cyonjan/WeChatFerry
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Impl Receive Message

Browse Source
This commit is contained in:
Changhua 2022-08-06 17:26:32 +08:00
parent 1028150f1f
commit 5f3ba38d87
4 changed files with 24 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
App/App.cpp
View File

@ -56,10 +56,10 @@ int main()
if (status != 0) { if (status != 0) {
return 0; return 0;
} }
#if 0
wcout << L"Message: 接收通知中......" << endl; wcout << L"Message: 接收通知中......" << endl;
WxSetTextMsgCb(onTextMsg); WxSetTextMsgCb(onTextMsg);
#if 0
// 测试消息发送 // 测试消息发送
WxSendTextMsg(wxid, at_wxid, content); WxSendTextMsg(wxid, at_wxid, content);
// 发送照片 // 发送照片

4
Spy/load_calls.cpp
View File

@ -6,11 +6,11 @@
#define SUPPORT_VERSION L"3.7.0.29" #define SUPPORT_VERSION L"3.7.0.29"
WxCalls_t wxCalls = { WxCalls_t wxCalls = {
0x23631D0, // Login Status 0x23631D0, // Login Status
{ 0x1DDF4BC, 0x1DDF534, 0x1DDF568 }, // User Info: wxid, nickname, mobile { 0x236307C, 0x23630F4, 0x2363128 }, // User Info: wxid, nickname, mobile
0x3E3B80, // Send Message 0x3E3B80, // Send Message
/* Receive Message: /* Receive Message:
Hook, call, type, self, id, msgXml, roomId, wxId, content */ Hook, call, type, self, id, msgXml, roomId, wxId, content */
{ 0x3C0D70, 0x3C0FA0, 0x38, 0x3C, 0x184, 0x1D8, 0x48, 0x170, 0x70 }, { 0x550F4C, 0xA94A50, 0x38, 0x3C, 0x184, 0x1EC, 0x48, 0x170, 0x70 },
{ 0x5CCB50, 0x6F5C0, 0x3E3490 } // Send Image Message { 0x5CCB50, 0x6F5C0, 0x3E3490 } // Send Image Message
}; };

4
Spy/monitor.cpp
View File

@ -8,7 +8,6 @@
HANDLE g_hEvent = NULL; HANDLE g_hEvent = NULL;
WxCalls_t g_WxCalls = { 0 }; WxCalls_t g_WxCalls = { 0 };
RpcMessage_t *g_pMsg = NULL; // Find a palce to free
DWORD g_WeChatWinDllAddr = 0; DWORD g_WeChatWinDllAddr = 0;
int InitDLL(void) int InitDLL(void)
@ -31,7 +30,6 @@ int InitDLL(void)
return -3; return -3;
} }
g_pMsg = new RpcMessage_t;
g_hEvent = CreateEvent(NULL, TRUE, FALSE, NULL); g_hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
return 0; return 0;
@ -39,7 +37,7 @@ int InitDLL(void)
DWORD WINAPI Monitor(HMODULE hModule) DWORD WINAPI Monitor(HMODULE hModule)
{ {
//ListenMessage(); ListenMessage();
return TRUE; return TRUE;
} }

37
Spy/receive_msg.cpp
View File

@ -14,39 +14,37 @@ MsgQueue_t g_MsgQueue;
DWORD reg_buffer = 0; DWORD reg_buffer = 0;
DWORD recvMsgCallAddr = 0; DWORD recvMsgCallAddr = 0;
DWORD recvMsgJumpBackAddr = 0; DWORD recvMsgJumpBackAddr = 0;
RpcMessage_t *pMsg = NULL; // Find a palce to free
void DispatchMsg(DWORD reg) void DispatchMsg(DWORD reg)
{ {
DWORD **p = (DWORD **)reg; //消息结构基址 DWORD *p = (DWORD *)reg; //消息结构基址
memset(g_pMsg, 0, sizeof(RpcMessage_t)); memset(pMsg, 0, sizeof(RpcMessage_t));
g_pMsg->type = GET_DWORD(**p + g_WxCalls.recvMsg.type); pMsg->type = GET_DWORD(*p + g_WxCalls.recvMsg.type);
g_pMsg->self = GET_DWORD(**p + g_WxCalls.recvMsg.isSelf); pMsg->self = GET_DWORD(*p + g_WxCalls.recvMsg.isSelf);
GetWstringByAddress(**p + g_WxCalls.recvMsg.msgId, g_pMsg->id, MSG_SIZE_MSG_ID); GetWstringByAddress(*p + g_WxCalls.recvMsg.msgId, pMsg->id, MSG_SIZE_MSG_ID);
GetWstringByAddress(**p + g_WxCalls.recvMsg.msgXml, g_pMsg->xml, MSG_SIZE_MSG_XML); GetWstringByAddress(*p + g_WxCalls.recvMsg.msgXml, pMsg->xml, MSG_SIZE_MSG_XML);
if (wcsstr(g_pMsg->xml, L"<membercount>") == NULL) { if (wcsstr(pMsg->xml, L"<membercount>") == NULL) {
// g_pMsg.roomId = {0}; // pMsg.roomId = {0};
GetWstringByAddress(**p + g_WxCalls.recvMsg.roomId, g_pMsg->wxId, MSG_SIZE_WXID); GetWstringByAddress(*p + g_WxCalls.recvMsg.roomId, pMsg->wxId, MSG_SIZE_WXID);
} else { } else {
g_pMsg->source = 1; pMsg->source = 1;
GetWstringByAddress(**p + g_WxCalls.recvMsg.roomId, g_pMsg->roomId, MSG_SIZE_ROOMID); GetWstringByAddress(*p + g_WxCalls.recvMsg.roomId, pMsg->roomId, MSG_SIZE_ROOMID);
GetWstringByAddress(**p + g_WxCalls.recvMsg.wxId, g_pMsg->wxId, MSG_SIZE_WXID); GetWstringByAddress(*p + g_WxCalls.recvMsg.wxId, pMsg->wxId, MSG_SIZE_WXID);
} }
GetWstringByAddress(**p + g_WxCalls.recvMsg.content, g_pMsg->content, MSG_SIZE_CONTENT); GetWstringByAddress(*p + g_WxCalls.recvMsg.content, pMsg->content, MSG_SIZE_CONTENT);
g_MsgQueue.push(*g_pMsg); // 发送消息 g_MsgQueue.push(*pMsg); // 发送消息
SetEvent(g_hEvent); // 发送消息通知 SetEvent(g_hEvent); // 发送消息通知
} }
__declspec(naked) void RecieveMsgHook() __declspec(naked) void RecieveMsgHook()
{ {
__asm { __asm {
push ebp // 保护现场 mov reg_buffer, edi //把值复制出来
add ebp, 0x3C // 地址为 ebp + 0x3C
mov reg_buffer, ebp //把值复制出来
pop ebp // 还原现场
} }
DispatchMsg(reg_buffer); DispatchMsg(reg_buffer);
@ -65,6 +63,7 @@ void ListenMessage()
return; return;
} }
pMsg = new RpcMessage_t;
DWORD hookAddress = g_WeChatWinDllAddr + g_WxCalls.recvMsg.hook; DWORD hookAddress = g_WeChatWinDllAddr + g_WxCalls.recvMsg.hook;
recvMsgCallAddr = g_WeChatWinDllAddr + g_WxCalls.recvMsg.call; recvMsgCallAddr = g_WeChatWinDllAddr + g_WxCalls.recvMsg.call;
recvMsgJumpBackAddr = hookAddress + 5; recvMsgJumpBackAddr = hookAddress + 5;