Skip to content

Commit c65ffa9

Browse files
JaveleyQAQJaveleyQAQ
authored
Update hook.js
1 parent 972bd29 commit c65ffa9

1 file changed

Lines changed: 127 additions & 76 deletions

File tree

‎scripts/hook.js‎

Lines changed: 127 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,24 @@
11
;
22
//获取WeChatAppEx.exe的基址
3-
var module = Process.findModuleByName("WeChatAppEx.exe")
4-
var base = module.base
3+
var module = Process.findModuleByName("WeChatAppEx.exe");
4+
var base = module.base;
55
// console.log("模块名称:",module.name);
66
// console.log("模块地址:",module.base);
77
// console.log("大小:",module.size);
88

9-
10-
for (let key in address) {
11-
12-
address[key] = base.add(address[key]);
13-
}
9+
Object.keys(address).forEach(key => {
10+
key != "Version" ? address[key] = base.add(address[key]) : false
11+
12+
});
1413
send("[+] WeChatAppEx.exe 注入成功!");
14+
send("[+] 当前小程序版本: " + address.Version);
15+
send("[+] 等待小程序加载...");
1516

1617
function readStdString(s) {
1718
var flag = s.add(23).readU8()
1819
if (flag == 0x80) {
1920
// 从堆中读取
20-
var size = s.add(8).readUInt()
21+
var size = s.add(8).readUInt()
2122
return s.readPointer().readUtf8String(size)
2223
} else {
2324
// 从栈中读取
@@ -43,80 +44,130 @@ function writeStdString(s, content) {
4344
s.add(23).writeU8(content.length)
4445
}
4546
}
47+
function sendMessage(msg) {
48+
49+
50+
msg===null || undefined ?send(msg):send("[+] 已还原完整F12")
51+
// send("[+] 已还原完整F12")
52+
}
53+
54+
55+
function replaceParams() {
56+
Interceptor.attach(address.LaunchAppletBegin, {
57+
onEnter(args) {
58+
send("[+] HOOK到小程序加载! " + readStdString(args[1]))
59+
for (var i = 0; i < 0x1000; i+=8) {
60+
try {
61+
var s = readStdString(args[2].add(i))
62+
var s1 = s.replaceAll("md5", "md6")
63+
.replaceAll('"enable_vconsole":false', '"enable_vconsole": true')
64+
.replaceAll('"frameset":false', '"frameset": true')
65+
//"frameset":false
66+
if (s !== s1) {
67+
writeStdString(args[2].add(i), s1)
68+
}
69+
} catch (a) {
70+
}
71+
}
72+
}
73+
})
74+
75+
}
76+
77+
4678

4779
// 过新版8555检测
4880
if(address.MenuItemDevToolsString){
4981
var menuItemDevToolsStringCr = new Uint8Array(address.MenuItemDevToolsString.readByteArray(7));
50-
var intptr_ = (menuItemDevToolsStringCr[3] & 0xFF) | ((menuItemDevToolsStringCr[4] & 0xFF) << 8) | ((menuItemDevToolsStringCr[5] & 0xFF) << 16) | ((menuItemDevToolsStringCr[6] & 0xFF) << 24);
51-
var menuItemDevToolsStringPtrData = address.MenuItemDevToolsString.add(intptr_+7);
52-
Memory.protect(menuItemDevToolsStringPtrData, 8, 'rw-')
53-
menuItemDevToolsStringPtrData.writeUtf8String("DevTools");
82+
var intptr_ = (menuItemDevToolsStringCr[3] & 0xFF) | ((menuItemDevToolsStringCr[4] & 0xFF) << 8) | ((menuItemDevToolsStringCr[5] & 0xFF) << 16) | ((menuItemDevToolsStringCr[6] & 0xFF) << 24);
83+
var menuItemDevToolsStringPtrData = address.MenuItemDevToolsString.add(intptr_+7);
84+
Memory.protect(menuItemDevToolsStringPtrData, 8, 'rw-')
85+
menuItemDevToolsStringPtrData.writeUtf8String("DevTools");
86+
replaceParams()
87+
setupInterceptor()
5488
}
5589

