Impl SendImageMsg

Spy/load_calls.cpp

@@ -4,14 +4,17 @@
 #include "load_calls.h"
 
 #define SUPPORT_VERSION L"3.3.0.115"
-WxCalls_t wxCalls = { 0x1DDF60C,                           // Login Status
-                      { 0x1DDF4BC, 0x1DDF534, 0x1DDF568 }, // User Info: wxid, nickname, mobile
-                      0x3E3B80,                            // Send Message
-                      /* Receive Message:
-                            Hook,   call,   type, self,   id, msgXml, roomId, wxId, content */
-                      { 0x3C0D70, 0x3C0FA0, 0x38, 0x3C, 0x184, 0x1D8, 0x48, 0x170, 0x70 } };
+WxCalls_t wxCalls = {
+    0x1DDF60C,                           // Login Status
+    { 0x1DDF4BC, 0x1DDF534, 0x1DDF568 }, // User Info: wxid, nickname, mobile
+    0x3E3B80,                            // Send Message
+    /* Receive Message:
+          Hook,   call,   type, self,   id, msgXml, roomId, wxId, content */
+    { 0x3C0D70, 0x3C0FA0, 0x38, 0x3C, 0x184, 0x1D8, 0x48, 0x170, 0x70 },
+    { 0x5CCB50, 0x6F5C0, 0x3E3490 } // Send Image Message
+};
 
-int LoadCalls(const wchar_t *version, WxCalls_t *calls)
+int LoadCalls(const wchar_t* version, WxCalls_t* calls)
 {
     if (wcscmp(version, SUPPORT_VERSION) != 0) {
         return -1;

Spy/rpc_server.cpp

@@ -46,6 +46,13 @@ int server_SendTextMsg(const wchar_t *wxid, const wchar_t *at_wxid, const wchar_
     return 0;
 }
 
+int server_SendImageMsg(const wchar_t *wxid, const wchar_t *path)
+{
+    SendImageMessage(wxid, path);
+
+    return 0;
+}
+
 RPC_STATUS CALLBACK SecurityCallback(RPC_IF_HANDLE /*hInterface*/, void * /*pBindingHandle*/)
 {
     return RPC_S_OK; // Always allow anyone.

Spy/send_msg.cpp

@@ -47,3 +47,48 @@ void SendTextMessage(const wchar_t *wxid, const wchar_t *at_wxid, const wchar_t
             add esp, 0xC
     }
 }
+
+void SendImageMessage(const wchar_t *wxid, const wchar_t *path)
+{
+    if (g_WeChatWinDllAddr == 0) {
+        return;
+    }
+    char buf1[0x20]      = { 0 };
+    char buf2[0x378]     = { 0 };
+    TextStruct_t imgWxid = { 0 };
+    TextStruct_t imgPath = { 0 };
+
+    wstring wsWxid = wxid;
+    wstring wsPath = path;
+
+    imgWxid.text     = (wchar_t *)wsWxid.c_str();
+    imgWxid.size     = wsWxid.size();
+    imgWxid.capacity = wsWxid.capacity();
+
+    imgPath.text     = (wchar_t *)wsPath.c_str();
+    imgPath.size     = wsPath.size();
+    imgPath.capacity = wsPath.capacity();
+
+    // 发送图片Call地址 = 微信基址 + 偏移
+    DWORD sendCall1 = g_WeChatWinDllAddr + g_WxCalls.sendImg.call1;
+    DWORD sendCall2 = g_WeChatWinDllAddr + g_WxCalls.sendImg.call2;
+    DWORD sendCall3 = g_WeChatWinDllAddr + g_WxCalls.sendImg.call3;
+
+    __asm {
+        pushad
+        sub esp, 0x14
+        lea eax, buf1
+        mov ecx, esp
+        push eax
+        call sendCall1
+        lea ebx, imgPath
+        push ebx
+        lea eax, imgWxid
+        push eax
+        lea eax, buf2
+        push eax
+        call sendCall2
+        mov ecx, eax
+        call sendCall3
+    }
+}

Spy/send_msg.h

@@ -1,3 +1,4 @@
 #pragma once
 
-void SendTextMessage(const wchar_t *wxid, const wchar_t *at_wxid, const wchar_t *msg);
+void SendTextMessage(const wchar_t *wxid, const wchar_t *at_wxid, const wchar_t *msg);
+void SendImageMessage(const wchar_t *wxid, const wchar_t *path);

Spy/spy_types.h

@@ -34,7 +34,8 @@ typedef struct WxCalls {
     UserInfoCall_t ui; // 用户信息
     DWORD sendTextMsg; // 发送消息
     RecvMsg_t recvMsg; // 接收消息
-} WxCalls_t;
+    SendImg_t sendImg; // 发送图片
+} WxCalls_t;
 
 typedef struct TextStruct {
     wchar_t *text;