mirror of
https://github.com/yincongcyincong/wechat_chatter.git
synced 2026-07-15 10:26:52 +08:00
support openclaw
This commit is contained in:
@@ -40,7 +40,7 @@ triggerSendImgMessage(0x20000199, "wxid_xxx","wxid_xxx")
|
||||
|
||||
```
|
||||
|
||||
## 支持onebot协议 (http接口)
|
||||
## 支持onebot协议 (http接口)&& 如何接入openclaw
|
||||
https://github.com/yincongcyincong/weixin-macos/blob/main/onebot/readme.md
|
||||
|
||||
## 交流群
|
||||
|
||||
+1
-1
@@ -77,7 +77,7 @@ func SendHttpReq(msg map[string]interface{}) {
|
||||
}
|
||||
}()
|
||||
|
||||
time.Sleep(1 * time.Second)
|
||||
time.Sleep(time.Duration(config.SendInterval) * time.Second)
|
||||
// 这里处理你的 X1 数据
|
||||
jsonData, err := json.Marshal(msg["payload"])
|
||||
if err != nil {
|
||||
|
||||
@@ -80,6 +80,7 @@ type Config struct {
|
||||
OnebotToken string `json:"onebot_token"`
|
||||
ImagePath string `json:"image_path"`
|
||||
ConnType string `json:"conn_type"`
|
||||
SendInterval int `json:"send_interval"`
|
||||
|
||||
WechatConf string `json:"wechat_conf"`
|
||||
}
|
||||
@@ -125,6 +126,7 @@ func initFlag() {
|
||||
flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
|
||||
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_55_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
|
||||
flag.StringVar(&config.ConnType, "conn_type", "http", "连接类型: http | websocket")
|
||||
flag.IntVar(&config.SendInterval, "send_interval", 1000, "发送间隔: ms")
|
||||
|
||||
flag.Parse()
|
||||
|
||||
|
||||
+24
-32
@@ -298,12 +298,12 @@ function setupSendTextMessageDynamic() {
|
||||
sendTextMessageAddr.add(0x20).writeU32(taskIdGlobal);
|
||||
sendTextMessageAddr.add(0x28).writePointer(textMessageAddr); // 指向动态分配的 Message
|
||||
|
||||
console.log(" [+] sendTextMessageAddr Object: ", hexdump(sendTextMessageAddr, {
|
||||
offset: 0,
|
||||
length: 48,
|
||||
header: true,
|
||||
ansi: true
|
||||
}));
|
||||
// console.log(" [+] sendTextMessageAddr Object: ", hexdump(sendTextMessageAddr, {
|
||||
// offset: 0,
|
||||
// length: 48,
|
||||
// header: true,
|
||||
// ansi: true
|
||||
// }));
|
||||
|
||||
// C. 构建 Message 结构体
|
||||
textMessageAddr.add(0x00).writePointer(sendMessageCallbackFunc);
|
||||
@@ -313,12 +313,12 @@ function setupSendTextMessageDynamic() {
|
||||
textMessageAddr.add(0x18).writePointer(textCgiAddr);
|
||||
textMessageAddr.add(0x20).writeU64(uint64("0x20"));
|
||||
|
||||
console.log(" [+] textMessageAddr Object: ", hexdump(textMessageAddr, {
|
||||
offset: 0,
|
||||
length: 64,
|
||||
header: true,
|
||||
ansi: true
|
||||
}));
|
||||
// console.log(" [+] textMessageAddr Object: ", hexdump(textMessageAddr, {
|
||||
// offset: 0,
|
||||
// length: 64,
|
||||
// header: true,
|
||||
// ansi: true
|
||||
// }));
|
||||
|
||||
console.log("[+] Dynamic Memory Setup Complete. - Message Object: " + textMessageAddr);
|
||||
}
|
||||
@@ -333,15 +333,14 @@ function patchTextProtoBuf() {
|
||||
cw.flush();
|
||||
});
|
||||
|
||||
console.log("[+] Patching patchTextProtobufAddr " + patchTextProtobufAddr + " 成功.");
|
||||
|
||||
Memory.patchCode(PatchTextProtobufDeleteAddr, 4, code => {
|
||||
const cw = new Arm64Writer(code, {pc: PatchTextProtobufDeleteAddr});
|
||||
cw.putNop();
|
||||
cw.flush();
|
||||
});
|
||||
|
||||
console.log("[+] Patching PatchTextProtobufDeleteAddr " + PatchTextProtobufDeleteAddr + " 成功.");
|
||||
console.log("[+] Patching PatchTextProtobufDeleteAddr " + PatchTextProtobufDeleteAddr + " 成功." +
|
||||
" Patching patchTextProtobufAddr " + patchTextProtobufAddr + " 成功.");
|
||||
}
|
||||
|
||||
setTimeout(function () {
|
||||
@@ -363,7 +362,7 @@ function triggerSendTextMessage(taskId, receiver, content, atUser) {
|
||||
receiverGlobal = receiver;
|
||||
contentGlobal = content;
|
||||
atUserGlobal = atUser
|
||||
console.log("taskIdGlobal: " + taskIdGlobal + ", receiverGlobal: " + receiverGlobal + ", contentGlobal: " + contentGlobal + ", atUserGlobal: " + atUserGlobal) ;
