From 0a789eaa3e90829fb692123daf90dbaee4fd341a Mon Sep 17 00:00:00 2001
From: Changhua <lichanghua0821@gmail.com>
Date: Sat, 6 Aug 2022 21:44:26 +0800
Subject: [PATCH] Impl Send Image

---
 App/App.cpp        | 12 +++++++-----
 SDK/sdk.cpp        |  2 +-
 SDK/sdk.h          |  2 +-
 SDK/util.cpp       |  2 +-
 Spy/load_calls.cpp |  2 +-
 Spy/send_msg.cpp   | 37 ++++++++++++++++++++-----------------
 6 files changed, 31 insertions(+), 26 deletions(-)

diff --git a/App/App.cpp b/App/App.cpp
index 5df300c..d70831c 100644
--- a/App/App.cpp
+++ b/App/App.cpp
@@ -1,4 +1,4 @@
-#include <fcntl.h>
+#include <fcntl.h>
 #include <io.h>
 #include <iostream>
 #include <process.h>
@@ -60,12 +60,14 @@ int main()
     wcout << L"Message: 接收通知中......" << endl;
     WxSetTextMsgCb(onTextMsg);
 
-    // 测试消息发送
+    // 测试消息发送
+    wcout << L"测试消息发送" << endl;
     WxSendTextMsg(wxid, at_wxid, content);
-#if 0
-    // 发送照片
-    WxSendImageMsg(wxid, img_path);
 
+    // 发送照片
+    wcout << L"测试发送照片" << endl;
+    WxSendImageMsg(wxid, img_path);
+#if 0
     Sleep(10000); // 等待10秒
     // 测试联系人获取
     auto mContact = WxGetContacts();
diff --git a/SDK/sdk.cpp b/SDK/sdk.cpp
index 0202aeb..4615c94 100644
--- a/SDK/sdk.cpp
+++ b/SDK/sdk.cpp
@@ -1,4 +1,4 @@
-#include "Shlwapi.h"
+#include "Shlwapi.h"
 #include "framework.h"
 #include <process.h>
 #include <queue>
diff --git a/SDK/sdk.h b/SDK/sdk.h
index 1e28520..06d1a87 100644
--- a/SDK/sdk.h
+++ b/SDK/sdk.h
@@ -1,4 +1,4 @@
-#pragma once
+#pragma once
 
 #include <functional>
 #include <map>
diff --git a/SDK/util.cpp b/SDK/util.cpp
index b4a4bdc..0d8a96e 100644
--- a/SDK/util.cpp
+++ b/SDK/util.cpp
@@ -1,4 +1,4 @@
-#include "Shlwapi.h"
+#include "Shlwapi.h"
 #include "framework.h"
 #include <string.h>
 #include <strsafe.h>
diff --git a/Spy/load_calls.cpp b/Spy/load_calls.cpp
index 86cadd7..18ee717 100644
--- a/Spy/load_calls.cpp
+++ b/Spy/load_calls.cpp
@@ -11,7 +11,7 @@ WxCalls_t wxCalls = {
     /* Receive Message:
           Hook,   call,   type, self,   id, msgXml, roomId, wxId, content */
     { 0x550F4C, 0xA94A50, 0x38, 0x3C, 0x184, 0x1EC, 0x48, 0x170, 0x70 },
-    { 0x5CCB50, 0x6F5C0, 0x3E3490 } // Send Image Message
+    { 0xBD780, 0x770120, 0x521640 } // Send Image Message
 };
 
 int LoadCalls(const wchar_t* version, WxCalls_t* calls)
diff --git a/Spy/send_msg.cpp b/Spy/send_msg.cpp
index 82d0437..d205b31 100644
--- a/Spy/send_msg.cpp
+++ b/Spy/send_msg.cpp
@@ -52,9 +52,10 @@ void SendImageMessage(const wchar_t *wxid, const wchar_t *path)
 {
     if (g_WeChatWinDllAddr == 0) {
         return;
-    }
-    char buf1[0x20]      = { 0 };
-    char buf2[0x378]     = { 0 };
+    }
+    DWORD tmpEAX = 0;
+    char buf1[0x48]      = { 0 };
+    char buf2[0x3B0]     = { 0 };
     TextStruct_t imgWxid = { 0 };
     TextStruct_t imgPath = { 0 };
 
@@ -76,19 +77,21 @@ void SendImageMessage(const wchar_t *wxid, const wchar_t *path)
 
     __asm {
         pushad
-        sub esp, 0x14
-        lea eax, buf1
-        mov ecx, esp
-        push eax
-        call sendCall1
-        lea ebx, imgPath
-        push ebx
-        lea eax, imgWxid
-        push eax
-        lea eax, buf2
-        push eax
-        call sendCall2
-        mov ecx, eax
-        call sendCall3
+        call sendCall1
+        sub esp, 0x14
+        mov tmpEAX, eax
+        lea eax, buf1
+        mov ecx, esp
+        lea edi, imgPath
+        push eax
+        call sendCall2
+        mov ecx, dword ptr [tmpEAX]
+        lea eax, imgWxid
+        push edi
+        push eax
+        lea eax, buf2
+        push eax
+        call sendCall3
+        popad
     }
 }