tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

add succ

Browse Source
This commit is contained in:
yincong
2025-12-24 18:29:14 +08:00
parent 6e2984682b
commit e880d816d4
5 changed files with 282 additions and 564 deletions
Download Patch File Download Diff File Expand all files Collapse all files
function.md
+175 -560
View File
@@ -6,424 +6,35 @@ cmdId 4位
00030001 固定
cgi 字符串指针
```azure
debug697:0000000175ED6600 DCB 0xE2
debug697:0000000175ED6601 DCB 0
debug697:0000000175ED6602 DCB 0
debug697:0000000175ED6603 DCB 0
debug697:0000000175ED6604 DCB 0xA
debug697:0000000175ED6605 DCB 2
debug697:0000000175ED6606 DCB 0
debug697:0000000175ED6607 DCB 0
debug697:0000000175ED6608 DCB 0
debug697:0000000175ED6609 DCB 0
debug697:0000000175ED660A DCB 0
debug697:0000000175ED660B DCB 0
debug697:0000000175ED660C DCB 0
debug697:0000000175ED660D DCB 0
debug697:0000000175ED660E DCB 0
debug697:0000000175ED660F DCB 0
debug697:0000000175ED6610 DCB 3
debug697:0000000175ED6611 DCB 0
debug697:0000000175ED6612 DCB 0
debug697:0000000175ED6613 DCB 0
debug697:0000000175ED6614 DCB 1
debug697:0000000175ED6615 DCB 0
debug697:0000000175ED6616 DCB 0
debug697:0000000175ED6617 DCB 0
debug697:0000000175ED6618 DCB 0x30 ; 0
debug697:0000000175ED6619 DCB 0x5B ;
debug697:0000000175ED661A DCB 0x58 ; X
debug697:0000000175ED661B DCB 0xD9
debug697:0000000175ED661C DCB 0xC
debug697:0000000175ED661D DCB 0
debug697:0000000175ED661E DCB 0
debug697:0000000175ED661F DCB 0
debug697:0000000175ED6620 DCB 0x20
debug697:0000000175ED6621 DCB 0
debug697:0000000175ED6622 DCB 0
debug697:0000000175ED6623 DCB 0
debug697:0000000175ED6624 DCB 0
debug697:0000000175ED6625 DCB 0
debug697:0000000175ED6626 DCB 0
debug697:0000000175ED6627 DCB 0
debug697:0000000175ED6628 DCB 0x30 ; 0
debug697:0000000175ED6629 DCB 0
debug697:0000000175ED662A DCB 0
debug697:0000000175ED662B DCB 0
debug697:0000000175ED662C DCB 0
debug697:0000000175ED662D DCB 0
debug697:0000000175ED662E DCB 0
debug697:0000000175ED662F DCB 0x80
debug697:0000000175ED6630 DCB 0
debug697:0000000175ED6631 DCB 1
debug697:0000000175ED6632 DCB 1
debug697:0000000175ED6633 DCB 1
debug697:0000000175ED6634 DCB 0
debug697:0000000175ED6635 DCB 0xAA
debug697:0000000175ED6636 DCB 0xAA
debug697:0000000175ED6637 DCB 0xAA
debug697:0000000175ED6638 DCB 0
debug697:0000000175ED6639 DCB 0
debug697:0000000175ED663A DCB 0
debug697:0000000175ED663B DCB 0
debug697:0000000175ED663C DCB 3
debug697:0000000175ED663D DCB 0
debug697:0000000175ED663E DCB 0
debug697:0000000175ED663F DCB 0
debug697:0000000175ED6640 DCB 1
debug697:0000000175ED6641 DCB 0
debug697:0000000175ED6642 DCB 0
debug697:0000000175ED6643 DCB 0
debug697:0000000175ED6644 DCB 0xFF
debug697:0000000175ED6645 DCB 0xFF
debug697:0000000175ED6646 DCB 0xFF
debug697:0000000175ED6647 DCB 0xFF
debug697:0000000175ED6648 DCB 0xFF
debug697:0000000175ED6649 DCB 0xFF
debug697:0000000175ED664A DCB 0xFF
debug697:0000000175ED664B DCB 0xFF
debug697:0000000175ED664C DCB 0
debug697:0000000175ED664D DCB 0xAA
debug697:0000000175ED664E DCB 0xAA
debug697:0000000175ED664F DCB 0xAA
debug697:0000000175ED6650 DCB 0xFF
debug697:0000000175ED6651 DCB 0xFF
debug697:0000000175ED6652 DCB 0xFF
debug697:0000000175ED6653 DCB 0xFF
debug697:0000000175ED6654 DCB 0xAA
debug697:0000000175ED6655 DCB 0xAA
debug697:0000000175ED6656 DCB 0xAA
debug697:0000000175ED6657 DCB 0xAA
debug697:0000000175ED6658 DCB 0
debug697:0000000175ED6659 DCB 0
debug697:0000000175ED665A DCB 0
debug697:0000000175ED665B DCB 0
debug697:0000000175ED665C DCB 0
debug697:0000000175ED665D DCB 0
debug697:0000000175ED665E DCB 0
debug697:0000000175ED665F DCB 0
debug697:0000000175ED6660 DCB 0xA
debug697:0000000175ED6661 DCB 2
debug697:0000000175ED6662 DCB 0
debug697:0000000175ED6663 DCB 0
debug697:0000000175ED6664 DCB 0
debug697:0000000175ED6665 DCB 0
debug697:0000000175ED6666 DCB 0
debug697:0000000175ED6667 DCB 0
debug697:0000000175ED6668 DCB 0x64 ; d
debug697:0000000175ED6669 DCB 0x65 ; e
debug697:0000000175ED666A DCB 0x66 ; f
