From 8098a8e9d82ad1af3cca1d52f8395b491cf2904a Mon Sep 17 00:00:00 2001 From: yuzifu Date: Thu, 19 Sep 2024 19:24:23 +0800 Subject: [PATCH 01/11] Update partial offset for 3.9.11.25 --- WeChatFerry/spy/chatroom_mgmt.cpp | 8 +++---- WeChatFerry/spy/contact_mgmt.cpp | 4 ++-- WeChatFerry/spy/exec_sql.cpp | 4 ++-- WeChatFerry/spy/funcs.cpp | 22 +++++++++---------- WeChatFerry/spy/receive_msg.cpp | 4 ++-- WeChatFerry/spy/send_msg.cpp | 26 +++++++++++----------- WeChatFerry/spy/sqlite3.h | 36 +++++++++++++++---------------- 7 files changed, 52 insertions(+), 52 deletions(-) diff --git a/WeChatFerry/spy/chatroom_mgmt.cpp b/WeChatFerry/spy/chatroom_mgmt.cpp index f26e351..43a28aa 100644 --- a/WeChatFerry/spy/chatroom_mgmt.cpp +++ b/WeChatFerry/spy/chatroom_mgmt.cpp @@ -9,10 +9,10 @@ using namespace std; extern QWORD g_WeChatWinDllAddr; -#define OS_GET_CHATROOM_MGR 0x1C4E200 -#define OS_ADD_MEMBERS 0x221B8A0 -#define OS_DELETE_MEMBERS 0x221BEE0 -#define OS_INVITE_MEMBERS 0x221B280 +#define OS_GET_CHATROOM_MGR 0x1b83bd0 +#define OS_ADD_MEMBERS 0x2155100 +#define OS_DELETE_MEMBERS 0x2155740 +#define OS_INVITE_MEMBERS 0x2154ae0 typedef QWORD (*GetChatRoomMgr_t)(); typedef QWORD (*AddMemberToChatRoom_t)(QWORD, QWORD, QWORD, QWORD); diff --git a/WeChatFerry/spy/contact_mgmt.cpp b/WeChatFerry/spy/contact_mgmt.cpp index 3b7b559..f81d1c1 100644 --- a/WeChatFerry/spy/contact_mgmt.cpp +++ b/WeChatFerry/spy/contact_mgmt.cpp @@ -7,8 +7,8 @@ using namespace std; extern QWORD g_WeChatWinDllAddr; -#define OS_GET_CONTACT_MGR 0x1C0BDE0 -#define OS_GET_CONTACT_LIST 0x2265540 +#define OS_GET_CONTACT_MGR 0x1B417A0 +#define OS_GET_CONTACT_LIST 0x219ED10 #define OS_CONTACT_BIN 0x200 #define OS_CONTACT_BIN_LEN 0x208 #define OS_CONTACT_WXID 0x10 diff --git a/WeChatFerry/spy/exec_sql.cpp b/WeChatFerry/spy/exec_sql.cpp index 5de9628..6253164 100644 --- a/WeChatFerry/spy/exec_sql.cpp +++ b/WeChatFerry/spy/exec_sql.cpp @@ -5,7 +5,7 @@ #include "sqlite3.h" #include "util.h" -#define OFFSET_DB_INSTANCE 0x5A40598 +#define OFFSET_DB_INSTANCE 0x5902000 #define OFFSET_DB_MICROMSG 0xb8 #define OFFSET_DB_CHAT_MSG 0x2c8 #define OFFSET_DB_MISC 0x5f0 @@ -14,7 +14,7 @@ #define OFFSET_DB_BIZCHAT_MSG 0x1A70 #define OFFSET_DB_FUNCTION_MSG 0x1b98 #define OFFSET_DB_NAME 0x28 -#define OFFSET_DB_MSG_MGR 0x5ABB5D8 +#define OFFSET_DB_MSG_MGR 0x595F900 extern UINT64 g_WeChatWinDllAddr; diff --git a/WeChatFerry/spy/funcs.cpp b/WeChatFerry/spy/funcs.cpp index 9ff3edc..0c3cb7e 100644 --- a/WeChatFerry/spy/funcs.cpp +++ b/WeChatFerry/spy/funcs.cpp @@ -24,17 +24,17 @@ extern QWORD g_WeChatWinDllAddr; #define HEADER_GIF1 0x47 #define HEADER_GIF2 0x49 -#define OS_LOGIN_STATUS 0x5AB86A8 -#define OS_GET_SNS_DATA_MGR 0x22A91C0 -#define OS_GET_SNS_FIRST_PAGE 0x2ED9080 -#define OS_GET_SNS_TIMELINE_MGR 0x2E6B110 -#define OS_GET_SNS_NEXT_PAGE 0x2EFEC00 -#define OS_NEW_CHAT_MSG 0x1C28800 -#define OS_FREE_CHAT_MSG 0x1C1FF10 -#define OS_GET_CHAT_MGR 0x1C51CF0 -#define OS_GET_MGR_BY_PREFIX_LOCAL_ID 0x2206280 -#define OS_GET_PRE_DOWNLOAD_MGR 0x1CD87E0 -#define OS_PUSH_ATTACH_TASK 0x1DA69C0 +#define OS_LOGIN_STATUS 0x595C9E8 +#define OS_GET_SNS_DATA_MGR 0x21E2200 +#define OS_GET_SNS_FIRST_PAGE 0x2E212d0 +#define OS_GET_SNS_TIMELINE_MGR 0x2DB3390 +#define OS_GET_SNS_NEXT_PAGE 0x2EC8970 +#define OS_NEW_CHAT_MSG 0x1B5E140 +#define OS_FREE_CHAT_MSG 0x1B55850 +#define OS_GET_CHAT_MGR 0x1B876C0 +#define OS_GET_MGR_BY_PREFIX_LOCAL_ID 0x213FB00 +#define OS_GET_PRE_DOWNLOAD_MGR 0x1C0EE70 +#define OS_PUSH_ATTACH_TASK 0x1CDF4E0 typedef QWORD (*GetSNSDataMgr_t)(); typedef QWORD (*GetSnsTimeLineMgr_t)(); diff --git a/WeChatFerry/spy/receive_msg.cpp b/WeChatFerry/spy/receive_msg.cpp index 8d385db..a9a40fa 100644 --- a/WeChatFerry/spy/receive_msg.cpp +++ b/WeChatFerry/spy/receive_msg.cpp @@ -38,8 +38,8 @@ extern QWORD g_WeChatWinDllAddr; #define OS_PYQ_MSG_XML 0x9B8 #define OS_PYQ_MSG_SENDER 0x18 #define OS_PYQ_MSG_CONTENT 0x48 -#define OS_PYQ_MSG_CALL 0x2EFAA10 -#define