tools/wechat_chatter
1
0
Fork 0
mirror of https://github.com/yincongcyincong/wechat_chatter.git synced 2026-07-15 10:26:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

update 4.1.9.52

Browse Source
This commit is contained in:
yincong
2026-05-09 14:07:15 +08:00
parent 520eb21dc1
commit ef3ccfb3d2
7 changed files with 57 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frida-wechat.md
+3 -3
View File
@@ -2,9 +2,9 @@
图片hook: startUploadMedia （ida搜）, OnUploadCompleted （ce查）
startUploadMedia 上传图片，OnUploadCompleted 上传图片完成后的回调
加密后的图片在 _OnRecvFileData
download系列都是_OnRecvFileData，在不同的文件下面
var downloadImagAddr // image_download
var downloadFileAddr // c2c_download
var downloadFileAddr // c2c_download 文件和缩略图
var downloadImagAddr // image_download 高清图
var downloadVideoAddr // hdvideo_streaming OnRecvedData
WeChatExt中会有导致idapro出问题的代码
frida/auto.js
+4 -11
View File
@@ -23,10 +23,7 @@ function scanPatterns() {
console.log(`"${name}": "${offset}", 绝对地址: ${address}`);
break;
case "downloadFileAddr":
console.log(`"${name}": "${offset.sub(0x3c)}", 绝对地址: ${address.sub(0x3c)}`);
break;
case "downloadImageAddr":
console.log(`"${name}": "${offset.sub(0x18)}", 绝对地址: ${address.sub(0x18)}`);
console.log(`"${name}": "${offset}", 绝对地址: ${address}`);
break;
case "uploadImageAddr":
console.log(`"${name}": "${offset.sub(0x30)}", 绝对地址: ${address.sub(0x30)}`);
@@ -41,7 +38,7 @@ function scanPatterns() {
console.log(`"${name}": "${offset.sub(0x28)}", 绝对地址: ${address.sub(0x28)}`);
break;
case "downloadVideoAddr":
console.log(`"${name}": "${offset.sub(0x2c)}", 绝对地址: ${address.sub(0x2c)}`);
console.log(`"${name}": "${offset.sub(0xc)}", 绝对地址: ${address.sub(0xc)}`);
break;
}
},
@@ -69,11 +66,7 @@ const myPatterns = [
},
{
name: "downloadFileAddr",
pattern: "F5 03 00 AA 68 4A 41 F9 08 41 46 39 60 22 01 91 69 52 41 F9"
},
{
name: "downloadImageAddr",
pattern: "68 52 41 F9 19 8D 41 F9 1A 00 14 8B 5F 03 19 EB"
pattern: "08 01 40 F9 A8 83 1B F8 08 50 41 F9 08 29 41 F9"
},
{
name: "uploadImageAddr",
@@ -93,7 +86,7 @@ const myPatterns = [
},
{
name: "downloadVideoAddr",
pattern: "E0 03 07 91 01 00 80 52 45 C1 80 52 06 00 80 52 07 00 80 D2"
pattern: "F5 03 00 AA 76 43 09 91 E0 03 16 AA"
}
];
frida/receiver.js
+10 -10
View File
@@ -9,10 +9,10 @@ if (!baseAddr) {
console.log("[+] WeChat base address: " + baseAddr);
var buf2RespAddr = baseAddr.add(0x39FAC00)
var downloadImagAddr = baseAddr.add(0x4CFFF3C) // image_download
var downloadFileAddr = baseAddr.add(0x4C9EF48) // c2c_download
var downloadVideoAddr = baseAddr.add(0x4CB8070) // hdvideo_streaming
var startDownloadMedia = baseAddr.add(0x4bdd618)
var downloadImagAddr = baseAddr.add(0x4E6F32C) // image_download
var downloadFileAddr = baseAddr.add(0x4E0E264) // c2c_download
var downloadVideoAddr = baseAddr.add(0x4E28044) // hdvideo_streaming
var startDownloadMedia = baseAddr.add(0x4d4c838)
var downloadGlobalX0;
var downloadFileX1 = ptr(0)
@@ -153,8 +153,8 @@ function setReceiver() {
Interceptor.attach(downloadFileAddr, {
onEnter: function (args) {
var dataPtr = this.context.x22;
var dataLen = this.context.x0.toInt32();
var fileId = this.context.sp.add(0x30).readPointer().readUtf8String();
var dataLen = this.context.x2.toInt32();
var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String();
var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String();
if (dataLen > 0) {
@@ -184,10 +184,10 @@ function setReceiver() {
Interceptor.attach(downloadVideoAddr, {
onEnter: function (args) {
var dataPtr = this.context.x1;
var dataLen = this.context.x24.toInt32();
var fileId = this.context.x22.add(0x40).readPointer().readUtf8String();
var cdnUrl = this.context.x22.add(0x58).readPointer().readUtf8String();
var dataPtr = this.context.x20.add(0x178).readPointer();
var dataLen = this.context.x23.toInt32();
var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String();
var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String();
if (dataLen > 0) {
var buffer = dataPtr.readByteArray(dataLen);
frida/text.js
+10 -7
View File
@@ -1,5 +1,8 @@
var moduleName = "wechat.dylib";
var baseAddr = Process.findModuleByName(moduleName).base;