debug697:0000000175ED666B DCB 0x61 ; a
debug697:0000000175ED666C DCB 0x75 ; u
debug697:0000000175ED666D DCB 0x6C ; l
debug697:0000000175ED666E DCB 0x74 ; t
debug697:0000000175ED666F DCB 0x2D ; -
debug697:0000000175ED6670 DCB 0x6C ; l
debug697:0000000175ED6671 DCB 0x6F ; o
debug697:0000000175ED6672 DCB 0x6E ; n
debug697:0000000175ED6673 DCB 0x67 ; g
debug697:0000000175ED6674 DCB 0x6C ; l
debug697:0000000175ED6675 DCB 0x69 ; i
debug697:0000000175ED6676 DCB 0x6E ; n
debug697:0000000175ED6677 DCB 0x6B ; k
debug697:0000000175ED6678 DCB 0
debug697:0000000175ED6679 DCB 0xAA
debug697:0000000175ED667A DCB 0xAA
debug697:0000000175ED667B DCB 0xAA
debug697:0000000175ED667C DCB 0xAA
debug697:0000000175ED667D DCB 0xAA
debug697:0000000175ED667E DCB 0xAA
debug697:0000000175ED667F DCB 0x10
debug697:0000000175ED6680 DCB 0
debug697:0000000175ED6681 DCB 0
debug697:0000000175ED6682 DCB 0
debug697:0000000175ED6683 DCB 0
debug697:0000000175ED6684 DCB 0
debug697:0000000175ED6685 DCB 0
debug697:0000000175ED6686 DCB 0
debug697:0000000175ED6687 DCB 0
debug697:0000000175ED6688 DCB 0
debug697:0000000175ED6689 DCB 0
debug697:0000000175ED668A DCB 0
debug697:0000000175ED668B DCB 0
debug697:0000000175ED668C DCB 0
debug697:0000000175ED668D DCB 0
debug697:0000000175ED668E DCB 0
debug697:0000000175ED668F DCB 0
debug697:0000000175ED6690 DCB 0
debug697:0000000175ED6691 DCB 0
debug697:0000000175ED6692 DCB 0
debug697:0000000175ED6693 DCB 0
debug697:0000000175ED6694 DCB 0
debug697:0000000175ED6695 DCB 0
debug697:0000000175ED6696 DCB 0
debug697:0000000175ED6697 DCB 0
debug697:0000000175ED6698 DCB 0
debug697:0000000175ED6699 DCB 0
debug697:0000000175ED669A DCB 0
debug697:0000000175ED669B DCB 0
debug697:0000000175ED669C DCB 0
debug697:0000000175ED669D DCB 0
debug697:0000000175ED669E DCB 0
debug697:0000000175ED669F DCB 0
debug697:0000000175ED66A0 DCB 0
debug697:0000000175ED66A1 DCB 0
debug697:0000000175ED66A2 DCB 0
debug697:0000000175ED66A3 DCB 0
debug697:0000000175ED66A4 DCB 0
debug697:0000000175ED66A5 DCB 0
debug697:0000000175ED66A6 DCB 0
debug697:0000000175ED66A7 DCB 0
debug697:0000000175ED66A8 DCB 0
debug697:0000000175ED66A9 DCB 0
debug697:0000000175ED66AA DCB 0
debug697:0000000175ED66AB DCB 0
debug697:0000000175ED66AC DCB 0
debug697:0000000175ED66AD DCB 0
debug697:0000000175ED66AE DCB 0
debug697:0000000175ED66AF DCB 0
debug697:0000000175ED66B0 DCB 0
debug697:0000000175ED66B1 DCB 0
debug697:0000000175ED66B2 DCB 0
debug697:0000000175ED66B3 DCB 0
debug697:0000000175ED66B4 DCB 0xAA
debug697:0000000175ED66B5 DCB 0xAA
debug697:0000000175ED66B6 DCB 0xAA
debug697:0000000175ED66B7 DCB 0xAA
debug697:0000000175ED66B8 DCB 0xC0
debug697:0000000175ED66B9 DCB 0x66 ; f
debug697:0000000175ED66BA DCB 0xED
debug697:0000000175ED66BB DCB 0x75 ; u
debug697:0000000175ED66BC DCB 1
debug697:0000000175ED66BD DCB 0
debug697:0000000175ED66BE DCB 0
debug697:0000000175ED66BF DCB 0
debug697:0000000175ED66C0 DCB 0
debug697:0000000175ED66C1 DCB 0
debug697:0000000175ED66C2 DCB 0
debug697:0000000175ED66C3 DCB 0
debug697:0000000175ED66C4 DCB 0
debug697:0000000175ED66C5 DCB 0
debug697:0000000175ED66C6 DCB 0
debug697:0000000175ED66C7 DCB 0
debug697:0000000175ED66C8 DCB 0
debug697:0000000175ED66C9 DCB 0
debug697:0000000175ED66CA DCB 0
debug697:0000000175ED66CB DCB 0
debug697:0000000175ED66CC DCB 0
debug697:0000000175ED66CD DCB 0
debug697:0000000175ED66CE DCB 0
debug697:0000000175ED66CF DCB 0
debug697:0000000175ED66D0 DCB 0
debug697:0000000175ED66D1 DCB 0
debug697:0000000175ED66D2 DCB 0
debug697:0000000175ED66D3 DCB 0
debug697:0000000175ED66D4 DCB 0
debug697:0000000175ED66D5 DCB 0
debug697:0000000175ED66D6 DCB 0
debug697:0000000175ED66D7 DCB 0
debug697:0000000175ED66D8 DCB 0
debug697:0000000175ED66D9 DCB 0
debug697:0000000175ED66DA DCB 0
debug697:0000000175ED66DB DCB 0
debug697:0000000175ED66DC DCB 0
debug697:0000000175ED66DD DCB 0
debug697:0000000175ED66DE DCB 0
debug697:0000000175ED66DF DCB 0
debug697:0000000175ED66E0 DCB 0
