Initial commit

2021-02-12 23:21:57 +08:00
commit 16754c3279
45 changed files with 2896 additions and 0 deletions
@@ -0,0 +1,200 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{4a0a22f7-0b1c-4565-a443-c43fac6c6396}</ProjectGuid>
+    <RootNamespace>Spy</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;SPY_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>NotUsing</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+      <AdditionalIncludeDirectories>$(SolutionDir)Rpc;$(SolutionDir)SDK;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalOptions> /utf-8 %(AdditionalOptions)</AdditionalOptions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+    <Midl>
+      <AdditionalOptions>/app_config /prefix client "client_" server "server_" </AdditionalOptions>
+      <AdditionalIncludeDirectories>$(SolutionDir)Rpc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </Midl>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;SPY_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>NotUsing</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+      <AdditionalIncludeDirectories>$(SolutionDir)Rpc;$(SolutionDir)SDK;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalOptions> /utf-8 %(AdditionalOptions)</AdditionalOptions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+    <Midl>
+      <AdditionalOptions>/prefix client "client_" server "server_" </AdditionalOptions>
+      <AdditionalIncludeDirectories>$(SolutionDir)Rpc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </Midl>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;SPY_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;SPY_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClInclude Include="..\Rpc\rpc_types.h" />
+    <ClInclude Include="..\Rpc\rpc_h.h" />
+    <ClInclude Include="..\SDK\util.h" />
+    <ClInclude Include="framework.h" />
+    <ClInclude Include="load_calls.h" />
+    <ClInclude Include="monitor.h" />
+    <ClInclude Include="receive_msg.h" />
+    <ClInclude Include="rpc_server.h" />
+    <ClInclude Include="send_msg.h" />
+    <ClInclude Include="spy_types.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="..\Rpc\rpc_memory.cpp" />
+    <ClCompile Include="..\Rpc\rpc_s.c" />
+    <ClCompile Include="..\SDK\util.cpp" />
+    <ClCompile Include="dllmain.cpp" />
+    <ClCompile Include="load_calls.cpp" />
+    <ClCompile Include="monitor.cpp" />
+    <ClCompile Include="receive_msg.cpp" />
+    <ClCompile Include="rpc_server.cpp" />
+    <ClCompile Include="send_msg.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <Midl Include="..\Rpc\rpc.idl">
+      <OutputDirectory Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">$(SolutionDir)Rpc</OutputDirectory>
+      <AdditionalOptions Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">/app_config /ms_ext /prefix client "client_" server "server_" </AdditionalOptions>
+      <AdditionalIncludeDirectories Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">$(SolutionDir)Rpc;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <OutputDirectory Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">$(SolutionDir)Rpc</OutputDirectory>
+      <AdditionalOptions Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">/app_config /ms_ext /prefix client "client_" server "server_" %(AdditionalOptions)</AdditionalOptions>
