support openclaw

This commit is contained in:
yincong
2026-02-27 10:14:47 +08:00
parent 6ba22acc8d
commit f4fd1271be
6 changed files with 30 additions and 36 deletions
+1 -1
View File
@@ -40,7 +40,7 @@ triggerSendImgMessage(0x20000199, "wxid_xxx","wxid_xxx")
```
## 支持onebot协议 http接口)
## 支持onebot协议 http接口)&& 如何接入openclaw
https://github.com/yincongcyincong/weixin-macos/blob/main/onebot/readme.md
## 交流群
+1 -1
View File
@@ -77,7 +77,7 @@ func SendHttpReq(msg map[string]interface{}) {
}
}()
time.Sleep(1 * time.Second)
time.Sleep(time.Duration(config.SendInterval) * time.Second)
// 这里处理你的 X1 数据
jsonData, err := json.Marshal(msg["payload"])
if err != nil {
+2
View File
@@ -80,6 +80,7 @@ type Config struct {
OnebotToken string `json:"onebot_token"`
ImagePath string `json:"image_path"`
ConnType string `json:"conn_type"`
SendInterval int `json:"send_interval"`
WechatConf string `json:"wechat_conf"`
}
@@ -125,6 +126,7 @@ func initFlag() {
flag.StringVar(&config.ImagePath, "image_path", "", "图片路径: /Users/xxx/Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat_files/xxx/temp/xxx/2026-01/Img/")
flag.StringVar(&config.WechatConf, "wechat_conf", "../wechat_version/4_1_7_55_mac.json", "微信配置文件路径: ../wechat_version/4_1_6_12_mac.json")
flag.StringVar(&config.ConnType, "conn_type", "http", "连接类型: http | websocket")
flag.IntVar(&config.SendInterval, "send_interval", 1000, "发送间隔: ms")
flag.Parse()
+24 -32
View File
@@ -298,12 +298,12 @@ function setupSendTextMessageDynamic() {
sendTextMessageAddr.add(0x20).writeU32(taskIdGlobal);
sendTextMessageAddr.add(0x28).writePointer(textMessageAddr); // 指向动态分配的 Message
console.log(" [+] sendTextMessageAddr Object: ", hexdump(sendTextMessageAddr, {
offset: 0,
length: 48,
header: true,
ansi: true
}));
// console.log(" [+] sendTextMessageAddr Object: ", hexdump(sendTextMessageAddr, {
// offset: 0,
// length: 48,
// header: true,
// ansi: true
// }));
// C. 构建 Message 结构体
textMessageAddr.add(0x00).writePointer(sendMessageCallbackFunc);
@@ -313,12 +313,12 @@ function setupSendTextMessageDynamic() {
textMessageAddr.add(0x18).writePointer(textCgiAddr);
textMessageAddr.add(0x20).writeU64(uint64("0x20"));
console.log(" [+] textMessageAddr Object: ", hexdump(textMessageAddr, {
offset: 0,
length: 64,
header: true,
ansi: true
}));
// console.log(" [+] textMessageAddr Object: ", hexdump(textMessageAddr, {
// offset: 0,
// length: 64,
// header: true,
// ansi: true
// }));
console.log("[+] Dynamic Memory Setup Complete. - Message Object: " + textMessageAddr);
}
@@ -333,15 +333,14 @@ function patchTextProtoBuf() {
cw.flush();
});
console.log("[+] Patching patchTextProtobufAddr " + patchTextProtobufAddr + " 成功.");
Memory.patchCode(PatchTextProtobufDeleteAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: PatchTextProtobufDeleteAddr});
cw.putNop();
cw.flush();
});
console.log("[+] Patching PatchTextProtobufDeleteAddr " + PatchTextProtobufDeleteAddr + " 成功.");
console.log("[+] Patching PatchTextProtobufDeleteAddr " + PatchTextProtobufDeleteAddr + " 成功." +
" Patching patchTextProtobufAddr " + patchTextProtobufAddr + " 成功.");
}
setTimeout(function () {
@@ -363,7 +362,7 @@ function triggerSendTextMessage(taskId, receiver, content, atUser) {
receiverGlobal = receiver;
contentGlobal = content;
atUserGlobal = atUser
