diff --git a/launcher/Launcher.h b/launcher/Launcher.h
index e697682..ca20b17 100644
--- a/launcher/Launcher.h
+++ b/launcher/Launcher.h
@@ -107,7 +107,8 @@ namespace launcher {
     private: System::Void Start_Click(System::Object^ sender, System::EventArgs^ e) {
         this->Start->Enabled = false;
         this->Stop->Enabled = true;
-        WxInitSDK(true, "tcp://0.0.0.0:10086");
+        int port = 10086;
+        WxInitSDK(true, port);
     }
     private: System::Void Stop_Click(System::Object^ sender, System::EventArgs^ e) {
         this->Stop->Enabled = false;
diff --git a/sdk/sdk.cpp b/sdk/sdk.cpp
index 9a96747..3073711 100644
--- a/sdk/sdk.cpp
+++ b/sdk/sdk.cpp
@@ -34,12 +34,8 @@ static int GetDllPath(bool debug, wchar_t *dllPath)
     return 0;
 }
 
-int WxInitSDK(bool debug, const char *url)
+int WxInitSDK(bool debug, int port)
 {
-    if (url == NULL) {
-        return -1;
-    }
-
     int status  = 0;
     DWORD wcPid = 0;
 
@@ -60,15 +56,8 @@ int WxInitSDK(bool debug, const char *url)
         LOG_ERROR("Failed to Inject DLL into WeChat.");
         return -1;
     }
-    size_t urlLen  = strlen(url) + 1;
-    LPVOID urlAddr = VirtualAllocEx(wcProcess, NULL, urlLen, MEM_COMMIT, PAGE_READWRITE);
-    if (urlAddr == NULL) {
-        LOG_ERROR("Failed to Alloc Memory.");
-        return NULL;
-    }
-    WriteProcessMemory(wcProcess, urlAddr, url, urlLen, NULL);
 
-    if (!CallDllFunc(wcProcess, spyDllPath, spyBase, "InitSpy", urlAddr, NULL)) {
+    if (!CallDllFunc(wcProcess, spyDllPath, spyBase, "InitSpy", (LPVOID)port, NULL)) {
         LOG_ERROR("Failed to InitSpy.");
         return -1;
     }
diff --git a/sdk/sdk.h b/sdk/sdk.h
index 640914e..68f4ccf 100644
--- a/sdk/sdk.h
+++ b/sdk/sdk.h
@@ -1,4 +1,4 @@
 #pragma once
 
-int WxInitSDK(bool debug, const char *url);
+int WxInitSDK(bool debug, int port);
 int WxDestroySDK();
diff --git a/spy/rpc_server.cpp b/spy/rpc_server.cpp
index 22b5c09..623c152 100644
--- a/spy/rpc_server.cpp
+++ b/spy/rpc_server.cpp
@@ -31,9 +31,9 @@
 #include "user_info.h"
 #include "util.h"
 
+#define URL_SIZE   20
+#define BASE_URL   "tcp://0.0.0.0"
 #define G_BUF_SIZE (16 * 1024 * 1024)
-#define CMD_URL    "tcp://0.0.0.0:10086"
-#define MSG_URL    "tcp://0.0.0.0:10087"
 
 extern int IsLogin(void); // Defined in spy.cpp
 
@@ -42,6 +42,7 @@ mutex gMutex;
 condition_variable gCV;
 queue<WxMsg_t> gMsgQueue;
 
+static int lport       = 0;
 static DWORD lThreadId = 0;
 static bool lIsRunning = false;
 static nng_socket sock;
@@ -297,7 +298,9 @@ static void PushMessage()
 
     pb_ostream_t stream = pb_ostream_from_buffer(buffer, G_BUF_SIZE);
 
-    char *url = (char *)MSG_URL;
+    char url[URL_SIZE + 1] = { 0 };
+    sprintf_s(url, URL_SIZE, "%s:%d", BASE_URL, lport + 1);
+    LOG_ERROR("URL: {}", url);
     if ((rv = nng_pair1_open(&msg_sock)) != 0) {
         LOG_ERROR("nng_pair0_open error {}", nng_strerror(rv));
         return;
@@ -560,9 +563,11 @@ static bool dispatcher(uint8_t *in, size_t in_len, uint8_t *out, size_t *out_len
     return ret;
 }
 
