tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

support chinese

Browse Source
This commit is contained in:
yincong
2025-12-29 13:28:16 +08:00
parent 37b5c9be9c
commit e5be321b4a
2 changed files with 72 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frida/script.js
+40 -21
View File
@@ -32,9 +32,10 @@ var messageAddrAddr = ptr(0);
var contentAddr = ptr(0);
var insertMsgAddr = ptr(0);
// 消息的taskId
var taskId = 0x20000090
var receiver = "wxid_7wd1ece99f7i21"
var content = "hello world";
var taskIdGlobal = 0x20000090 // 最好比较大，不和原始的微信消息重复
var receiverGlobal = "wxid_"
var contentGlobal = "";
var lastSendTime = 0;
// 打印消息的地址，便于查询问题
function printAddr() {
@@ -81,7 +82,7 @@ function setupSendMessageDynamic() {
sendMessageAddr.add(0x08).writeU64(0);
sendMessageAddr.add(0x10).writePointer(sendMessageCallbackFunc); // 虚表地址通常仍需硬编码或从模块基址计算
sendMessageAddr.add(0x18).writeU64(1);
sendMessageAddr.add(0x20).writeU32(taskId);
sendMessageAddr.add(0x20).writeU32(taskIdGlobal);
sendMessageAddr.add(0x28).writePointer(messageAddr); // 指向动态分配的 Message
console.log(" [+] sendMessageAddr Object: ", hexdump(sendMessageAddr, {
@@ -93,7 +94,7 @@ function setupSendMessageDynamic() {
// C. 构建 Message 结构体
messageAddr.add(0x00).writePointer(messageCallbackFunc1);
messageAddr.add(0x08).writeU32(taskId);
messageAddr.add(0x08).writeU32(taskIdGlobal);
messageAddr.add(0x0c).writeU32(0x20a);
messageAddr.add(0x10).writeU64(0x3);
messageAddr.add(0x18).writePointer(cgiAddr);
@@ -159,19 +160,33 @@ function setTriggerAttach() {
setImmediate(setTriggerAttach);
function manualTrigger() {
function manualTrigger(taskId, receiver, content) {
console.log("[*] Manual Trigger Started...");
if (globalMessagePtr.isNull()) {
console.log("[!] globalMessagePtr is NULL, cannot trigger!");
return;
}
if (!taskId || !receiver || !content) {
console.log("[!] taskId or Receiver or Content is empty!");
return;
}
// 获取当前时间戳 (秒)
const timestamp = Math.floor(Date.now() / 1000);
// 全局变量不为空，并且上次发送时间小于1s，不给发送
if ((taskIdGlobal !== 0 || receiverGlobal !== "" || contentGlobal !== "") && lastSendTime + 1 > timestamp) {
console.log("[!] taskId or receiver or content is not empty!");
return;
}
messageAddr.add(0x08).writeU32(taskId);
sendMessageAddr.add(0x20).writeU32(taskId);
lastSendTime = timestamp
taskIdGlobal = taskId;
receiverGlobal = receiver;
contentGlobal = content;
messageAddr.add(0x08).writeU32(taskIdGlobal);
sendMessageAddr.add(0x20).writeU32(taskIdGlobal);
messageAddrAddr.add(0x18).writeU32(timestamp);
const payloadData = [
@@ -230,7 +245,7 @@ function manualTrigger() {
];
// 从 0x175ED6604 开始写入 Payload
triggerX1Payload.writeU32(taskId);
triggerX1Payload.writeU32(taskIdGlobal);
triggerX1Payload.add(0x04).writeByteArray(payloadData);
triggerX1Payload.add(0x18).writePointer(cgiAddr);
@@ -260,11 +275,11 @@ function attachReq2buf() {
// 2. 开始拦截
Interceptor.attach(req2bufEnterAddr, {
onEnter: function(args) {
if (!this.context.x1.equals(taskId)) {
if (!this.context.x1.equals(taskIdGlobal)) {
return;
}
console.log("[+] 已命中目标Req2Buf地址:0x1033EE8E8 taskId:" + taskId + "base:" + baseAddr);
