); +} diff --git a/function.js b/function.js deleted file mode 100644 index 07af9c7..0000000 --- a/function.js +++ /dev/null @@ -1,103 +0,0 @@ -// ====== 配置：你想 Hook 的 WeChat 函数偏移 ====== -const WECHAT_OFFSETS = [ - 0x4565b2c, - 0x4566f1c, - 0x4564860, - 0x4591ff8, - 0x45d09cc, - 0x45cebbc, - 0x4591fa0, - 0x4581834, - 0x4581760, - 0x4387d08, - 0x4334e88, - 0x4328ebc, - 0x4384764, - 0x43811e8 -]; - -// ====== 统一安全打印函数 ====== -function safePrintRegister(args) { - for (let i = 0; i < 8; i++) { - try { - console.log(`x${i}: ${args[i]}`); - } catch (e) { - console.log(`x${i}: <无法读取> (${e})`); - } - } -} - -function safePrintBacktrace(context) { - try { - let bt = Thread.backtrace( - context, - Backtracer.FUZZY // 更稳定，遇到系统函数更不容易崩 - ).map(DebugSymbol.fromAddress) - .join("\n"); - - console.log("\n--- 调用堆栈 ---"); - console.log(bt); - console.log("-----------------\n"); - - } catch (e) { - console.log("无法获取堆栈：" + e); - } -} - -// ====== 主逻辑：Hook 偏移量函数 ====== -function hook_wechat_internal_functions() { - const wechatModule = Process.findModuleByName("WeChat"); - if (!wechatModule) { - console.error("❌ 找不到 WeChat 模块"); - return; - } - - const base = wechatModule.base; - console.log("📌 WeChat Base:", base); - - WECHAT_OFFSETS.forEach(offset => { - const target = base.add(offset); - - // 尝试符号化 - let funcName = `WeChat!0x${offset.toString(16)}`; - try { - const sym = DebugSymbol.fromAddress(target); - if (sym && sym.name) funcName = sym.name; - } catch (_) {} - - console.log(`\n🔧 准备 Hook: ${funcName} @ 0x${target}`); - - try { - Interceptor.attach(target, { - onEnter(args) { - console.log("\n=============================================="); - console.log(`🚀 进入函数: ${funcName}`); - console.log(`📍 地址: 0x${target}`); - - console.log("\n--- 🧩 寄存器参数 x0-x7 ---"); - safePrintRegister(args); - - console.log("\n--- 🧵 调用堆栈 ---"); - safePrintBacktrace(this.context); - - console.log("==============================================\n"); - }, - - onLeave(retval) { - // 如果需要打印返回值，可打开： - // console.log("返回值:", retval); - } - }); - - console.log(`✅ 已 Hook: ${funcName}`); - - } catch (e) { - console.error(`❌ Hook 失败 @ 0x${target} ：${e}`); - } - }); -} - -// ====== 入口 ====== -setImmediate(() => { - hook_wechat_internal_functions(); -}); diff --git a/idapro.js b/idapro.js deleted file mode 100644 index 073aa8e..0000000 --- a/idapro.js +++ /dev/null @@ -1,45 +0,0 @@ -const mod = Process.getModuleByName("WeChat"); -const realAddr = ptr("0x1057ee3a8").sub("0x100000000").add(mod.base); - -console.log("[+] Real Function Address:", realAddr); - -Interceptor.attach(realAddr, { - onEnter(args) { - for (let i = 0; i < 10; i++) { - try { - if (args[i].isNull()) { - continue; - } - console.log(`\n[+] arg${i} ${args[i]}`); - - if (args[i].compare(ptr("0x600000000000")) >= 0 && args[i].compare(ptr("0x700000000000")) < 0 && args[i].and(0x7).isNull()) { - console.log(hexdump(args[i], { - offset: 0, - length: 128 - })); - } - } catch (e) { - console.log("Enter Error:", e); - } - } - - console.log( - Thread.backtrace(this.context, Backtracer.ACCURATE) - .map(DebugSymbol.fromAddress).join('\n')); - - }, - - onLeave(retval) { - console.log("===== sub_105808800 LEAVE ====="); - console.log("Return value:", retval); - try { - console.log("Return hexdump:"); - console.log(hexdump(retval, { - offset: 0, - length: 128 - })); - } catch (_) { - } - } -}); - diff --git a/keyword.js b/keyword.js deleted file mode 100644 index 9ab940c..0000000 --- a/keyword.js +++ /dev/null @@ -1,89 +0,0 @@ -const keyword = "7.7"; -const addrs = ["6000033DDE48"] -console.log(keyword); -console.log(addrs); - -function memoGet(p) { - p = "0x" + p; - const idaAddr = ptr(p); - MemoryAccessMonitor.enable( - { - base: idaAddr, - size: 0x40 // buffer 大小 - }, - { - onAccess(details) { - console.log("Access