+    </Midl>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="源文件">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="头文件">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="资源文件">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+    <Filter Include="Rpc">
+      <UniqueIdentifier>{37eb8a5c-e792-4c10-a858-9abc84f79f80}</UniqueIdentifier>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="framework.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="..\Rpc\rpc_h.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="monitor.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="..\Rpc\rpc_types.h">
+      <Filter>Rpc</Filter>
+    </ClInclude>
+    <ClInclude Include="rpc_server.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="load_calls.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="..\SDK\util.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="receive_msg.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="send_msg.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="spy_types.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="..\Rpc\rpc_s.c">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="..\Rpc\rpc_memory.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="monitor.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="rpc_server.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="load_calls.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="..\SDK\util.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="receive_msg.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="send_msg.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <Midl Include="..\Rpc\rpc.idl">
+      <Filter>Rpc</Filter>
+    </Midl>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>
@@ -0,0 +1,37 @@
+#include <stdlib.h>
+
+#include "monitor.h"
+#include "rpc_server.h"
+
+extern HANDLE g_hEvent;
+
+BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
+{
+    switch (ul_reason_for_call) {
+        case DLL_PROCESS_ATTACH: {
+            // MessageBox(NULL, L"RpcStartServer", L"Hey", 0);
+            if (InitDLL() != 0) {
+                // Exit
+                FreeLibraryAndExitThread(hModule, 0);
+            }
+            HANDLE rpcThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)RpcStartServer, hModule, NULL, 0);
+            if (rpcThread != 0) {
+                CloseHandle(rpcThread);
+            }
+            g_hEvent       = CreateEvent(NULL, TRUE, FALSE, NULL); // 创建消息句柄
+            HANDLE mThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Monitor, hModule, NULL, 0);
+            if (mThread != 0) {
+                CloseHandle(mThread);
+            }
+            break;
+        }
+        case DLL_THREAD_ATTACH:
+        case DLL_THREAD_DETACH:
+            break;
+        case DLL_PROCESS_DETACH: {
+            RpcStopServer();
+            break;
+        }
+    }
+    return TRUE;
+}
@@ -0,0 +1,5 @@
+#pragma once
+
+#define WIN32_LEAN_AND_MEAN // 从 Windows 头文件中排除极少使用的内容
+// Windows 头文件
+#include <windows.h>
@@ -0,0 +1,26 @@
+#include <iostream>
+#include <map>
+
+#include "load_calls.h"
+
+std::map<std::wstring, WxCalls_t> wxCalls {
+    { L"3.0.0.57",
+      { 0x1874F38,                           // Login Status
+        { 0x1856BF0, 0x1856A8C, 0x1856AC0 }, // User Info: wxid, nickname, mobile
+        0x38D8A0,                            // Send Message
+        // Receive Message:
+        // Hook,      call,   type, self,  id, msgXml, roomId, wxId, content
+        { 0x36A350, 0x36A5A0, 0x30, 0x34, 0x164, 0x1A4, 0x40, 0x150, 0x68 } } }
+};
+
