From ef3ccfb3d272ea68d0b077619ad8f0e52c88dc75 Mon Sep 17 00:00:00 2001 From: yincong Date: Sat, 9 May 2026 14:07:15 +0800 Subject: [PATCH] update 4.1.9.52 --- frida-wechat.md | 6 +++--- frida/auto.js | 15 ++++----------- frida/receiver.js | 20 ++++++++++---------- frida/text.js | 17 ++++++++++------- onebot/script.js | 16 ++++++++-------- wechat_version/4_1_9_31_mac.json | 22 ---------------------- wechat_version/4_1_9_52_mac.json | 22 ++++++++++++++++++++++ 7 files changed, 57 insertions(+), 61 deletions(-) delete mode 100644 wechat_version/4_1_9_31_mac.json create mode 100644 wechat_version/4_1_9_52_mac.json diff --git a/frida-wechat.md b/frida-wechat.md index 811e321..94c6bab 100644 --- a/frida-wechat.md +++ b/frida-wechat.md @@ -2,9 +2,9 @@ 图片hook: startUploadMedia （ida搜）, OnUploadCompleted （ce查） startUploadMedia 上传图片，OnUploadCompleted 上传图片完成后的回调 加密后的图片在 _OnRecvFileData -download系列都是_OnRecvFileData，在不同的文件下面 -var downloadImagAddr // image_download -var downloadFileAddr // c2c_download + +var downloadFileAddr // c2c_download 文件和缩略图 +var downloadImagAddr // image_download 高清图 var downloadVideoAddr // hdvideo_streaming OnRecvedData WeChatExt中会有导致idapro出问题的代码 diff --git a/frida/auto.js b/frida/auto.js index afdd21f..eff0fc6 100644 --- a/frida/auto.js +++ b/frida/auto.js @@ -23,10 +23,7 @@ function scanPatterns() { console.log(`"${name}": "${offset}", 绝对地址: ${address}`); break; case "downloadFileAddr": - console.log(`"${name}": "${offset.sub(0x3c)}", 绝对地址: ${address.sub(0x3c)}`); - break; - case "downloadImageAddr": - console.log(`"${name}": "${offset.sub(0x18)}", 绝对地址: ${address.sub(0x18)}`); + console.log(`"${name}": "${offset}", 绝对地址: ${address}`); break; case "uploadImageAddr": console.log(`"${name}": "${offset.sub(0x30)}", 绝对地址: ${address.sub(0x30)}`); @@ -41,7 +38,7 @@ function scanPatterns() { console.log(`"${name}": "${offset.sub(0x28)}", 绝对地址: ${address.sub(0x28)}`); break; case "downloadVideoAddr": - console.log(`"${name}": "${offset.sub(0x2c)}", 绝对地址: ${address.sub(0x2c)}`); + console.log(`"${name}": "${offset.sub(0xc)}", 绝对地址: ${address.sub(0xc)}`); break; } }, @@ -69,11 +66,7 @@ const myPatterns = [ }, { name: "downloadFileAddr", - pattern: "F5 03 00 AA 68 4A 41 F9 08 41 46 39 60 22 01 91 69 52 41 F9" - }, - { - name: "downloadImageAddr", - pattern: "68 52 41 F9 19 8D 41 F9 1A 00 14 8B 5F 03 19 EB" + pattern: "08 01 40 F9 A8 83 1B F8 08 50 41 F9 08 29 41 F9" }, { name: "uploadImageAddr", @@ -93,7 +86,7 @@ const myPatterns = [ }, { name: "downloadVideoAddr", - pattern: "E0 03 07 91 01 00 80 52 45 C1 80 52 06 00 80 52 07 00 80 D2" + pattern: "F5 03 00 AA 76 43 09 91 E0 03 16 AA" } ]; diff --git a/frida/receiver.js b/frida/receiver.js index 41ae1db..4d8bab7 100644 --- a/frida/receiver.js +++ b/frida/receiver.js @@ -9,10 +9,10 @@ if (!baseAddr) { console.log("[+] WeChat base address: " + baseAddr); var buf2RespAddr = baseAddr.add(0x39FAC00) -var downloadImagAddr = baseAddr.add(0x4CFFF3C) // image_download -var downloadFileAddr = baseAddr.add(0x4C9EF48) // c2c_download -var downloadVideoAddr = baseAddr.add(0x4CB8070) // hdvideo_streaming -var startDownloadMedia = baseAddr.add(0x4bdd618) +var downloadImagAddr = baseAddr.add(0x4E6F32C) // image_download +var downloadFileAddr = baseAddr.add(0x4E0E264) // c2c_download +var downloadVideoAddr = baseAddr.add(0x4E28044) // hdvideo_streaming +var startDownloadMedia = baseAddr.add(0x4d4c838) var downloadGlobalX0; var downloadFileX1 = ptr(0) @@ -153,8 +153,8 @@ function setReceiver() { Interceptor.attach(downloadFileAddr, { onEnter: function (args) { var dataPtr = this.context.x22; - var dataLen = this.context.x0.toInt32(); - var fileId = this.context.sp.add(0x30).readPointer().readUtf8String(); + var dataLen = this.context.x2.toInt32(); + var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String(); var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String(); if (dataLen > 0) { @@ -184,10 +184,10 @@ function setReceiver() { Interceptor.attach(downloadVideoAddr, { onEnter: function (args) { - var dataPtr = this.context.x1; - var dataLen = this.context.x24.toInt32(); - var fileId = this.context.x22.add(0x40).readPointer().readUtf8String(); - var cdnUrl = this.context.x22.add(0x58).readPointer().readUtf8String(); + var dataPtr = this.context.x20.add(0x178).readPointer(); + var dataLen = this.context.x23.toInt32(); + var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String(); + var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String(); if (dataLen > 0) { var buffer = dataPtr.readByteArray(dataLen); diff --git a/frida/text.js b/frida/text.js index c7bafba..f6ffa18 100644 --- a/frida/text.js +++ b/frida/text.js @@ -1,5 +1,8 @@ -var moduleName = "wechat.dylib"; -var baseAddr = Process.findModuleByName(moduleName).base; +var targetPath = "/Applications/WeChat.app/Contents/Resources/wechat.dylib"; +var module = Process.enumerateModules().find(function(m) { + return m.path === targetPath; +}); +const baseAddr = module.base; if (!baseAddr) { console.error("[!] 找不到 WeChat 模块基址，请检查进程名。"); } @@ -78,7 +81,7 @@ function patchString(addr, plainStr) { // -------------------------全局变量分区------------------------- // 文本消息全局变量 -var textCallbackFuncAddr = baseAddr.add(0x2587018); +var textCallbackFuncAddr = baseAddr.add(0x26779D4); var protobufAddr = textCallbackFuncAddr.add(0x40); var patchTextProtobufAddr = textCallbackFuncAddr.add(0x20); var patchTextProtobufByte @@ -90,15 +93,15 @@ var sendTextMessageAddr = ptr(0); var textMessageAddr = ptr(0); var textProtoX1PayloadAddr = ptr(0); -var sendMessageCallbackFunc = baseAddr.add(0x8A047B0); +var sendMessageCallbackFunc = baseAddr.add(0x8C2C880); // 双方公共使用的地址 var triggerX1Payload; var triggerX0; -var req2bufEnterAddr = baseAddr.add(0x388b400); -var req2bufExitAddr = baseAddr.add(0x388C514); -var sendFuncAddr = baseAddr.add(0x4a5e108); +var req2bufEnterAddr = baseAddr.add(0x39d51d8); +var req2bufExitAddr = baseAddr.add(0x39D62EC); +var sendFuncAddr = baseAddr.add(0x4bd0e1c); var insertMsgAddr = ptr(0); var sendMsgType = ""; diff --git a/onebot/script.js b/onebot/script.js index 43e5e80..b53d4a7 100644 --- a/onebot/script.js +++ b/onebot/script.js @@ -930,10 +930,10 @@ function setReceiver() { Interceptor.attach(downloadFileAddr, { onEnter: