Skip to content

Commit 211a385

Browse files
itxiao6itxiao6
committed
多微信处理
1 parent 1a5d6aa commit 211a385

3 files changed

Lines changed: 111 additions & 39 deletions

File tree

‎scripts/hook.js‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,26 @@
1-
;
1+
2+
var wechatProcesses = [];
3+
Process.enumerateModules({
4+
onMatch: function(module){
5+
if(module.name.startsWith("WeChatAppEx")){
6+
wechatProcesses.push(module);
7+
console.log('Found WeChatAppEx module: ' + module.name + ' at ' + module.base);
8+
}
9+
},
10+
onComplete: function(){
11+
console.log('Module enumeration completed. Found ' + wechatProcesses.length + ' WeChatAppEx modules.');
12+
}
13+
});
14+
15+
216
//获取WeChatAppEx.exe的基址
317
var module = Process.findModuleByName("WeChatAppEx.exe") || Process.findModuleByName('WeChatAppEx Framework')
18+
419
var base = module.base;
5-
// console.log("模块名称:",module.name);
6-
// console.log("模块地址:",module.base);
7-
// console.log("大小:",module.size);
20+
21+
console.log("模块名称:",module.name);
22+
console.log("模块地址:",module.base);
23+
console.log("大小:",module.size);
824

925

1026
Object.keys(address).forEach(key => {

‎utils/commons.py‎

Lines changed: 63 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,37 @@
1-
#commons.py //2024年3月5日23点25分
2-
1+
# commons.py
32
from utils.colors import Color
43
from utils.wechatutils import WechatUtils
5-
import frida,sys,time,platform
6-
4+
import frida
5+
import sys
6+
import time
7+
import platform
78

89
class Commons:
910
def __init__(self):
1011
self.wechatutils_instance = WechatUtils()
1112
self.device = frida.get_local_device()
1213
self.process = self.device.enumerate_processes()
13-
self.pid = -1
1414
self.version_list = []
1515
self.configs_path = ""
16+
self.active_sessions = []
1617

1718
def onMessage(self, message, data):
1819
if message['type'] == 'send':
1920
print(Color.GREEN + message['payload'], Color.END)
2021
elif message['type'] == 'error':
2122
print(Color.RED + message['stack'], Color.END)
2223

23-
def inject_wehcatEx(self, pid, code):
24-
session = frida.attach(pid)
25-
script = session.create_script(code)
26-
script.on("message", self.onMessage)
27-
script.load()
28-
sys.stdin.read()
29-
# session.detach()
24+
def inject_wechatEx(self, pid, code):
25+
try:
26+
session = frida.attach(pid)
27+
script = session.create_script(code)
28+
script.on("message", self.onMessage)
29+
script.load()
30+
print(f"Successfully injected into WeChat PID: {pid}")
31+
return session
32+
except Exception as e:
33+
print(f"Error injecting into WeChat PID {pid}: {e}")
34+
return None
3035

3136
def inject_wechatDLL(self, path, code):
3237
pid = self.device.spawn(path)
@@ -37,47 +42,70 @@ def inject_wechatDLL(self, path, code):
3742
self.device.resume(pid)
3843
time.sleep(10)
3944
session.detach()
40-
# sys.stdin.read()
4145

4246
def load_wechatEx_configs(self):
4347
path = self.wechatutils_instance.get_configs_path()
4448
if get_cpu_architecture() == "MacOS x64":
45-
pid, version = self.wechatutils_instance.get_wechat_pid_and_version_mac()
49+
wechat_instances = self.wechatutils_instance.get_wechat_pids_and_versions_mac()
4650
else:
47-
pid, version = self.wechatutils_instance.get_wechat_pid_and_version()
48-
if pid or version is not None:
49-
wehcatEx_hookcode = open(path + "../scripts/hook.js", "r", encoding="utf-8").read()
50-
wechatEx_addresses = open(path + "../configs/address_{}_x64.json".format(version)).read()
51-
wehcatEx_hookcode = "var address=" + wechatEx_addresses + wehcatEx_hookcode
52-
self.inject_wehcatEx(pid, wehcatEx_hookcode)
51+
wechat_instances = self.wechatutils_instance.get_wechat_pids_and_versions()
52+
53+
if wechat_instances:
54+
for pid, version in wechat_instances:
55+
try:
56+
wechatEx_hookcode = open(path + "../scripts/hook.js", "r", encoding="utf-8").read()
57+
wechatEx_addresses = open(path + f"../configs/address_{version}_x64.json").read()
58+
wechatEx_hookcode = "var address=" + wechatEx_addresses + wechatEx_hookcode
59+
session = self.inject_wechatEx(pid, wechatEx_hookcode)
60+
if session:
61+
self.active_sessions.append(session)
62+
print(f"Injected into WeChat instance PID: {pid}, Version: {version}")
63+
except Exception as e:
64+
print(f"Error injecting into WeChat PID {pid}: {e}")
5365
else:
5466
self.wechatutils_instance.print_process_not_found_message()
5567