OS_WXLOG 0x26DA2D0 +#define OS_PYQ_MSG_CALL 0x2e42c90 +#define OS_WXLOG 0x2613d20 typedef QWORD (*RecvMsg_t)(QWORD, QWORD); typedef QWORD (*WxLog_t)(QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD); diff --git a/WeChatFerry/spy/send_msg.cpp b/WeChatFerry/spy/send_msg.cpp index 70b0900..a6df0a7 100644 --- a/WeChatFerry/spy/send_msg.cpp +++ b/WeChatFerry/spy/send_msg.cpp @@ -14,20 +14,20 @@ extern string GetSelfWxid(); // Defined in spy.cpp #define SRTM_SIZE 0x3F0 -#define OS_NEW 0x1C28800 -#define OS_FREE 0x1C1FF10 -#define OS_SEND_MSG_MGR 0x1C1E690 -#define OS_SEND_TEXT 0x238DDD0 -#define OS_SEND_IMAGE 0x2383560 -#define OS_GET_APP_MSG_MGR 0x1C23630 -#define OS_SEND_FILE 0x21969E0 -#define OS_RTM_NEW 0x1C27D50 -#define OS_RTM_FREE 0x1C27120 +#define OS_NEW 0x1b5e140 +#define OS_FREE 0x1b55850 +#define OS_SEND_MSG_MGR 0x1ca4f70 +#define OS_SEND_TEXT 0x22c6b60 +#define OS_SEND_IMAGE 0x22bc2f0 +#define OS_GET_APP_MSG_MGR 0x1b557d0 +#define OS_SEND_FILE 0x20d0230 +#define OS_RTM_NEW 0x1b5d690 +#define OS_RTM_FREE 0x1b5ca60 #define OS_SEND_RICH_TEXT 0x21A09C0 -#define OS_SEND_PAT_MSG 0x2D669B0 -#define OS_FORWARD_MSG 0x238D350 -#define OS_GET_EMOTION_MGR 0x1C988D0 -#define OS_SEND_EMOTION 0x227B9E0 +#define OS_SEND_PAT_MSG 0x2caec00 +#define OS_FORWARD_MSG 0x22C60E0 +#define OS_GET_EMOTION_MGR 0x1bcef10 +#define OS_SEND_EMOTION 0x21b52d5 typedef QWORD (*New_t)(QWORD); typedef QWORD (*Free_t)(QWORD); diff --git a/WeChatFerry/spy/sqlite3.h b/WeChatFerry/spy/sqlite3.h index 09bc15d..9b1b604 100644 --- a/WeChatFerry/spy/sqlite3.h +++ b/WeChatFerry/spy/sqlite3.h @@ -138,24 +138,24 @@ #define SQLITE_NULL 5 #define SQLITE_TEXT 3 -#define SQLITE3_EXEC_OFFSET 0x3AFBCE0 -#define SQLITE3_BACKUP_INIT_OFFSET 0x1DEA900 -#define SQLITE3_PREPARE_OFFSET 0x3B03990 -#define SQLITE3_OPEN_OFFSET 0x1E598B0 -#define SQLITE3_BACKUP_STEP_OFFSET 0x1DEAD00 -#define SQLITE3_BACKUP_REMAINING_OFFSET 0x1DEB440 -#define SQLITE3_BACKUP_PAGECOUNT_OFFSET 0x1DEB450 -#define SQLITE3_BACKUP_FINISH_OFFSET 0x1DEB340 -#define SQLITE3_SLEEP_OFFSET 0x1E5A0F0 -#define SQLITE3_ERRCODE_OFFSET 0x1E58550 -#define SQLITE3_CLOSE_OFFSET 0x1E56CD0 -#define SQLITE3_STEP_OFFSET 0x3ABFCE0 -#define SQLITE3_COLUMN_COUNT_OFFSET 0x3AC0500 -#define SQLITE3_COLUMN_NAME_OFFSET 0x3AC0F00 -#define SQLITE3_COLUMN_TYPE_OFFSET 0x3AC0D50 -#define SQLITE3_COLUMN_BLOB_OFFSET 0x3AC0530 -#define SQLITE3_COLUMN_BYTES_OFFSET 0x3AC0620 -#define SQLITE3_FINALIZE_OFFSET 0x3ABED90 +#define SQLITE3_EXEC_OFFSET 0x3A5EDA0 +#define SQLITE3_BACKUP_INIT_OFFSET 0x3A18EA0 +#define SQLITE3_PREPARE_OFFSET 0x3A66A20 +#define SQLITE3_OPEN_OFFSET 0x3A9E210 +#define SQLITE3_BACKUP_STEP_OFFSET 0x3A193F0 +#define SQLITE3_BACKUP_REMAINING_OFFSET 0x1B26EB0 +#define SQLITE3_BACKUP_PAGECOUNT_OFFSET 0x1B26EE0 +#define SQLITE3_BACKUP_FINISH_OFFSET 0x3A19AF0 +#define SQLITE3_SLEEP_OFFSET 0x3A9EE70 +#define SQLITE3_ERRCODE_OFFSET 0x3A9CB10 +#define SQLITE3_CLOSE_OFFSET 0x3A9AC70 +#define SQLITE3_STEP_OFFSET 0x3A22DA0 +#define SQLITE3_COLUMN_COUNT_OFFSET 0x3A235C0 +#define SQLITE3_COLUMN_NAME_OFFSET 0x3A23FC0 +#define SQLITE3_COLUMN_TYPE_OFFSET 0x3A23E10 +#define SQLITE3_COLUMN_BLOB_OFFSET 0x3A235F0 +#define SQLITE3_COLUMN_BYTES_OFFSET 0x3A236E0 +#define SQLITE3_FINALIZE_OFFSET 0x3A21E50 typedef int (*Sqlite3_callback)(void *, int, char **, char **); From 8f9d10bf3b362c76a3fc0830de1c85cd8c868124 Mon Sep 17 00:00:00 2001 From: yuzifu Date: Fri, 20 Sep 2024 16:27:15 +0800 Subject: [PATCH 02/11] Update partial offset for 3.9.11.25 --- WeChatFerry/spy/send_msg.cpp | 2 +- WeChatFerry/spy/spy.