mirror of
https://github.com/yincongcyincong/wechat_chatter.git
synced 2026-07-15 10:26:52 +08:00
47 lines
2.2 KiB
JavaScript
47 lines
2.2 KiB
JavaScript
/**
|
|
* 构造内存数据并调用 sub_10481C304
|
|
*/
|
|
function callTargetFunction() {
|
|
// 1. 查找函数地址 (请确保模块名正确，这里假设是 WeChat)
|
|
const moduleName = "WeChat";
|
|
const sub_10481C304_addr = Module.findBaseAddress(moduleName).add(0x481C304);
|
|
const sub_10481C304 = new NativeFunction(sub_10481C304_addr, 'void', ['pointer']);
|
|
|
|
// 2. 准备原始字节数据 (Hex 形式)
|
|
// 注意：0x18 偏移处的 8 字节（原数据 60 E1 39 78 05 00 00 00）会被动态生成的指针覆盖
|
|
const rawData = [
|
|
0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // 0x18 指针位置
|
|
0x05, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x80, 0x00, 0x01, 0x11, 0x01, 0x00, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00,
|
|
0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
|
|
0x00, 0xAA, 0xAA, 0xAA, 0xFF, 0xFF, 0xFF, 0xFF, 0xAA, 0xAA, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
|
];
|
|
|
|
// 3. 申请结构体内存
|
|
const structPtr = Memory.alloc(rawData.length);
|
|
structPtr.writeByteArray(rawData);
|
|
|
|
// 4. 申请字符串内存并写入指针 (偏移 0x18)
|
|
const cgiPath = "/cgi-bin/micromsg-bin/newsendmsg";
|
|
const pathPtr = Memory.allocUtf8String(cgiPath);
|
|
|
|
// 将字符串地址写入结构体的 0x18 偏移处 (64位系统占8字节)
|
|
structPtr.add(0x18).writePointer(pathPtr);
|
|
|
|
console.log("[+] 内存结构体已准备完毕: " + structPtr);
|
|
console.log("[+] 字符串地址: " + pathPtr + " 内容: " + cgiPath);
|
|
|
|
// 5. 调用函数
|
|
try {
|
|
sub_10481C304(structPtr);
|
|
console.log("[+] sub_10481C304 调用成功！");
|
|
|
|
console.log("[*] 结构体内存布局 (调用后):");
|
|
console.log(hexdump(structPtr, { offset: 0, length: rawData.length, header: true, ansi: true }));
|
|
|
|
} catch (e) {
|
|
console.log("[-] 调用出错: " + e);
|
|
}
|
|
} |