debug697:0000000175ED66E1 DCB 0
debug697:0000000175ED66E2 DCB 0
debug697:0000000175ED66E3 DCB 0
debug697:0000000175ED66E4 DCB 0
debug697:0000000175ED66E5 DCB 0
debug697:0000000175ED66E6 DCB 0
debug697:0000000175ED66E7 DCB 0
debug697:0000000175ED66E8 DCB 0
debug697:0000000175ED66E9 DCB 0
debug697:0000000175ED66EA DCB 0
debug697:0000000175ED66EB DCB 0
debug697:0000000175ED66EC DCB 0
debug697:0000000175ED66ED DCB 0
debug697:0000000175ED66EE DCB 0
debug697:0000000175ED66EF DCB 0
debug697:0000000175ED66F0 DCB 0
debug697:0000000175ED66F1 DCB 0
debug697:0000000175ED66F2 DCB 0
debug697:0000000175ED66F3 DCB 0
debug697:0000000175ED66F4 DCB 0
debug697:0000000175ED66F5 DCB 0
debug697:0000000175ED66F6 DCB 0
debug697:0000000175ED66F7 DCB 0
debug697:0000000175ED66F8 DCB 0
debug697:0000000175ED66F9 DCB 0
debug697:0000000175ED66FA DCB 0
debug697:0000000175ED66FB DCB 0
debug697:0000000175ED66FC DCB 0
debug697:0000000175ED66FD DCB 0
debug697:0000000175ED66FE DCB 0
debug697:0000000175ED66FF DCB 0
debug697:0000000175ED6700 DCB 0
debug697:0000000175ED6701 DCB 0
debug697:0000000175ED6702 DCB 0
debug697:0000000175ED6703 DCB 0
debug697:0000000175ED6704 DCB 0
debug697:0000000175ED6705 DCB 0
debug697:0000000175ED6706 DCB 0
debug697:0000000175ED6707 DCB 0
debug697:0000000175ED6708 DCB 0
debug697:0000000175ED6709 DCB 0
debug697:0000000175ED670A DCB 0
debug697:0000000175ED670B DCB 0
debug697:0000000175ED670C DCB 0
debug697:0000000175ED670D DCB 0
debug697:0000000175ED670E DCB 0
debug697:0000000175ED670F DCB 0
debug697:0000000175ED6710 DCB 0
debug697:0000000175ED6711 DCB 0
debug697:0000000175ED6712 DCB 0
debug697:0000000175ED6713 DCB 0
debug697:0000000175ED6714 DCB 0
debug697:0000000175ED6715 DCB 0
debug697:0000000175ED6716 DCB 0
debug697:0000000175ED6717 DCB 0
debug697:0000000175ED6718 DCB 0
debug697:0000000175ED6719 DCB 0
debug697:0000000175ED671A DCB 0
debug697:0000000175ED671B DCB 0
debug697:0000000175ED671C DCB 0
debug697:0000000175ED671D DCB 0
debug697:0000000175ED671E DCB 0
debug697:0000000175ED671F DCB 0
debug697:0000000175ED6720 DCB 0
debug697:0000000175ED6721 DCB 0
debug697:0000000175ED6722 DCB 0
debug697:0000000175ED6723 DCB 0
debug697:0000000175ED6724 DCB 0
debug697:0000000175ED6725 DCB 0
debug697:0000000175ED6726 DCB 0
debug697:0000000175ED6727 DCB 0
debug697:0000000175ED6728 DCB 0
debug697:0000000175ED6729 DCB 0
debug697:0000000175ED672A DCB 0
debug697:0000000175ED672B DCB 0
debug697:0000000175ED672C DCB 0
debug697:0000000175ED672D DCB 0
debug697:0000000175ED672E DCB 0
debug697:0000000175ED672F DCB 0
debug697:0000000175ED6730 DCB 0
debug697:0000000175ED6731 DCB 0
debug697:0000000175ED6732 DCB 0
debug697:0000000175ED6733 DCB 0
debug697:0000000175ED6734 DCB 0
debug697:0000000175ED6735 DCB 0
debug697:0000000175ED6736 DCB 0
debug697:0000000175ED6737 DCB 0
debug697:0000000175ED6738 DCB 0
debug697:0000000175ED6739 DCB 0
debug697:0000000175ED673A DCB 0
debug697:0000000175ED673B DCB 0
debug697:0000000175ED673C DCB 0
debug697:0000000175ED673D DCB 0
debug697:0000000175ED673E DCB 0
debug697:0000000175ED673F DCB 0
debug697:0000000175ED6740 DCB 0
debug697:0000000175ED6741 DCB 0
debug697:0000000175ED6742 DCB 0
debug697:0000000175ED6743 DCB 0
debug697:0000000175ED6744 DCB 0
debug697:0000000175ED6745 DCB 0
debug697:0000000175ED6746 DCB 0
debug697:0000000175ED6747 DCB 0
debug697:0000000175ED6748 DCB 1
debug697:0000000175ED6749 DCB 0
debug697:0000000175ED674A DCB 0
debug697:0000000175ED674B DCB 0
debug697:0000000175ED674C DCB 0xAA
debug697:0000000175ED674D DCB 0xAA
debug697:0000000175ED674E DCB 0xAA
debug697:0000000175ED674F DCB 0xAA
debug697:0000000175ED6750 DCB 0
debug697:0000000175ED6751 DCB 0
debug697:0000000175ED6752 DCB 0
debug697:0000000175ED6753 DCB 0
debug697:0000000175ED6754 DCB 0
debug697:0000000175ED6755 DCB 0
debug697:0000000175ED6756 DCB 0
debug697:0000000175ED6757 DCB 0
debug697:0000000175ED6758 DCB 0
debug697:0000000175ED6759 DCB 0
debug697:0000000175ED675A DCB 0
debug697:0000000175ED675B DCB 0
