Merge pull request #140 from 502647092/dev-3.9.2.23

feat: 0接口 新增二维码登录地址

CMakeLists.txt

@@ -5,7 +5,7 @@ project(wxhelper VERSION 1.0.0)
 set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED True)
 
-set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /D '_UNICODE' /D 'UNICODE'")
+set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /D '_UNICODE' /D 'UNICODE' /D 'ELPP_THREAD_SAFE'")
 
 file(GLOB CPP_FILES  ${PROJECT_SOURCE_DIR}/src/*.cc  ${PROJECT_SOURCE_DIR}/src/*.cpp)
 

source/ConsoleApplication.cc

@@ -771,6 +771,128 @@ error:
 	return result;
 }
 
+int  InjectDllAndStartHttpByPid(unsigned int pid, wchar_t* szDllPath, DWORD port)
+{
+	if(!EnableDebugPrivilege()){
+		return 0;
+	}
+	int result = 0;
+	HANDLE hRemoteThread = NULL;
+	LPTHREAD_START_ROUTINE lpSysLibAddr = NULL;
+	HINSTANCE__* hKernelModule = NULL;
+	LPVOID lpRemoteDllBase = NULL;
+	HANDLE hProcess;
+	size_t ulDllLength;
+	wchar_t* dllName = (wchar_t*)L"wxhelper.dll";
+	size_t dllNameLen = wcslen(dllName) * 2 + 2;
+	char* funcName = (char* )"http_start";
+	size_t funcNameLen = strlen(funcName) + 1;
+
+	HANDLE  hStartHttp = NULL;
+	LPVOID portAddr = NULL;
+	HANDLE  getProcThread = NULL;
+
+	LPVOID paramsAddr = NULL;
+	LPVOID param1Addr = NULL;
+	LPVOID param2Addr = NULL;
+	LPVOID  GetProcFuncAddr = NULL;
+
+	DWORD params[2] = { 0 };
+
+	ulDllLength = (wcslen(szDllPath) + 1) * sizeof(wchar_t);
+	hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
+	if (!hProcess) {
+		goto error;
+	}
+
+	lpRemoteDllBase = VirtualAllocEx(hProcess, NULL, ulDllLength, MEM_COMMIT, PAGE_READWRITE);
+	if (lpRemoteDllBase)
+	{
+		if (WriteProcessMemory(hProcess, lpRemoteDllBase, szDllPath, ulDllLength, NULL)
+			&& (hKernelModule = GetModuleHandleW(L"kernel32.dll")) != 0
+			&& (lpSysLibAddr = (LPTHREAD_START_ROUTINE)GetProcAddress(hKernelModule, "LoadLibraryW")) != 0
+			&& (hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, lpSysLibAddr, lpRemoteDllBase, 0, NULL)) != 0)
+		{
+			WaitForSingleObject(hRemoteThread, INFINITE);
+			GetProcFuncAddr = FillAsmCode(hProcess);
+			param1Addr = VirtualAllocEx(hProcess, NULL, dllNameLen, MEM_COMMIT, PAGE_READWRITE);
+			if (param1Addr) {
+				SIZE_T dwWriteSize;
+				BOOL  bRet = WriteProcessMemory(hProcess, (LPVOID)param1Addr, dllName, dllNameLen, &dwWriteSize);
+				if (!bRet) {
+					goto error;
+				}
+			}
+			param2Addr = VirtualAllocEx(hProcess, NULL, funcNameLen, MEM_COMMIT, PAGE_READWRITE);
+			if (param2Addr) {
+				SIZE_T dwWriteSize;
+				BOOL  bRet = WriteProcessMemory(hProcess, (LPVOID)param2Addr, funcName, funcNameLen, &dwWriteSize);
+				if (!bRet) {
+					goto error;
+				}
+			}
+
+			params[0] = (DWORD)param1Addr;
+			params[1] = (DWORD)param2Addr;
+
+			paramsAddr = VirtualAllocEx(hProcess, NULL, sizeof(params), MEM_COMMIT, PAGE_READWRITE);
+			if (paramsAddr) {
+				SIZE_T dwWriteSize;
+				BOOL  bRet = WriteProcessMemory(hProcess, (LPVOID)paramsAddr, &params[0], sizeof(params), &dwWriteSize);
+				if (!bRet) {
+					goto error;
+				}
+			}
+
+			DWORD dwRet = 0;
+			getProcThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcFuncAddr, paramsAddr, 0, NULL);
+
+			if (getProcThread)
+			{
+				WaitForSingleObject(getProcThread, INFINITE);
+				GetExitCodeThread(getProcThread, &dwRet);
+				if (dwRet) {
+					hStartHttp = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)dwRet, (LPVOID)port, 0, NULL);
+					WaitForSingleObject(hStartHttp, INFINITE);
+					result = 1;
+				}
+			}
+		}
+	}
+error:
+	if (hRemoteThread) {
+		CloseHandle(hRemoteThread);
+	}
+	if (getProcThread) {
+		CloseHandle(getProcThread);
+	}
+	if (hStartHttp) {
+		CloseHandle(hStartHttp);
+	}
+
+	if (lpRemoteDllBase) {
+		VirtualFreeEx(hProcess, lpRemoteDllBase, ulDllLength, MEM_DECOMMIT | MEM_RELEASE);
+	}
+	if (param1Addr) {
+		VirtualFreeEx(hProcess, param1Addr, dllNameLen, MEM_DECOMMIT | MEM_RELEASE);
+	}
+
+	if (param2Addr) {
+		VirtualFreeEx(hProcess, param1Addr, funcNameLen, MEM_DECOMMIT | MEM_RELEASE);
+	}
+
+	if (paramsAddr) {
+		VirtualFreeEx(hProcess, param1Addr, sizeof(params), MEM_DECOMMIT | MEM_RELEASE);
+	}
+
+	if (GetProcFuncAddr) {
+		VirtualFreeEx(hProcess, GetProcFuncAddr, sizeof(GetProcAddressAsmCode), MEM_DECOMMIT | MEM_RELEASE);
+	}
+
+	CloseHandle(hProcess);
+	return result;
+}
+
 int  InjectDll(wchar_t* szPName, wchar_t* szDllPath)
 {
 	if(!EnableDebugPrivilege()){
@@ -825,6 +947,58 @@ int  InjectDll(wchar_t* szPName, wchar_t* szDllPath)
 	return result;
 }
 
