吾爱破解 - 52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

查看: 9827|回复: 41
收起左侧

[MacOS逆向] **由于未知原因出错,需要从****App Store****重新下载**

  [复制链接]
odmin 发表于 2023-3-31 10:32
**由于未知原因出错,需要从****App Store****重新下载**

image-20230331101459565.png
image-20230331101741392.png
image-20230331101839491.png


[JavaScript] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
(*  Start *)
 
do shell script "sudo -S date 010110002022" with administrator privileges
 
tell application "iShot Pro"
        activate
end tell
 
do shell script "sleep 1" with administrator privileges
 
do shell script "sudo -S sntp -sS time.apple.com." with administrator privileges
 
display alert "iShot Pro打开成功
 
本窗口3秒后将自动关闭" giving up after 3
 
(*  End *)

免费评分

参与人数 5吾爱币 +10 热心值 +4 收起 理由
VisualStudio + 1 + 1 我很赞同!10月亲测有效
rammston + 1 谢谢@Thanks!
Hmily + 7 + 1 欢迎分析讨论交流,吾爱破解论坛有你更精彩!
yuanting + 1 + 1 我很赞同!
RIKE + 1 热心回复!

查看全部评分

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

cdsgg 发表于 2023-3-31 10:38

大佬上次那个 微信收到消息 下载附件是咋实现的
 楼主| odmin 发表于 2023-3-31 10:58
cdsgg 发表于 2023-3-31 10:38
大佬上次那个 微信收到消息 下载附件是咋实现的

仅3.9.0.28

[C++] 纯文本查看 复制代码
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050
051
052
053
054
055
056
057
058
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083
084
085
086
087
088
089
090
091
092
093
094
095
096
097
098
099
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
#include "pch.h"
#include "download.h"
 
#include "common.h"
#include "get_db_handle.h"
 
#include "wechat_data.h"
 
#define WX_NEW_CHAT_MSG_OFFSET 0x70e2a0
#define WX_GET_PRE_DOWNLOAD_MGR_OFFSET 0x7ae310
#define WX_PUSH_ATTACH_TASK_OFFSET 0x7c94a0
#define WX_FREE_CHAT_MSG_INSTANCE_COUNTER_OFFSET 0x6f5370
#define WX_FREE_CHAT_MSG_OFFSET 0x6f4ea0
#define WX_CHAT_MGR_OFFSET 0x732660
#define WX_GET_MGR_BY_PREFIX_LOCAL_ID_OFFSET 0xb54950
#define WX_GET_CURRENT_DATA_PATH_OFFSET 0xc11140
#define WX_APP_MSG_INFO_OFFSET 0x7571d0
#define WX_GET_APP_MSG_XML_OFFSET 0xddef80
#define WX_FREE_APP_MSG_INFO_OFFSET 0x73d820
#define WX_PUSH_THUMB_TASK_OFFSET 0x7c93a0
#define WX_VIDEO_MGR_OFFSET 0x7c7300
#define WX_DOWNLOAD_VIDEO_IMG_OFFSET 0xcc6d80
 
using namespace std;
 
int DoDownloadTask(ULONG64 msg_id) {
  int success = -1;
  int db_index = 0;
  int local_id = GetLocalIdByMsgId(msg_id, db_index);
  if (local_id < 1) {
    return -2;
  }
 
  char chat_msg[0x2C4] = {0};
  DWORD base = GetWeChatWinBase();
  DWORD new_chat_msg_addr = base + WX_NEW_CHAT_MSG_OFFSET;
  DWORD get_chat_mgr_addr = base + WX_CHAT_MGR_OFFSET;
  DWORD pre_download_mgr_addr = base + WX_GET_PRE_DOWNLOAD_MGR_OFFSET;
  DWORD push_attach_task_addr = base + WX_PUSH_ATTACH_TASK_OFFSET;
  DWORD free_addr = base + WX_FREE_CHAT_MSG_INSTANCE_COUNTER_OFFSET;
  DWORD get_by_local_Id_addr = base + WX_GET_MGR_BY_PREFIX_LOCAL_ID_OFFSET;
  DWORD get_current_data_path_addr = base + WX_GET_CURRENT_DATA_PATH_OFFSET;
  DWORD free_app_msg_info_addr = base + WX_FREE_APP_MSG_INFO_OFFSET;
  DWORD push_thumb_task_addr = base + WX_PUSH_THUMB_TASK_OFFSET;
  DWORD video_mgr_addr = base + WX_VIDEO_MGR_OFFSET;
  DWORD download_video_image_addr = base + WX_VIDEO_MGR_OFFSET;
 
  WeChatString current_data_path;
 