+int LoadCalls(const wchar_t *version, WxCalls_t *calls)
+{
+    auto iter = wxCalls.find(version);
+    if (iter == wxCalls.end()) {
+        return -1;
+    }
+
+    memcpy_s(calls, sizeof(WxCalls_t), &(iter->second), sizeof(WxCalls_t));
+
+    return 0;
+}
@@ -0,0 +1,5 @@
+#pragma once
+
+#include "spy_types.h"
+
+int LoadCalls(const wchar_t *version, WxCalls_t *calls);
@@ -0,0 +1,54 @@
+#include <atlstr.h>
+#include <stdio.h>
+
+#include "load_calls.h"
+#include "monitor.h"
+#include "receive_msg.h"
+#include "util.h"
+
+HANDLE g_hEvent          = NULL;
+WxCalls_t g_WxCalls      = { 0 };
+RpcMessage_t *g_pMsg     = NULL; // Find a palce to free
+DWORD g_WeChatWinDllAddr = 0;
+
+int InitDLL(void)
+{
+    wchar_t version[16] = { 0 };
+
+    g_WeChatWinDllAddr = (DWORD)LoadLibrary(L"WeChatWin.dll"); //获取wechatWin模块地址
+    if (g_WeChatWinDllAddr == 0) {
+        MessageBox(NULL, L"获取wechatWin.dll模块地址", L"错误", 0);
+        return -1;
+    }
+
+    if (!GetWeChatVersion(version)) { //获取微信版本
+        MessageBox(NULL, L"获取微信版本失败", L"错误", 0);
+        return -2;
+    }
+
+    if (LoadCalls(version, &g_WxCalls) != 0) { //加载微信版本对应的Call地址
+        MessageBox(NULL, L"不支持当前版本", L"错误", 0);
+        return -3;
+    }
+
+    g_pMsg   = new RpcMessage_t;
+    g_hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
+
+    return 0;
+}
+
+DWORD WINAPI Monitor(HMODULE hModule)
+{
+    ListenMessage();
+
+    return TRUE;
+}
+
+int IsLogin(void)
+{
+    if (g_WeChatWinDllAddr == 0) {
+        return 0;
+    }
+
+    return (int)GET_DWORD(g_WeChatWinDllAddr + g_WxCalls.login);
+}
@@ -0,0 +1,7 @@
+#pragma once
+
+#include "framework.h"
+
+int InitDLL(void);
+DWORD WINAPI Monitor(HMODULE hModule);
+int IsLogin();
@@ -0,0 +1,79 @@
+#include "framework.h"
+
+#include "load_calls.h"
+#include "receive_msg.h"
+#include "spy_types.h"
+#include "util.h"
+
+extern HANDLE g_hEvent;
+extern RpcMessage_t *g_pMsg;
+extern WxCalls_t g_WxCalls;
+extern DWORD g_WeChatWinDllAddr;
+
+MsgQueue_t g_MsgQueue;
+DWORD reg_buffer          = 0;
+DWORD recvMsgCallAddr     = 0;
+DWORD recvMsgJumpBackAddr = 0;
+
+void DispatchMsg(DWORD reg)
+{
+    DWORD **p = (DWORD **)reg; //消息结构基址
+
+    memset(g_pMsg, 0, sizeof(RpcMessage_t));
+
+    g_pMsg->type = GET_DWORD(**p + g_WxCalls.recvMsg.type);
+    g_pMsg->self = GET_DWORD(**p + g_WxCalls.recvMsg.isSelf);
+
+    GetWstringByAddress(**p + g_WxCalls.recvMsg.msgId, g_pMsg->id, MSG_SIZE_MSG_ID);
+    GetWstringByAddress(**p + g_WxCalls.recvMsg.msgXml, g_pMsg->xml, MSG_SIZE_MSG_XML);
+
+    if (wcsstr(g_pMsg->xml, L"<membercount>") == NULL) {
+        // g_pMsg.roomId = {0};
+        GetWstringByAddress(**p + g_WxCalls.recvMsg.roomId, g_pMsg->wxId, MSG_SIZE_WXID);
+    } else {
+        g_pMsg->source = 1;
+        GetWstringByAddress(**p + g_WxCalls.recvMsg.roomId, g_pMsg->roomId, MSG_SIZE_ROOMID);
+        GetWstringByAddress(**p + g_WxCalls.recvMsg.wxId, g_pMsg->wxId, MSG_SIZE_WXID);
+    }
+    GetWstringByAddress(**p + g_WxCalls.recvMsg.content, g_pMsg->content, MSG_SIZE_CONTENT);
+    g_MsgQueue.push(*g_pMsg); // 发送消息
+    SetEvent(g_hEvent);       // 发送消息通知
+}
+
+__declspec(naked) void RecieveMsgHook()
+{
+    __asm {
+        push ebp            // 保护现场
+        add ebp, 0x3C       // 地址为 ebp + 0x3C
+        mov reg_buffer, ebp //把值复制出来
+        pop ebp             // 还原现场
+    }
+
+    DispatchMsg(reg_buffer);
+
+    __asm
+    {
+        call recvMsgCallAddr    // 这个为被覆盖的call
+        jmp recvMsgJumpBackAddr // 跳回被HOOK指令的下一条指令