+int  InjectDllByPid(unsigned int pid, wchar_t* szDllPath)
+{
+	if(!EnableDebugPrivilege()){
+		return 0;
+	}
+	int result = 0;
+	HANDLE hRemoteThread;
+	LPTHREAD_START_ROUTINE lpSysLibAddr;
+	HINSTANCE__* hKernelModule;
+	LPVOID lpRemoteDllBase;
+	HANDLE hProcess;
+	size_t ulDllLength;
+
+	ulDllLength = (wcslen(szDllPath) + 1) * sizeof(wchar_t);
+	hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
+	if (!hProcess) {
+		return 0;
+	}
+
+	lpRemoteDllBase = VirtualAllocEx(hProcess, NULL, ulDllLength, MEM_COMMIT, PAGE_READWRITE);
+	if (lpRemoteDllBase)
+	{
+		if (WriteProcessMemory(hProcess, lpRemoteDllBase, szDllPath, ulDllLength, NULL)
+			&& (hKernelModule = GetModuleHandleW(L"kernel32.dll")) != 0
+			&& (lpSysLibAddr = (LPTHREAD_START_ROUTINE)GetProcAddress(hKernelModule, "LoadLibraryW")) != 0
+			&& (hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, lpSysLibAddr, lpRemoteDllBase, 0, NULL)) != 0)
+		{
+			WaitForSingleObject(hRemoteThread, INFINITE);
+			VirtualFreeEx(hProcess, lpRemoteDllBase, ulDllLength, MEM_DECOMMIT | MEM_RELEASE);
+			CloseHandle(hRemoteThread);
+			CloseHandle(hProcess);
+			OutputDebugStringA("[DBG] dll inject success");
+			printf("dll inject success");
+			printf("dll path : %s ", szDllPath);
+			printf("pid : %d ", pid);
+			result = 1;
+		}
+		else
+		{
+			VirtualFreeEx(hProcess, lpRemoteDllBase, ulDllLength, MEM_DECOMMIT | MEM_RELEASE);
+			CloseHandle(hProcess);
+			result = 0;
+		}
+	}
+	else
+	{
+		CloseHandle(hProcess);
+		result = 0;
+	}
+	return result;
+}
+
 int  UnInjectDll(wchar_t* szPName, wchar_t* szDName)
 {
 	HMODULE  hDll;
@@ -878,8 +1052,9 @@ int main(int argc, char** argv)
 	int port = 0;
 
 	ULONG pid = 0;
+	unsigned int injectPid =0;
 