by:", details.from); - attach(details.from) - console.log(hexdump(idaAddr, {length: 0x40})); - } - } - ); - -} - -function attach(from) { - const realAddr = ptr(from); - - console.log("[+] Real Function Address:", realAddr); - - Interceptor.attach(realAddr, { - onEnter(args) { - for (let i = 0; i < 10; i++) { - try { - if (args[i].isNull()) { - continue; - } - console.log(`\n[+] arg${i} ${args[i]}`); - - if (args[i].compare(ptr("0x600000000000")) >= 0 && args[i].compare(ptr("0x700000000000")) < 0 && args[i].and(0x7).isNull()) { - const buf = args[i].readByteArray(128) - if (!buf) { - continue; - } - let s = ""; - const u8 = new Uint8Array(buf); - for (let b of u8) { - if (b >= 0x20 && b <= 0x7E) { - s += String.fromCharCode(b); - } else { - s += "."; - } - } - - if (keyword === "" || s.includes(keyword)) { - console.log(`\n[+] arg${i} ${args[i]} ${s}`); - console.log(hexdump(args[i], {length: 128})); - console.log( - Thread.backtrace(this.context, Backtracer.ACCURATE) - .map(DebugSymbol.fromAddress).join('\n')); - return; - } - } - } catch (e) { - console.log("Enter Error:", e); - } - } - - }, - - onLeave(retval) { - console.log("===== sub_105808800 LEAVE ====="); - console.log("Return value:", retval); - try { - if (retval.compare(ptr("0x600000000000")) >= 0 && retval.compare(ptr("0x700000000000")) < 0 && retval.and(0x7).isNull()) { - console.log(hexdump(retval, { - offset: 0, - length: 40 - })); - } - } catch (_) { - } - } - }); -} - - -for (let addr of addrs) { - memoGet(addr); -} \ No newline at end of file diff --git a/log.js b/log.js deleted file mode 100644 index 130fe36..0000000 --- a/log.js +++ /dev/null @@ -1,64 +0,0 @@ -const mod = Process.getModuleByName("WeChat"); -const realAddr = ptr("0x105efadc0").sub("0x100000000").add(mod.base); - -console.log("[+] Real Function Address:", realAddr); - -Interceptor.attach(realAddr, { - onEnter(args) { - for (let i = 0; i < 10; i++) { - try { - if (args[i].isNull()) { - continue; - } - - if (args[i].compare(ptr("0x600000000000")) >= 0 && args[i].compare(ptr("0x700000000000")) < 0 && args[i].and(0x7).isNull()) { - const buf = args[i].readByteArray(128) - if (!buf) { - continue; - } - let s = ""; - const u8 = new Uint8Array(buf); - for (let b of u8) { - if (b >= 0x20 && b <= 0x7E) { - s += String.fromCharCode(b); - } else { - s += "."; - } - } - - console.log(`\n[+] arg${i} ${args[i]} ${s}`); - console.log( - Thread.backtrace(this.context, Backtracer.ACCURATE) - .map(DebugSymbol.fromAddress).join('\n')); - - // if (s.includes(".cc")) { - // console.log(`\n[+] arg${i} ${args[i]} ${s}`); - // console.log(hexdump(args[i], { length: 128 })); - // console.log( - // Thread.backtrace(this.context, Backtracer.ACCURATE) - // .map(DebugSymbol.fromAddress).join('\n')); - // return; - // } - } - } catch (e) { - console.log("Enter Error:", e); - } - } - - - }, - - onLeave(retval) { - // console.log("===== sub_105808800 LEAVE ====="); - // console.log("Return value:", retval); - // try { - // console.log("Return hexdump:"); - // console.log(hexdump(retval, { - // offset: 0, - // length: 128 - // })); - // } catch (_) { - // } - } -}); - diff --git a/log_memaddress.js b/log_memaddress.js deleted file mode 100644 index 35a3b6c..0000000 --- a/log_memaddress.js +++ /dev/null @@ -1,64 +0,0 @@ -const mod = Process.getModuleByName("WeChat"); -const realAddr = ptr("0x10a1f083c"); - -console.log("[+] Real Function Address:", realAddr); - -Interceptor.attach(realAddr, { - onEnter(args) { - for (let i = 0; i < 10; i++) { - try { - if (args[i].isNull()) { - continue; - } - - if (args[i].compare(ptr("0x600000000000")) >= 0 && args[i].compare(ptr("0x700000000000")) < 0 && args[i].and(0x7).isNull()) { - const buf = args[i].readByteArray(128) - if (!buf) { - continue; - } - let s = ""; - const u8 = new Uint8Array(buf); - for (let b of