+    }
+}
+
+void ListenMessage()
+{
+    // MessageBox(NULL, L"ListenMessage", L"ListenMessage", 0);
+    if (g_WeChatWinDllAddr == 0) {
+        return;
+    }
+
+    DWORD hookAddress   = g_WeChatWinDllAddr + g_WxCalls.recvMsg.hook;
+    recvMsgCallAddr     = g_WeChatWinDllAddr + g_WxCalls.recvMsg.call;
+    recvMsgJumpBackAddr = hookAddress + 5;
+
+    BYTE jmpCode[5] = { 0 };
+    jmpCode[0]      = 0xE9;
+
+    *(DWORD *)&jmpCode[1] = (DWORD)RecieveMsgHook - hookAddress - 5;
+
+    // 6FB6A350 E8 4B020000 call WeChatWi .6FB6A5A0;
+    WriteProcessMemory(GetCurrentProcess(), (LPVOID)hookAddress, jmpCode, 5, 0);
+}
@@ -0,0 +1,3 @@
+#pragma once
+
+void ListenMessage();
@@ -0,0 +1,94 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "monitor.h"
+#include "rpc_server.h"
+#include "send_msg.h"
+#include "spy_types.h"
+
+#include "../Rpc/rpc_h.h"
+#pragma comment(lib, "Rpcrt4.lib")
+
+extern HANDLE g_hEvent;
+extern MsgQueue_t g_MsgQueue;
+
+int server_IsLogin() { return IsLogin(); }
+
+void server_EnableReceiveMsg()
+{
+    unsigned long ulCode = 0;
+
+    RpcTryExcept
+    {
+        // 调用客户端的回调函数
+        while (true) {
+            // 中断式，兼顾及时性和CPU使用率
+            WaitForSingleObject(g_hEvent, INFINITE); // 等待消息
+            while (!g_MsgQueue.empty()) {
+                client_ReceiveMsg((RpcMessage_t *)&g_MsgQueue.front()); // 调用接收消息回调
+                g_MsgQueue.pop();
+            }
+            ResetEvent(g_hEvent);
+        }
+    }
+    RpcExcept(1)
+    {
+        ulCode = RpcExceptionCode();
+        printf("Runtime reported exception 0x%lx = %ld\n", ulCode, ulCode);
+    }
+    RpcEndExcept
+}
+
+int server_SendTextMsg(const wchar_t *wxid, const wchar_t *at_wxid, const wchar_t *msg)
+{
+    SendTextMessage(wxid, at_wxid, msg);
+
+    return 0;
+}
+
+RPC_STATUS CALLBACK SecurityCallback(RPC_IF_HANDLE /*hInterface*/, void * /*pBindingHandle*/)
+{
+    return RPC_S_OK; // Always allow anyone.
+}
+
+int RpcStartServer(HMODULE hModule)
+{
+    RPC_STATUS status;
+    // Uses the protocol combined with the endpoint for receiving
+    // remote procedure calls.
+    status = RpcServerUseProtseqEp(reinterpret_cast<RPC_WSTR>((RPC_WSTR)L"ncalrpc"), // Use TCP/IP protocol
+                                   RPC_C_LISTEN_MAX_CALLS_DEFAULT,                   // Backlog queue length for TCP/IP.
+                                   reinterpret_cast<RPC_WSTR>((RPC_WSTR)L"tmp_endpoint"), // TCP/IP port to use
+                                   NULL                                                   // No security
+    );
+
+    if (status)
+        return status;
+
+    // Registers the interface and auto listen
+    // Equal to RpcServerRegisterIf + RpcServerListen
+    status = RpcServerRegisterIf2(server_ISpy_v1_0_s_ifspec, // Interface to register.
+                                  NULL,                      // Use the MIDL generated entry-point vector.
+                                  NULL,                      // Use the MIDL generated entry-point vector.
+                                  RPC_IF_ALLOW_LOCAL_ONLY | RPC_IF_AUTOLISTEN, // Forces use of security callback.
+                                  RPC_C_LISTEN_MAX_CALLS_DEFAULT, // Use default number of concurrent calls.
+                                  (unsigned)-1,                   // Infinite max size of incoming data blocks.
+                                  SecurityCallback);              // Naive security callback.
