diff --git a/frida/file.js b/frida/file.js index ee709a8..b61523d 100644 --- a/frida/file.js +++ b/frida/file.js @@ -1082,12 +1082,12 @@ function attachUploadMedia() { onEnter: function (args) { uploadGlobalX0 = this.context.x0; const selfId = this.context.x1.add(0x68).readUtf8String(); - const imagePath = this.context.x1.add(0xe0).readPointer().readUtf8String(); + const filePath = this.context.x1.add(0xe0).readPointer().readUtf8String(); send({ type: "upload", self_id: selfId, }) - console.log("UploadMedia x0: " + uploadGlobalX0 + " filePath: " + imagePath + " selfId: " + selfId); + console.log("UploadMedia x0: " + uploadGlobalX0 + " filePath: " + filePath + " selfId: " + selfId); } }) } diff --git a/onebot/script.js b/onebot/script.js index 4187900..cf7885f 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -293,7 +293,7 @@ var imgProtobufDeleteAddr = imageCallbackFuncAddr.add(0x6c); var imgProtobufDeleteAddrByte; // 视频消息全局变量 -var videoCallbackFuncAddr = baseAddr.add(0x24C76C8); +var videoCallbackFuncAddr = baseAddr.add({{.videoCallbackFuncAddr}}); var videoProtobufAddr = videoCallbackFuncAddr.add(0x54); var patchVideoProtobufFunc1 = videoCallbackFuncAddr.add(0x10); var patchVideoProtobufFunc1Byte; @@ -305,7 +305,7 @@ var videoProtobufDeleteAddrByte; var uploadImageAddr = baseAddr.add({{.uploadImageAddr}}); var CndOnCompleteAddr = baseAddr.add({{.CndOnCompleteAddr}}); var imgMessageCallbackFunc1 = baseAddr.add({{.imgMessageCallbackFunc1}}); -var videoMessageCallbackFunc1 = baseAddr.add(0x8793B78); +var videoMessageCallbackFunc1 = baseAddr.add({{.videoMessageCallbackFunc1}}); var uploadGetCallbackWrapperAddr = baseAddr.add({{.uploadGetCallbackWrapperAddr}}); var uploadGetCallbackWrapperFuncAddr = baseAddr.add({{.uploadGetCallbackWrapperFuncAddr}}); @@ -1162,12 +1162,12 @@ function attachProto() { var currTaskId = this.context.sp.add(0x30).readU32(); if (currTaskId !== taskIdGlobal) { console.log(`[+] 拦截到非目标 currTaskId: ${currTaskId} taskIdGlobal: ${taskIdGlobal}`); - console.log("[+] 视频寄存器修改完成: X1=" + this.context.x1 + ", X2=" + this.context.x2, hexdump(this.context.x1, { - offset: 0, - length: 1028, - header: true, - ansi: true - })); + // console.log("[+] 视频寄存器修改完成: X1=" + this.context.x1 + ", X2=" + this.context.x2, hexdump(this.context.x1, { + // offset: 0, + // length: 1028, + // header: true, + // ansi: true + // })); return } diff --git a/onebot/utils.go b/onebot/utils.go index 0130a79..dff38d7 100644 --- a/onebot/utils.go +++ b/onebot/utils.go @@ -60,64 +60,6 @@ func SaveBase64Image(base64Data string) (string, string, error) { return targetPath, md5Str, nil } -// SaveVideoWithSalt 保存视频并进行无损去重(不破坏播放) -func SaveVideoWithSalt(base64Data string) (string, string, error) { - rawContents := base64Data - if strings.HasPrefix(base64Data, "base64://") { - rawContents = strings.TrimPrefix(base64Data, "base64://") - } else if idx := strings.Index(base64Data, ","); idx != -1 { - rawContents = base64Data[idx+1:] - } - - data, err := base64.StdEncoding.DecodeString(rawContents) - if err != nil { - return "", "", fmt.Errorf("base64 decode failed: %v", err) - } - - // --- 无损去重核心逻辑 --- - // 构造一个合法的 MP4 'free' box - // 格式: [4字节长度][4字节类型'free'][随机数据] - saltContent := []byte(fmt.Sprintf("md5_salt_%d_%d", time.Now().UnixNano(), rand.Intn(10000))) - boxLen := uint32(len(saltContent) + 8) - freeBox := make([]byte, 8) - // 写入大端序长度 (4字节) - freeBox[0] = byte(boxLen >> 24) - freeBox[1] = byte(boxLen >> 16) - freeBox[2] = byte(boxLen >> 8) - freeBox[3] = byte(boxLen) - // 写入 'free' 标识 (4字节) - copy(freeBox[4:], []byte("free")) - - // 将 free box 追加到文件末尾(比直接追加字符串安全得多) - data = append(data, freeBox...) - data = append(data, saltContent...) - // ----------------------- - - r := rand.New(rand.NewSource(time.Now().UnixNano())) - randomNumber := r.Intn(1000) - timestamp := time.Now().Unix() - - // 假设你已有 DetectFileFormat - fileName := fmt.Sprintf("%d_%d.%s", randomNumber, timestamp, DetectFileFormat(data)) - targetPath := config.ImagePath + fileName - dir := filepath.Dir(targetPath) - if err := os.MkdirAll(dir, 0755); err != nil { - return "", "", fmt.Errorf("create directory failed: %v", err) - } - - err = os.WriteFile(targetPath, data, 0644) - if err != nil { - return "", "", fmt.Errorf("write file failed: %v", err) - } - - md5Str, err := GetFileMD5(targetPath) - if err != nil { - return "", "", fmt.Errorf("get file md5 failed: %v", err) - } - - return targetPath, md5Str, nil -} - func GetFileMD5(filePath string) (string, error) { file, err := os.Open(filePath) if err != nil { diff --git a/wechat_version/4_1_7_57_mac.json b/wechat_version/4_1_7_57_mac.json index 3c20401..a624174 100644 --- a/wechat_version/4_1_7_57_mac.json +++ b/wechat_version/4_1_7_57_mac.json @@ -16,5 +16,7 @@ "downloadImagAddr": "0x4A6975C", "startDownloadMedia": "0x494663C", "downloadFileAddr": "0x4A084EC", - "downloadVideoAddr": "0x4A2A268" + "downloadVideoAddr": "0x4A2A268", + "videoCallbackFuncAddr": "0x24C76C8", + "videoMessageCallbackFunc1": "0x8793B78" } \ No newline at end of file