debug697:0000000175ED675C DCB 0
debug697:0000000175ED675D DCB 0
debug697:0000000175ED675E DCB 0
debug697:0000000175ED675F DCB 0
debug697:0000000175ED6760 DCB 0
debug697:0000000175ED6761 DCB 0
debug697:0000000175ED6762 DCB 0
debug697:0000000175ED6763 DCB 0
debug697:0000000175ED6764 DCB 0
debug697:0000000175ED6765 DCB 0
debug697:0000000175ED6766 DCB 0
debug697:0000000175ED6767 DCB 0
debug697:0000000175ED6768 DCB 0
debug697:0000000175ED6769 DCB 0
debug697:0000000175ED676A DCB 0
debug697:0000000175ED676B DCB 0
debug697:0000000175ED676C DCB 0
debug697:0000000175ED676D DCB 0
debug697:0000000175ED676E DCB 0
debug697:0000000175ED676F DCB 0
debug697:0000000175ED6770 DCB 0
debug697:0000000175ED6771 DCB 0
debug697:0000000175ED6772 DCB 0
debug697:0000000175ED6773 DCB 0
debug697:0000000175ED6774 DCB 0
debug697:0000000175ED6775 DCB 0
debug697:0000000175ED6776 DCB 0
debug697:0000000175ED6777 DCB 0
debug697:0000000175ED6778 DCB 0
debug697:0000000175ED6779 DCB 0
debug697:0000000175ED677A DCB 0
debug697:0000000175ED677B DCB 0
debug697:0000000175ED677C DCB 0
debug697:0000000175ED677D DCB 0
debug697:0000000175ED677E DCB 0
debug697:0000000175ED677F DCB 0
debug697:0000000175ED6780 DCB 3
debug697:0000000175ED6781 DCB 0
debug697:0000000175ED6782 DCB 0
debug697:0000000175ED6783 DCB 0
debug697:0000000175ED6784 DCB 0
debug697:0000000175ED6785 DCB 0
debug697:0000000175ED6786 DCB 0
debug697:0000000175ED6787 DCB 0
debug697:0000000175ED6788 DCB 0
debug697:0000000175ED6789 DCB 0
debug697:0000000175ED678A DCB 0xAA
debug697:0000000175ED678B DCB 0xAA
debug697:0000000175ED678C DCB 0xAA
debug697:0000000175ED678D DCB 0xAA
debug697:0000000175ED678E DCB 0xAA
debug697:0000000175ED678F DCB 0xAA
debug697:0000000175ED6790 DCB 0x98
debug697:0000000175ED6791 DCB 0x67 ; g
debug697:0000000175ED6792 DCB 0xED
debug697:0000000175ED6793 DCB 0x75 ; u
debug697:0000000175ED6794 DCB 1
debug697:0000000175ED6795 DCB 0
debug697:0000000175ED6796 DCB 0
debug697:0000000175ED6797 DCB 0
debug697:0000000175ED6798 DCB 0
debug697:0000000175ED6799 DCB 0
debug697:0000000175ED679A DCB 0
debug697:0000000175ED679B DCB 0
debug697:0000000175ED679C DCB 0
debug697:0000000175ED679D DCB 0
debug697:0000000175ED679E DCB 0
debug697:0000000175ED679F DCB 0
```
task信息：
地址范围 | 字节内容 (十六进制) | 备注/解析
----------------------------------------------------------------------------------
175ED6600 - D6607: E2 00 00 00 0A 02 00 00 ; 数据 (可能是 ID + 类型)
175ED6608 - D660F: 00 00 00 00 00 00 00 00 ; 填充
175ED6610 - D6617: 03 00 00 00 01 00 00 00 ; 计数值 (3, 1)
175ED6618 - D661F: 30 5B 58 D9 0C 00 00 00 ; 内存指针: 0xC D9585B30
175ED6620 - D6627: 20 00 00 00 00 00 00 00 ; 长度/偏移 (32)
175ED6628 - D662F: 30 00 00 00 00 00 00 80 ; 标志位
175ED6630 - D6637: 00 01 01 01 00 AA AA AA ; 状态字节 + 对齐填充
175ED6638 - D663F: 00 00 00 00 03 00 00 00 ; 填充 + 计数 (3)
175ED6640 - D6647: 01 00 00 00 FF FF FF FF ; 计数 (1) + 结束符/错误码 (-1)
175ED6648 - D664F: FF FF FF FF 00 AA AA AA ; 结束符 (-1) + 填充
175ED6650 - D6657: FF FF FF FF AA AA AA AA ; 填充/未初始化内存
175ED6658 - D665F: 00 00 00 00 00 00 00 00 ; 填充
175ED6660 - D6667: 0A 02 00 00 00 00 00 00 ; 类型标识
175ED6668 - D666F: 64 65 66 61 75 6C 74 2D ; ASCII "default-"
175ED6670 - D6677: 6C 6F 6E 67 6C 69 6E 6B ; ASCII "longlink"
175ED6678 - D667F: 00 AA AA AA AA AA AA 10 ; 字符串结束 + 填充 + 长度
175ED6680 - D66F7: [... 全 00 填充区域 ...] ; 连续空内存
175ED66F8 - D66FF: 00 00 00 00 00 00 00 00 ; 填充
175ED6700 - D6747: [... 全 00 填充区域 ...] ; 连续空内存
175ED6748 - D674F: 01 00 00 00 AA AA AA AA ; 布尔值/计数 + 填充
175ED6750 - D677F: [... 全 00 填充区域 ...] ; 连续空内存
175ED6780 - D6787: 03 00 00 00 00 00 00 00 ; 计数 (3)
175ED6788 - D678F: 00 00 AA AA AA AA AA AA ; 填充
175ED6790 - D6797: 98 67 ED 75 01 00 00 00 ; 指针: 0x1 75ED6798
175ED6798 - D679F: 00 00 00 00 00 00 00 00 ; 结尾填充
```
@@ -464,147 +75,151 @@ X0=X0+#0xB8就是消息的指针
接着8位是数字 可能是消息id？
后面就有时一个相同的指针，也是消息的一些内容，但是和上面的指针不是同一个
```
7D3F60A80 DCB 0xA0
debug5019:00000007D3F60A81 DCB 0x68 ; h
debug5019:00000007D3F60A82 DCB 0xF9
debug5019:00000007D3F60A83 DCB 7