-static int RunServer(LPVOID url)
+static int RunServer()
 {
-    int rv = 0;
+    int rv                 = 0;
+    char url[URL_SIZE + 1] = { 0 };
+    sprintf_s(url, URL_SIZE, "%s:%d", BASE_URL, lport);
     if ((rv = nng_pair1_open(&sock)) != 0) {
         LOG_ERROR("nng_pair0_open error {}", nng_strerror(rv));
         return rv;
@@ -612,13 +617,15 @@ static int RunServer(LPVOID url)
     return rv;
 }
 
-int RpcStartServer(const char *url)
+int RpcStartServer(int port)
 {
     if (lIsRunning) {
         return 0;
     }
 
-    HANDLE rpcThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)RunServer, (LPVOID)url, NULL, &lThreadId);
+    lport = port;
+
+    HANDLE rpcThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)RunServer, NULL, NULL, &lThreadId);
     if (rpcThread != 0) {
         CloseHandle(rpcThread);
     }
diff --git a/spy/rpc_server.h b/spy/rpc_server.h
index 028c8de..7722d33 100644
--- a/spy/rpc_server.h
+++ b/spy/rpc_server.h
@@ -6,5 +6,5 @@
 #define SPY_API __declspec(dllimport)
 #endif
 
-int RpcStartServer(const char *url);
+int RpcStartServer(int port);
 int RpcStopServer();
diff --git a/spy/spy.cpp b/spy/spy.cpp
index f1571c9..5f7d33e 100644
--- a/spy/spy.cpp
+++ b/spy/spy.cpp
@@ -7,7 +7,7 @@
 WxCalls_t g_WxCalls      = { 0 };
 DWORD g_WeChatWinDllAddr = 0;
 
-void InitSpy(const char *url)
+void InitSpy(int port)
 {
     wchar_t version[16] = { 0 };
     InitLogger();
@@ -28,13 +28,9 @@ void InitSpy(const char *url)
         return;
     }
 
-    RpcStartServer(url);
+    RpcStartServer(port);
 }
 
-void CleanupSpy()
-{
-    RpcStopServer();
-    // FreeLibraryAndExitThread(hModule, 0);
-}
+void CleanupSpy() { RpcStopServer(); }
 
 int IsLogin(void) { return (int)GET_DWORD(g_WeChatWinDllAddr + g_WxCalls.login); }
diff --git a/spy/spy.h b/spy/spy.h
index 690b024..3aa41dd 100644
--- a/spy/spy.h
+++ b/spy/spy.h
@@ -2,6 +2,5 @@
 
 #include "framework.h"
 
-void InitSpy();
+void InitSpy(int port);
 void CleanupSpy();
-int IsLogin(void);
diff --git a/wcf/main.cpp b/wcf/main.cpp
index 2c9df45..98ff667 100644
--- a/wcf/main.cpp
+++ b/wcf/main.cpp
@@ -1,4 +1,5 @@
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
 
 #include "framework.h"
@@ -6,7 +7,10 @@
 #include "log.h"
 #include "sdk.h"
 
-void help() { LOG_INFO("Usage: \n启动: wcf.exe start url [debug]\n关闭: wcf.exe stop"); }
+void help()
+{
+    LOG_INFO("\nUsage: \n启动: wcf.exe start port [debug]\n关闭: wcf.exe stop\nport: 命令端口, 消息端口为命令端口+1\n");
+}
 
 int main(int argc, char *argv[])
 {
@@ -16,11 +20,13 @@ int main(int argc, char *argv[])
     if ((argc < 2) || (argc > 4)) {
         help();
     } else if (argc == 4) {
-        debug = (strcmp(argv[2], "debug") == 0);
+        debug = (strcmp(argv[3], "debug") == 0);
     }
 
     if (strcmp(argv[1], "start") == 0) {
-        ret = WxInitSDK(debug, argv[2]);
+        int port = strtol(argv[2], NULL, 10);
+
+        ret = WxInitSDK(debug, port);
     } else if (strcmp(argv[1], "stop") == 0) {
         ret = WxDestroySDK();
     } else {