console.log("[+] 已命中目标Req2Buf地址:0x1033EE8E8 taskId:" + taskIdGlobal + "base:" + baseAddr);
// 3. 获取 X24 寄存器的值
const x24_base = this.context.x24;
@@ -297,11 +312,14 @@ function attachReq2buf() {
console.log("[*] Target Req2buf leave Address: " + req2bufExitAddr);
Interceptor.attach(req2bufExitAddr, {
onEnter: function(args) {
if (!this.context.x25.equals(taskId)) {
if (!this.context.x25.equals(taskIdGlobal)) {
return;
}
insertMsgAddr.writeU64(0x0);
console.log("[+] 0x1033EFA00 清空写入后内存预览: " + insertMsgAddr.readPointer());
taskIdGlobal = 0;
receiverGlobal = "";
contentGlobal = "";
}
});
}
@@ -327,9 +345,10 @@ function getVarintTimestampBytes() {
}
function stringToHexArray(str) {
var utf8Str = unescape(encodeURIComponent(str));
var arr = [];
for (var i = 0; i < str.length; i++) {
arr.push(str.charCodeAt(i)); // 获取字符的 ASCII 码 (即十六进制值)
for (var i = 0; i < utf8Str.length; i++) {
arr.push(utf8Str.charCodeAt(i)); // 获取字符的 ASCII 码 (即十六进制值)
}
return arr;
}
@@ -364,9 +383,9 @@ function attachProto() {
0x08, 0x01, 0x12, 0x5E, 0x0A, 0x15, 0x0A, 0x13, // 0x00
];
const receiverProto = stringToHexArray(receiver);
const contentHeader = [0x12, content.length];
const contentProto = stringToHexArray(content);
const receiverProto = stringToHexArray(receiverGlobal);
const contentProto = stringToHexArray(contentGlobal);
const contentHeader = [0x12, contentProto.length];
const tsHeader = [0x18, 0x01, 0x20];
const tsBytes = getVarintTimestampBytes();
const msgIdHeader = [0x28]
@@ -385,17 +404,17 @@ function attachProto() {
// 合并数组
const finalPayload = prefix.concat(receiverProto).concat(contentHeader).
concat(contentProto).concat(tsHeader).concat(tsBytes).concat(msgIdHeader).concat(msgId).concat(suffix);
concat(contentProto).concat(tsHeader).concat(tsBytes).concat(msgIdHeader).concat(msgId).concat(suffix);
x1_custom_addr.writeByteArray(finalPayload);
console.log("[*] Payload 已写入，长度: " + finalPayload.length);
this.context.x1 = x1_custom_addr;
this.context.x2 = ptr(0x62);
this.context.x2 = ptr(finalPayload.length);
console.log("[+] 寄存器修改完成: X1=" + this.context.x1 + ", X2=" + this.context.x2, hexdump(x1_custom_addr, {
offset: 0,
length: 160,
length: 128,
header: true,
ansi: true
}));
frida/succ.js
+32 -15
View File
@@ -32,9 +32,10 @@ var messageAddrAddr = ptr(0);
var contentAddr = ptr(0);
var insertMsgAddr = ptr(0);
// 消息的taskId
var taskId = 0x20000090
var receiver = "wxid_"
var content = "hello world";
var taskIdGlobal = 0x20000090 // 最好比较大，不和原始的微信消息重复
var receiverGlobal = "wxid_"
var contentGlobal = "";
var lastSendTime = 0;
// 打印消息的地址，便于查询问题
function printAddr() {
@@ -81,7 +82,7 @@ function setupSendMessageDynamic() {
sendMessageAddr.add(0x08).writeU64(0);
sendMessageAddr.add(0x10).writePointer(sendMessageCallbackFunc); // 虚表地址通常仍需硬编码或从模块基址计算
sendMessageAddr.add(0x18).writeU64(1);
sendMessageAddr.add(0x20).writeU32(taskId);
sendMessageAddr.add(0x20).writeU32(taskIdGlobal);
sendMessageAddr.add(0x28).writePointer(messageAddr); // 指向动态分配的 Message
