本帖最后由 hksnow 于 2021-1-8 09:33 编辑
好久没发帖子了，直接上图
[Asm] 纯文本查看 复制代码 *hook [edi] 700ACB75 83C4 04 add esp,0x4 +0x3CCB75
700ACB78 8BC8 mov ecx,eax 1879755640
700ACB7A E8 91964500 call WeChatWi.70506210
700ACB7F 8BCF mov ecx,edi
具体细节看代码
[Python] 纯文本查看 复制代码 from __future__ import print_function
import frida
import sys
def on_message(message, data):
if message['payload']['chatroomvxid'] == None:
print('[个人消息]: ' + message['payload']['wxid'] + ': ' + message['payload']['text'])
else:
print('[群消息]: ' + message['payload']['wxid'] + ': ' + message['payload']['chatroomvxid'] + ': ' + message['payload']['text'])
def main(target_process):
session = frida.attach(target_process)
script = session.create_script("""
var ModAddress=Process.findModuleByName('wechatwin.dll');
//console.log('ModAdress:' + ModAddress.base);
var hookAddress=ModAddress.base.add('0x3CCB75')
//console.log('hookAdress' + hookAddress.base)
Interceptor.attach(hookAddress,{
onEnter:function(args) {
//console.log(JSON.stringify(this.context));
var edi=this.context.edi;
//console.log('edi:' + Memory.readPointer(edi));
var edi1=Memory.readPointer(edi)
var wxid=Memory.readUtf16String(Memory.readPointer(edi1.add('0x40')));
var text=Memory.readUtf16String(Memory.readPointer(edi1.add('0x68')));
var chatroomvxid=Memory.readUtf16String(Memory.readPointer(edi1.add('0x164')));
send({'wxid':wxid,'text':text,'chatroomvxid':chatroomvxid})
//console.log(wxid + ':' + text);
}
})
""")
script.on('message', on_message)
script.load()
print("[!] Ctrl+D on UNIX, Ctrl+Z on Windows/cmd.exe to detach from instrumented program.\n\n")
sys.stdin.read()
session.detach()
if __name__ == '__main__':
main('wechat.exe')
代码还是比较简单的，然后用python回调输出消息。核心就在找call，做hook实现方式很多，最近玩frida比较多，用它比较简单。 | 
[复制链接]
发表于 2021-1-7 18:19
不明觉厉