From fb1329c467cefca8d7597728d88c03442c3f2555 Mon Sep 17 00:00:00 2001 From: yincong Date: Tue, 31 Mar 2026 18:57:42 +0800 Subject: [PATCH] format --- frida/tmp_file.js | 874 +++++++++++++++++++++++----------------------- 1 file changed, 441 insertions(+), 433 deletions(-) diff --git a/frida/tmp_file.js b/frida/tmp_file.js index ff2de29..6020834 100644 --- a/frida/tmp_file.js +++ b/frida/tmp_file.js @@ -1,6 +1,11 @@ -// 下载文件上传函数 - 基于视频上传，0x98位置从0x04改为0x05 +// ============================================================================= +// 微信 macOS Frida 脚本 - 文件上传与发送 +// 基于视频上传逻辑，0x98 位置从 0x04 改为 0x05 以支持文件类型 +// ============================================================================= + + +// =========================== 模块基址初始化 =========================== -// 获取微信主模块的基地址 var moduleName = "wechat.dylib"; var baseAddr = Process.findModuleByName(moduleName).base; if (!baseAddr) { @@ -8,16 +13,10 @@ if (!baseAddr) { } console.log("[+] WeChat base address: " + baseAddr); -// 全局变量 -var uploadFileX1 = ptr(0); -var fileIdAddr = ptr(0); -var md5Addr = ptr(0) -var uploadAesKeyAddr = ptr(0); -var filePathAddr1 = ptr(0); -var uploadGlobalX0 = ptr(0); -var uploadFunc1Addr = ptr(0); -var uploadFunc2Addr = ptr(0); -var uploadCallback = ptr(0); + +// =========================== 地址定义 =========================== + +// --- 文件上传相关地址 --- var uploadImageAddr = baseAddr.add(0x4ad95c0); var uploadGetCallbackWrapperAddr = baseAddr.add(0x4aa7084); var uploadGetCallbackWrapperFuncAddr = baseAddr.add(0x37C874C); @@ -25,21 +24,34 @@ var uploadOnCompleteAddr = baseAddr.add(0x4AA7680); var uploadOnCompleteFuncAddr = baseAddr.add(0x37C9930); var cndOnCompleteAddr = baseAddr.add(0x37c8f00); +// --- 文件回调 & Protobuf 相关地址 --- var fileCallbackFuncAddr = baseAddr.add(0x2544584); var fileProtobufAddr = fileCallbackFuncAddr.add(0x50); var patchFileProtobufFunc1 = fileCallbackFuncAddr.add(0x10); -var patchFileProtobufFunc1Byte; var patchFileProtobufFunc2 = fileCallbackFuncAddr.add(0x30); -var patchFileProtobufFunc2Byte; var fileProtobufDeleteAddr = fileCallbackFuncAddr.add(0x6c); -var fileProtobufDeleteAddrByte; - -var fileMessageCallbackFunc1 = baseAddr.add(0x892DEF8) +var fileMessageCallbackFunc1 = baseAddr.add(0x892DEF8); +// --- 发送 & Req2Buf 相关地址 --- var sendFuncAddr = baseAddr.add(0x4992040); var req2bufEnterAddr = baseAddr.add(0x380b950); var req2bufExitAddr = baseAddr.add(0x380CA64); + +// =========================== 全局状态变量 =========================== + +// --- 上传相关指针 --- +var uploadFileX1 = ptr(0); +var fileIdAddr = ptr(0); +var md5Addr = ptr(0); +var uploadAesKeyAddr = ptr(0); +var filePathAddr1 = ptr(0); +var uploadGlobalX0 = ptr(0); +var uploadFunc1Addr = ptr(0); +var uploadFunc2Addr = ptr(0); +var uploadCallback = ptr(0); + +// --- 发送消息相关指针 --- var fileCgiAddr2 = ptr(0); var sendFileMessageAddr = ptr(0); var fileMessageAddr = ptr(0); @@ -47,17 +59,105 @@ var fileProtoX1PayloadAddr = ptr(0); var triggerX1Payload; var triggerX0; var insertMsgAddr = ptr(0); + +// --- Patch 原始字节备份 --- +var patchFileProtobufFunc1Byte; +var patchFileProtobufFunc2Byte; +var fileProtobufDeleteAddrByte; + +// --- 业务状态 --- +var taskIdGlobal = 0x0; +var receiverGlobal = "wxid_"; +var contentGlobal = ""; +var senderGlobal = "wxid_"; +var lastSendTime = 0; var sendMsgType = ""; -var taskIdGlobal = 0x0 -var receiverGlobal = "wxid_" -var contentGlobal = ""; -var senderGlobal = "wxid_" -var lastSendTime = 0; +// --- 常量 --- +const fileCp = generateBytes(16); -const fileCp = generateBytes(16) -// 文件上传完成队列 +// =========================== 工具函数 =========================== + +function stringToHexArray(str) { + var utf8Str = unescape(encodeURIComponent(str)); + var arr = []; + for (var i = 0; i < utf8Str.length; i++) { + arr.push(utf8Str.charCodeAt(i)); + } + return arr; +} + +function toVarint(n) { + let res = []; + while (n >= 128) { + res.push((n & 0x7F) | 0x80); + n = n >> 7; + } + res.push(n); + return res; +} + +function generateRandom5ByteVarint() { + let res = []; + // 前 4 个字节：最高位(bit 7)必须是 1，低 7 位随机 + for (let i = 0; i < 4; i++) { + let random7Bit = Math.floor(Math.random() * 128); + res.push(random7Bit | 0x80); + } + // 第 5 个字节：最高位必须是 0，低 7 位不能全为 0 + let lastByte = Math.floor(Math.random() * 127) + 1; + res.push(lastByte & 0x7F); + return res; +} + +function getVarintTimestampBytes() { + let ts = Math.floor(Date.now() / 1000); + let encodedBytes = []; + let tempTs = ts >>> 0; + while (true) { + let byte = tempTs & 0x7F; + tempTs >>>= 7; + if (tempTs !