function (args) { - var dataPtr = this.context.x22; - var dataLen = this.context.x20.toInt32(); - var fileId = this.context.sp.add(0x30).readPointer().readUtf8String(); - var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String(); + var dataPtr = this.context.x22; + var dataLen = this.context.x2.toInt32(); + var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String(); + var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String(); if (dataLen > 0) { var buffer = dataPtr.readByteArray(dataLen); @@ -972,10 +972,10 @@ function setReceiver() { Interceptor.attach(downloadVideoAddr, { onEnter: function (args) { - var dataPtr = this.context.x1; - var dataLen = this.context.x24.toInt32(); - var fileId = this.context.x22.add(0x40).readPointer().readUtf8String(); - var cdnUrl = this.context.x22.add(0x58).readPointer().readUtf8String(); + var dataPtr = this.context.x20.add(0x178).readPointer(); + var dataLen = this.context.x23.toInt32(); + var fileId = this.context.x19.add(0x2E0).readPointer().readUtf8String(); + var cdnUrl = this.context.x19.add(0x2F8).readPointer().readUtf8String(); if (dataLen > 0) { var buffer = dataPtr.readByteArray(dataLen); diff --git a/wechat_version/4_1_9_31_mac.json b/wechat_version/4_1_9_31_mac.json deleted file mode 100644 index 6df0f90..0000000 --- a/wechat_version/4_1_9_31_mac.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "textCallbackFuncAddr": "0x26779D4", - "sendMessageCallbackFunc": "0x8C2C880", - "sendFuncAddr": "0x4A61D3C", - "req2bufEnterAddr": "0x38cba28", - "req2bufExitAddr": "0x38CC97C", - "imageCallbackFuncAddr": "0x266E3A0", - "imgMessageCallbackFunc": "0x8C2C348", - "uploadImageAddr": "0x4bdc9b0", - "cndOnCompleteAddr": "0x388883c", - "buf2RespAddr": "0x38f1520", - "uploadGetCallbackWrapperAddr": "0x4b9b754", - "uploadGetCallbackWrapperFuncAddr": "", - "uploadOnCompleteAddr": "", - "uploadOnCompleteFuncAddr": "", - "downloadImagAddr": "0x4CFFF3C", - "startDownloadMedia": "0x4bdd618", - "downloadFileAddr": "0x4C9EF50", - "downloadVideoAddr": "0x4CB8070", - "videoCallbackFuncAddr": "0x26DD8C8", - "videoMessageCallbackFunc": "0x8C2F0F8" -} diff --git a/wechat_version/4_1_9_52_mac.json b/wechat_version/4_1_9_52_mac.json new file mode 100644 index 0000000..bec5655 --- /dev/null +++ b/wechat_version/4_1_9_52_mac.json @@ -0,0 +1,22 @@ +{ + "textCallbackFuncAddr": "0x26779D4", + "sendMessageCallbackFunc": "0x8C2C880", + "sendFuncAddr": "0x4bd0e1c", + "req2bufEnterAddr": "0x39d51d8", + "req2bufExitAddr": "0x39D62EC", + "imageCallbackFuncAddr": "0x266E3A0", + "imgMessageCallbackFunc": "0x8C2C348", + "uploadImageAddr": "0x4bdc9b0", + "cndOnCompleteAddr": "0x388883c", + "buf2RespAddr": "0x38f1520", + "uploadGetCallbackWrapperAddr": "0x4d0a928", + "uploadGetCallbackWrapperFuncAddr": "0x8CC0A90", + "uploadOnCompleteAddr": "0x4D0B0E0", + "uploadOnCompleteFuncAddr": "0x8CC0AB0", + "startDownloadMedia": "0x4d4c838", + "downloadImagAddr": "0x4E6F32C", + "downloadFileAddr": "0x4E0E264", + "downloadVideoAddr": "0x4E28044", + "videoCallbackFuncAddr": "0x26DD8C8", + "videoMessageCallbackFunc": "0x8C2F0F8" +}