|
||||
console.log("taskIdGlobal: " + taskIdGlobal + ", receiverGlobal: " + receiverGlobal + ", contentGlobal: " + contentGlobal + ", atUserGlobal: " + atUserGlobal);
|
||||
|
||||
textMessageAddr.add(0x08).writeU32(taskIdGlobal);
|
||||
sendTextMessageAddr.add(0x20).writeU32(taskIdGlobal);
|
||||
@@ -463,8 +462,7 @@ setImmediate(AttachSendTextProto);
|
||||
|
||||
// 拦截 SendTextProto 编码逻辑,注入自定义 Payload
|
||||
function attachSendTextProto() {
|
||||
console.log("[+] proto注入拦截目标地址: " + protobufAddr);
|
||||
textProtoX1PayloadAddr = Memory.alloc(1024);
|
||||
textProtoX1PayloadAddr = Memory.alloc(2048);
|
||||
console.log("[+] Frida 分配的 Payload 地址: " + textProtoX1PayloadAddr);
|
||||
|
||||
Interceptor.attach(protobufAddr, {
|
||||
@@ -591,8 +589,6 @@ setImmediate(attachReq2buf);
|
||||
|
||||
// 初始化进行内存的分配
|
||||
function setupSendImgMessageDynamic() {
|
||||
console.log("[+] Starting setupSendImgMessageDynamic Dynamic Message Patching...");
|
||||
|
||||
// 1. 动态分配内存块(按需分配大小)
|
||||
// 分配原则:字符串给 64-128 字节,结构体按实际大小分配
|
||||
imgCgiAddr = Memory.alloc(128);
|
||||
@@ -617,12 +613,12 @@ function setupSendImgMessageDynamic() {
|
||||
sendImgMessageAddr.add(0x20).writeU32(taskIdGlobal);
|
||||
sendImgMessageAddr.add(0x28).writePointer(imgMessageAddr);
|
||||
|
||||
console.log(" [+] sendImgMessageAddr Object: ", hexdump(sendImgMessageAddr, {
|
||||
offset: 0,
|
||||
length: 48,
|
||||
header: true,
|
||||
ansi: true
|
||||
}));
|
||||
// console.log(" [+] sendImgMessageAddr Object: ", hexdump(sendImgMessageAddr, {
|
||||
// offset: 0,
|
||||
// length: 48,
|
||||
// header: true,
|
||||
// ansi: true
|
||||
// }));
|
||||
|
||||
// C. 构建 Message 结构体
|
||||
imgMessageAddr.add(0x00).writePointer(imgMessageCallbackFunc1);
|
||||
@@ -647,23 +643,20 @@ function patchImgProtoBuf() {
|
||||
cw.flush();
|
||||
});
|
||||
|
||||
console.log("[+] Patching patchImgProtobufFunc1 " + patchImgProtobufFunc1 + " 成功.");
|
||||
|
||||
Memory.patchCode(patchImgProtobufFunc2, 4, code => {
|
||||
const cw = new Arm64Writer(code, {pc: patchImgProtobufFunc2});
|
||||
cw.putNop();
|
||||
cw.flush();
|
||||
});
|
||||
|
||||
console.log("[+] Patching patchImgProtobufFunc2 " + patchImgProtobufFunc2 + " 成功.");
|
||||
|
||||
Memory.patchCode(imgProtobufDeleteAddr, 4, code => {
|
||||
const cw = new Arm64Writer(code, {pc: imgProtobufDeleteAddr});
|
||||
cw.putNop();
|
||||
cw.flush();
|
||||
});
|
||||
|
||||
console.log("[+] Patching imgProtobufDeleteAddr " + imgProtobufDeleteAddr + " 成功.");
|
||||
console.log("[+] Patching patchImgProtobufFunc1 " + patchImgProtobufFunc1 + " 成功." + "[+] Patching patchImgProtobufFunc2 " + patchImgProtobufFunc2 + " 成功."
|
||||
+ " Patching imgProtobufDeleteAddr " + imgProtobufDeleteAddr + " 成功.");
|
||||
}
|
||||
|
||||
|
||||
@@ -769,7 +762,6 @@ function triggerSendImgMessage(taskId, sender, receiver) {
|
||||
|
||||
// 拦截 Protobuf 编码逻辑,注入自定义 Payload
|
||||
function attachProto() {
|
||||
console.log("[+] proto注入拦截目标地址: " + imgProtoX1PayloadAddr);
|
||||
imgProtoX1PayloadAddr = Memory.alloc(1024);
|
||||
console.log("[+] Frida 分配的 Payload 地址: " + imgProtoX1PayloadAddr);
|
||||
|
||||
|
||||
+1
-1
@@ -87,7 +87,7 @@ func SendWebSocketMsg(msg map[string]interface{}) {
|
||||
}
|
||||
}()
|
||||
|
||||
time.Sleep(1 * time.Second)
|
||||
time.Sleep(time.Duration(config.SendInterval) * time.Second)
|
||||
// 这里处理你的 X1 数据
|
||||
jsonData, err := json.Marshal(msg["payload"])
|
||||
if err != nil {
|
||||
|
||||
+1
-1
@@ -30,7 +30,7 @@ func SendWorker() {
|
||||
}
|
||||
|
||||
func SendWechatMsg(m *SendMsg) {
|
||||
time.Sleep(1 * time.Second)
|
||||
time.Sleep(time.Duration(config.SendInterval) * time.Millisecond)
|
||||
currTaskId := atomic.AddInt64(&taskId, 1)
|
||||
log.Printf("📩 收到任务: %d\n", currTaskId)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user