u8) { - if (b >= 0x20 && b <= 0x7E) { - s += String.fromCharCode(b); - } else { - s += "."; - } - } - - console.log(`\n[+] arg${i} ${args[i]} ${s}`); - console.log( - Thread.backtrace(this.context, Backtracer.ACCURATE) - .map(DebugSymbol.fromAddress).join('\n')); - - // if (s.includes(".cc")) { - // console.log(`\n[+] arg${i} ${args[i]} ${s}`); - // console.log(hexdump(args[i], { length: 128 })); - // console.log( - // Thread.backtrace(this.context, Backtracer.ACCURATE) - // .map(DebugSymbol.fromAddress).join('\n')); - // return; - // } - } - } catch (e) { - console.log("Enter Error:", e); - } - } - - - }, - - onLeave(retval) { - // console.log("===== sub_105808800 LEAVE ====="); - // console.log("Return value:", retval); - // try { - // console.log("Return hexdump:"); - // console.log(hexdump(retval, { - // offset: 0, - // length: 128 - // })); - // } catch (_) { - // } - } -}); - diff --git a/matchFun.js b/matchFun.js deleted file mode 100644 index 55a61a9..0000000 --- a/matchFun.js +++ /dev/null @@ -1,36 +0,0 @@ -[ - "sendmsg", - "newsendmsg", - "SendMsg", - "SendMsgFH" -].forEach(sig => { - let arr = DebugSymbol.findFunctionsMatching("*" + sig + "*"); - arr.forEach(target => { - console.log("Hooking:", target); - - Interceptor.attach(ptr(target), { - onEnter(args) { - console.log("🚀 Called:", target); - - // 打印调用堆栈 - console.log( - Thread.backtrace(this.context, Backtracer.ACCURATE) - .map(DebugSymbol.fromAddress) - .join("\n") - ); - - // 打印第 1 个参数，一般就是 protobuf buffer - try { - console.log("arg0:", args[0]); - console.log(hexdump(args[0], { length: 256 })); - } catch(e){} - - // 打印第 2 个参数（通常是长度） - console.log("arg1:", args[1]); - }, - onLeave(retval) { - console.log("⬅️ return:", retval); - } - }); - }); -}); diff --git a/memcpy.js b/memcpy.js deleted file mode 100644 index dc4a768..0000000 --- a/memcpy.js +++ /dev/null @@ -1,43 +0,0 @@ -const libc = Process.getModuleByName("libSystem.B.dylib"); - -// 2. 拦截 memcpy -const memcpy_ptr = libc.findExportByName("memcpy"); - -if (memcpy_ptr) { - console.log("[+] Hooking memcpy."); - Interceptor.attach(memcpy_ptr, { - onEnter(args) { - // args[0] = destination (目标缓冲区) - // args[1] = source (源数据) - // args[2] = length - this.src = args[1]; - this.len = args[2].toInt32(); - }, - onLeave(retval) { - // 只检查长度适中的数据块 (防止日志爆炸) - if (this.len > 5 && this.len < 500) { - try { - // 尝试将源数据读取为 C 字符串 - const message = this.src.readCString(); - - if (message && message.length > 1) { - console.log(`\n======================================================`); - console.log(`[+] ⚠️ 明文捕获于 memcpy!`); - console.log(`[+] 长度: ${this.len} 字节`); - console.log(`[+] 消息内容 (ASCII): ${message}`); - - // 打印 Hexdump 验证 - console.log(`--- Hexdump 验证 ---`); - console.log(hexdump(this.src, { length: this.len > 128 ? 128 : this.len })); - - console.log(`======================================================`); - } - } catch (e) { - // 忽略读取错误 - } - } - } - }); -} else { - console.log("[!] memcpy symbol not found."); -} \ No newline at end of file diff --git a/memo_check.js b/memo_check.js deleted file mode 100644 index de04e16..0000000 --- a/memo_check.js +++ /dev/null @@ -1,13 +0,0 @@ -MemoryAccessMonitor.enable( - { - base: ptr("0x6000034c1000"), - size: 0x40 // buffer 大小 - }, - { - onAccess(details) { - console.log("Access by:", details.from); - console.log("Operation:", details.operation); - console.log(hexdump(idaAddr, { length: 0x40 })); - } - } -); diff --git a/other_memo_check.js b/other_memo_check.js deleted file mode 100644 index cac1b82..0000000 --- a/other_memo_check.js +++ /dev/null @@ -1,17 +0,0 @@ -const idaAddr = ptr("0x6000025A96DA"); -console.log("start monitor"); - -MemoryAccessMonitor.enable( - { - base: idaAddr, - size: 0x40 // buffer 大小 - }, - { - onAccess(details) { - console.log("0x6000029C6DF0 