Skip to content

Commit 0356d08

Browse files
javeleyjaveley
javeley
authored and
javeley
committed
更新mac3.8.8 (28454)
1 parent abccd6d commit 0356d08

5 files changed

Lines changed: 111 additions & 78 deletions

File tree

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
frida-example
2+
.DS_Store
3+
__pycache__

‎configs/address_13080811_x64.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"WechatAppHtml": "0x2C86E2B",
3+
"WechatWebHtml": "0x8023935",
4+
"LaunchAppletBegin":"0x2E1D9A8",
5+
"MenuItemDevToolsString":"0x2E295AD",
6+
"Version":13080811
7+
}

‎scripts/hook.js‎

Lines changed: 73 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
;
22
//获取WeChatAppEx.exe的基址
3-
var module = Process.findModuleByName("WeChatAppEx.exe");
3+
var module = Process.findModuleByName("WeChatAppEx.exe") || Process.findModuleByName('WeChatAppEx Framework')
44
var base = module.base;
55
// console.log("模块名称:",module.name);
66
// console.log("模块地址:",module.base);
@@ -9,17 +9,17 @@ var base = module.base;
99

1010
Object.keys(address).forEach(key => {
1111
key != "Version" ? address[key] = base.add(address[key]) : false
12-
1312
});
14-
send("[+] WeChatAppEx.exe 注入成功!");
13+
14+
send("[+] WeChatAppEx 注入成功!");
1515
send("[+] 当前小程序版本: " + address.Version);
1616
send("[+] 等待小程序加载...");
1717

1818
function readStdString(s) {
1919
var flag = s.add(23).readU8()
2020
if (flag == 0x80) {
2121
// 从堆中读取
22-
var size = s.add(8).readUInt()
22+
var size = s.add(8).readUInt()
2323
return s.readPointer().readUtf8String(size)
2424
} else {
2525
// 从栈中读取
@@ -46,9 +46,7 @@ function writeStdString(s, content) {
4646
}
4747
}
4848
function sendMessage(msg) {
49-
50-
51-
msg===null || undefined ?send(msg):send("[+] 已还原完整F12")
49+
msg === null || undefined ? send(msg) : send("[+] 已还原完整F12")
5250
// send("[+] 已还原完整F12")
5351
}
5452

@@ -57,97 +55,104 @@ function replaceParams() {
5755
Interceptor.attach(address.LaunchAppletBegin, {
5856
onEnter(args) {
5957
send("[+] HOOK到小程序加载! " + readStdString(args[1]))
60-
for (var i = 0; i < 0x1000; i+=8) {
58+
for (var i = 0; i < 0x1000; i += 8) {
6159
try {
6260
var s = readStdString(args[2].add(i))
63-
var s1 = s.replaceAll("md5", "md6")
64-
.replaceAll('"enable_vconsole":false', '"enable_vconsole": true')
65-
.replaceAll('"frameset":false', '"frameset": true')
66-
//"frameset":false
61+
var s1 = s.replaceAll('"enable_vconsole":false', '"enable_vconsole": true')
62+
// .replaceAll("md5", "md6")
63+
// .replaceAll('"frameset":false', '"frameset": true')
64+
//"frameset":false
6765
if (s !== s1) {
6866
writeStdString(args[2].add(i), s1)
69-
}
67+
}
7068
} catch (a) {
7169
}
7270
}
7371
}
7472
})
75-
73+
7674
}
7775

7876

7977

8078
// 过新版8555检测
81-
if(address.MenuItemDevToolsString){
79+
if (address.MenuItemDevToolsString) {
8280
var menuItemDevToolsStringCr = new Uint8Array(address.MenuItemDevToolsString.readByteArray(7));
8381
var intptr_ = (menuItemDevToolsStringCr[3] & 0xFF) | ((menuItemDevToolsStringCr[4] & 0xFF) << 8) | ((menuItemDevToolsStringCr[5] & 0xFF) << 16) | ((menuItemDevToolsStringCr[6] & 0xFF) << 24);
84-
var menuItemDevToolsStringPtrData = address.MenuItemDevToolsString.add(intptr_+7);
82+
var menuItemDevToolsStringPtrData = address.MenuItemDevToolsString.add(intptr_ + 7);
8583
Memory.protect(menuItemDevToolsStringPtrData, 8, 'rw-')
8684
menuItemDevToolsStringPtrData.writeUtf8String("DevTools");
8785
replaceParams()
8886
setupInterceptor()
8987
}
9088

