cyonjan/WeChatFerry
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Impl Functions_FUNC_SEND_TXT

Browse Source
This commit is contained in:
Changhua 2023-06-02 17:35:52 +08:00
parent 4ef478a5bb
commit b7c71152e1
4 changed files with 29 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
spy/load_calls.cpp
View File

@ -7,7 +7,7 @@
WxCalls_t wxCalls = { WxCalls_t wxCalls = {
0x2FFD638, // Login Status 0x2FFD638, // Login Status
{ 0x2FFD4E8, 0x23660F4, 0x2366128, 0x2386F7C }, // User Info: wxid, nickname, mobile, home { 0x2FFD4E8, 0x23660F4, 0x2366128, 0x2386F7C }, // User Info: wxid, nickname, mobile, home
0x521D30, // Send Message { 0x768140, 0xCE6C80, 0x756960 }, // Send Message
/* Receive Message: /* Receive Message:
Hook, call, type, self, id, msgXml, roomId, wxId, content, thumb, extra */ Hook, call, type, self, id, msgXml, roomId, wxId, content, thumb, extra */
{ 0x550F4C, 0xA96350, 0x38, 0x3C, 0x184, 0x1EC, 0x48, 0x170, 0x70, 0x198, 0x1AC }, { 0x550F4C, 0xA96350, 0x38, 0x3C, 0x184, 0x1EC, 0x48, 0x170, 0x70, 0x198, 0x1AC },

2
spy/rpc_server.cpp
View File

@ -579,12 +579,12 @@ static bool dispatcher(uint8_t *in, size_t in_len, uint8_t *out, size_t *out_len
ret = func_get_user_info(out, out_len); ret = func_get_user_info(out, out_len);
break; break;
} }
#if 0
case Functions_FUNC_SEND_TXT: { case Functions_FUNC_SEND_TXT: {
LOG_DEBUG("[Functions_FUNC_SEND_TXT]"); LOG_DEBUG("[Functions_FUNC_SEND_TXT]");
ret = func_send_txt(req.msg.txt, out, out_len); ret = func_send_txt(req.msg.txt, out, out_len);
break; break;
} }
#if 0
case Functions_FUNC_SEND_IMG: { case Functions_FUNC_SEND_IMG: {
LOG_DEBUG("[Functions_FUNC_SEND_IMG]"); LOG_DEBUG("[Functions_FUNC_SEND_IMG]");
ret = func_send_img(req.msg.file.path, req.msg.file.receiver, out, out_len); ret = func_send_img(req.msg.file.path, req.msg.file.receiver, out, out_len);

26
spy/send_msg.cpp
View File

@ -13,12 +13,15 @@ extern string GetSelfWxid(); // Defined in spy.cpp
void SendTextMessage(string wxid, string msg, string atWxids) void SendTextMessage(string wxid, string msg, string atWxids)
{ {
char buffer[0x3B0] = { 0 }; int success = 0;
char buffer[0x2D8] = { 0 };
WxString_t wxMsg = { 0 }; WxString_t wxMsg = { 0 };
WxString_t wxWxid = { 0 }; WxString_t wxWxid = { 0 };
// 发送消息Call地址 = 微信基址 + 偏移 // 发送消息Call地址 = 微信基址 + 偏移
DWORD sendCallAddress = g_WeChatWinDllAddr + g_WxCalls.sendTextMsg; DWORD sendCall1 = g_WeChatWinDllAddr + g_WxCalls.sendText.call1;
DWORD sendCall2 = g_WeChatWinDllAddr + g_WxCalls.sendText.call2;
DWORD sendCall3 = g_WeChatWinDllAddr + g_WxCalls.sendText.call3;
wstring wsWxid = String2Wstring(wxid); wstring wsWxid = String2Wstring(wxid);
wstring wsMsg = String2Wstring(msg); wstring wsMsg = String2Wstring(msg);
@ -49,15 +52,24 @@ void SendTextMessage(string wxid, string msg, string atWxids)
__asm __asm
{ {
pushad;
call sendCall1;
push 0x0;
push 0x0;
push 0x0;
push 0x1;
lea eax, vTxtAtWxids; lea eax, vTxtAtWxids;
push 0x01;
push eax; push eax;
lea edi, wxMsg; lea eax, wxMsg;
push edi; push eax;
lea edx, wxWxid; lea edx, wxWxid;
lea ecx, buffer; lea ecx, buffer;
call sendCallAddress; call sendCall2;
add esp, 0xC; mov success, eax;
add esp, 0x18;
lea ecx, buffer;
call sendCall3;
popad;
} }
} }

8
spy/spy_types.h
View File

@ -23,6 +23,12 @@ typedef struct RecvMsg {
DWORD extra; // 附加数据 DWORD extra; // 附加数据
} RecvMsg_t; } RecvMsg_t;
typedef struct SendText {
DWORD call1;
DWORD call2;
DWORD call3;
} SendText_t;
typedef struct Sendfile { typedef struct Sendfile {
DWORD call1; DWORD call1;
DWORD call2; DWORD call2;
@ -79,7 +85,7 @@ typedef struct TF {
typedef struct WxCalls { typedef struct WxCalls {
DWORD login; // 登录状态 DWORD login; // 登录状态
UserInfoCall_t ui; // 用户信息 UserInfoCall_t ui; // 用户信息
DWORD sendTextMsg; // 发送消息 SendText_t sendText; // 发送消息
RecvMsg_t recvMsg; // 接收消息 RecvMsg_t recvMsg; // 接收消息
Sendfile_t sendImg; // 发送图片 Sendfile_t sendImg; // 发送图片
Sendfile_t sendFile; // 发送文件 Sendfile_t sendFile; // 发送文件