console.log(" [+] sendMessageAddr Object: ", hexdump(sendMessageAddr, {
@@ -93,7 +94,7 @@ function setupSendMessageDynamic() {
// C. 构建 Message 结构体
messageAddr.add(0x00).writePointer(messageCallbackFunc1);
messageAddr.add(0x08).writeU32(taskId);
messageAddr.add(0x08).writeU32(taskIdGlobal);
messageAddr.add(0x0c).writeU32(0x20a);
messageAddr.add(0x10).writeU64(0x3);
messageAddr.add(0x18).writePointer(cgiAddr);
@@ -159,19 +160,32 @@ function setTriggerAttach() {
setImmediate(setTriggerAttach);
function manualTrigger() {
function manualTrigger(taskId, receiver, content) {
console.log("[*] Manual Trigger Started...");
if (globalMessagePtr.isNull()) {
console.log("[!] globalMessagePtr is NULL, cannot trigger!");
return;
}
if (taskId.empty() || receiver.empty() || content.empty()) {
console.log("[!] taskId or Receiver or Content is empty!");
return;
}
// 获取当前时间戳 (秒)
const timestamp = Math.floor(Date.now() / 1000);
// 全局变量不为空，并且上次发送时间小于1s，不给发送
if ((taskIdGlobal !== 0 || receiverGlobal !== "" || contentGlobal !== "") && lastSendTime + 1 < timestamp) {
console.log("[!] taskId or receiver or content is not empty!");
return;
}
messageAddr.add(0x08).writeU32(taskId);
sendMessageAddr.add(0x20).writeU32(taskId);
taskIdGlobal = taskId;
receiverGlobal = receiver;
contentGlobal = content;
messageAddr.add(0x08).writeU32(taskIdGlobal);
sendMessageAddr.add(0x20).writeU32(taskIdGlobal);
messageAddrAddr.add(0x18).writeU32(timestamp);
const payloadData = [
@@ -230,7 +244,7 @@ function manualTrigger() {
];
// 从 0x175ED6604 开始写入 Payload
triggerX1Payload.writeU32(taskId);
triggerX1Payload.writeU32(taskIdGlobal);
triggerX1Payload.add(0x04).writeByteArray(payloadData);
triggerX1Payload.add(0x18).writePointer(cgiAddr);
@@ -260,11 +274,11 @@ function attachReq2buf() {
// 2. 开始拦截
Interceptor.attach(req2bufEnterAddr, {
onEnter: function(args) {
if (!this.context.x1.equals(taskId)) {
if (!this.context.x1.equals(taskIdGlobal)) {
return;
}
console.log("[+] 已命中目标Req2Buf地址:0x1033EE8E8 taskId:" + taskId + "base:" + baseAddr);
console.log("[+] 已命中目标Req2Buf地址:0x1033EE8E8 taskId:" + taskIdGlobal + "base:" + baseAddr);
// 3. 获取 X24 寄存器的值
const x24_base = this.context.x24;
@@ -297,11 +311,14 @@ function attachReq2buf() {
console.log("[*] Target Req2buf leave Address: " + req2bufExitAddr);
Interceptor.attach(req2bufExitAddr, {
onEnter: function(args) {
if (!this.context.x25.equals(taskId)) {
if (!this.context.x25.equals(taskIdGlobal)) {
return;
}
insertMsgAddr.writeU64(0x0);
console.log("[+] 0x1033EFA00 清空写入后内存预览: " + insertMsgAddr.readPointer());
TaskIdGlobal = 0;
receiverGlobal = "";
contentGlobal = "";
}
});
}
@@ -364,9 +381,9 @@ function attachProto() {
0x08, 0x01, 0x12, 0x5E, 0x0A, 0x15, 0x0A, 0x13, // 0x00
];
const receiverProto = stringToHexArray(receiver);
const receiverProto = stringToHexArray(receiverGlobal);
const contentHeader = [0x12, content.length];
const contentProto = stringToHexArray(content);
const contentProto = stringToHexArray(contentGlobal);
const tsHeader = [0x18, 0x01, 0x20];
const tsBytes = getVarintTimestampBytes();
const msgIdHeader = [0x28]