var targetPath = "/Applications/WeChat.app/Contents/Resources/wechat.dylib";
var module = Process.enumerateModules().find(function(m) {
return m.path === targetPath;
});
const baseAddr = module.base;
if (!baseAddr) {
console.error("[!] 找不到 WeChat 模块基址，请检查进程名。");
}
@@ -78,7 +81,7 @@ function patchString(addr, plainStr) {
// -------------------------全局变量分区-------------------------
// 文本消息全局变量
var textCallbackFuncAddr = baseAddr.add(0x2587018);
var textCallbackFuncAddr = baseAddr.add(0x26779D4);
var protobufAddr = textCallbackFuncAddr.add(0x40);
var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20);
var patchTextProtobufByte
@@ -90,15 +93,15 @@ var sendTextMessageAddr = ptr(0);
var textMessageAddr = ptr(0);
var textProtoX1PayloadAddr = ptr(0);
var sendMessageCallbackFunc = baseAddr.add(0x8A047B0);
var sendMessageCallbackFunc = baseAddr.add(0x8C2C880);
// 双方公共使用的地址
var triggerX1Payload;
var triggerX0;
var req2bufEnterAddr = baseAddr.add(0x388b400);
var req2bufExitAddr = baseAddr.add(0x388C514);
var sendFuncAddr = baseAddr.add(0x4a5e108);
var req2bufEnterAddr = baseAddr.add(0x39d51d8);
var req2bufExitAddr = baseAddr.add(0x39D62EC);
var sendFuncAddr = baseAddr.add(0x4bd0e1c);
var insertMsgAddr = ptr(0);
var sendMsgType = "";
onebot/script.js
+8 -8
View File
@@ -930,10 +930,10 @@ function setReceiver() {
Interceptor.attach(downloadFileAddr, {
onEnter: function (args) {
var dataPtr = this.context.x22;
var dataLen = this.context.x20.toInt32();
var fileId = this.context.sp.add(0x30).readPointer().readUtf8String();
var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String();
var dataPtr = this.context.x22;
var dataLen = this.context.x2.toInt32();
var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String();
var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String();
if (dataLen > 0) {
var buffer = dataPtr.readByteArray(dataLen);
@@ -972,10 +972,10 @@ function setReceiver() {
Interceptor.attach(downloadVideoAddr, {
onEnter: function (args) {
var dataPtr = this.context.x1;
var dataLen = this.context.x24.toInt32();
var fileId = this.context.x22.add(0x40).readPointer().readUtf8String();
var cdnUrl = this.context.x22.add(0x58).readPointer().readUtf8String();
var dataPtr = this.context.x20.add(0x178).readPointer();
var dataLen = this.context.x23.toInt32();
var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String();
var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String();
if (dataLen > 0) {
var buffer = dataPtr.readByteArray(dataLen);
wechat_version/4_1_9_31_mac.json
-22
View File
@@ -1,22 +0,0 @@
{
"textCallbackFuncAddr": "0x26779D4",
"sendMessageCallbackFunc": "0x8C2C880",
"sendFuncAddr": "0x4A61D3C",
"req2bufEnterAddr": "0x38cba28",
"req2bufExitAddr": "0x38CC97C",
"imageCallbackFuncAddr": "0x266E3A0",
"imgMessageCallbackFunc": "0x8C2C348",
"uploadImageAddr": "0x4bdc9b0",
"cndOnCompleteAddr": "0x388883c",
"buf2RespAddr": "0x38f1520",
"uploadGetCallbackWrapperAddr": "0x4b9b754",
"uploadGetCallbackWrapperFuncAddr": "",
"uploadOnCompleteAddr": "",
"uploadOnCompleteFuncAddr": "",
"downloadImagAddr": "0x4CFFF3C",
"startDownloadMedia": "0x4bdd618",
"downloadFileAddr": "0x4C9EF50",
"downloadVideoAddr": "0x4CB8070",
"videoCallbackFuncAddr": "0x26DD8C8",
"videoMessageCallbackFunc": "0x8C2F0F8"
}
wechat_version/4_1_9_52_mac.json
+22
View File
@@ -0,0 +1,22 @@
{
"textCallbackFuncAddr": "0x26779D4",
"sendMessageCallbackFunc": "0x8C2C880",
"sendFuncAddr": "0x4bd0e1c",
"req2bufEnterAddr": "0x39d51d8",
"req2bufExitAddr": "0x39D62EC",
"imageCallbackFuncAddr": "0x266E3A0",
"imgMessageCallbackFunc": "0x8C2C348",
"uploadImageAddr": "0x4bdc9b0",
"cndOnCompleteAddr": "0x388883c",
"buf2RespAddr": "0x38f1520",
"uploadGetCallbackWrapperAddr": "0x4d0a928",
"uploadGetCallbackWrapperFuncAddr": "0x8CC0A90",
"uploadOnCompleteAddr": "0x4D0B0E0",
"uploadOnCompleteFuncAddr": "0x8CC0AB0",
"startDownloadMedia": "0x4d4c838",
"downloadImagAddr": "0x4E6F32C",
"downloadFileAddr": "0x4E0E264",
"downloadVideoAddr": "0x4E28044",
"videoCallbackFuncAddr": "0x26DD8C8",
"videoMessageCallbackFunc": "0x8C2F0F8"
}