Details:", JSON.stringify(details)); - // console.log("0x6000029C6DF0 Access by:", DebugSymbol.fromAddress(details.from)); - console.log(hexdump(idaAddr, { length: 0x40 })); - } - } -); - diff --git a/script.js b/script.js deleted file mode 100644 index da796f0..0000000 --- a/script.js +++ /dev/null @@ -1,63 +0,0 @@ -const mod = Process.getModuleByName("WeChat"); -const realAddr = ptr("0x1057ee3a8").sub("0x100000000").add(mod.base); - -console.log("[+] Real Function Address:", realAddr); - -Interceptor.attach(realAddr, { - onEnter(args) { - for (let i = 0; i < 10; i++) { - try { - if (args[i].isNull()) { - continue; - } - - // console.log(`\n[+] arg${i} ${args[i]}`); - if (args[i].compare(ptr("0x600000000000")) >= 0 && args[i].compare(ptr("0x700000000000")) < 0 && args[i].and(0x7).isNull()) { - const buf = args[i].readByteArray(128) - if (!buf) { - continue; - } - let s = ""; - const u8 = new Uint8Array(buf); - for (let b of u8) { - if (b >= 0x20 && b <= 0x7E) { - s += String.fromCharCode(b); - } else { - s += "."; - } - } - - - if (s.includes("3.3.3.3")) { - console.log(`\n[+] arg${i} ${args[i]}`); - console.log(hexdump(args[i], { length: 128 })); - args[i].add(0x18).writeUtf16String("5555"); - console.log(hexdump(args[i], { length: 128 })); - // console.log( - // Thread.backtrace(this.context, Backtracer.ACCURATE) - // .map(DebugSymbol.fromAddress).join('\n')); - return; - } - } - } catch (e) { - console.log("Enter Error:", e); - } - } - - - }, - - onLeave(retval) { - // console.log("===== sub_105808800 LEAVE ====="); - // console.log("Return value:", retval); - // try { - // console.log("Return hexdump:"); - // console.log(hexdump(retval, { - // offset: 0, - // length: 128 - // })); - // } catch (_) { - // } - } -}); - diff --git a/tracelog.js b/tracelog.js deleted file mode 100644 index 0ee41c7..0000000 --- a/tracelog.js +++ /dev/null @@ -1,21 +0,0 @@ -defineHandler({ - onEnter(log, args, state) { - log('ccaes_cbc_encrypt_mode() [libcorecrypto.dylib]'); - - try { - const bt = Thread.backtrace( - this.context, - Backtracer.ACCURATE - ) - .map(DebugSymbol.fromAddress) - .join('\n'); - - log('--- Call Stack ---\n' + bt + '\n-------------------'); - } catch (e) { - log('Error printing backtrace: ' + e); - } - }, - - onLeave(log, retval, state) { - } -}); diff --git a/writedata.js b/writedata.js deleted file mode 100644 index 0939d82..0000000 --- a/writedata.js +++ /dev/null @@ -1,62 +0,0 @@ -const mod = Process.getModuleByName("WeChat"); -const realAddr = ptr("0x1057ee3a8").sub("0x100000000").add(mod.base); - -console.log("[+] Real Function Address:", realAddr); - -Interceptor.attach(realAddr, { - onEnter(args) { - for (let i = 0; i < 10; i++) { - try { - if (args[i].isNull()) { - continue; - } - - // console.log(`\n[+] arg${i} ${args[i]}`); - if (args[i].compare(ptr("0x600000000000")) >= 0 && args[i].compare(ptr("0x700000000000")) < 0 && args[i].and(0x7).isNull()) { - const buf = args[i].readByteArray(128) - if (!buf) { - continue; - } - let s = ""; - const u8 = new Uint8Array(buf); - for (let b of u8) { - if (b >= 0x20 && b <= 0x7E) { - s += String.fromCharCode(b); - } else { - s += "."; - } - } - - - if (s.includes("3.3.3.3")) { - console.log(`\n[+] arg${i} ${args[i]}`); - console.log(hexdump(args[i], { length: 128 })); - args[i].add(0x18).writeUtf16String("5555"); - // console.log( - // Thread.backtrace(this.context, Backtracer.ACCURATE) - // .map(DebugSymbol.fromAddress).join('\n')); - return; - } - } - } catch (e) { - console.log("Enter Error:", e); - } - } - - - }, - - onLeave(retval) { - // console.log("===== sub_105808800 LEAVE ====="); - // console.log("Return value:", retval); - // try { - // console.log("Return hexdump:"); - // console.log(hexdump(retval, { - // offset: 0, - // length: 128 - // })); - // } catch (_) { - // } - } -}); -