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/WeChatFerry/spy/send_msg.cpp b/WeChatFerry/spy/send_msg.cpp index a6df0a7..4946108 100644 --- a/WeChatFerry/spy/send_msg.cpp +++ b/WeChatFerry/spy/send_msg.cpp @@ -23,7 +23,7 @@ extern string GetSelfWxid(); // Defined in spy.cpp #define OS_SEND_FILE 0x20d0230 #define OS_RTM_NEW 0x1b5d690 #define OS_RTM_FREE 0x1b5ca60 -#define OS_SEND_RICH_TEXT 0x21A09C0 +#define OS_SEND_RICH_TEXT 0x20da210 #define OS_SEND_PAT_MSG 0x2caec00 #define OS_FORWARD_MSG 0x22C60E0 #define OS_GET_EMOTION_MGR 0x1bcef10 diff --git a/WeChatFerry/spy/spy.h b/WeChatFerry/spy/spy.h index f985134..525109a 100644 --- a/WeChatFerry/spy/spy.h +++ b/WeChatFerry/spy/spy.h @@ -2,7 +2,7 @@ #include "framework.h" -#define SUPPORT_VERSION L"3.9.10.27" +#define SUPPORT_VERSION L"3.9.11.25" void InitSpy(int port); void CleanupSpy(); From 3d95fc34b708eb39fbd45c85b64636a1435c5bf1 Mon Sep 17 00:00:00 2001 From: yuzifu Date: Mon, 23 Sep 2024 15:16:52 +0800 Subject: [PATCH 03/11] Update partial offset for 3.9.11.25 --- WeChatFerry/spy/receive_msg.cpp | 2 +- WeChatFerry/spy/user_info.cpp | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/WeChatFerry/spy/receive_msg.cpp b/WeChatFerry/spy/receive_msg.cpp index a9a40fa..ec538f7 100644 --- a/WeChatFerry/spy/receive_msg.cpp +++ b/WeChatFerry/spy/receive_msg.cpp @@ -31,7 +31,7 @@ extern QWORD g_WeChatWinDllAddr; #define OS_RECV_MSG_THUMB 0x280 #define OS_RECV_MSG_EXTRA 0x2A0 #define OS_RECV_MSG_XML 0x308 -#define OS_RECV_MSG_CALL 0x2205510 +#define OS_RECV_MSG_CALL 0x2147680 #define OS_PYQ_MSG_START 0x30 #define OS_PYQ_MSG_END 0x38 #define OS_PYQ_MSG_TS 0x38 diff --git a/WeChatFerry/spy/user_info.cpp b/WeChatFerry/spy/user_info.cpp index 3c7152c..41268d0 100644 --- a/WeChatFerry/spy/user_info.cpp +++ b/WeChatFerry/spy/user_info.cpp @@ -4,10 +4,10 @@ extern UINT64 g_WeChatWinDllAddr; -#define OS_USER_HOME 0x5A7E190 -#define OS_USER_WXID 0x5AB7F30 -#define OS_USER_NAME 0x5AB8098 -#define OS_USER_MOBILE 0x5AB7FD8 +#define OS_USER_HOME 0x5932770 +#define OS_USER_WXID 0x595c270 +#define OS_USER_NAME 0x595c3d8 +#define OS_USER_MOBILE 0x595c318 static char home[MAX_PATH] = { 0 }; From 19079bc468fe6681a65887a42a9215a9ec7392d1 Mon Sep 17 00:00:00 2001 From: kingmo888 <17401091+kingmo888@users.noreply.github.com> Date: Thu, 26 Sep 2024 08:46:09 +0800 Subject: [PATCH 04/11] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=9B=A0=E6=97=A0logs?= =?UTF-8?q?=E6=96=87=E4=BB=B6=E5=A4=B9=E5=AF=BC=E8=87=B4=E5=90=AF=E5=8A=A8?= =?UTF-8?q?=E5=A4=B1=E8=B4=A5=E7=9A=84=E9=97=AE=E9=A2=98=E3=80=82c++?= =?UTF-8?q?=E9=A1=B9=E7=9B=AE=E5=A2=9E=E5=8A=A0=20/utf8=E5=85=BC=E5=AE=B9?= =?UTF-8?q?=EF=BC=8C=E8=A7=A3=E5=86=B3=E7=BC=96=E7=A0=81=E5=BC=82=E5=B8=B8?= =?UTF-8?q?=E9=97=AE=E9=A2=98=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- WeChatFerry/com/log.cpp | 6 +++++- WeChatFerry/sdk/SDK.vcxproj | 1 + WeChatFerry/spy/Spy.vcxproj | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/WeChatFerry/com/log.cpp b/WeChatFerry/com/log.cpp index e06c0e9..6524dd0 100644 --- a/WeChatFerry/com/log.cpp +++ b/WeChatFerry/com/log.cpp @@ -14,7 +14,11 @@ void InitLogger(std::string path) if (logger != nullptr) { return; } - + // check and create logs folder + std::filesystem::path logDir = std::filesystem::path(path) / "logs"; + if (!std::filesystem::exists(logDir)) { + std::filesystem::create_directory(logDir); + } auto filename = std::filesystem::path(path + LOGGER_FILE_NAME).make_preferred().string(); try { logger = spdlog::rotating_logger_mt(LOGGER_NAME, filename, LOGGER_MAX_SIZE, LOGGER_MAX_FILES); diff --git a/WeChatFerry/sdk/SDK.vcxproj b/WeChatFerry/sdk/SDK.vcxproj index af47a4b..a796526 100644 --- a/WeChatFerry/sdk/SDK.vcxproj +++ b/WeChatFerry/sdk/SDK.vcxproj @@ -117,6 +117,7 @@ true MultiThreaded + /utf-8 %(AdditionalOptions) Windows diff --git a/WeChatFerry/spy/Spy.vcxproj b/WeChatFerry/spy/Spy.vcxproj index 0c44f9a..02a49a0 100644 --- a/WeChatFerry/spy/Spy.vcxproj +++ b/WeChatFerry/spy/Spy.vcxproj @@ -192,7 +192,7 @@ xcopy /y $(OutDir)$(TargetFileName) $(SolutionDir)..\clients\python\wcferryfalse 4251;4731;4819 - /EHa %(AdditionalOptions) + /EHa /utf-8 %(AdditionalOptions) MultiThreaded From 7efe6bce55faba94d5e179148b4b5e772c497b0e Mon Sep 17 00:00:00 2001 From: lzb Date: Thu, 26 Sep 2024 19:53:15 +0800 Subject: [PATCH 05/11] =?UTF-8?q?