diff --git a/WeChatFerry/spy/receive_msg.cpp b/WeChatFerry/spy/receive_msg.cpp
index 53cb55d..f99793e 100644
--- a/WeChatFerry/spy/receive_msg.cpp
+++ b/WeChatFerry/spy/receive_msg.cpp
@@ -80,7 +80,7 @@ void ListenMessage()
         LOG_WARN("gIsListening || (g_WeChatWinDllAddr == 0)");
         return;
     }
-    funcRecvMsg = (funcRecvMsg_t)(g_WeChatWinDllAddr + g_WxCalls.recvMsg.call);
+    funcRecvMsg = (funcRecvMsg_t)(g_WeChatWinDllAddr + 0x2206570); // TODO: Fix me
 
     status = MH_Initialize();
     if (status != MH_OK) {
@@ -88,13 +88,13 @@ void ListenMessage()
         return;
     }
 
-    status = MH_CreateHook(&funcRecvMsg, &DispatchMsg, reinterpret_cast<LPVOID *>(&realRecvMsg));
+    status = MH_CreateHook(funcRecvMsg, &DispatchMsg, reinterpret_cast<LPVOID *>(&realRecvMsg));
     if (status != MH_OK) {
         LOG_ERROR("MH_CreateHook failed: {}", to_string(status));
         return;
     }
 
-    status = MH_EnableHook(&funcRecvMsg);
+    status = MH_EnableHook(funcRecvMsg);
     if (status != MH_OK) {
         LOG_ERROR("MH_EnableHook failed: {}", to_string(status));
         return;
@@ -110,7 +110,7 @@ void UnListenMessage()
         return;
     }
 
-    status = MH_DisableHook(&funcRecvMsg);
+    status = MH_DisableHook(funcRecvMsg);
     if (status != MH_OK) {
         LOG_ERROR("MH_DisableHook failed: {}", to_string(status));
         return;
@@ -125,6 +125,10 @@ void UnListenMessage()
     gIsListening = false;
 }
 
+void ListenPyq() { }
+
+void UnListenPyq() { }
+
 #if 0
 // static DWORD reg_buffer          = 0;
 // static DWORD recvMsgHookAddr     = 0;
diff --git a/WeChatFerry/spy/rpc_server.cpp b/WeChatFerry/spy/rpc_server.cpp
index 2745b61..c450fac 100644
--- a/WeChatFerry/spy/rpc_server.cpp
+++ b/WeChatFerry/spy/rpc_server.cpp
@@ -426,7 +426,7 @@ bool func_forward_msg(uint64_t id, char *receiver, uint8_t *out, size_t *len)
 
     return true;
 }
-
+#endif
 static void PushMessage()
 {
     static uint8_t buffer[G_BUF_SIZE] = { 0 };
@@ -543,6 +543,7 @@ bool func_disable_recv_txt(uint8_t *out, size_t *len)
     return true;
 }
 
+#if 0
 bool func_exec_db_query(char *db, char *sql, uint8_t *out, size_t *len)
 {
     Response rsp  = Response_init_default;
@@ -907,7 +908,6 @@ static bool dispatcher(uint8_t *in, size_t in_len, uint8_t *out, size_t *out_len
             ret = func_forward_msg(req.msg.fm.id, req.msg.fm.receiver, out, out_len);
             break;
         }
-#if 0
         case Functions_FUNC_SEND_XML: {
             ret = func_send_xml(req.msg.xml, out, out_len);
             break;
@@ -925,6 +925,7 @@ static bool dispatcher(uint8_t *in, size_t in_len, uint8_t *out, size_t *out_len
             ret = func_disable_recv_txt(out, out_len);
             break;
         }
+#if 0
         case Functions_FUNC_EXEC_DB_QUERY: {
             ret = func_exec_db_query(req.msg.query.db, req.msg.query.sql, out, out_len);
             break;