== 0) { + encodedBytes.push(byte | 0x80); + } else { + encodedBytes.push(byte); + break; + } + } + return encodedBytes; +} + +function patchString(addr, plainStr) { + const bytes = []; + for (let i = 0; i < plainStr.length; i++) { + bytes.push(plainStr.charCodeAt(i)); + } + addr.writeByteArray(bytes); + addr.add(bytes.length).writeU8(0); +} + +function generateAESKey() { + const chars = 'abcdef0123456789'; + let key = ''; + for (let i = 0; i < 32; i++) { + key += chars.charAt(Math.floor(Math.random() * chars.length)); + } + return key; +} + +function generateBytes(n) { + const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; + let result = ''; + for (let i = 0; i < n; i++) { + result += chars.charAt(Math.floor(Math.random() * chars.length)); + } + return stringToHexArray(result); +} + + +// =========================== 文件上传队列 =========================== + var fileUploadQueue = []; function getFileUploadInfo() { @@ -72,7 +172,11 @@ function pushFileUploadInfo(info) { console.log("[+] 文件上传信息已入队，当前队列长度:", fileUploadQueue.length); } + +// =========================== 内存初始化 =========================== + function setupUploadFileDynamic() { + // 上传相关内存分配 fileIdAddr = Memory.alloc(256); filePathAddr1 = Memory.alloc(256); uploadFileX1 = Memory.alloc(1024); @@ -91,6 +195,7 @@ function setupUploadFileDynamic() { patchString(fileCgiAddr2, "/cgi-bin/micromsg-bin/sendappmsg"); + // 初始化 sendFileMessageAddr 结构体 sendFileMessageAddr.add(0x00).writeU64(0); sendFileMessageAddr.add(0x08).writeU64(0); sendFileMessageAddr.add(0x10).writeU64(0); @@ -98,6 +203,7 @@ function setupUploadFileDynamic() { sendFileMessageAddr.add(0x20).writeU32(taskIdGlobal); sendFileMessageAddr.add(0x28).writePointer(fileMessageAddr); + // 初始化 fileMessageAddr 结构体 fileMessageAddr.add(0x00).writePointer(fileMessageCallbackFunc1); fileMessageAddr.add(0x08).writeU32(taskIdGlobal); fileMessageAddr.add(0x0c).writeU32(0x20a); @@ -105,6 +211,7 @@ function setupUploadFileDynamic() { fileMessageAddr.add(0x18).writePointer(fileCgiAddr2); fileMessageAddr.add(0x20).writeU64(uint64("0x20")); + // 备份 Patch 原始字节 patchFileProtobufFunc1Byte = patchFileProtobufFunc1.readByteArray(4); patchFileProtobufFunc2Byte = patchFileProtobufFunc2.readByteArray(4); fileProtobufDeleteAddrByte = fileProtobufDeleteAddr.readByteArray(4); @@ -114,60 +221,63 @@ function setupUploadFileDynamic() { setImmediate(setupUploadFileDynamic); + +// =========================== 文件上传触发 =========================== + function triggerUploadFile(receiver, md5, filePath) { const payload = [ - 0x20, 0x05, 0x33, 0x8C, 0x0B, 0x00, 0x00, 0x00, // 函数 10802b8b0 的指针 - 0x00, 0x05, 0x33, 0x8C, 0x0B, 0x00, 0x00, 0x00, // 函数 107fd5908 的指针 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x20, 0x05, 0x33, 0x8C, 0x0B, 0x00, 0x00, 0x00, // 0x00 函数指针1 + 0x00, 0x05, 0x33, 0x8C, 0x0B, 0x00, 0x00, 0x00, // 0x08 函数指针2 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x10 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x18 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x20 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x28 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x30 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x38 0x01, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, // 0x40 - 0xD0, 0x72, 0x20, 0x89, 0x0B, 0x00, 0x00, 0x00, // 文件id // 0x48 + 0xD0, 0x72, 0x20, 0x89, 0x0B, 0x00, 0x00, 0x00, // 0x48 文件id 0x26, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x50 - 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x77, 0x78, 0x69, 0x64, 0x5F, 0x37, 0x77, 0x64, // 发送人 0x68 - 0x31, 0x65, 0x63, 0x65, 0x39, 0x39, 0x66, 0x37, - 0x69, 0x32, 0x31, 0x00, 0x00, 0x00, 0x00, 0x13, // 发送人id长度 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, // 0x58 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x60 + 0x77, 0x78, 0x69, 0x64, 0x5F, 0x37, 0x77, 0x64, // 0x68 发送人 + 0x31, 0x65, 0x63, 0x65, 0x39, 0x39, 0x66, 0x37, // 0x70 + 0x69, 0x32, 0x31, 0x00, 0x00, 0x00, 0x00, 0x13, // 0x78 发送人id长度 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x80 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x88 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0xAA, 0xAA, 0xAA, 0x05, 0x00, 0x00, 0x00, // 0x98 ← 这里从0x04改成0x05 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x90 + 0x01, 0xAA, 0xAA, 0xAA, 0x05, 0x00, 0x00, 0x00, // 0x98 文件类型标记 (0x05) 0x00, 0x00, 0x00, 0x00, 0xAA, 0xAA, 0xAA, 0xAA, // 0xa0 0xA0, 0xBE, 0x2D, 0x8C, 0x0B, 0x00, 0x00, 0x00, // 0xa8 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0xb0 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, // 0xb8 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x55, 0xDB, 0x89, 0x0B, 0x00, 0x00, 0x00, // 0xe0 文件地址 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0xc0 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0xc8 