=E6=B2=A1=E6=B5=8B=E8=BF=87=E7=9A=84?= =?UTF-8?q?=E5=8F=91=E9=80=81xml..?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- WeChatFerry/spy/send_msg.cpp | 93 +++++++++++++++--------------------- 1 file changed, 39 insertions(+), 54 deletions(-) diff --git a/WeChatFerry/spy/send_msg.cpp b/WeChatFerry/spy/send_msg.cpp index 4946108..6be13c0 100644 --- a/WeChatFerry/spy/send_msg.cpp +++ b/WeChatFerry/spy/send_msg.cpp @@ -28,6 +28,8 @@ extern string GetSelfWxid(); // Defined in spy.cpp #define OS_FORWARD_MSG 0x22C60E0 #define OS_GET_EMOTION_MGR 0x1bcef10 #define OS_SEND_EMOTION 0x21b52d5 +#define OS_XML_BUGSIGN 0x24F0D70 +#define OS_SEND_XML 0x20CF360 typedef QWORD (*New_t)(QWORD); typedef QWORD (*Free_t)(QWORD); @@ -43,6 +45,10 @@ typedef QWORD (*ForwardMsg_t)(QWORD, QWORD, QWORD, QWORD); typedef QWORD (*GetEmotionMgr_t)(); typedef QWORD (*SendEmotion_t)(QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD); + +typedef QWORD(*__XmlBufSignFunc)(QWORD, QWORD, QWORD); +typedef QWORD(*__SendXmlMsgFunc)(QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD); + void SendTextMessage(string wxid, string msg, string atWxids) { QWORD success = 0; @@ -228,70 +234,49 @@ void SendEmotionMessage(string wxid, string path) SendEmotion(mgr, (QWORD)pWxPath, (QWORD)buff, (QWORD)pWxWxid, 2, (QWORD)buff, 0, (QWORD)buff); } -#if 0 + void SendXmlMessage(string receiver, string xml, string path, int type) { if (g_WeChatWinDllAddr == 0) { return; } - // 发送消息Call地址 = 微信基址 + 偏移 - DWORD sendXmlCall1 = g_WeChatWinDllAddr + g_WxCalls.sendXml.call1; - DWORD sendXmlCall2 = g_WeChatWinDllAddr + g_WxCalls.sendXml.call2; - DWORD sendXmlCall3 = g_WeChatWinDllAddr + g_WxCalls.sendXml.call3; - DWORD sendXmlCall4 = g_WeChatWinDllAddr + g_WxCalls.sendXml.call4; - DWORD sendXmlParam = g_WeChatWinDllAddr + g_WxCalls.sendXml.param; - char buffer[0xFF0] = { 0 }; + New_t funcNew = (New_t)(g_WeChatWinDllAddr + OS_NEW); + Free_t funcFree = (Free_t)(g_WeChatWinDllAddr + OS_FREE); + + DWORD xmlBufSign = g_WeChatWinDllAddr + OS_XML_BUGSIGN; + DWORD sendXmlMsg = g_WeChatWinDllAddr + OS_SEND_XML; + __XmlBufSignFunc xmlBufSignFunc = (__XmlBufSignFunc)xmlBufSign; + __SendXmlMsgFunc sendXmlMsgFunc = (__SendXmlMsgFunc)sendXmlMsg; + + + char buff[0x500] = { 0 }; + char buff2[0x500] = { 0 }; char nullBuf[0x1C] = { 0 }; - wstring wsSender = String2Wstring(GetSelfWxid()); - wstring wsReceiver = String2Wstring(receiver); - wstring wsXml = String2Wstring(xml); + DWORD pBuf = reinterpret_cast(&buff); + DWORD pBuf2 = reinterpret_cast(&buff2); - WxString wxPath; - WxString wxNull; - WxString wxXml(wsXml); - WxString wxSender(wsSender); - WxString wxReceiver(wsReceiver); - if (!path.empty()) { - wstring wsPath = String2Wstring(path); - wxPath = WxString(wsPath); - } + funcNew(pBuf); + funcNew(pBuf2); - DWORD sendtype = type; - __asm { - pushad; - pushfd; - lea ecx, buffer; - call sendXmlCall1; - mov eax, [sendtype]; - push eax; - lea eax, nullBuf; - lea edx, wxSender; - push eax; - lea eax, wxPath; - push eax; - lea eax, wxXml; - push eax; - lea edi, wxReceiver; - push edi; - lea ecx, buffer; - call sendXmlCall2; - add esp, 0x14; - lea eax, wxNull; - push eax; - lea ecx, buffer; - call sendXmlCall3; - mov dl, 0x0; - lea ecx, buffer; - push sendXmlParam; - push sendXmlParam; - call sendXmlCall4; - add esp, 0x8; - popfd; - popad; - } + DWORD sbuf[4] = { 0,0,0, 0 }; + + DWORD sign = xmlBufSignFunc(pBuf2, reinterpret_cast(&sbuf), 0x1); + + + WxString* pReceiver = NewWxStringFromStr(receiver); + WxString* pXml = NewWxStringFromStr(xml); + WxString* pPath = NewWxStringFromStr(path); + WxString* pType = NewWxStringFromStr(type); + + wstring* pSender = NewWxStringFromStr(GetSelfWxid()); + + sendXmlMsgFunc(pBuf, pSender, pReceiver, pXml, pPath, reinterpret_cast(&nullBuf), pType, 0x4, sign, pBuf2); + + funcFree(reinterpret_cast(&buff)); + funcFree(reinterpret_cast(&buff2)); } -#endif + From d00edd8add6c6ea89abe3d5519bbfb46aeac764e Mon Sep 17 00:00:00 2001 From: wxlinzebin Date: Thu, 26 Sep 2024 23:24:35 +0800 Subject: [PATCH 06/11] =?UTF-8?q?OK=E7=BC=96=E8=AF=91=E9=80=9A=E8=BF=87?