console.log("taskIdGlobal: " + taskIdGlobal + ", receiverGlobal: " + receiverGlobal + ", contentGlobal: " + contentGlobal + ", atUserGlobal: " + atUserGlobal) ;
console.log("taskIdGlobal: " + taskIdGlobal + ", receiverGlobal: " + receiverGlobal + ", contentGlobal: " + contentGlobal + ", atUserGlobal: " + atUserGlobal);
textMessageAddr.add(0x08).writeU32(taskIdGlobal);
sendTextMessageAddr.add(0x20).writeU32(taskIdGlobal);
@@ -463,8 +462,7 @@ setImmediate(AttachSendTextProto);
// 拦截 SendTextProto 编码逻辑,注入自定义 Payload
function attachSendTextProto() {
console.log("[+] proto注入拦截目标地址: " + protobufAddr);
textProtoX1PayloadAddr = Memory.alloc(1024);
textProtoX1PayloadAddr = Memory.alloc(2048);
console.log("[+] Frida 分配的 Payload 地址: " + textProtoX1PayloadAddr);
Interceptor.attach(protobufAddr, {
@@ -591,8 +589,6 @@ setImmediate(attachReq2buf);
// 初始化进行内存的分配
function setupSendImgMessageDynamic() {
console.log("[+] Starting setupSendImgMessageDynamic Dynamic Message Patching...");
// 1. 动态分配内存块(按需分配大小)
// 分配原则:字符串给 64-128 字节,结构体按实际大小分配
imgCgiAddr = Memory.alloc(128);
@@ -617,12 +613,12 @@ function setupSendImgMessageDynamic() {
sendImgMessageAddr.add(0x20).writeU32(taskIdGlobal);
sendImgMessageAddr.add(0x28).writePointer(imgMessageAddr);
console.log(" [+] sendImgMessageAddr Object: ", hexdump(sendImgMessageAddr, {
offset: 0,
length: 48,
header: true,
ansi: true
}));
// console.log(" [+] sendImgMessageAddr Object: ", hexdump(sendImgMessageAddr, {
// offset: 0,
// length: 48,
// header: true,
// ansi: true
// }));
// C. 构建 Message 结构体
imgMessageAddr.add(0x00).writePointer(imgMessageCallbackFunc1);
@@ -647,23 +643,20 @@ function patchImgProtoBuf() {
cw.flush();
});
console.log("[+] Patching patchImgProtobufFunc1 " + patchImgProtobufFunc1 + " 成功.");
Memory.patchCode(patchImgProtobufFunc2, 4, code => {
const cw = new Arm64Writer(code, {pc: patchImgProtobufFunc2});
cw.putNop();
cw.flush();
});
console.log("[+] Patching patchImgProtobufFunc2 " + patchImgProtobufFunc2 + " 成功.");
Memory.patchCode(imgProtobufDeleteAddr, 4, code => {
const cw = new Arm64Writer(code, {pc: imgProtobufDeleteAddr});
cw.putNop();
cw.flush();
});
console.log("[+] Patching imgProtobufDeleteAddr " + imgProtobufDeleteAddr + " 成功.");
console.log("[+] Patching patchImgProtobufFunc1 " + patchImgProtobufFunc1 + " 成功." + "[+] Patching patchImgProtobufFunc2 " + patchImgProtobufFunc2 + " 成功."
+ " Patching imgProtobufDeleteAddr " + imgProtobufDeleteAddr + " 成功.");
}
@@ -769,7 +762,6 @@ function triggerSendImgMessage(taskId, sender, receiver) {
// 拦截 Protobuf 编码逻辑,注入自定义 Payload
function attachProto() {
console.log("[+] proto注入拦截目标地址: " + imgProtoX1PayloadAddr);
imgProtoX1PayloadAddr = Memory.alloc(1024);
console.log("[+] Frida 分配的 Payload 地址: " + imgProtoX1PayloadAddr);
+1 -1
View File
@@ -87,7 +87,7 @@ func SendWebSocketMsg(msg map[string]interface{}) {
}
}()
time.Sleep(1 * time.Second)
time.Sleep(time.Duration(config.SendInterval) * time.Second)
// 这里处理你的 X1 数据
jsonData, err := json.Marshal(msg["payload"])
if err != nil {
+1 -1
View File
@@ -30,7 +30,7 @@ func SendWorker() {
}
func SendWechatMsg(m *SendMsg) {
time.Sleep(1 * time.Second)
time.Sleep(time.Duration(config.SendInterval) * time.Millisecond)
currTaskId := atomic.AddInt64(&taskId, 1)
log.Printf("📩 收到任务: %d\n", currTaskId)