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0xd0 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0xd8 + 0x00, 0x55, 0xDB, 0x89, 0x0B, 0x00, 0x00, 0x00, // 0xe0 文件路径1 0xB2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0xe8 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, // 0xf0 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0xf8 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x100 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x108 - 0x40, 0x54, 0xDB, 0x89, 0x0B, 0x00, 0x00, 0x00, // 0x110 文件地址 + 0x40, 0x54, 0xDB, 0x89, 0x0B, 0x00, 0x00, 0x00, // 0x110 文件路径2 0xB2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x118 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, // 0x120 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x40, 0x5D, 0xDB, 0x89, 0x0B, 0x00, 0x00, 0x00, // 0x140 文件地址 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x128 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x130 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x138 + 0x40, 0x5D, 0xDB, 0x89, 0x0B, 0x00, 0x00, 0x00, // 0x140 文件路径3 0xB2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x148 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, // 0x150 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x158 - 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0xE0, 0x03, // 0x168 + 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0xE0, 0x03, // 0x160 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x168 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x170 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x178 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x180 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,// 0x188 0x00, 0xAA, 0xAA, 0xAA, 0x01, 0x00, 0x00, 0x00, // 0x190 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x198 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,// 0x1a0 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x1a0 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x1a8 0x00, 0x00, 0x00, 0x00, 0x0A, 0x0A, 0x0A, 0x0A, // 0x1b0 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x1b8 @@ -178,7 +288,7 @@ function triggerUploadFile(receiver, md5, filePath) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x1e0 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x1e8 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x1f0 - 0xD0, 0x78, 0x46, 0x8C, 0x0B, 0x00, 0x00, 0x00, // 0x1f8 某个key + 0xD0, 0x78, 0x46, 0x8C, 0x0B, 0x00, 0x00, 0x00, // 0x1f8 AES Key 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x200 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, // 0x208 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x210 @@ -189,13 +299,13 @@ function triggerUploadFile(receiver, md5, filePath) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x238 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x240 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x248 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,// 0x250 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, // 0x250 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, // 0x258 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x260 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x268 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x270 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,// 0x278 - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,// 0x280 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x278 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x280 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x288 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x290 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x298 @@ -209,13 +319,14 @@ function triggerUploadFile(receiver, md5, filePath) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x2d8 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x2e0 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 // 0x2e8 - ] + ]; patchString(fileIdAddr, receiver + "_" + String(Math.floor(Date.now() / 1000)) + "_" + Math.floor(Math.random() * 1001) + "_1"); - patchString(md5Addr, md5) - patchString(uploadAesKeyAddr, generateAESKey()) + patchString(md5Addr, md5); + patchString(uploadAesKeyAddr, generateAESKey()); patchString(filePathAddr1, filePath); + // 写入 payload 并覆盖关键字段指针 uploadFileX1.writeByteArray(payload); uploadFileX1.writePointer(uploadFunc1Addr); uploadFileX1.add(0x08).writePointer(uploadFunc2Addr); @@ -239,229 +350,9 @@ function triggerUploadFile(receiver, md5, filePath) { console.log("文件上传调用结果: " + result); } -// -------------------------上传相关Attach逻辑------------------------- -function