FilesExpand file tree

 master

/

test9.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

66 lines (58 loc) · 2 KB

 master

/

test9.py

Copy path

Top

File metadata and controls

• Code
• Blame

66 lines (58 loc) · 2 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

#!/usr/bin/env python

# -*- coding: utf-8 -*-

# @Author: anchen

# @Date: 2022-09-30 13:06:26

# @Last Modified by: anchen

# @Last Modified time: 2022-10-20 13:55:46

# 610A0000 6165EC6E 5BEC6E

from __future__ import print_function

import frida

import sys

def on_message(message, data):

if message['type'] == 'send':

# print(message)

# print(message['payload']['resource'])

print(message['payload']['xml'])

# print(data)

# base = message['payload']['wxid']

# size = int(message['payload']['text'])

# print(hex(base), size)

elif message['type'] == 'error':

print(message)

# for i in message:

# if i == "type":

# print("[*] %s" % "error:")

# continue

# if type(message[i]) is str:

# print("[*] %s" %

# i + ":\n {0}".format(message[i].replace('\t', ' ')))

# else:

# print("[*] %s" %

# i + ":\n {0}".format(message[i]))

else:

print(message)

# F为公众号消息

def main(target_process):

session = frida.attach(target_process)

print("公众号")

script = session.create_script("""

var ModAddress = Process.findModuleByName('wechatwin.dll');

var hookAddress = ModAddress.base.add('0x492FCA');

Interceptor.attach(hookAddress , {

onEnter:function(args) {

var ebp = this.context.ebp;

console.log('hookchenggong');

var msgUni = Memory.readPointer(ebp.add('0x34'));

var msg = Memory.readPointer(msgUni.add('0x70'));

var xml = Memory.readUtf16String(msg);

send({'xml':xml});

}

} );

""")

script.on('message', on_message)

script.load()

print("[!] Ctrl+D on UNIX, Ctrl+Z on Windows/cmd.exe to detach from instrumented program.\n\n")

sys.stdin.read()

session.detach()

if __name__ == '__main__':

main('WeChat.exe')