Impl get db names with sql

Spy/Spy.vcxproj

@@ -166,6 +166,7 @@
   <ItemGroup>
     <ClInclude Include="..\Rpc\rpc_h.h" />
     <ClInclude Include="..\SDK\util.h" />
+    <ClInclude Include="exec_sql.h" />
     <ClInclude Include="framework.h" />
     <ClInclude Include="get_contacts.h" />
     <ClInclude Include="load_calls.h" />
@@ -180,6 +181,7 @@
     <ClCompile Include="..\Rpc\rpc_s.c" />
     <ClCompile Include="..\SDK\util.cpp" />
     <ClCompile Include="dllmain.cpp" />
+    <ClCompile Include="exec_sql.cpp" />
     <ClCompile Include="get_contacts.cpp" />
     <ClCompile Include="load_calls.cpp" />
     <ClCompile Include="monitor.cpp" />

Spy/Spy.vcxproj.filters

@@ -48,6 +48,9 @@
     <ClInclude Include="get_contacts.h">
       <Filter>头文件</Filter>
     </ClInclude>
+    <ClInclude Include="exec_sql.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="dllmain.cpp">
@@ -80,6 +83,9 @@
     <ClCompile Include="get_contacts.cpp">
       <Filter>源文件</Filter>
     </ClCompile>
+    <ClCompile Include="exec_sql.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <Midl Include="..\Rpc\rpc.idl">

Spy/exec_sql.cpp

@@ -0,0 +1,33 @@
+#include <map>
+#include <string>
+
+#include "exec_sql.h"
+#include "load_calls.h"
+
+using namespace std;
+
+extern WxCalls_t g_WxCalls;
+extern DWORD g_WeChatWinDllAddr;
+
+typedef map<wstring, DWORD> dbMap_t;
+static dbMap_t dbMap;
+
+vector<wstring> GetDbNames()
+{
+    vector<wstring> vDbs;
+    if (dbMap.empty()) {
+        DWORD sqlHandleBaseAddr  = *(DWORD *)(g_WeChatWinDllAddr + g_WxCalls.sql.base);
+        DWORD sqlHandleBeginAddr = *(DWORD *)(sqlHandleBaseAddr + g_WxCalls.sql.start);
+        DWORD sqlHandleEndAddr   = *(DWORD *)(sqlHandleBaseAddr + g_WxCalls.sql.end);
+        while (sqlHandleBeginAddr < sqlHandleEndAddr) {
+            DWORD dwHandle = *(DWORD *)sqlHandleBeginAddr;
+            dbMap[wstring((wchar_t *)(*(DWORD *)(dwHandle + g_WxCalls.sql.name)))]
+                = *(DWORD *)(dwHandle + g_WxCalls.sql.slot);
+            sqlHandleBeginAddr += 0x04;
+        }
+    }
+    for (auto it = dbMap.begin(); it != dbMap.end(); it++) {
+        vDbs.push_back(it->first);
+    }
+    return vDbs;
+}

Spy/exec_sql.h

@@ -0,0 +1,8 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+#include "rpc_h.h"
+
+std::vector<std::wstring> GetDbNames();

Spy/load_calls.cpp

@@ -1,4 +1,4 @@
-#include <iostream>
+#include <iostream>
 #include <map>
 
 #include "load_calls.h"
@@ -13,7 +13,10 @@ WxCalls_t wxCalls = { 0x23631D0,                           // Login Status
                       { 0xBD780, 0x770120, 0x521640 }, // Send Image Message
                       /* Get Contacts:
                             Base,  head, wxId, Code, Name, Gender, Country, Province, City*/
-                      { 0x23638F4, 0x4C, 0x30, 0x44, 0x8C, 0x184, 0x1D0, 0x1E4, 0x1F8 } };
+                      { 0x23638F4, 0x4C, 0x30, 0x44, 0x8C, 0x184, 0x1D0, 0x1E4, 0x1F8 },
+                      /* Exec Sql:
+                            Exec,     base,   start,   end,   slot, name*/
+                      { 0x141A4D0, 0x2363934, 0x1428, 0x142C, 0x3C, 0x50 } };
 
 int LoadCalls(const wchar_t *version, WxCalls_t *calls)
 {

Spy/rpc_server.cpp

@@ -1,6 +1,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#include "exec_sql.h"
 #include "get_contacts.h"
 #include "monitor.h"
 #include "rpc_h.h"
@@ -8,6 +9,9 @@
 #include "sdk.h"
 #include "send_msg.h"
 #include "spy_types.h"
+#include "util.h"
+
+using namespace std;
 
 extern HANDLE g_hEvent;
 extern MsgQueue_t g_MsgQueue;
@@ -82,7 +86,7 @@ int server_GetMsgTypes(int *pNum, PPRpcIntBstrPair *msgTypes)
 
 int server_GetContacts(int *pNum, PPRpcContact *contacts)
 {
-    std::vector<RpcContact_t> vContacts = GetContacts();
+    vector<RpcContact_t> vContacts = GetContacts();
 
     *pNum           = vContacts.size();
     PPRpcContact pp = (PPRpcContact)midl_user_allocate(*pNum * sizeof(RpcContact_t));
@@ -115,6 +119,26 @@ int server_GetContacts(int *pNum, PPRpcContact *contacts)
     return 0;
 }
 
+int server_GetDbNames(int *pNum, BSTR **dbs)
+{
+    vector<wstring> vDbs = GetDbNames();
+    *pNum                = vDbs.size();
+    BSTR *pp             = (BSTR *)midl_user_allocate(*pNum * sizeof(BSTR));
+    if (pp == NULL) {
+        printf("server_GetMsgTypes midl_user_allocate Failed for pp\n");
+        return -2;
+    }
+
+    int index = 0;
+    for (auto it = vDbs.begin(); it != vDbs.end(); it++) {
+        pp[index++] = GetBstrFromWstring(*it);
+    }
+
+    *dbs = pp;
+
+    return 0;
+}
+
 RPC_STATUS CALLBACK SecurityCallback(RPC_IF_HANDLE /*hInterface*/, void * /*pBindingHandle*/)
 {
     return RPC_S_OK; // Always allow anyone.

Spy/spy_types.h

@@ -1,4 +1,4 @@
-#pragma once
+#pragma once
 
 #include "framework.h"
 #include <queue>
@@ -41,6 +41,15 @@ typedef struct Contact {
     DWORD wxCity;
 } Contact_t;
 
+typedef struct Sql {
+    DWORD exec;
+    DWORD base;
+    DWORD start;
+    DWORD end;
+    DWORD slot;
+    DWORD name;
+} Sql_t;
+
 typedef struct WxCalls {
     DWORD login;       // 登录状态
     UserInfoCall_t ui; // 用户信息
@@ -48,7 +57,8 @@ typedef struct WxCalls {
     RecvMsg_t recvMsg; // 接收消息
     SendImg_t sendImg; // 发送图片
     Contact_t contact; // 获取联系人
-} WxCalls_t;
+    Sql_t sql;         // 执行 SQL
+} WxCalls_t;
 
 typedef struct TextStruct {
     wchar_t *text;