wechat_chatter/frida/matchFun.js

[
    "sendmsg",
    "newsendmsg",
    "SendMsg",
    "SendMsgFH"
].forEach(sig => {
    let arr = DebugSymbol.findFunctionsMatching("*" + sig + "*");
    arr.forEach(target => {
        console.log("Hooking:", target);

        Interceptor.attach(ptr(target), {
            onEnter(args) {
                console.log("🚀 Called:", target);

                // 打印调用堆栈
                console.log(
                    Thread.backtrace(this.context, Backtracer.ACCURATE)
                        .map(DebugSymbol.fromAddress)
                        .join("\n")
                );

                // 打印第 1 个参数，一般就是 protobuf buffer
                try {
                    console.log("arg0:", args[0]);
                    console.log(hexdump(args[0], { length: 256 }));
                } catch(e){}

                // 打印第 2 个参数（通常是长度）
                console.log("arg1:", args[1]);
            },
            onLeave(retval) {
                console.log("⬅️ return:", retval);
            }
        });
    });
});