diff --git a/WeChatFerry/spy/funcs.cpp b/WeChatFerry/spy/funcs.cpp
index 33d9ccf..ad74649 100644
--- a/WeChatFerry/spy/funcs.cpp
+++ b/WeChatFerry/spy/funcs.cpp
@@ -423,3 +423,15 @@ void RefreshLoginQrcode() {
         popad;
     }
 }
+
+string GetLoginUrl() {
+    // 判断是否登录， 已登录直接返回空字符
+    int isLogin = (int)GET_DWORD(g_WeChatWinDllAddr + g_WxCalls.login);
+    if (isLogin) {
+        return "";
+    }
+
+    DWORD loginUrlAddr = g_WeChatWinDllAddr + g_WxCalls.rlq.url;
+    string qrcodeLoginUrl = "http://weixin.qq.com/x/" + string(reinterpret_cast<char*>(*(DWORD*)loginUrlAddr));
+    return qrcodeLoginUrl;
+}
diff --git a/WeChatFerry/spy/load_calls.cpp b/WeChatFerry/spy/load_calls.cpp
index d1a9cbb..4c0cbfe 100644
--- a/WeChatFerry/spy/load_calls.cpp
+++ b/WeChatFerry/spy/load_calls.cpp
@@ -42,8 +42,8 @@ WxCalls_t wxCalls = {
     {0x80A800, 0x80F270, 0x13DA3E0},
     /*  call1,   call2 */
     {0xF59E40, 0xCE6730},
-    /*  call1,   call2 */
-    {0xAE9DB0, 0xCDA6F0}
+    /*  call1,   call2,     url */
+    {0xAE9DB0, 0xCDA6F0, 0x3040DE8}
 };
 
 int LoadCalls(const wchar_t *version, WxCalls_t *calls)
diff --git a/WeChatFerry/spy/spy_types.h b/WeChatFerry/spy/spy_types.h
index 6e56f9d..08fa4ae 100644
--- a/WeChatFerry/spy/spy_types.h
+++ b/WeChatFerry/spy/spy_types.h
@@ -159,6 +159,7 @@ typedef struct CallFm {
 typedef struct CallRfLoginQr {
     DWORD call1;
     DWORD call2;
+    DWORD url;
 } CallRfLoginQr_t;
 
 typedef struct WxCalls {