attachUploadFileMedia() { - Interceptor.attach(uploadImageAddr.add(0x10), { - onEnter: function (args) { - uploadGlobalX0 = this.context.x0; - const selfId = this.context.x1.add(0x68).readUtf8String(); - const filePath = this.context.x1.add(0xe0).readPointer().readUtf8String(); - send({ - type: "upload", - self_id: selfId, - }) - console.log("UploadFileMedia x0: " + uploadGlobalX0 + " filePath: " + filePath + " selfId: " + selfId); - } - }) -} +// =========================== 发送文件消息触发 =========================== -setImmediate(attachUploadFileMedia); - -function patchFileCdnOnComplete() { - Interceptor.attach(cndOnCompleteAddr, { - onEnter: function (args) { - try { - const x2 = this.context.x2; - const currentFileId = x2.add(0x20).readPointer().readUtf8String(); - const fileId = fileIdAddr.readUtf8String(); - if (currentFileId !== fileId) { - console.log("[-] FileCdnOnComplete x2: " + x2 + " currentFileId: " + currentFileId + " fileId: " + fileId); - return; - } - - const cdnKey = x2.add(0x60).readPointer().readUtf8String(); - const aesKey = x2.add(0x78).readPointer().readUtf8String(); - const md5Key = x2.add(0x90).readPointer().readUtf8String(); - const videoId = x2.add(0xf0).readPointer().readUtf8String(); - const targetId = x2.add(0x40).readUtf8String(); - - console.log("File X2: " + x2 + "[+] cdnKey: " + cdnKey + " aesKey: " + aesKey + - " md5Key: " + md5Key + " videoId:" + videoId); - - send({ - type: "finish", - }); - - if (cdnKey !== "" && cdnKey != null && aesKey !== "" && aesKey != null && - md5Key !== "" && md5Key != null) { - pushFileUploadInfo({ - cdnKey: cdnKey, - aesKey: aesKey, - md5Key: md5Key, - targetId: targetId - }); - send({ - type: "upload_file_finish", - target_id: targetId, - cdn_key: cdnKey, - aes_key: aesKey, - md5_key: md5Key - }); - } else { - console.error("cdnKey or aesKey or md5key 为空") - } - } catch (e) { - console.log("[-] File Memory access error at onEnter: " + e); - } - } - }) -} - -setImmediate(patchFileCdnOnComplete); - -function attachFileGetCallbackFromWrapper() { - Interceptor.attach(uploadGetCallbackWrapperAddr, { - onEnter: function (args) { - const tmpFileId = this.context.x1.readPointer().readUtf8String(); - const fileId = fileIdAddr.readUtf8String(); - if (tmpFileId !== fileId) { - console.log("[+] File GetCallbackFromWrapper tmpFileId: " + tmpFileId + " fileId: " + fileId); - return; - } - - uploadCallback.add(0x10).writePointer(uploadGetCallbackWrapperFuncAddr); - this.context.x8 = uploadCallback; - console.log("[+] File GetCallbackFromWrapper x8: " + this.context.x8); - } - }) - - Interceptor.attach(uploadOnCompleteAddr, { - onEnter: function (args) { - const tmpFileId = this.context.x1.readPointer().readUtf8String(); - const fileId = fileIdAddr.readUtf8String(); - if (tmpFileId !== fileId) { - console.log("[+] File OnComplete tmpFileId: " + tmpFileId + " fileId: " + fileId); - return; - } - - uploadCallback.add(0x30).writePointer(uploadOnCompleteFuncAddr); - this.context.x8 = uploadCallback; - console.log("[+] File OnComplete x8: " + this.context.x8); - } - }) -} - -setImmediate(attachFileGetCallbackFromWrapper); - -// -------------------------上传相关Attach逻辑结束------------------------- - - -// -------------------------Req2Buf公共部分分区------------------------- -function attachReq2buf() { - console.log("[+] Target Req2buf enter Address: " + req2bufEnterAddr); - - Interceptor.attach(req2bufEnterAddr, { - onEnter: function (args) { - if (!this.context.x1.equals(taskIdGlobal)) { - return; - } - - console.log("[+] 已命中目标Req2Buf taskId:" + taskIdGlobal + " base:" + baseAddr); - - const x24_base = this.context.x24; - insertMsgAddr = x24_base.add(0x60); - console.log("[+] 当前 Req2Buf X24 基址: " + x24_base); - - if (sendMsgType === "file") { - insertMsgAddr.writePointer(sendFileMessageAddr); - console.log("[+] 发送文件消息成功! Req2Buf 已将 X24+0x60 指向新地址: " + sendFileMessageAddr + - " Req2Buf 写入后内存预览: " + insertMsgAddr); - } - } - }); - - console.log("[+] Target Req2buf leave Address: " + req2bufExitAddr); - Interceptor.attach(req2bufExitAddr, { - onEnter: function (args) { - if (!this.context.x25.equals(taskIdGlobal)) { - return; - } - insertMsgAddr.writeU64(0x0); - console.log("[+] 清空写入后内存预览: " + insertMsgAddr.readPointer()); - taskIdGlobal = 0; - receiverGlobal = ""; - senderGlobal = ""; - contentGlobal = ""; - send({ - type: "finish", - }) - } - }); -} - -setImmediate(attachReq2buf); - -function AttachSendProto() { - Interceptor.attach(sendFuncAddr, { - onEnter: function (args) { - if (triggerX1Payload) { - return - } - - triggerX0 = this.context.x0; - triggerX1Payload = this.context.x1; - console.log(`[+] 捕获到 StartTask 调用，X0地址：${triggerX0}, Payload 地址: ${triggerX1Payload}`); - } - }) -} - -setImmediate(AttachSendProto); -// -------------------------Req2Buf公共部分分区结束------------------------- - - -// -------------------------PatchFileProtoBuf分区------------------------- -function patchFileProtoBuf() { - Interceptor.attach(fileCallbackFuncAddr, { - onEnter: function (args) { - var firstValue = this.context.sp.add(0x10).readU32(); - console.log("[+] 捕获到 FileCallbackFunc 调用，firstValue：", firstValue, "taskIdGlobal：", taskIdGlobal); - if (firstValue === taskIdGlobal) { - if (patchFileProtobufFunc1.readU32() !