diff --git a/pywxdump/wx_info/get_wx_info.py b/pywxdump/wx_info/get_wx_info.py index 8aeb86e..ed173a8 100644 --- a/pywxdump/wx_info/get_wx_info.py +++ b/pywxdump/wx_info/get_wx_info.py @@ -239,16 +239,6 @@ def read_info(version_list, is_logging=False): tmp_rd['pid'] = process.pid tmp_rd['version'] = Dispatch("Scripting.FileSystemObject").GetFileVersion(process.exe()) - wechat_base_address = 0 - for module in process.memory_maps(grouped=False): - if module.path and 'WeChatWin.dll' in module.path: - wechat_base_address = int(module.addr, 16) - break - if wechat_base_address == 0: - error = f"[-] WeChat WeChatWin.dll Not Found" - if is_logging: print(error) - return error - Handle = ctypes.windll.kernel32.OpenProcess(0x1F0FFF, False, process.pid) bias_list = version_list.get(tmp_rd['version'], None) @@ -260,6 +250,16 @@ def read_info(version_list, is_logging=False): tmp_rd['name'] = "None" tmp_rd['mail'] = "None" else: + wechat_base_address = 0 + for module in process.memory_maps(grouped=False): + if module.path and 'WeChatWin.dll' in module.path: + wechat_base_address = int(module.addr, 16) + break + if wechat_base_address == 0: + error = f"[-] WeChat WeChatWin.dll Not Found" + if is_logging: print(error) + # return error + name_baseaddr = wechat_base_address + bias_list[0] account__baseaddr = wechat_base_address + bias_list[1] mobile_baseaddr = wechat_base_address + bias_list[2] diff --git a/pywxdump/wx_info/simplify_wx_info.py b/pywxdump/wx_info/simplify_wx_info.py index 7981b5f..9fc309b 100644 --- a/pywxdump/wx_info/simplify_wx_info.py +++ b/pywxdump/wx_info/simplify_wx_info.py @@ -95,15 +95,29 @@ def get_info_wxid(h_process): def get_info_filePath(wxid="all"): if not wxid: return "None" + w_dir = "MyDocument:" + is_w_dir = False + try: - user_profile = os.environ.get("USERPROFILE") - path_3ebffe94 = os.path.join(user_profile, "AppData", "Roaming", "Tencent", "WeChat", "All Users", "config", - "3ebffe94.ini") - with open(path_3ebffe94, "r", encoding="utf-8") as f: - w_dir = f.read() + key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, r"Software\Tencent\WeChat", 0, winreg.KEY_READ) + value, _ = winreg.QueryValueEx(key, "FileSavePath") + winreg.CloseKey(key) + w_dir = value + is_w_dir = True except Exception as e: w_dir = "MyDocument:" + if not is_w_dir: + try: + user_profile = os.environ.get("USERPROFILE") + path_3ebffe94 = os.path.join(user_profile, "AppData", "Roaming", "Tencent", "WeChat", "All Users", "config", + "3ebffe94.ini") + with open(path_3ebffe94, "r", encoding="utf-8") as f: + w_dir = f.read() + is_w_dir = True + except Exception as e: + w_dir = "MyDocument:" + if w_dir == "MyDocument:": try: # 打开注册表路径 @@ -131,7 +145,7 @@ def get_info_filePath(wxid="all"): return filePath if os.path.exists(filePath) else "None" -def get_key(db_path, addr_len): +def get_key(pid, db_path, addr_len): def read_key_bytes(h_process, address, address_len=8): array = ctypes.create_string_buffer(address_len) if ReadProcessMemory(h_process, void_p(address), array, address_len, 0) == 0: return "None" @@ -164,7 +178,7 @@ def get_key(db_path, addr_len): phone_type2 = "android\x00" phone_type3 = "ipad\x00" - pm = pymem.Pymem("WeChat.exe") + pm = pymem.Pymem(pid) module_name = "WeChatWin.dll" MicroMsg_path = os.path.join(db_path, "MSG", "MicroMsg.db") @@ -172,11 +186,17 @@ def get_key(db_path, addr_len): type1_addrs = pm.pattern_scan_module(phone_type1.encode(), module_name, return_multiple=True) type2_addrs = pm.pattern_scan_module(phone_type2.encode(), module_name, return_multiple=True) type3_addrs = pm.pattern_scan_module(phone_type3.encode(), module_name, return_multiple=True) - type_addrs = type1_addrs if len(type1_addrs) >= 2 else type2_addrs if len(type2_addrs) >= 2 else type3_addrs if len( - type3_addrs) >= 2 else "None" - # print(type_addrs) - if type_addrs == "None": - return "None" + + # print(type1_addrs, type2_addrs, type3_addrs) + + type_addrs = [] + if len(type1_addrs) >= 2: type_addrs += type1_addrs + if len(type2_addrs) >= 2: type_addrs += type2_addrs + if len(type3_addrs) >= 2: type_addrs += type3_addrs + if len(type_addrs) == 0: return "None" + + type_addrs.sort() # 从小到大排序 + for i in type_addrs[::-1]: for j in range(i, i - 2000, -addr_len): key_bytes = read_key_bytes(pm.process_handle, j, addr_len) @@ -212,9 +232,10 @@ def read_info(is_logging=False): tmp_rd['wxid'] = get_info_wxid(Handle) tmp_rd['filePath'] = get_info_filePath(tmp_rd['wxid']) if tmp_rd['wxid'] != "None" else "None" - tmp_rd['key'] = get_key(tmp_rd['filePath'], addrLen) if tmp_rd['filePath'] != "None" else "None" + tmp_rd['key'] = get_key(tmp_rd['pid'], tmp_rd['filePath'], addrLen) if tmp_rd['filePath'] != "None" else "None" result.append(tmp_rd) + if is_logging: print("=" * 32) if isinstance(result, str): # 输出报错