debug5019:00000007D3F60A84 DCB 1
debug5019:00000007D3F60A85 DCB 0
debug5019:00000007D3F60A86 DCB 0
debug5019:00000007D3F60A87 DCB 0
debug5019:00000007D3F60A88 DCB 0xA0
debug5019:00000007D3F60A89 DCB 0xE4
debug5019:00000007D3F60A8A DCB 0x4A ; J
debug5019:00000007D3F60A8B DCB 0xD7
debug5019:00000007D3F60A8C DCB 7
debug5019:00000007D3F60A8D DCB 0
debug5019:00000007D3F60A8E DCB 0
debug5019:00000007D3F60A8F DCB 0
debug5019:00000007D3F60A90 DCB 0
debug5019:00000007D3F60A91 DCB 0xB5
debug5019:00000007D3F60A92 DCB 0xFD
debug5019:00000007D3F60A93 DCB 0xD3
debug5019:00000007D3F60A94 DCB 7
debug5019:00000007D3F60A95 DCB 0
debug5019:00000007D3F60A96 DCB 0
debug5019:00000007D3F60A97 DCB 0
debug5019:00000007D3F60A98 DCB 1
debug5019:00000007D3F60A99 DCB 0
debug5019:00000007D3F60A9A DCB 0
debug5019:00000007D3F60A9B DCB 0
debug5019:00000007D3F60A9C DCB 0xB8
debug5019:00000007D3F60A9D DCB 0x2B ; +
debug5019:00000007D3F60A9E DCB 0x4A ; J
debug5019:00000007D3F60A9F DCB 0x69 ; i
debug5019:00000007D3F60AA0 DCB 0x20
debug5019:00000007D3F60AA1 DCB 0xB5
debug5019:00000007D3F60AA2 DCB 0xFD
debug5019:00000007D3F60AA3 DCB 0xD3
debug5019:00000007D3F60AA4 DCB 7
debug5019:00000007D3F60AA5 DCB 0
debug5019:00000007D3F60AA6 DCB 0
debug5019:00000007D3F60AA7 DCB 0
debug5019:00000007D3F60AA8 DCB 0x30 ; 0
debug5019:00000007D3F60AA9 DCB 0x35 ; 5
debug5019:00000007D3F60AAA DCB 0xAE
debug5019:00000007D3F60AAB DCB 0x8C
debug5019:00000007D3F60AAC DCB 0
debug5019:00000007D3F60AAD DCB 0
debug5019:00000007D3F60AAE DCB 0
debug5019:00000007D3F60AAF DCB 0
debug5019:00000007D3F60AB0 DCB 0
debug5019:00000007D3F60AB1 DCB 0
debug5019:00000007D3F60AB2 DCB 0
debug5019:00000007D3F60AB3 DCB 0
debug5019:00000007D3F60AB4 DCB 0x3F ; ?
debug5019:00000007D3F60AB5 DCB 0
debug5019:00000007D3F60AB6 DCB 0
debug5019:00000007D3F60AB7 DCB 0
debug5019:00000007D3F60AB8 DCB 0
debug5019:00000007D3F60AB9 DCB 0
debug5019:00000007D3F60ABA DCB 0
debug5019:00000007D3F60ABB DCB 0
debug5019:00000007D3F60ABC DCB 0
debug5019:00000007D3F60ABD DCB 0
debug5019:00000007D3F60ABE DCB 0
debug5019:00000007D3F60ABF DCB 0
debug5019:00000007D3F60AC0 DCB 0xA0
debug5019:00000007D3F60AC1 DCB 0x68 ; h
debug5019:00000007D3F60AC2 DCB 0xF9
debug5019:00000007D3F60AC3 DCB 7
debug5019:00000007D3F60AC4 DCB 1
debug5019:00000007D3F60AC5 DCB 0
debug5019:00000007D3F60AC6 DCB 0
debug5019:00000007D3F60AC7 DCB 0
debug5019:00000007D3F60AC8 DCB 0xC0
debug5019:00000007D3F60AC9 DCB 0x6B ; k
debug5019:00000007D3F60ACA DCB 0x62 ; b
debug5019:00000007D3F60ACB DCB 0xD7
debug5019:00000007D3F60ACC DCB 7
debug5019:00000007D3F60ACD DCB 0
debug5019:00000007D3F60ACE DCB 0
debug5019:00000007D3F60ACF DCB 0
debug5019:00000007D3F60AD0 DCB 0x20
debug5019:00000007D3F60AD1 DCB 0xAC
debug5019:00000007D3F60AD2 DCB 0xFD
debug5019:00000007D3F60AD3 DCB 0xD3
debug5019:00000007D3F60AD4 DCB 7
debug5019:00000007D3F60AD5 DCB 0
debug5019:00000007D3F60AD6 DCB 0
debug5019:00000007D3F60AD7 DCB 0
debug5019:00000007D3F60AD8 DCB 1
debug5019:00000007D3F60AD9 DCB 0
debug5019:00000007D3F60ADA DCB 0
debug5019:00000007D3F60ADB DCB 0
debug5019:00000007D3F60ADC DCB 0xB8
debug5019:00000007D3F60ADD DCB 0x2B ; +
debug5019:00000007D3F60ADE DCB 0x4A ; J
debug5019:00000007D3F60ADF DCB 0x69 ; i
debug5019:00000007D3F60AE0 DCB 0
debug5019:00000007D3F60AE1 DCB 0xBE
debug5019:00000007D3F60AE2 DCB 0xFD
debug5019:00000007D3F60AE3 DCB 0xD3
debug5019:00000007D3F60AE4 DCB 7
debug5019:00000007D3F60AE5 DCB 0
debug5019:00000007D3F60AE6 DCB 0
debug5019:00000007D3F60AE7 DCB 0
debug5019:00000007D3F60AE8 DCB 0x30 ; 0
debug5019:00000007D3F60AE9 DCB 0x35 ; 5
debug5019:00000007D3F60AEA DCB 0xAE
debug5019:00000007D3F60AEB DCB 0x8C
debug5019:00000007D3F60AEC DCB 0
debug5019:00000007D3F60AED DCB 0
debug5019:00000007D3F60AEE DCB 0
debug5019:00000007D3F60AEF DCB 0
debug5019:00000007D3F60AF0 DCB 0
debug5019:00000007D3F60AF1 DCB 0
debug5019:00000007D3F60AF2 DCB 0
debug5019:00000007D3F60AF3 DCB 0
debug5019:00000007D3F60AF4 DCB 0x3F ; ?