== 3573751839) { - Memory.patchCode(patchFileProtobufFunc1, 4, code => { - const cw = new Arm64Writer(code, {pc: patchFileProtobufFunc1}); - cw.putNop(); - cw.flush(); - }); - Memory.patchCode(patchFileProtobufFunc2, 4, code => { - const cw = new Arm64Writer(code, {pc: patchFileProtobufFunc2}); - cw.putNop(); - cw.flush(); - }); - Memory.patchCode(fileProtobufDeleteAddr, 4, code => { - const cw = new Arm64Writer(code, {pc: fileProtobufDeleteAddr}); - cw.putNop(); - cw.flush(); - }); - } - } else { - if (patchFileProtobufFunc1.readU32() === 3573751839) { - Memory.patchCode(patchFileProtobufFunc1, 4, code => { - const cw = new Arm64Writer(code, {pc: patchFileProtobufFunc1}); - cw.putBytes(new Uint8Array(patchFileProtobufFunc1Byte)); - cw.flush(); - }); - Memory.patchCode(patchFileProtobufFunc2, 4, code => { - const cw = new Arm64Writer(code, {pc: patchFileProtobufFunc2}); - cw.putBytes(new Uint8Array(patchFileProtobufFunc2Byte)); - cw.flush(); - }); - Memory.patchCode(fileProtobufDeleteAddr, 4, code => { - const cw = new Arm64Writer(code, {pc: fileProtobufDeleteAddr}); - cw.putBytes(new Uint8Array(fileProtobufDeleteAddrByte)); - cw.flush(); - }); - } - } - } - }) -} - -setImmediate(patchFileProtoBuf); -// -------------------------PatchFileProtoBuf分区结束------------------------- - - -// -------------------------发送文件消息分区------------------------- function triggerSendFileMessage(taskId, sender, receiver) { console.log("[+] File Manual Trigger Started..."); if (!taskId || !receiver || !sender) { @@ -470,7 +361,7 @@ function triggerSendFileMessage(taskId, sender, receiver) { } const timestamp = Math.floor(Date.now() / 1000); - lastSendTime = timestamp + lastSendTime = timestamp; taskIdGlobal = taskId; receiverGlobal = receiver; senderGlobal = sender; @@ -492,8 +383,8 @@ function triggerSendFileMessage(taskId, sender, receiver) { 0xFF, 0xFF, 0xFF, 0xFF, 0xAA, 0xAA, 0xAA, 0xAA, // 0x50 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x58 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x60 - 0x64, 0x65, 0x66, 0x61, 0x75, 0x6C, 0x74, 0x2D, // 0x68 default- - 0x6C, 0x6F, 0x6E, 0x67, 0x6C, 0x69, 0x6E, 0x6B, // 0x70 longlink + 0x64, 0x65, 0x66, 0x61, 0x75, 0x6C, 0x74, 0x2D, // 0x68 "default-" + 0x6C, 0x6F, 0x6E, 0x67, 0x6C, 0x69, 0x6E, 0x6B, // 0x70 "longlink" 0x00, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0x10, // 0x78 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x80 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x88 @@ -532,14 +423,15 @@ function triggerSendFileMessage(taskId, sender, receiver) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x190 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x198 ]; + triggerX1Payload.writeU32(taskIdGlobal); triggerX1Payload.add(0x04).writeByteArray(payloadData); triggerX1Payload.add(0x18).writePointer(fileCgiAddr2); triggerX1Payload.add(0xb8).writePointer(triggerX1Payload.add(0xc0)); triggerX1Payload.add(0x190).writePointer(triggerX1Payload.add(0x198)); - sendMsgType = "file" + sendMsgType = "file"; - console.log("finished init file payload") + console.log("finished init file payload"); const MMStartTask = new NativeFunction(sendFuncAddr, 'int64', ['pointer', 'pointer']); try { @@ -553,71 +445,284 @@ function triggerSendFileMessage(taskId, sender, receiver) { } +// =========================== Interceptor Hook: 上传媒体 =========================== + +function attachUploadFileMedia() { + Interceptor.attach(uploadImageAddr.add(0x10), { + onEnter: function (args) { + uploadGlobalX0 = this.context.x0; + const selfId = this.context.x1.add(0x68).readUtf8String(); + const filePath = this.context.x1.add(0xe0).readPointer().readUtf8String(); + send({ + type: "upload", + self_id: selfId, + }); + console.log("UploadFileMedia x0: " + uploadGlobalX0 + " filePath: " + filePath + " selfId: " + selfId); + } + }); +} + +setImmediate(attachUploadFileMedia); + + +// =========================== Interceptor Hook: CDN 上传完成 =========================== + +function patchFileCdnOnComplete() { + Interceptor.attach(cndOnCompleteAddr, { + onEnter: function (args) { + try { + const x2 = this.context.x2; + const currentFileId = x2.add(0x20).readPointer().readUtf8String(); + const fileId = fileIdAddr.readUtf8String(); + if (currentFileId !