= =?UTF-8?q?=EF=BC=8C=E7=BE=A4=E4=B8=BB=E6=B5=8B=E5=90=A7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- WeChatFerry/spy/send_msg.cpp | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/WeChatFerry/spy/send_msg.cpp b/WeChatFerry/spy/send_msg.cpp index 6be13c0..2e50985 100644 --- a/WeChatFerry/spy/send_msg.cpp +++ b/WeChatFerry/spy/send_msg.cpp @@ -235,13 +235,14 @@ void SendEmotionMessage(string wxid, string path) } -void SendXmlMessage(string receiver, string xml, string path, int type) +void SendXmlMessage(string receiver, string xml, string path, QWORD type) { if (g_WeChatWinDllAddr == 0) { return; } + New_t funcNew = (New_t)(g_WeChatWinDllAddr + OS_NEW); Free_t funcFree = (Free_t)(g_WeChatWinDllAddr + OS_FREE); @@ -270,11 +271,12 @@ void SendXmlMessage(string receiver, string xml, string path, int type) WxString* pReceiver = NewWxStringFromStr(receiver); WxString* pXml = NewWxStringFromStr(xml); WxString* pPath = NewWxStringFromStr(path); - WxString* pType = NewWxStringFromStr(type); - wstring* pSender = NewWxStringFromStr(GetSelfWxid()); + WxString* pSender = NewWxStringFromStr(GetSelfWxid()); + + //sendXmlMsgFunc(pBuf, pSender, pReceiver, pXml, pPath, reinterpret_cast(&nullBuf), pType, 0x4, sign, pBuf2); + sendXmlMsgFunc(pBuf, reinterpret_cast(pSender), reinterpret_cast(pReceiver), reinterpret_cast(pXml), reinterpret_cast(pPath), reinterpret_cast(&nullBuf), type, 0x4, sign, pBuf2); - sendXmlMsgFunc(pBuf, pSender, pReceiver, pXml, pPath, reinterpret_cast(&nullBuf), pType, 0x4, sign, pBuf2); funcFree(reinterpret_cast(&buff)); funcFree(reinterpret_cast(&buff2)); From 44afafd5d72ed6b6e12700e4c60a114801fcb360 Mon Sep 17 00:00:00 2001 From: Changhua Date: Mon, 14 Oct 2024 18:55:55 +0800 Subject: [PATCH 07/11] Add contributors --- README.MD | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.MD b/README.MD index 58c17fc..79b0de4 100644 --- a/README.MD +++ b/README.MD @@ -61,6 +61,10 @@ +## 感谢大佬们贡献代码 + +![](https://contrib.rocks/image?repo=lich0821/WeChatFerry) + ## 快速开始 ### Python [![PyPi](https://img.shields.io/pypi/v/wcferry.svg)](https://pypi.python.org/pypi/wcferry) [![Downloads](https://static.pepy.tech/badge/wcferry)](https://pypi.python.org/pypi/wcferry) [![Documentation Status](https://readthedocs.org/projects/wechatferry/badge/?version=latest)](https://wechatferry.readthedocs.io/zh/latest/?badge=latest) From 86c0920445eed5cf69a90cdd4b857ff09efc9f60 Mon Sep 17 00:00:00 2001 From: Changhua Date: Thu, 31 Oct 2024 22:53:01 +0800 Subject: [PATCH 08/11] Reformat --- WeChatFerry/spy/chatroom_mgmt.cpp | 4 +- WeChatFerry/spy/exec_sql.cpp | 10 ++--- WeChatFerry/spy/receive_msg.cpp | 4 +- WeChatFerry/spy/send_msg.cpp | 74 +++++++++++++------------------ WeChatFerry/spy/sqlite3.h | 20 ++++----- WeChatFerry/spy/user_info.cpp | 6 +-- 6 files changed, 54 insertions(+), 64 deletions(-) diff --git a/WeChatFerry/spy/chatroom_mgmt.cpp b/WeChatFerry/spy/chatroom_mgmt.cpp index 43a28aa..41d1da5 100644 --- a/WeChatFerry/spy/chatroom_mgmt.cpp +++ b/WeChatFerry/spy/chatroom_mgmt.cpp @@ -9,10 +9,10 @@ using namespace std; extern QWORD g_WeChatWinDllAddr; -#define OS_GET_CHATROOM_MGR 0x1b83bd0 +#define OS_GET_CHATROOM_MGR 0x1B83BD0 #define OS_ADD_MEMBERS 0x2155100 #define OS_DELETE_MEMBERS 0x2155740 -#define OS_INVITE_MEMBERS 0x2154ae0 +#define OS_INVITE_MEMBERS 0x2154AE0 typedef QWORD (*GetChatRoomMgr_t)(); typedef QWORD (*AddMemberToChatRoom_t)(QWORD, QWORD, QWORD, QWORD); diff --git a/WeChatFerry/spy/exec_sql.cpp b/WeChatFerry/spy/exec_sql.cpp index 6253164..c3f114f 100644 --- a/WeChatFerry/spy/exec_sql.cpp +++ b/WeChatFerry/spy/exec_sql.cpp @@ -6,13 +6,13 @@ #include "util.h" #define OFFSET_DB_INSTANCE 0x5902000 -#define OFFSET_DB_MICROMSG 0xb8 -#define OFFSET_DB_CHAT_MSG 0x2c8 -#define OFFSET_DB_MISC 0x5f0 -#define OFFSET_DB_EMOTION 0x15f0 +#define OFFSET_DB_MICROMSG 0xB8 +#define OFFSET_DB_CHAT_MSG 0x2C8 +#define OFFSET_DB_MISC 0x5F0 +#define OFFSET_DB_EMOTION 0x15F0 #define OFFSET_DB_MEDIA 0xF48 #define OFFSET_DB_BIZCHAT_MSG 0x1A70 -#define OFFSET_DB_FUNCTION_MSG 0x1b98 +#define OFFSET_DB_FUNCTION_MSG 0x1B98 #define OFFSET_DB_NAME 0x28 #define OFFSET_DB_MSG_MGR 0x595F900 diff --git a/WeChatFerry/spy/receive_msg.cpp b/WeChatFerry/spy/receive_msg.cpp index ec538f7..3ba59f1 100644 --- a/WeChatFerry/spy/receive_msg.cpp +++ b/WeChatFerry/spy/receive_msg.cpp @@ -38,8 +38,8 @@ extern QWORD g_WeChatWinDllAddr; #define OS_PYQ_MSG_XML 0x9B8 #define OS_PYQ_MSG_SENDER 0x18 #define OS_PYQ_MSG_CONTENT 0x48 -#define OS_PYQ_MSG_CALL 0x2e42c90 -#define OS_WXLOG 0x2613d20 +#define OS_PYQ_MSG_CALL 0x2E42C90 +#define OS_WXLOG 0x2613D20 typedef QWORD (*RecvMsg_t)(QWORD, QWORD); typedef QWORD (*WxLog_t)(QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD); diff --git a/WeChatFerry/spy/send_msg.cpp b/WeChatFerry/spy/send_msg.cpp index 2e50985..fba7c1a 100644 --- a/WeChatFerry/spy/send_msg.cpp +++ b/WeChatFerry/spy/send_msg.cpp @@ -14,20 +14,20 @@ extern string GetSelfWxid(); // Defined in spy.cpp #define SRTM_SIZE 0x3F0 -#define OS_NEW 0x1b5e140 -#define OS_FREE 0x1b55850 -#define OS_SEND_MSG_MGR 0x1ca4f70 -#define OS_SEND_TEXT 0x22c6b60 -#define OS_SEND_IMAGE 0x22bc2f0 -#define OS_GET_APP_MSG_MGR 0x1b557d0 -#define OS_SEND_FILE 0x20d0230 -#define OS_RTM_NEW 0x1b5d690 -#define OS_RTM_FREE 0x1b5ca60 -#define OS_SEND_RICH_TEXT 0x20da210 -#define OS_SEND_PAT_MSG 0x2caec00 +#define OS_NEW 0x1B5E140 +#define OS_FREE 0x1B55850 +#define OS_SEND_MSG_MGR 0x1CA4F70 +#define OS_SEND_TEXT 0x22C6B60 +#define OS_SEND_IMAGE 0x22BC2F0 +#define OS_GET_APP_MSG_MGR 0x1B557D0 +#define OS_SEND_FILE 0x20D0230 +#define OS_RTM_NEW 0x1B5D690 +#define OS_RTM_FREE 0x1B5CA60 +#define OS_SEND_RICH_TEXT 0x20DA210 +#define OS_SEND_PAT_MSG 0x2CAEC00 #define OS_FORWARD_MSG 0x22C60E0 -#define OS_GET_EMOTION_MGR 0x1bcef10 -#define OS_SEND_EMOTION 0x21b52d5 +#define OS_GET_EMOTION_MGR 0x1BCEF10 +#define OS_SEND_EMOTION 0x21B52D5 #define OS_XML_BUGSIGN 0x24F0D70 #define OS_SEND_XML 0x20CF360 @@ -45,9 +45,8 @@ typedef QWORD (*ForwardMsg_t)(QWORD, QWORD, QWORD, QWORD); typedef QWORD (*GetEmotionMgr_t)(); typedef QWORD (*SendEmotion_t)(QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD); - -typedef QWORD(*__XmlBufSignFunc)(QWORD, QWORD, QWORD); -typedef QWORD(*__SendXmlMsgFunc)(QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD); +typedef QWORD (*__XmlBufSignFunc)(QWORD, QWORD, QWORD); +typedef QWORD (*__SendXmlMsgFunc)(QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD, QWORD); void SendTextMessage(string wxid, string msg, string atWxids) { @@ -234,51 +233,42 @@ void SendEmotionMessage(string wxid, string path) SendEmotion(mgr, (QWORD)pWxPath, (QWORD)buff, (QWORD)pWxWxid, 2, (QWORD)buff, 0, (QWORD)buff); } - void SendXmlMessage(string receiver, string xml, string path, QWORD type) { if (g_WeChatWinDllAddr == 0) { return; } - - - New_t funcNew = (New_t)(g_WeChatWinDllAddr + OS_NEW); + New_t funcNew = (New_t)(g_WeChatWinDllAddr + OS_NEW); Free_t funcFree = (Free_t)(g_WeChatWinDllAddr + OS_FREE); - DWORD xmlBufSign = g_WeChatWinDllAddr + OS_XML_BUGSIGN; - DWORD sendXmlMsg = g_WeChatWinDllAddr + OS_SEND_XML; + DWORD xmlBufSign = g_WeChatWinDllAddr + OS_XML_BUGSIGN; + DWORD sendXmlMsg = g_WeChatWinDllAddr + OS_SEND_XML; __XmlBufSignFunc xmlBufSignFunc = (__XmlBufSignFunc)xmlBufSign; __SendXmlMsgFunc sendXmlMsgFunc = (__SendXmlMsgFunc)sendXmlMsg; - - char buff[0x500] = { 0 }; - char buff2[0x500] = { 0 }; + char buff[0x500] = { 0 }; + char buff2[0x500] = { 0 }; char nullBuf[0x1C] = { 0 }; - DWORD pBuf = reinterpret_cast(&buff); - DWORD pBuf2 = reinterpret_cast(&buff2); - + DWORD pBuf = (DWORD)(&buff); + DWORD pBuf2 = (DWORD)(&buff2); funcNew(pBuf); funcNew(pBuf2); - DWORD sbuf[4] = { 0,0,0, 0 }; + DWORD sbuf[4] = { 0, 0, 0, 0 }; - DWORD sign = xmlBufSignFunc(pBuf2, reinterpret_cast(&sbuf), 0x1); + DWORD sign = xmlBufSignFunc(pBuf2, (DWORD)(&sbuf), 0x1); + WxString *pReceiver = NewWxStringFromStr(receiver); + WxString *pXml = NewWxStringFromStr(xml); + WxString *pPath = NewWxStringFromStr(path); + WxString *pSender = NewWxStringFromStr(GetSelfWxid()); - WxString* pReceiver = NewWxStringFromStr(receiver); - WxString* pXml = NewWxStringFromStr(xml); - WxString* pPath = NewWxStringFromStr(path); + sendXmlMsgFunc(pBuf, (QWORD)pSender, (QWORD)pReceiver, (QWORD)pXml, (QWORD)pPath, (QWORD)(&nullBuf), type, 0x4, + sign, pBuf2); - WxString* pSender = NewWxStringFromStr(GetSelfWxid()); - - //sendXmlMsgFunc(pBuf, pSender, pReceiver, pXml, pPath, reinterpret_cast(&nullBuf), pType, 0x4, sign, pBuf2); - sendXmlMsgFunc(pBuf, reinterpret_cast(pSender), reinterpret_cast(pReceiver), reinterpret_cast(pXml), reinterpret_cast(pPath), reinterpret_cast(&nullBuf), type, 0x4, sign, pBuf2); - - - funcFree(reinterpret_cast(&buff)); - funcFree(reinterpret_cast(&buff2)); + funcFree((QWORD)&buff)); + funcFree((QWORD)&buff2)); } - diff --git a/WeChatFerry/spy/sqlite3.h b/WeChatFerry/spy/sqlite3.h index 9b1b604..b50ec2a 100644 --- a/WeChatFerry/spy/sqlite3.h +++ b/WeChatFerry/spy/sqlite3.h @@ -159,22 +159,22 @@ typedef int (*Sqlite3_callback)(void *, int, char **, char **); -typedef int(__cdecl *Sqlite3_exec)(QWORD, /* An open database */ - const char *sql, /* SQL to be evaluated */ - Sqlite3_callback, /* Callback function */ - void *, /* 1st argument to callback */ - char **errmsg /* Error msg written here */ +typedef int(__cdecl *Sqlite3_exec)(QWORD, /* An open database */ + const char *sql, /* SQL to be evaluated */ + Sqlite3_callback, /* Callback function */ + void *, /* 1st argument to callback */ + char **errmsg /* Error msg written here */ ); typedef QWORD(__cdecl *Sqlite3_backup_init)(QWORD *pDest, /* Destination database handle */ const char *zDestName, /* Destination database name */ QWORD *pSource, /* Source database handle */ const char *zSourceName /* Source database name */ ); -typedef int(__cdecl *Sqlite3_prepare)(QWORD db, /* Database handle */ - const char *zSql, /* SQL statement, UTF-8 encoded */ - int nByte, /* Maximum length of zSql in bytes. */ - QWORD **ppStmt, /* OUT: Statement handle */ - const char **pzTail /* OUT: Pointer to unused portion of zSql */ +typedef int(__cdecl *Sqlite3_prepare)(QWORD db, /* Database handle */ + const char *zSql, /* SQL statement, UTF-8 encoded */ + int nByte, /* Maximum length of zSql in bytes. */ + QWORD **ppStmt, /* OUT: Statement handle */ + const char **pzTail /* OUT: Pointer to unused portion of zSql */ ); typedef int(__cdecl *Sqlite3_open)(const char *filename, QWORD **ppDb); typedef int(__cdecl *Sqlite3_backup_step)(QWORD *p, int nPage); diff --git a/WeChatFerry/spy/user_info.cpp b/WeChatFerry/spy/user_info.cpp index 41268d0..f7f2b53 100644 --- a/WeChatFerry/spy/user_info.cpp +++ b/WeChatFerry/spy/user_info.cpp @@ -5,9 +5,9 @@ extern UINT64 g_WeChatWinDllAddr; #define OS_USER_HOME 0x5932770 -#define OS_USER_WXID 0x595c270 -#define OS_USER_NAME 0x595c3d8 -#define OS_USER_MOBILE 0x595c318 +#define OS_USER_WXID 0x595C270 +#define OS_USER_NAME 0x595C3D8 +#define OS_USER_MOBILE 0x595C318 static char home[MAX_PATH] = { 0 }; From c66b1f7eb2b99d080e5647fee92c0bbdf10d7f41 Mon Sep 17 00:00:00 2001 From: Changhua Date: Thu, 31 Oct 2024 22:59:27 +0800 Subject: [PATCH 09/11] Fix SendXmlMessage --- WeChatFerry/rpc/proto/wcf.proto | 2 +- WeChatFerry/spy/rpc_server.cpp | 4 +--- WeChatFerry/spy/send_msg.h | 2 +- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/WeChatFerry/rpc/proto/wcf.proto b/WeChatFerry/rpc/proto/wcf.proto index 270e5e6..f859336 100644 --- a/WeChatFerry/rpc/proto/wcf.proto +++ b/WeChatFerry/rpc/proto/wcf.proto @@ -117,7 +117,7 @@ message XmlMsg string receiver = 1; // 消息接收人 string content = 2; // xml 内容 string path = 3; // 图片路径 - int32 type = 4; // 消息类型 + uint64 type = 4; // 消息类型 } message