9189

92-
9390
function setupInterceptor() {
9491

9592
/**
9693
*
9794
*/
98-
95+
9996
switch (address.Version) {
100-
97+
10198
case 8555:
10299
Interceptor.attach(address.WechatAppHtml, {
103100
onEnter(args) {
104101
this.context.rdx = address.WechatWebHtml;
105102
sendMessage()
106103
}
107104
});
108-
105+
109106
break;
110-
111-
107+
108+
112109
case 9105:
113110
Interceptor.attach(address.SwitchVersion, {
114111
onEnter(args) {
115-
this.context.r8= this.context.rax
112+
this.context.r8 = this.context.rax
116113
sendMessage()
117114
}
118115
})
119116
break;
120-
117+
121118
case 9079:
122119
Interceptor.attach(address.SwitchVersion, {
123120
onEnter(args) {
124-
this.context.r8= this.context.rax
121+
this.context.r8 = this.context.rax
125122
sendMessage()
126123
}
127124
})
128125
break;
129-
126+
130127
case 9115:
131128
Interceptor.attach(address.SwitchVersion, {
132129
onEnter(args) {
133-
this.context.r8= this.context.rax
130+
this.context.r8 = this.context.rax
134131
sendMessage()
135132
}
136133
})
137134
break;
138135

139136
case 9129:
140-
Interceptor.attach(address.SwitchVersion, {
141-
onEnter(args) {
142-
this.context.r8= this.context.rax
143-
sendMessage()
144-
}
145-
})
146-
break;
147-
137+
Interceptor.attach(address.SwitchVersion, {
138+
onEnter(args) {
139+
this.context.r8 = this.context.rax
140+
sendMessage()
141+
}
142+
})
143+
break;
148144

145+
case 13080811:
146+
Interceptor.attach(address.WechatAppHtml, {
147+
onEnter(args) {
148+
this.context.rsi = address.WechatWebHtml
149+
sendMessage()
150+
}
151+
})
152+
break;
149153

150154
default:
155+
console.log(address.Version);
151156
Interceptor.attach(address.WechatAppHtml, {
152157
onEnter(args) {
153158
this.context.rdx = address.WechatWebHtml;
@@ -156,41 +161,38 @@ function setupInterceptor() {
156161
});
157162
break;
158163

159-
160-
161-
162-
163-
// case "null":
164-
// Interceptor.attach(address.WechatAppHtml, {
165-
// onEnter(args) {
166-
// const webhtml= "68 74 74 70 73 3A 2F 2F 61 70 70 6C 65 74 2D 64 65 62 75 67 2E 63 6F 6D 2F 64 65 76 74 6F 6F 6C 73 2F 77 65 63 68 61 74 5F 77 65 62 2E 68 74 6D 6C";
167-
// var data;
168-
// Process.enumerateModules({
169-
// onMatch: function(module){
170-
// var ranges = module.enumerateRanges('r--');
171-
// for (var i = 0; i < ranges.length; i++) {
172-
// var range = ranges[i];
173-
// var scanResults = Memory.scanSync(range.base, range.size, webhtml);
174-
// if (scanResults.length > 0){
175-
// data = scanResults[0].address
176-
// // console.log('Memory.scanSync() result for range ' + range.base + '-' + range.size + ':\n' + JSON.stringify(scanResults));
177-
// }
178-
// }
179-
180-
// },
181-
// onComplete: function(){
182-
183-
// }});
184-
185-
// this.context.rdx = data
186-
// sendMessage()
187-
188-
// }
189-
// })
190-
191-
// break;
192-
193-
194-
164+
165+
// case "null":
166+
// Interceptor.attach(address.WechatAppHtml, {
167+
// onEnter(args) {
168+
// const webhtml= "68 74 74 70 73 3A 2F 2F 61 70 70 6C 65 74 2D 64 65 62 75 67 2E 63 6F 6D 2F 64 65 76 74 6F 6F 6C 73 2F 77 65 63 68 61 74 5F 77 65 62 2E 68 74 6D 6C";
169+
// var data;
170+
// Process.enumerateModules({
171+
// onMatch: function(module){
172+
// var ranges = module.enumerateRanges('r--');
173+
// for (var i = 0; i < ranges.length; i++) {
174+
// var range = ranges[i];
175+
// var scanResults = Memory.scanSync(range.base, range.size, webhtml);
176+
// if (scanResults.length > 0){
177+
// data = scanResults[0].address
178+
// // console.log('Memory.scanSync() result for range ' + range.base + '-' + range.size + ':\n' + JSON.stringify(scanResults));
179+
// }
180+
// }
181+
182+
// },
183+
// onComplete: function(){
184+
185+
// }});
186+
187+
// this.context.rdx = data
188+
// sendMessage()
189+
190+
// }
191+
// })
192+
193+
// break;
194+
195+
196+
195197
}
196198
}