debug5019:00000007D3F60AF5 DCB 0
debug5019:00000007D3F60AF6 DCB 0
debug5019:00000007D3F60AF7 DCB 0
debug5019:00000007D3F60AF8 DCB 0
debug5019:00000007D3F60AF9 DCB 0
debug5019:00000007D3F60AFA DCB 0
debug5019:00000007D3F60AFB DCB 0
debug5019:00000007D3F60AFC DCB 0
debug5019:00000007D3F60AFD DCB 0
debug5019:00000007D3F60AFE DCB 0
debug5019:00000007D3F60AFF DCB 0
debug5019:00000007D3F60B00 DCB 0x43 ; C
debug5019:00000007D3F60B01 DCB 0x55 ; U
debug5019:00000007D3F60B02 DCB 0xCB
debug5019:00000007D3F60B03 DCB 0xA4
debug5019:00000007D3F60B04 DCB 0x55 ; U
debug5019:00000007D3F60B05 DCB 0x7C ; |
debug5019:00000007D3F60B06 DCB 0xE4
debug5019:00000007D3F60B07 DCB 0x96
debug5019:00000007D3F60B08 DCB 0xF0
debug5019:00000007D3F60B09 DCB 0x90
debug5019:00000007D3F60B0A DCB 0x52 ; R
```
地址范围 | 字节内容 (十六进制) | 备注/潜在含义
----------------------------------------------------------------------------------
7D3F60A80 - 60A87: A0 68 F9 07 01 00 00 00 ; 指针: 0x107F968A0
7D3F60A88 - 60A8F: A0 E4 4A D7 07 00 00 00 ; 指针: 0x7D74AE4A0
7D3F60A90 - 60A97: 00 B5 FD D3 07 00 00 00 ; 指针: 0x7D3FDB500
7D3F60A98 - 60A9F: 01 00 00 00 B8 2B 4A 69 ; 数据 (数字 1 + 部分 Hash?)
7D3F60AA0 - 60AA7: 20 B5 FD D3 07 00 00 00 ; 指针: 0x7D3FDB520
7D3F60AA8 - 60AAF: 30 35 AE 8C 00 00 00 00 ; 整数/时间戳
7D3F60AB0 - 60AB7: 00 00 00 00 3F 00 00 00 ; 标志位/长度 (63)
7D3F60AB8 - 60ABF: 00 00 00 00 00 00 00 00 ; 填充
7D3F60AC0 - 60AC7: A0 68 F9 07 01 00 00 00 ; 指针: 0x107F968A0 (重复)
7D3F60AC8 - 60ACF: C0 6B 62 D7 07 00 00 00 ; 指针: 0x7D7D7626BC0
7D3F60AD0 - 60AD7: 20 AC FD D3 07 00 00 00 ; 指针: 0x7D3FDBAC0
7D3F60AD8 - 60ADF: 01 00 00 00 B8 2B 4A 69 ; 重复出现的模式数据
7D3F60AE0 - 60AE7: 00 BE FD D3 07 00 00 00 ; 指针: 0x7D3FDBE00
7D3F60AE8 - 60AEF: 30 35 AE 8C 00 00 00 00 ; 重复的整数
7D3F60AF0 - 60AF7: 00 00 00 00 3F 00 00 00 ; 重复的标志
7D3F60AF8 - 60AFF: 00 00 00 00 00 00 00 00 ; 填充
7D3F60B00 - 60B07: 43 55 CB A4 55 7C E4 96 ; 随机数据/加密负载
7D3F60B08 - 60B0F: F0 90 52 ... ; 截断处
req2Buf的X0寄存器：
地址范围| 字节内容 (Hex) | 解释/备注
---------------------------------------------
0x00: C0 1D F9 07 01 00 00 00 ; 回调函数指针 (0x107F91DC0)
0x08: 10 1F F9 07 01 00 00 00 ; 回调函数指针 (0x107F91F10)
0x10: 40 1F F9 07 01 00 00 00 ; 回调函数指针 (0x107F91F40)
0x18: 01 00 00 00 00 00 00 00 ; 数字 1 (64位整数)
0x20: 50 B7 E2 24 07 00 00 00 ; 内存地址/指针 client信息
0x28: C8 34 DC 0E 01 00 00 00 ; 内存地址/指针 填充ZTUM
0x30: 40 93 05 25 07 00 00 00 ; 内存地址/指针 回调函数
0x38: 50 93 05 25 07 00 00 00 ; 内存地址/指针 回调函数
0x40: 50 43 C9 24 07 00 00 00 ; 内存地址/指针 回调函数
0x48: 30 CC 09 25 07 00 00 00 ; 内存地址/指针 回调函数
0x50: 60 93 05 25 07 00 00 00 ; 内存地址/指针 回调函数
0x58: 60 C0 47 24 07 00 00 00 ; 消息字段指针
0x60: 60 C0 47 24 07 00 00 00 ; 消息字段指针
0x68: 01 00 00 00 00 00 00 00 ; 数字 1
0x70: 5A 54 55 4D 00 00 00 00 ; ASCII "ZTUM" 填充
