Impl Send Image

Spy/load_calls.cpp

@@ -11,7 +11,7 @@ WxCalls_t wxCalls = {
     /* Receive Message:
           Hook,   call,   type, self,   id, msgXml, roomId, wxId, content */
     { 0x550F4C, 0xA94A50, 0x38, 0x3C, 0x184, 0x1EC, 0x48, 0x170, 0x70 },
-    { 0x5CCB50, 0x6F5C0, 0x3E3490 } // Send Image Message
+    { 0xBD780, 0x770120, 0x521640 } // Send Image Message
 };
 
 int LoadCalls(const wchar_t* version, WxCalls_t* calls)

Spy/send_msg.cpp

@@ -52,9 +52,10 @@ void SendImageMessage(const wchar_t *wxid, const wchar_t *path)
 {
     if (g_WeChatWinDllAddr == 0) {
         return;
-    }
-    char buf1[0x20]      = { 0 };
-    char buf2[0x378]     = { 0 };
+    }
+    DWORD tmpEAX = 0;
+    char buf1[0x48]      = { 0 };
+    char buf2[0x3B0]     = { 0 };
     TextStruct_t imgWxid = { 0 };
     TextStruct_t imgPath = { 0 };
 
@@ -76,19 +77,21 @@ void SendImageMessage(const wchar_t *wxid, const wchar_t *path)
 
     __asm {
         pushad
-        sub esp, 0x14
-        lea eax, buf1
-        mov ecx, esp
-        push eax
-        call sendCall1
-        lea ebx, imgPath
-        push ebx
-        lea eax, imgWxid
-        push eax
-        lea eax, buf2
-        push eax
-        call sendCall2
-        mov ecx, eax
-        call sendCall3
+        call sendCall1
+        sub esp, 0x14
+        mov tmpEAX, eax
+        lea eax, buf1
+        mov ecx, esp
+        lea edi, imgPath
+        push eax
+        call sendCall2
+        mov ecx, dword ptr [tmpEAX]
+        lea eax, imgWxid
+        push edi
+        push eax
+        lea eax, buf2
+        push eax
+        call sendCall3
+        popad
     }
 }