Impl Send Image

App/App.cpp

@@ -1,4 +1,4 @@
-#include <fcntl.h>
+#include <fcntl.h>
 #include <io.h>
 #include <iostream>
 #include <process.h>
@@ -61,11 +61,13 @@ int main()
     WxSetTextMsgCb(onTextMsg);
 
     // 测试消息发送
+    wcout << L"测试消息发送" << endl;
     WxSendTextMsg(wxid, at_wxid, content);
-#if 0
-    // 发送照片
-    WxSendImageMsg(wxid, img_path);
 
+    // 发送照片
+    wcout << L"测试发送照片" << endl;
+    WxSendImageMsg(wxid, img_path);
+#if 0
     Sleep(10000); // 等待10秒
     // 测试联系人获取
     auto mContact = WxGetContacts();

SDK/sdk.cpp

@@ -1,4 +1,4 @@
-#include "Shlwapi.h"
+#include "Shlwapi.h"
 #include "framework.h"
 #include <process.h>
 #include <queue>

SDK/sdk.h

@@ -1,4 +1,4 @@
-#pragma once
+#pragma once
 
 #include <functional>
 #include <map>

SDK/util.cpp

@@ -1,4 +1,4 @@
-#include "Shlwapi.h"
+#include "Shlwapi.h"
 #include "framework.h"
 #include <string.h>
 #include <strsafe.h>

Spy/load_calls.cpp

@@ -11,7 +11,7 @@ WxCalls_t wxCalls = {
     /* Receive Message:
           Hook,   call,   type, self,   id, msgXml, roomId, wxId, content */
     { 0x550F4C, 0xA94A50, 0x38, 0x3C, 0x184, 0x1EC, 0x48, 0x170, 0x70 },
-    { 0x5CCB50, 0x6F5C0, 0x3E3490 } // Send Image Message
+    { 0xBD780, 0x770120, 0x521640 } // Send Image Message
 };
 
 int LoadCalls(const wchar_t* version, WxCalls_t* calls)

Spy/send_msg.cpp

@@ -53,8 +53,9 @@ void SendImageMessage(const wchar_t *wxid, const wchar_t *path)
     if (g_WeChatWinDllAddr == 0) {
         return;
     }
-    char buf1[0x20]      = { 0 };
+    DWORD tmpEAX = 0;
-    char buf2[0x378]     = { 0 };
+    char buf1[0x48]      = { 0 };
+    char buf2[0x3B0]     = { 0 };
     TextStruct_t imgWxid = { 0 };
     TextStruct_t imgPath = { 0 };
 
@@ -76,19 +77,21 @@ void SendImageMessage(const wchar_t *wxid, const wchar_t *path)
 
     __asm {
         pushad
+        call sendCall1
         sub esp, 0x14
+        mov tmpEAX, eax
         lea eax, buf1
         mov ecx, esp
+        lea edi, imgPath
         push eax
-        call sendCall1
+        call sendCall2
-        lea ebx, imgPath
+        mov ecx, dword ptr [tmpEAX]
-        push ebx
         lea eax, imgWxid
+        push edi
         push eax
         lea eax, buf2
         push eax
-        call sendCall2
-        mov ecx, eax
         call sendCall3
+        popad
     }
 }