5690

57-
Interceptor.attach(address.LaunchAppletBegin, {
58-
onEnter(args) {
59-
send("[+] HOOK到小程序加载! " + readStdString(args[1]))
60-
for (var i = 0; i < 0x1000; i+=8) {
61-
try {
62-
var s = readStdString(args[2].add(i))
63-
// console.log(s)
64-
var s1 = s.replaceAll("md5", "md6")
65-
.replaceAll('"enable_vconsole":false', '"enable_vconsole": true')
66-
.replaceAll('"frameset":false', '"frameset": true')
67-
//"frameset":false
68-
if (s !== s1) {
69-
//send(s1)
70-
writeStdString(args[2].add(i), s1)
71-
}
72-
} catch (a) {
73-
}
74-
}
91+
92+
function setupInterceptor() {
93+
94+
/**
95+
*
96+
*/
97+
98+
switch (address.Version) {
99+
100+
case 8555:
101+
Interceptor.attach(address.WechatAppHtml, {
102+
onEnter(args) {
103+
this.context.rdx = address.WechatWebHtml;
104+
sendMessage()
105+
}
106+
});
107+
108+
break;
109+
110+
111+
case 9105:
112+
Interceptor.attach(address.SwitchVersion, {
113+
onEnter(args) {
114+
this.context.r8= this.context.rax
115+
sendMessage()
116+
}
117+
})
118+
break;
119+
120+
121+
default:
122+
123+
break;
124+
125+
126+
127+
128+
129+
// case "null":
130+
// Interceptor.attach(address.WechatAppHtml, {
131+
// onEnter(args) {
132+
// const webhtml= "68 74 74 70 73 3A 2F 2F 61 70 70 6C 65 74 2D 64 65 62 75 67 2E 63 6F 6D 2F 64 65 76 74 6F 6F 6C 73 2F 77 65 63 68 61 74 5F 77 65 62 2E 68 74 6D 6C";
133+
// var data;
134+
// Process.enumerateModules({
135+
// onMatch: function(module){
136+
// var ranges = module.enumerateRanges('r--');
137+
// for (var i = 0; i < ranges.length; i++) {
138+
// var range = ranges[i];
139+
// var scanResults = Memory.scanSync(range.base, range.size, webhtml);
140+
// if (scanResults.length > 0){
141+
// data = scanResults[0].address
142+
// // console.log('Memory.scanSync() result for range ' + range.base + '-' + range.size + ':\n' + JSON.stringify(scanResults));
143+
// }
144+
// }
145+
146+
// },
147+
// onComplete: function(){
148+
149+
// }});
150+
151+
// this.context.rdx = data
152+
// sendMessage()
153+
154+
// }
155+
// })
156+
157+
// break;
158+
159+
160+
// // case 9105:
161+
// // Interceptor.attach(address.LaunchAppletBegin, {
162+
// // onEnter(args) {
163+
// // this.context.rdx= address.WechatWebHtml;
164+
// // sendMessage()
165+
// // }
166+
// // })
167+
// break;
168+
75169
}
76-
})
77-
78-
79-
80-
81-
if(address.WechatVersionSwitch){
82-
83-
Interceptor.attach(address.WechatVersionSwitch, {
84-
onEnter(args) {
85-
86-
this.context.r8 = this.context.rax
87-
send("[+] 已还原完整F12")
88-
}
89-
})
90-
91-
}else{
92-
Interceptor.attach(address.WechatAppHtml, {
93-
94-
onEnter(args) {
95-
const webhtml= "68 74 74 70 73 3A 2F 2F 61 70 70 6C 65 74 2D 64 65 62 75 67 2E 63 6F 6D 2F 64 65 76 74 6F 6F 6C 73 2F 77 65 63 68 61 74 5F 77 65 62 2E 68 74 6D 6C";
96-
var data;
97-
Process.enumerateModules({
98-
onMatch: function(module){
99-
var ranges = module.enumerateRanges('r--');
100-
for (var i = 0; i < ranges.length; i++) {
101-
102-
var range = ranges[i];
103-
var scanResults = Memory.scanSync(range.base, range.size, webhtml);
104-
if (scanResults.length > 0){
105-
data = scanResults[0].address
106-
// console.log('Memory.scanSync() result for range ' + range.base + '-' + range.size + ':\n' + JSON.stringify(scanResults));
107-
}
108-
}
109-
110-
},
111-
onComplete: function(){
112-
113-
}
114-
115-
});
116-
117-
this.context.rdx = data
118-
send("[+] 已还原完整F12")
119-
120-
}
121-
})
170+
171+
172+
122173
}

0 commit comments

Comments
 (0)