  __asm {
    PUSHAD
    PUSHFD
    LEA        ECX,current_data_path
    CALL       get_current_data_path_addr
 
    LEA        ECX,chat_msg
    CALL       new_chat_msg_addr
 
    CALL       get_chat_mgr_addr                                      
    PUSH       dword ptr [db_index]
    LEA        ECX,chat_msg
    PUSH       dword ptr [local_id]
    CALL       get_by_local_Id_addr              
    ADD        ESP,0x8
    POPFD
    POPAD
  }
  wstring save_path = L"";
  wstring thumb_path = L"";
  if (current_data_path.length > 0) {
    save_path += current_data_path.ptr;
    save_path += L"wxhelper";
  } else {
    return -1;
  }
  
  if (!FindOrCreateDirectoryW(save_path.c_str())) {
    return -3;
  }
  DWORD type = *(DWORD *)(chat_msg + 0x38);
  wchar_t *content = *(wchar_t **)(chat_msg + 0x70);
 
  switch (type) {
    case 0x3: {
      save_path += L"\\image";
      if (!FindOrCreateDirectoryW(save_path.c_str())) {
        return -3;
      }
      save_path = save_path +L"\\"+ to_wstring(msg_id) + L".png";
      break;
    }
    case 0x3E:
    case 0x2B: {
      save_path += L"\\video";
      if (!FindOrCreateDirectoryW(save_path.c_str())) {
        return -3;
      }
      thumb_path = save_path + L"\\"+ to_wstring(msg_id) + L".jpg";
      save_path =  save_path + L"\\"+ to_wstring(msg_id) + L".mp4";
      
      break;
    }
    case 0x31: {
      save_path += L"\\file";
      wcout << save_path << endl;
      if (!FindOrCreateDirectoryW(save_path.c_str())) {
        return -3;
      }
      char xml_app_msg[0xC80] = {0};
      DWORD new_app_msg_addr = base + WX_APP_MSG_INFO_OFFSET;
      DWORD get_xml_addr = base + WX_GET_APP_MSG_XML_OFFSET;
      WeChatString w_content(content);
 
      __asm {
        PUSHAD
        PUSHFD
        LEA        ECX,xml_app_msg     
        CALL       new_app_msg_addr
        PUSH       0x1
        LEA        EAX,w_content
        PUSH       EAX      
        LEA        ECX,xml_app_msg
        CALL       get_xml_addr
        MOV        success,EAX
        LEA        ECX,xml_app_msg
        CALL       free_app_msg_info_addr
        POPFD
        POPAD
      }
      if (success != 1) {
        return -4;
      }
      WeChatString *file_name = (WeChatString *)((DWORD)xml_app_msg + 0x44);
      save_path = save_path +L"\\" + to_wstring(msg_id) + L"_" +
                  wstring(file_name->ptr, file_name->length);
      break;
    }
    default:
      break;
  }
  WeChatString  w_save_path(save_path);
  WeChatString  w_thumb_path(thumb_path);
  int temp =1;
  memcpy(&chat_msg[0x19C], &w_thumb_path, sizeof(w_thumb_path));
  memcpy(&chat_msg[0x1B0], &w_save_path, sizeof(w_save_path));
  memcpy(&chat_msg[0x290], &temp, sizeof(temp));
  // note: the image has been downloaded and will not be downloaded again
  // use low-level method 
  // this function does not work, need to modify chatmsg.
  // if (type == 0x3E || type == 0x2B){
  //   __asm{
  //      PUSHAD
  //      PUSHFD
  //      CALL       video_mgr_addr
  //      LEA        ECX,chat_msg
  //      PUSH       ECX
  //      MOV        ECX,EAX
  //      CALL       download_video_image_addr
  //      POPFD
  //      POPAD
  //   }
  // }
 
  __asm {
    PUSHAD
    PUSHFD
    CALL       pre_download_mgr_addr                               
    PUSH       0x1
    PUSH       0x0
    LEA        ECX,chat_msg
    PUSH       ECX
    MOV        ECX,EAX
    CALL       push_attach_task_addr
    MOV        success,EAX
    LEA        ECX,chat_msg
    PUSH       0x0
    CALL       free_addr
    POPFD
    POPAD
  }
 
  return success;
}
cdsgg 发表于 2023-3-31 10:37
cdsgg 发表于 2023-3-31 11:03
odmin 发表于 2023-3-31 10:58
仅3.9.0.28

[mw_shl_code=cpp,true]#include "pch.h"

感谢楼主 我研究看一下
Easonll 发表于 2023-3-31 11:04
牛鼻plus 学习了
aa2923821a 发表于 2023-3-31 11:14
我也遇到过这个问题
quiet0 发表于 2023-3-31 11:18
还是G了比较牛
一只大菜猫 发表于 2023-3-31 11:36
有点牛。
Light紫星 发表于 2023-3-31 11:40
厉害,学习了
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则

返回列表

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2025-4-22 23:44

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表