== fileId) { + console.log("[-] FileCdnOnComplete x2: " + x2 + " currentFileId: " + currentFileId + " fileId: " + fileId); + return; + } + + const cdnKey = x2.add(0x60).readPointer().readUtf8String(); + const aesKey = x2.add(0x78).readPointer().readUtf8String(); + const md5Key = x2.add(0x90).readPointer().readUtf8String(); + const videoId = x2.add(0xf0).readPointer().readUtf8String(); + const targetId = x2.add(0x40).readUtf8String(); + + console.log("File X2: " + x2 + "[+] cdnKey: " + cdnKey + " aesKey: " + aesKey + + " md5Key: " + md5Key + " videoId:" + videoId); + + send({ type: "finish" }); + + if (cdnKey !== "" && cdnKey != null && aesKey !== "" && aesKey != null && + md5Key !== "" && md5Key != null) { + pushFileUploadInfo({ + cdnKey: cdnKey, + aesKey: aesKey, + md5Key: md5Key, + targetId: targetId + }); + send({ + type: "upload_file_finish", + target_id: targetId, + cdn_key: cdnKey, + aes_key: aesKey, + md5_key: md5Key + }); + } else { + console.error("cdnKey or aesKey or md5key 为空"); + } + } catch (e) { + console.log("[-] File Memory access error at onEnter: " + e); + } + } + }); +} + +setImmediate(patchFileCdnOnComplete); + + +// =========================== Interceptor Hook: 上传回调包装 =========================== + +function attachFileGetCallbackFromWrapper() { + Interceptor.attach(uploadGetCallbackWrapperAddr, { + onEnter: function (args) { + const tmpFileId = this.context.x1.readPointer().readUtf8String(); + const fileId = fileIdAddr.readUtf8String(); + if (tmpFileId !== fileId) { + console.log("[+] File GetCallbackFromWrapper tmpFileId: " + tmpFileId + " fileId: " + fileId); + return; + } + uploadCallback.add(0x10).writePointer(uploadGetCallbackWrapperFuncAddr); + this.context.x8 = uploadCallback; + console.log("[+] File GetCallbackFromWrapper x8: " + this.context.x8); + } + }); + + Interceptor.attach(uploadOnCompleteAddr, { + onEnter: function (args) { + const tmpFileId = this.context.x1.readPointer().readUtf8String(); + const fileId = fileIdAddr.readUtf8String(); + if (tmpFileId !== fileId) { + console.log("[+] File OnComplete tmpFileId: " + tmpFileId + " fileId: " + fileId); + return; + } + uploadCallback.add(0x30).writePointer(uploadOnCompleteFuncAddr); + this.context.x8 = uploadCallback; + console.log("[+] File OnComplete x8: " + this.context.x8); + } + }); +} + +setImmediate(attachFileGetCallbackFromWrapper); + + +// =========================== Interceptor Hook: Req2Buf 拦截 =========================== + +function attachReq2buf() { + console.log("[+] Target Req2buf enter Address: " + req2bufEnterAddr); + + Interceptor.attach(req2bufEnterAddr, { + onEnter: function (args) { + if (!this.context.x1.equals(taskIdGlobal)) { + return; + } + console.log("[+] 已命中目标Req2Buf taskId:" + taskIdGlobal + " base:" + baseAddr); + + const x24_base = this.context.x24; + insertMsgAddr = x24_base.add(0x60); + console.log("[+] 当前 Req2Buf X24 基址: " + x24_base); + + if (sendMsgType === "file") { + insertMsgAddr.writePointer(sendFileMessageAddr); + console.log("[+] 发送文件消息成功! Req2Buf 已将 X24+0x60 指向新地址: " + sendFileMessageAddr + + " Req2Buf 写入后内存预览: " + insertMsgAddr); + } + } + }); + + console.log("[+] Target Req2buf leave Address: " + req2bufExitAddr); + + Interceptor.attach(req2bufExitAddr, { + onEnter: function (args) { + if (!this.context.x25.equals(taskIdGlobal)) { + return; + } + insertMsgAddr.writeU64(0x0); + console.log("[+] 清空写入后内存预览: " + insertMsgAddr.readPointer()); + taskIdGlobal = 0; + receiverGlobal = ""; + senderGlobal = ""; + contentGlobal = ""; + send({ type: "finish" }); + } + }); +} + +setImmediate(attachReq2buf); + + +// =========================== Interceptor Hook: 捕获 SendProto =========================== + +function AttachSendProto() { + Interceptor.attach(sendFuncAddr, { + onEnter: function (args) { + if (triggerX1Payload) { + return; + } + triggerX0 = this.context.x0; + triggerX1Payload = this.context.x1; + console.log(`[+] 捕获到 StartTask 调用，X0地址：${triggerX0}, Payload 地址: ${triggerX1Payload}`); + } + }); +} + +setImmediate(AttachSendProto); + + +// =========================== Interceptor Hook: Patch File ProtoBuf =========================== + +function patchFileProtoBuf() { + Interceptor.attach(fileCallbackFuncAddr, { + onEnter: function (args) { + var firstValue = this.context.sp.add(0x10).readU32(); + console.log("[+] 捕获到 FileCallbackFunc 调用，firstValue：", firstValue, "taskIdGlobal：", taskIdGlobal); + + if (firstValue === taskIdGlobal) { + // 目标任务：将指令 NOP 掉以跳过原逻辑 + if (patchFileProtobufFunc1.readU32() !