0x78: 00 00 00 00 A0 20 00 00 ; cmdid
0x80: 00 00 00 00 5A 54 55 4D ; ASCII "ZTUM" 填充
0x88: 00 00 00 00 00 00 00 00 ; 全零填充
0x90: 00 28 00 00 00 28 00 00 ; 偏移量/长度 (40, 40)
0x98: FF FF FF FF FF FF FF FF ; -1 (64位)
0xa0: 07 43 24 F1 FE FF FF FF ; 特殊标志/补码地址
0xa8: 5A 54 55 4D 5A 54 55 4D ; ASCII "ZTUMZTUM" 填充
消息字段指针:
地址范围| 字节内容 (Hex) | 解释/备注
0x00, 00,00,00,00,00,00,00,00
0x08, 00,00,00,00,00,00,00,00,
0x10, 78,46,DB,0E,01,00,00,00, 某个回调函数
0x18, 01,00,00,00,00,00,00,00, 数字1
0x20, A9,03,00,00,00,00,00,00, taskId
0x28, 00,77,B6,BE,0B,00,00,00, 消息体
type SendMessage struct {
num1_0 int64
num2_0 int64
func1 uintptr // 10edb4678 确认一下
num3_1 int64
taskId int64
message Message
}
消息体指针：
0x00: 70 4F F0 07 01 00 00 00 回调函数
0x08: BF 03 00 00 0A 02 00 00 tasId cmdId
0x10: 03 00 00 00 00 00 00 00 数字3
0x18: 60 2A 4F B3 05 00 00 00 cgi
0x20: 20 00 00 00 00 00 00 00 固定
0x28: 30 00 00 00 00 00 00 80 固定
0x30: 00 01 01 01 00 00 00 00 固定
0x38: 00 00 00 00 00 00 00 00 固定
0x40: 00 00 00 00 00 00 00 00 固定
0x48: 00 00 00 00 00 00 00 00 固定
0x50: 00 00 00 00 00 00 00 00 固定
0x58: 01 00 00 00 01 01 01 01 固定
0x60: 00 00 00 00 00 00 00 00 固定
0x68: 00 00 00 00 00 00 00 00 固定
0x70: 00 00 00 00 00 00 00 00 固定
0x78: 00 00 00 00 00 00 00 00 固定
0x80: 00 00 00 00 00 00 00 00 固定
0x88: 00 00 00 00 00 00 00 00 固定
0x90: 00 00 00 00 00 00 00 00 固定
0x98: 90 6D 69 BE 0B 00 00 00 函数指针 107f04fc8
0xa0: 00 00 00 00 00 00 00 00 固定
0xa8: 00 00 00 00 00 00 00 00 固定
0xb0: 00 00 00 00 00 00 00 00 固定
0xb8: 18 69 F9 07 01 00 00 00 回调函数
0xc0: 80 4E 97 BE 0B 00 00 00 消息体
0xc8: 01 00 00 00 01 00 00 00 固定
0xd0: 04 00 00 00 00 00 00 00 固定
0xd8: 01 00 00 00 00 00 00 00 固定
0xe0: 01 00 00 00 00 00 00 00 固定
0xe8: 08 6A F9 07 01 00 00 00 回调函数
type Message struct {
func1 uintptr // 107f04f70
taskId int32
cmdId int32
num1_3 int32
cgi uintptr // cgi的字符串指针
num2_20 int64
num3_30 int64
num4_31 int64
num5_0 int64
num6_0 int64
num7_0 int64
num8_0 int64
num9_51 int64
}
type SendMessage struct {
num1_0 int64
num2_0 int64
func1 uintptr // 10edb4678 确认一下
num3_1 int64
taskId int64
message Message
}
type Message struct {
func1 uintptr // 107f04f70
taskId int32
cmdId int32
num1_3 int32
cgi uintptr // cgi的字符串指针
num2_20 int64
num3_30 int64
num4_31 int64
num5_0 int64
num6_0 int64
num7_0 int64
num8_0 int64
num9_51 int64
}
idapro/patch_req2buf.py
+18
View File
@@ -0,0 +1,18 @@
import idc
def patch_ptr_at_x0_offset_60(target_pointer_addr):
"""
在 X0 寄存器指向的地址偏移 0x60 处写入一个新指针
target_pointer_addr: 你想要填入的指针数值（目标地址）
"""
# 1. 获取 X0 的当前地址
x0_base = idc.get_reg_value("X0")
target_field_ea = x0_base + 0x60
# 3. 写入指针值 (AArch64 下指针为 8 字节)
# idc.patch_qword 会自动处理小端序转换
idc.patch_qword(target_field_ea, target_pointer_addr)
print(f"[+] {target_pointer_addr} 操作成功!")