+
+    while (1) {
+        Sleep(10000); // 休眠，释放CPU
+    }
+
+    return 0;
+}
+
+int RpcStopServer(void)
+{
+    RPC_STATUS status;
+    status = RpcMgmtStopServerListening(NULL);
+    if (status)
+        return status;
+
+    status = RpcServerUnregisterIf(NULL, NULL, FALSE);
+    return status;
+}
@@ -0,0 +1,5 @@
+#pragma once
+#include "framework.h"
+
+int RpcStartServer(HMODULE hModule);
+int RpcStopServer(void);
@@ -0,0 +1,49 @@
+#include "framework.h"
+#include <string>
+
+#include "spy_types.h"
+
+extern HANDLE g_hEvent;
+extern WxCalls_t g_WxCalls;
+extern RpcMessage_t *g_pMsg;
+extern DWORD g_WeChatWinDllAddr;
+
+using namespace std;
+
+void SendTextMessage(const wchar_t *wxid, const wchar_t *at_wxid, const wchar_t *msg)
+{
+    if (g_WeChatWinDllAddr == 0) {
+        return;
+    }
+    char buffer[0x5F0]     = { 0 };
+    TextStruct_t txtWxid   = { 0 };
+    TextStruct_t txtAtWxid = { 0 };
+    TextStruct_t txtMsg    = { 0 };
+
+    wstring wsWxid   = wxid;
+    wstring wsAtWxid = at_wxid;
+    wstring wsMsg    = msg;
+
+    // 发送消息Call地址 = 微信基址 + 偏移
+    DWORD sendCallAddress = g_WeChatWinDllAddr + g_WxCalls.sendTextMsg;
+
+    txtWxid.text     = (wchar_t *)wsWxid.c_str();
+    txtWxid.size     = wsWxid.size();
+    txtWxid.capacity = wsWxid.capacity();
+
+    txtMsg.text     = (wchar_t *)wsMsg.c_str();
+    txtMsg.size     = wsMsg.size();
+    txtMsg.capacity = wsMsg.capacity();
+
+    __asm {
+        lea edx, txtWxid
+        lea edi, txtAtWxid
+        lea ebx, txtMsg
+        push 0x01
+        push edi
+        push ebx
+        lea ecx, buffer;
+        call sendCallAddress
+            add esp, 0xC
+    }
+}
@@ -0,0 +1,3 @@
+#pragma once
+
+void SendTextMessage(const wchar_t *wxid, const wchar_t *at_wxid, const wchar_t *msg);
@@ -0,0 +1,46 @@
+#pragma once
+
+#include "framework.h"
+#include <queue>
+
+#include "rpc_types.h"
+
+typedef struct UserInfoCall {
+    DWORD wxid;
+    DWORD nickName;
+    DWORD mobile;
+} UserInfoCall_t;
+
+typedef struct RecvMsg {
+    DWORD hook;    // Hook地址
+    DWORD call;    // Call地址
+    DWORD type;    // 消息类型地址
+    DWORD isSelf;  // 是否自己发送标志地址
+    DWORD msgId;   // 消息ID地址
+    DWORD msgXml;  // 消息xml内容地址
+    DWORD roomId;  // 群聊时，为群ID；私聊时，为微信ID
+    DWORD wxId;    // 私聊时，为空；群群时，为发送者微信ID
+    DWORD content; // 消息内容地址
+} RecvMsg_t;
+
+typedef struct SendImg {
+    DWORD call1;
+    DWORD call2;
+    DWORD call3;
+} SendImg_t;
+
+typedef struct WxCalls {
+    DWORD login;       // 登录状态
+    UserInfoCall_t ui; // 用户信息
+    DWORD sendTextMsg; // 发送消息
+    RecvMsg_t recvMsg; // 接收消息
+} WxCalls_t;
+
+typedef struct TextStruct {
+    wchar_t *text;
+    DWORD size;
+    DWORD capacity;
+    char fill[8];
+} TextStruct_t;
+
+typedef std::queue<RpcMessage_t> MsgQueue_t;