== 3573751839) { + Memory.patchCode(patchFileProtobufFunc1, 4, code => { + const cw = new Arm64Writer(code, { pc: patchFileProtobufFunc1 }); + cw.putNop(); + cw.flush(); + }); + Memory.patchCode(patchFileProtobufFunc2, 4, code => { + const cw = new Arm64Writer(code, { pc: patchFileProtobufFunc2 }); + cw.putNop(); + cw.flush(); + }); + Memory.patchCode(fileProtobufDeleteAddr, 4, code => { + const cw = new Arm64Writer(code, { pc: fileProtobufDeleteAddr }); + cw.putNop(); + cw.flush(); + }); + } + } else { + // 非目标任务：恢复原始指令 + if (patchFileProtobufFunc1.readU32() === 3573751839) { + Memory.patchCode(patchFileProtobufFunc1, 4, code => { + const cw = new Arm64Writer(code, { pc: patchFileProtobufFunc1 }); + cw.putBytes(new Uint8Array(patchFileProtobufFunc1Byte)); + cw.flush(); + }); + Memory.patchCode(patchFileProtobufFunc2, 4, code => { + const cw = new Arm64Writer(code, { pc: patchFileProtobufFunc2 }); + cw.putBytes(new Uint8Array(patchFileProtobufFunc2Byte)); + cw.flush(); + }); + Memory.patchCode(fileProtobufDeleteAddr, 4, code => { + const cw = new Arm64Writer(code, { pc: fileProtobufDeleteAddr }); + cw.putBytes(new Uint8Array(fileProtobufDeleteAddrByte)); + cw.flush(); + }); + } + } + } + }); +} + +setImmediate(patchFileProtoBuf); + + +// =========================== Interceptor Hook: 文件 Protobuf 构建 =========================== + function attachFileProto() { Interceptor.attach(fileProtobufAddr, { onEnter: function (args) { - var currTaskId = this.context.sp.add(0x30).readU32(); if (currTaskId !== taskIdGlobal) { console.log(`[+] 文件拦截到非目标 currTaskId: ${currTaskId} taskIdGlobal: ${taskIdGlobal}`); return; } - // 从文件队列获取上传信息 + // 从队列获取上传完成信息 const fileUploadInfo = getFileUploadInfo(); - let cdnKey = ""; - let aesKey = ""; - let md5Key = ""; - let targetId = ""; - let fileName = ""; - let fileSize = ""; - let appId = ""; - let fileExt = ""; - let fileUploadToken = ""; - - if (fileUploadInfo) { - cdnKey = fileUploadInfo.cdnKey; - aesKey = fileUploadInfo.aesKey; - md5Key = fileUploadInfo.md5Key; - targetId = fileUploadInfo.targetId; - fileName = fileUploadInfo.fileName || ""; - fileSize = fileUploadInfo.fileSize || "0"; - appId = fileUploadInfo.appId || "wx6618f1cfc6c132f8"; - fileExt = fileUploadInfo.fileExt || ""; - fileUploadToken = fileUploadInfo.fileUploadToken || ""; - } else { + if (!fileUploadInfo) { console.error("[!] 无法获取文件上传信息"); return; } - // --- 构建 protobuf --- - // Field 1: Header (0x0A, len=0x40) - const type = [0x0A, 0x40, 0x0A, 0x01, 0x00] - const msgId = [0x10].concat(generateRandom5ByteVarint()) - const cpHeader = [0x1A, 0x10] + const cdnKey = fileUploadInfo.cdnKey; + const aesKey = fileUploadInfo.aesKey; + const md5Key = fileUploadInfo.md5Key; + const targetId = fileUploadInfo.targetId; + const fileName = fileUploadInfo.fileName || ""; + const fileSize = fileUploadInfo.fileSize || "0"; + const appId = fileUploadInfo.appId || "wx6618f1cfc6c132f8"; + const fileExt = fileUploadInfo.fileExt || ""; + const fileUploadToken = fileUploadInfo.fileUploadToken || ""; - const randomId = [0x20, 0x9D, 0xB0, 0x90, 0x93, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01] - const sysHeader = [0x2A, 0x15] - // UnifiedPCMac 26 arm64 - const sys = [0x55, 0x6E, 0x69, 0x66, 0x69, 0x65, 0x64, 0x50, 0x43, 0x4D, 0x61, 0x63, 0x20, 0x32, 0x36, 0x20, 0x61, 0x72, 0x6D, 0x36, 0x34] - const sysEnd = [0x30, 0xF8, 0x01] + // --- 构建 Protobuf Header (Field 1) --- + const type = [0x0A, 0x40, 0x0A, 0x01, 0x00]; + const msgId = [0x10].concat(generateRandom5ByteVarint()); + const cpHeader = [0x1A, 0x10]; + const randomId = [0x20, 0x9D, 0xB0, 0x90, 0x93, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01]; + const sysHeader = [0x2A, 0x15]; + // "UnifiedPCMac 26 arm64" + const sys = [0x55, 0x6E, 0x69, 0x66, 0x69, 0x65, 0x64, 0x50, 0x43, 0x4D, 0x61, 0x63, 0x20, 0x32, 0x36, 0x20, 0x61, 0x72, 0x6D, 0x36, 0x34]; + const sysEnd = [0x30, 0xF8, 0x01]; - // Field 2: Message body - // sender (field 1) + // --- 构建 Protobuf Body (Field 2) --- const senderBytes = stringToHexArray(senderGlobal); const senderHeader = [0x0A, senderBytes.length]; - // appid (field 2) + const appIdBytes = stringToHexArray(appId); const appIdHeader = [0x12, appIdBytes.length]; - // field 3 = 0 + const field3 = [0x18, 0x00]; - // receiver (field 4) + const receiverBytes = stringToHexArray(targetId); const receiverHeader = [0x22, receiverBytes.length]; - // type = 6 (file) (field 5) - const msgType = [0x28, 0x06]; - // 构建 appmsg XML (field 6) + const msgType = [0x28, 0x06]; // type=6 文件 + + // 构建 appmsg XML