‎utils/commons.py‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
from utils.colors import Color
44
from utils.wechatutils import WechatUtils
5-
import frida,sys,time
5+
import frida,sys,time,platform
66

77

88
class Commons:
@@ -41,10 +41,13 @@ def inject_wechatDLL(self, path, code):
4141

4242
def load_wechatEx_configs(self):
4343
path = self.wechatutils_instance.get_configs_path()
44-
pid, version = self.wechatutils_instance.get_wechat_pid_and_version()
44+
if get_cpu_architecture() == "MacOS x64":
45+
pid, version = self.wechatutils_instance.get_wechat_pid_and_version_mac()
46+
else:
47+
pid, version = self.wechatutils_instance.get_wechat_pid_and_version()
4548
if pid or version is not None:
46-
wehcatEx_hookcode = open(path + "..\\scripts\\hook.js", "r", encoding="utf-8").read()
47-
wechatEx_addresses = open(path + "..\\configs\\address_{}_x64.json".format(version)).read()
49+
wehcatEx_hookcode = open(path + "../scripts/hook.js", "r", encoding="utf-8").read()
50+
wechatEx_addresses = open(path + "../configs/address_{}_x64.json".format(version)).read()
4851
wehcatEx_hookcode = "var address=" + wechatEx_addresses + wehcatEx_hookcode
4952
self.inject_wehcatEx(pid, wehcatEx_hookcode)
5053
else:
@@ -67,4 +70,14 @@ def load_wechatEXE_and_wechatEx(self):
6770
print(Color.RED+f"[-] 请关闭微信后在执行该命令 "+Color.END)
6871
return 0
6972
self.load_wechatEXE_configs()
70-
self.load_wechatEx_configs()
73+
self.load_wechatEx_configs()
74+
75+
76+
def get_cpu_architecture():
77+
try:
78+
cpu_arch = platform.platform().lower()
79+
if "64bit" in cpu_arch and "macos" in cpu_arch:
80+
return "MacOS x64"
81+
except Exception as e:
82+
print(Color.RED, f"[-] Error detecting CPU arc: {e} ", Color.END)
83+
return "Windows"

‎utils/wechatutils.py‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import os,re,winreg
2-
import psutil
2+
import psutil,subprocess
33
from utils.colors import Color
44

55
class WechatUtils:
@@ -12,7 +12,7 @@ def __init__(self):
1212

1313
def get_configs_path(self):
1414
current_path = os.path.abspath(__file__)
15-
relative_path = '..\\configs\\'
15+
relative_path = '../configs/'
1616
return os.path.join(os.path.dirname(current_path), relative_path)
1717

1818
def get_version_list(self):
@@ -67,4 +67,13 @@ def get_wechat_pid_and_version(self):
6767
def print_process_not_found_message(self):
6868
print(Color.RED + "[-] 未找到匹配版本的微信进程或微信未运行" + Color.END)
6969

70+
def get_wechat_pid_and_version_mac(self):
71+
try:
72+
pid_command="ps aux | grep 'WeChatAppEx' | grep -v 'grep' | grep ' --client_version' | grep '-user-agent=' | awk '{print $2}' | tail -n 1"
73+
version_command = "ps aux | grep 'WeChatAppEx' | grep -v 'grep' | grep ' --client_version' | grep '-user-agent=' | grep -oE 'MacWechat/([0-9]+\.)+[0-9]+\(0x\d+\)' | grep -oE '(0x\d+)' | sed 's/0x//g' | head -n 1"
74+
pid = subprocess.run(pid_command, shell=True, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE).stdout.replace("\n","")
75+
version = subprocess.run(version_command, shell=True, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE).stdout.replace("\n","")
76+
return int(pid),version
77+
except subprocess.CalledProcessError as e:
78+
return e.stderr
7079

0 commit comments

Comments
 (0)