/**
 * 构造内存数据并调用 sub_10481C304
 */
function callTargetFunction() {
    const mod = Process.getModuleByName("WeChat");
    const sub_10481C304_addr = ptr("0x10481C304").sub("0x100000000").add(mod.base);
    const sub_10481C304 = new NativeFunction(sub_10481C304_addr, 'void', ['pointer']);

    // 2. 准备原始字节数据 (Hex 形式)
    // 注意：0x18 偏移处的 8 字节（原数据 60 E1 39 78 05 00 00 00）会被动态生成的指针覆盖
    const rawData = [
        0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x18 指针位置
        0x05, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x80, 0x00, 0x01, 0x11, 0x01, 0x00, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00,
        0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
        0x00, 0xAA, 0xAA, 0xAA, 0xFF, 0xFF, 0xFF, 0xFF, 0xAA, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    ];

    // 3. 申请结构体内存
    const structPtr = Memory.alloc(rawData.length);
    structPtr.writeByteArray(rawData);

    // 4. 申请字符串内存并写入指针 (偏移 0x18)
    const cgiPath = "/cgi-bin/micromsg-bin/newsendmsg";
    const pathPtr = Memory.allocUtf8String(cgiPath);
    structPtr.add(0x18).writePointer(pathPtr);

    console.log("[+] 内存结构体已准备完毕: " + structPtr + " [+] 字符串地址: " + pathPtr + " 内容: " + cgiPath);
    console.log();

    // 5. 调用函数
    try {
        console.log("[*] 结构体内存布局 (调用前):");
        sub_10481C304(structPtr);
        console.log("[+] sub_10481C304 调用成功！");

        console.log(hexdump(structPtr, { offset: 0, length: rawData.length, header: true, ansi: true }));

    } catch (e) {
        console.log("[-] 调用出错: " + e);
    }
}