const cdnAttachUrl = cdnKey.replace(/_[^_]*$/, ''); const appmsgXml = '' + '' + fileName + '' + @@ -658,57 +763,47 @@ function attachFileProto() { ''; const appmsgBytes = stringToHexArray(appmsgXml); - // fromusername 紧跟在 appmsg XML 后面 const fromUsernameXml = '' + senderGlobal + ''; const fromUsernameBytes = stringToHexArray(fromUsernameXml); - // 合并 appmsg content 和 fromusername const contentBytes = appmsgBytes.concat(fromUsernameBytes); const contentHeader = [0x32].concat(toVarint(contentBytes.length)); - // timestamp (field 7) const tsHeader = [0x38]; const tsBytes = getVarintTimestampBytes(); - // msgid string (field 8): wxid_xxx_timestamp_3_xwechat_9 + // msgid: wxid_xxx_timestamp_3_xwechat_9 const receiverMsgId = stringToHexArray(targetId).concat([0x5F]) .concat(stringToHexArray(Math.floor(Date.now() / 1000).toString())) - .concat([0x5F, 0x33, 0x5F, 0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, 0x5F, 0x39]); // _3_xwechat_9 + .concat([0x5F, 0x33, 0x5F, 0x78, 0x77, 0x65, 0x63, 0x68, 0x61, 0x74, 0x5F, 0x39]); const msgIdHeader2 = [0x42, receiverMsgId.length]; - // field 10: varint = 1 const field10 = [0x50, 0x01]; - // field 12: msgsource XML const msgsourceXml = '12'; const msgsourceBytes = stringToHexArray(msgsourceXml); const msgsourceHeader = [0x62, msgsourceBytes.length]; - // empty fields const field13 = [0x6A, 0x00]; const field14 = [0x72, 0x00]; const field15 = [0x7A, 0x00]; - // 构建 field 2 内部数据 + // 组装 field 2 内部数据 const field2Inner = senderHeader.concat(senderBytes, appIdHeader, appIdBytes, field3, receiverHeader, receiverBytes, msgType, contentHeader, contentBytes, tsHeader, tsBytes, msgIdHeader2, receiverMsgId, field10, msgsourceHeader, msgsourceBytes, field13, field14, field15); - // 构建完整 field 2 const field2HeaderBytes = [0x12].concat(toVarint(field2Inner.length)); - // md5 trailing field: 0x2A 0x20 + 32 bytes md5 + // --- 构建 Protobuf 尾部字段 --- const md5Trailing = [0x2A, 0x20].concat(stringToHexArray(md5Key)); - // field 9: varint = 1 const field9 = [0x48, 0x01]; - // field 10 (second): file size varint const fileSizeVarint = toVarint(parseInt(fileSize)); const field10b = [0x50].concat(fileSizeVarint); - // field 11: varint = 2 const field11 = [0x58, 0x02]; - // 构建最终 payload + // --- 组装最终 Payload --- const finalPayload = type.concat(msgId, cpHeader, fileCp, randomId, sysHeader, sys, sysEnd, field2HeaderBytes, field2Inner, md5Trailing, field9, field10b, field11); @@ -730,98 +825,11 @@ function attachFileProto() { } setImmediate(attachFileProto); -// -------------------------发送文件消息分区结束------------------------- + + +// =========================== RPC 导出 =========================== rpc.exports = { triggerUploadFile: triggerUploadFile, triggerSendFileMessage: triggerSendFileMessage, }; - - -function stringToHexArray(str) { - var utf8Str = unescape(encodeURIComponent(str)); - var arr = []; - for (var i = 0; i < utf8Str.length; i++) { - arr.push(utf8Str.charCodeAt(i)); // 获取字符的 ASCII 码 (即十六进制值) - } - return arr; -} - - -function toVarint(n) { - let res = []; - while (n >= 128) { - res.push((n & 0x7F) | 0x80); - n = n >> 7; - } - res.push(n); - return res; -} - - -function generateRandom5ByteVarint() { - let res = []; - - // 前 4 个字节：最高位(bit 7)必须是 1，低 7 位随机 - for (let i = 0; i < 4; i++) { - let random7Bit = Math.floor(Math.random() * 128); - res.push(random7Bit | 0x80); // 强制设置最高位为 1 - } - - // 第 5 个字节：最高位必须是 0，为了确保不变成 4 字节，低 7 位不能全为 0 - let lastByte = Math.floor(Math.random() * 127) + 1; - res.push(lastByte & 0x7F); // 确保最高位为 0 - - return res; -} - - -// 辅助函数：Protobuf Varint 编码 (对应 get_varint_timestamp_bytes) -function getVarintTimestampBytes() { - let ts = Math.floor(Date.now() / 1000); - let encodedBytes = []; - let tempTs = ts >>> 0; // 强制转为 32位 无符号整数 - - while (true) { - let byte = tempTs & 0x7F; - tempTs >>>= 7; - if (tempTs !== 0) { - encodedBytes.push(byte | 0x80); - } else { - encodedBytes.push(byte); - break; - } - } - return encodedBytes; -} - -function patchString(addr, plainStr) { - const bytes = []; - for (let i = 0; i < plainStr.length; i++) { - bytes.push(plainStr.charCodeAt(i)); - } - - addr.writeByteArray(bytes); - addr.add(bytes.length).writeU8(0); -} - -function generateAESKey() { - const chars = 'abcdef0123456789'; - let key = ''; - for (let i = 0; i < 32; i++) { - key += chars.charAt(Math.floor(Math.random() * chars.length)); - } - return key; -} - -function generateBytes(n) { - // 生成随机字符串 - const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; - let result = ''; - - for (let i = 0; i < n; i++) { - result += chars.charAt(Math.floor(Math.random() * chars.length)); - } - - return stringToHexArray(result); -}