MsgTypes { map types = 1; } diff --git a/WeChatFerry/spy/rpc_server.cpp b/WeChatFerry/spy/rpc_server.cpp index 679d38f..bb72d42 100644 --- a/WeChatFerry/spy/rpc_server.cpp +++ b/WeChatFerry/spy/rpc_server.cpp @@ -321,7 +321,6 @@ bool func_send_emotion(char *path, char *receiver, uint8_t *out, size_t *len) return true; } -#if 0 bool func_send_xml(XmlMsg xml, uint8_t *out, size_t *len) { Response rsp = Response_init_default; @@ -335,7 +334,7 @@ bool func_send_xml(XmlMsg xml, uint8_t *out, size_t *len) string receiver(xml.receiver); string content(xml.content); string path(xml.path ? xml.path : ""); - uint32_t type = (uint32_t)xml.type; + uint64_t type = (uint64_t)xml.type; SendXmlMessage(receiver, content, path, type); rsp.msg.status = 0; } @@ -349,7 +348,6 @@ bool func_send_xml(XmlMsg xml, uint8_t *out, size_t *len) return true; } -#endif bool func_send_rich_txt(RichText rt, uint8_t *out, size_t *len) { diff --git a/WeChatFerry/spy/send_msg.h b/WeChatFerry/spy/send_msg.h index 1abd0fd..0218a5d 100644 --- a/WeChatFerry/spy/send_msg.h +++ b/WeChatFerry/spy/send_msg.h @@ -17,7 +17,7 @@ typedef struct { void SendTextMessage(string wxid, string msg, string atWxids); void SendImageMessage(string wxid, string path); void SendFileMessage(string wxid, string path); -void SendXmlMessage(string receiver, string xml, string path, int type); +void SendXmlMessage(string receiver, string xml, string path, uint64_t type); void SendEmotionMessage(string wxid, string path); int SendRichTextMessage(RichText_t &rt); int SendPatMessage(string roomid, string wxid); From fe890aefebaae12490c364b437a6cd4222d42463 Mon Sep 17 00:00:00 2001 From: Changhua Date: Thu, 31 Oct 2024 23:07:22 +0800 Subject: [PATCH 10/11] Bump to v39.3.0 --- README.MD | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/README.MD b/README.MD index 79b0de4..a6a5ebc 100644 --- a/README.MD +++ b/README.MD @@ -38,6 +38,7 @@ * 发送图片消息 * 发送文件消息 * 发送卡片消息 +* 发送 XML 消息 * 发送 GIF 消息 * 拍一拍群友 * 转发消息 @@ -100,6 +101,7 @@ pip install --upgrade wcferry ## 一起开发 > 🚫 非开发用户不需要往下看。 +> > **开发用户**：可以根据文档和错误提示，自行解决编译错误的人员。 ### 安装开发环境 @@ -205,9 +207,9 @@ WeChatFerry ## 版本更新 -### v39.2.4 +### v39.3.0 -* 修复 wxid 问题 +* 适配 `3.9.11.24`
点击查看更多 @@ -219,6 +221,10 @@ WeChatFerry * `y` 是 `WeChatFerry` 的版本，从 0 开始 * `z` 是各客户端的版本，从 0 开始 +### v39.2.4 + +* 修复 wxid 问题 + ### v39.2.3 * 实现发送 GIF From af34a151d5e70ecb036cd32eddf7f50ea1534bff Mon Sep 17 00:00:00 2001 From: Changhua Date: Thu, 31 Oct 2024 23:16:08 +0800 Subject: [PATCH 11/11] Bump to v39.3.0 --- README.MD | 2 +- WeChatFerry/spy/spy.aps | Bin 2612 -> 2612 bytes WeChatFerry/spy/spy.rc | 8 ++++---- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.MD b/README.MD index a6a5ebc..a5ec8e4 100644 --- a/README.MD +++ b/README.MD @@ -209,7 +209,7 @@ WeChatFerry ### v39.3.0 -* 适配 `3.9.11.24` +* 适配 `3.9.11.25`
点击查看更多 diff --git a/WeChatFerry/spy/spy.aps b/WeChatFerry/spy/spy.aps index 1c00a30d35eec932acc8280af45bc1cd0d94584b..9a2d14615a1ade6b64b35523c2ca58ff7c926d61 100644 GIT binary patch delta 50 zcmdlYvPEP88$UCHIs*uBGB7hpGH_4kXZy}-%%I0$u$h}(nUUQP$TVUw-E7M7pAi7f C?g)DT delta 50 zcmdlYvPEP88$T0+Is*d(3j-$uGlMh(*JOUS@2o})dJHC;x!IK&*$se9BL?%$rX2qn E0nV)mg8%>k diff --git a/WeChatFerry/spy/spy.rc b/WeChatFerry/spy/spy.rc index 381b4eb..1c1c4e9 100644 --- a/WeChatFerry/spy/spy.rc +++ b/WeChatFerry/spy/spy.rc @@ -51,8 +51,8 @@ END // VS_VERSION_INFO VERSIONINFO - FILEVERSION 39,2,4,0 - PRODUCTVERSION 3,9,10,27 + FILEVERSION 39,3,0,0 + PRODUCTVERSION 3,9,11,25 FILEFLAGSMASK 0x3fL #ifdef _DEBUG FILEFLAGS 0x1L @@ -69,12 +69,12 @@ BEGIN BEGIN VALUE "CompanyName", "WeChatFerry" VALUE "FileDescription", "WeChatFerry" - VALUE "FileVersion", "39.2.4.0" + VALUE "FileVersion", "39.3.0.0" VALUE "InternalName", "spy.dll" VALUE "LegalCopyright", "Copyright (C) 2023" VALUE "OriginalFilename", "spy.dll" VALUE "ProductName", "WeChatFerry" - VALUE "ProductVersion", "3.9.10.27" + VALUE "ProductVersion", "3.9.11.25" END END BLOCK "VarFileInfo"