68+
# 管理会话
69+
while self.active_sessions:
70+
self.manage_sessions()
71+
time.sleep(5) # 每5秒检查一次
72+
5673
def load_wechatEXE_configs(self):
57-
pid, version = self.wechatutils_instance.get_wechat_pid_and_version()
58-
if pid or version is not None:
59-
print(Color.RED+f"[-] 请退出微信后在执行该命令 "+Color.END)
74+
wechat_instances = self.wechatutils_instance.get_wechat_pids_and_versions()
75+
if wechat_instances:
76+
print(Color.RED + f"[-] 请退出所有微信实例后再执行该命令 " + Color.END)
6077
return 0
6178

6279
wechatEXEpath = self.wechatutils_instance.find_installation_path("微信")
6380
path = self.wechatutils_instance.get_configs_path()
64-
wehcatEXE_hookcode = open(path + "..\\scripts\\WechatWin.dll\\hook.js", "r", encoding="utf-8").read()
65-
self.inject_wechatDLL(wechatEXEpath, wehcatEXE_hookcode)
81+
wechatEXE_hookcode = open(path + "..\\scripts\\WechatWin.dll\\hook.js", "r", encoding="utf-8").read()
82+
self.inject_wechatDLL(wechatEXEpath, wechatEXE_hookcode)
6683

6784
def load_wechatEXE_and_wechatEx(self):
68-
pid, version = self.wechatutils_instance.get_wechat_pid_and_version()
69-
if pid or version is not None:
70-
print(Color.RED+f"[-] 请关闭微信后在执行该命令 "+Color.END)
85+
wechat_instances = self.wechatutils_instance.get_wechat_pids_and_versions()
86+
if wechat_instances:
87+
print(Color.RED + f"[-] 请关闭所有微信实例后再执行该命令 " + Color.END)
7188
return 0
7289
self.load_wechatEXE_configs()
7390
self.load_wechatEx_configs()
7491

92+
def manage_sessions(self):
93+
for session in self.active_sessions[:]: # 使用切片创建副本以便在迭代时修改
94+
if session.is_detached:
95+
print(f"Session {session} detached, removing from active sessions.")
96+
self.active_sessions.remove(session)
7597

7698
def get_cpu_architecture():
77-
try:
78-
cpu_arch = platform.platform().lower()
79-
if "64bit" in cpu_arch and "macos" in cpu_arch:
80-
return "MacOS x64"
81-
except Exception as e:
82-
print(Color.RED, f"[-] Error detecting CPU arc: {e} ", Color.END)
83-
return "Windows"
99+
try:
100+
cpu_arch = platform.platform().lower()
101+
if "64bit" in cpu_arch and "macos" in cpu_arch:
102+
return "MacOS x64"
103+
return "Windows" # 默认返回Windows
104+
except Exception as e:
105+
print(Color.RED, f"[-] Error detecting CPU architecture: {e} ", Color.END)
106+
return "Windows"
107+
108+
# 主函数示例
109+
if __name__ == "__main__":
110+
commons = Commons()
111+
commons.load_wechatEx_configs()

‎utils/wechatutils.py‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,34 @@ def get_version_list(self):
2929
def is_wechatEx_process(self, cmdline):
3030
process_name = "WeChatAppEx"
3131
return cmdline and process_name in cmdline[0] and "--type=" not in ' '.join(cmdline)
32+
def get_wechat_pids_and_versions(self):
33+
processes = (proc.info for proc in psutil.process_iter(['pid', 'cmdline']))
34+
wechatEx_processes = (p for p in processes if self.is_wechatEx_process(p['cmdline']))
35+
wechat_instances = []
36+
for process in wechatEx_processes:
37+
pid = process['pid']
38+
version = self.extract_version_number(process['cmdline'])
39+
if version in self.version_list:
40+
wechat_instances.append((pid, version))
41+
return wechat_instances
42+
43+
def get_wechat_pid_and_version(self):
44+
wechat_instances = self.get_wechat_pids_and_versions()
45+
return wechat_instances[0] if wechat_instances else (None, None)
46+
47+
def get_wechat_pids_and_versions_mac(self):
48+
try:
49+
pid_command = "ps aux | grep 'WeChatAppEx' | grep -v 'grep' | grep ' --client_version' | grep '-user-agent=' | awk '{print $2}'"
50+
version_command = "ps aux | grep 'WeChatAppEx' | grep -v 'grep' | grep ' --client_version' | grep '-user-agent=' | grep -oE 'MacWechat/([0-9]+\.)+[0-9]+\(0x\d+\)' | grep -oE '(0x\d+)' | sed 's/0x//g'"
51+
pids = subprocess.run(pid_command, shell=True, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE).stdout.split()
52+
versions = subprocess.run(version_command, shell=True, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE).stdout.split()
53+
return list(zip(map(int, pids), versions))
54+
except subprocess.CalledProcessError as e:
55+
print(Color.RED + f"Error getting MacOS WeChat instances: {e.stderr}" + Color.END)
56+
return []
57+
58+
def print_process_not_found_message(self):
59+
print(Color.RED + "[-] 未找到匹配版本的微信进程或微信未运行" + Color.END)
3260

3361
def find_installation_path(self, program_name):
3462
try:

0 commit comments

Comments
 (0)