patch_ptr_at_x0_offset_60(0x1120eed40)
idapro/trigger_send.py
+13 -4
View File
@@ -1,12 +1,21 @@
import ida_idd
import ida_bytes
import idc
sendMessageAddress = 0x1120eed40
MessageAddress = 0x1120eee40
task_id = 0x20000090
idc.patch_dword(MessageAddress + 0x08, task_id)
idc.patch_dword(sendMessageAddress + 0x20, task_id)
idc.patch_dword(0x175ED6600, task_id)
# 改task id， 改 cgi，改第一个指针即可
payload = (
b"\x00\x00\x00\x02\x0A\x02\x00\x00" # 0x00 // task id / cmd id 175ED6600
b"\x90\x00\x00\x20\x0A\x02\x00\x00" # 0x00 // task id / cmd id 175ED6600
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x08
b"\x03\x00\x00\x00\x10\x00\x00\x00" # 0x10
b"\xf0\x02\x38\x38\x0d\x00\x00\x00" # 0x18 // cgi
b"\x40\xec\x0e\x12\x01\x00\x00\x00" # 0x18 // cgi 1120eec40
b"\x20\x00\x00\x00\x00\x00\x00\x00" # 0x20
b"\x30\x00\x00\x00\x00\x00\x00\x80" # 0x28
b"\x00\x01\x01\x01\x00\xAA\xAA\xAA" # 0x30
@@ -56,12 +65,12 @@ payload = (
b"\x98\x67\xED\x75\x01\x00\x00\x00" # 0x190
b"\x00\x00\x00\x00\x00\x00\x00\x00" # 0x198
)
ida_bytes.patch_bytes(0x175ED6600, payload)
ida_bytes.patch_bytes(0x175ED6604, payload)
my_func = ida_idd.Appcall.proto(0x10444A99C, "long long __fastcall sub_10444A99C(long long *a1, long long a2);")
try:
my_func(0x7D72BD400, 0x175ED6600)
my_func(0x9816A9400, 0x175ED6600)
print("Executed with manually set X0.")
except Exception as e:
print(f"Error: {e}")
idapro/use_struct.py
+71
View File
@@ -0,0 +1,71 @@
import idc
cgiAddress = 0x1120eec40
callBackFuncAddress = 0x1120eec70
sendMessageAddress = 0x1120eed40 # 40 ed 0e 12 01
MessageAddress = 0x1120eee40
MessageContentAddress = 0x1120eed70
MessageAddrAddr = 0x1120eed80
def setup_send_message():
patch_string_at_address(cgiAddress,
"2F 63 67 69 2D 62 69 6E 2F 6D 69 63 72 6F 6D 73 67 2D 62 69 6E 2F 6E 65 77 73 65 6E 64 6D 73 67")
idc.patch_qword(sendMessageAddress + 0x00, 0) # num1_0
idc.patch_qword(sendMessageAddress + 0x08, 0) # num2_0
idc.patch_qword(sendMessageAddress + 0x10, 0x10EDB4678) # func1 (SendMessage 虚表)
idc.patch_qword(sendMessageAddress + 0x18, 1) # num3_1
idc.patch_qword(sendMessageAddress + 0x20, 0x20000090) # taskId
idc.patch_qword(sendMessageAddress + 0x28, MessageAddress) # message
idc.patch_qword(MessageAddress + 0x00, 0x107f04f70) # 回调函数
idc.patch_dword(MessageAddress + 0x08, 0x20000090) # taskId 4位
idc.patch_dword(MessageAddress + 0x0c, 0x20a) # cmdId 4位
idc.patch_qword(MessageAddress + 0x10, 3) # 数字
idc.patch_qword(MessageAddress + 0x18, cgiAddress) # param3
idc.patch_qword(MessageAddress + 0x20, 0x0000000000000020)
idc.patch_qword(MessageAddress + 0x28, 0x8000000000000030)
idc.patch_qword(MessageAddress + 0x30, 0x0000000001010100)
idc.patch_qword(MessageAddress + 0x38, 0)
idc.patch_qword(MessageAddress + 0x40, 0)
idc.patch_qword(MessageAddress + 0x48, 0)
idc.patch_qword(MessageAddress + 0x50, 0)
idc.patch_qword(MessageAddress + 0x58, 0x0101010100000001)
idc.patch_qword(MessageAddress + 0x60, 0)
idc.patch_qword(MessageAddress + 0x68, 0)
idc.patch_qword(MessageAddress + 0x70, 0)
idc.patch_qword(MessageAddress + 0x78, 0)
idc.patch_qword(MessageAddress + 0x80, 0)
idc.patch_qword(MessageAddress + 0x88, 0)
idc.patch_qword(MessageAddress + 0x90, 0)
idc.patch_qword(callBackFuncAddress, 0x107f04fc8)
idc.patch_qword(MessageAddress + 0x98, callBackFuncAddress)
idc.patch_qword(MessageAddress + 0xa0, 0)
idc.patch_qword(MessageAddress + 0xa8, 0)
idc.patch_qword(MessageAddress + 0xb0, 0)
idc.patch_qword(MessageAddress + 0xb8, 0x107f96918)
idc.patch_qword(MessageAddress + 0xc0, MessageContentAddress)
idc.patch_qword(MessageAddress + 0xc8, 0x0000000100000001)
idc.patch_qword(MessageAddress + 0xd0, 4)
idc.patch_qword(MessageAddress + 0xd8, 1)
idc.patch_qword(MessageAddress + 0xe0, 1)
idc.patch_qword(MessageAddress + 0xe8, 0x107f96a08)
# 可能需要修改，再试一下
idc.patch_qword(MessageContentAddress, MessageAddrAddr)
idc.patch_qword(MessageAddrAddr, 0x107f968a0)
idc.patch_qword(MessageAddrAddr, cgiAddress)
def patch_string_at_address(target_addr, hex_str):
data = bytes.fromhex(hex_str.replace(" ", "").replace("\n", ""))
for i, byte in enumerate(data):
idc.patch_byte(target_addr + i, byte)
idc.patch_byte(target_addr + len(data), 0) # 终止符
print(f"Data at {hex(target_addr)} has been overwritten.")
setup_send_message()
succ.md
+5
View File
@@ -0,0 +1,5 @@
执行use_struct.py脚本
然后执行trigger_send.py脚本，改task id， 改 cgi，改第一个指针即可，第一个指针sub_10444A99C 函数执行的x0
在req2buf中打断点，在x0+60处，patch指针0x1120eed40
更改0x1120eed40 的taskId
然后在protobuf编辑处打断点，执行脚本update_sendMsg.py