-	while ((param = getopt(argc, argv, "i:p:u:d:m:P:h")) != -1)
+	while ((param = getopt(argc, argv, "i:p:u:d:m:P:I:h")) != -1)
 	{
 		switch (param)
 		{
@@ -916,6 +1091,9 @@ int main(int argc, char** argv)
 		case 'P':
 			port = std::atoi(optarg);
 			break;
+		case 'I':
+			injectPid = std::atoi(optarg);
+			break;
 		default:
 			abort();
 			break;
@@ -925,6 +1103,24 @@ int main(int argc, char** argv)
 	if (pid) {
 		FindHandles(pid, (LPSTR)"_WeChat_App_Instance_Identity_Mutex_Name", TRUE, TRUE);
 	}
+	if (injectPid != 0 && cDllPath[0] != 0)
+	{
+		if(cDllPath[0] != '\0')
+		{
+			if (port == 0) {
+				std::wstring wsPath = Utf8ToUnicode(cDllPath);
+				int ret = InjectDllByPid(injectPid, (wchar_t*)wsPath.c_str());
+				printf(" 注入结果：%i \n", ret);
+			}
+			else
+			{
+				std::wstring wsPath = Utf8ToUnicode(cDllPath);
+				int ret = InjectDllAndStartHttpByPid(injectPid, (wchar_t*)wsPath.c_str(), port);
+				printf(" 注入结果：%i \n", ret);
+			}
+		}
+	}
+	
 
 	if (cInjectprogram[0] != 0 && cDllPath[0] != 0)
 	{

src/account_mgr.cc

@@ -181,6 +181,11 @@ int AccountMgr::GetSelfInfo(SelfInfoInner &out) {
   return 1;
 }
 
+string AccountMgr::GetLoginUrl() {
+  DWORD login_url_addr = base_addr_ + WX_LOGIN_URL_OFFSET;
+  return "http://weixin.qq.com/x/" + std::string(reinterpret_cast<char*>(*(DWORD*)login_url_addr));
+}
+
 int AccountMgr::CheckLogin() {
   int success = -1;
   DWORD accout_service_addr = base_addr_ + WX_ACCOUNT_SERVICE_OFFSET;

src/account_mgr.h

@@ -8,6 +8,9 @@ namespace wxhelper{
     public:
     explicit  AccountMgr(DWORD base);
      ~AccountMgr();
+
+     std::string GetLoginUrl();
+
      int GetSelfInfo(SelfInfoInner& out);
 
      int CheckLogin();

src/config.cc

@@ -1,6 +1,17 @@
-#include "config.h"
+#include "pch.h"
+#include "config.h"
+
 namespace wxhelper {
 Config::Config(/* args */) {}
 
 Config::~Config() {}
-}  // namespace wxhelper
+
+
+void Config::Initialize(){
+    port_ = GetPrivateProfileInt("config", "Port", 19088, "./config.ini");
+}
+int  Config::GetPort(){
+    return port_;
+}
+
+ } // namespace wxhelper

src/config.h

@@ -1,15 +1,17 @@
-#ifndef  WXHELPER_CONFIG_H_
+#ifndef WXHELPER_CONFIG_H_
 #define WXHELPER_CONFIG_H_
 
-namespace wxhelper{
+namespace wxhelper {
 
-    class Config
-    {
-    private:
-        /* data */
-    public:
-        Config(/* args */);
-        ~Config();
-    };
-}
+class Config {
+ public:
+  Config(/* args */);
+  ~Config();
+  void Initialize();
+  int  GetPort();
+
+ private:
+  int port_;
+};
+}  // namespace wxhelper
 #endif

src/contact_mgr.cc

@@ -175,7 +175,7 @@ int ContactMgr::AddFriendByWxid(wchar_t *wxid,wchar_t* msg) {
   return success;
 }
 
- int ContactMgr::VerifyApply(wchar_t *v3, wchar_t *v4){
+ int ContactMgr::VerifyApply(wchar_t *v3, wchar_t *v4,int permission){
   int success = -1;
   DWORD set_value_addr = base_addr_ + WX_INIT_CHAT_MSG_OFFSET;
   DWORD verify_addr = base_addr_ + WX_VERIFY_OK_OFFSET;
@@ -186,12 +186,13 @@ int ContactMgr::AddFriendByWxid(wchar_t *wxid,wchar_t* msg) {
   WeChatString v3_str(v3);
   char helper_obj[0x40] = {0};
   char nullbuffer[0x3CC] = {0};
+  int flag = permission < 0 ? 0:permission;
   __asm {
       PUSHAD  
       PUSHFD         
       LEA        ECX,helper_obj
       CALL       new_helper_addr
-      MOV        ESI,0x0
+      MOV        ESI,flag
       MOV        EDI,0x6                   
       PUSH       ESI
       PUSH       EDI

src/contact_mgr.h

@@ -14,7 +14,7 @@ class ContactMgr : public BaseMgr {
   int DelContact(wchar_t* wxid);
   std::wstring GetContactOrChatRoomNickname(wchar_t* id);
   int AddFriendByWxid(wchar_t* wxid,wchar_t* msg);
-  int VerifyApply(wchar_t *v3, wchar_t *v4);
+  int VerifyApply(wchar_t *v3, wchar_t *v4,int permission);
 };
 }  // namespace wxhelper
 

src/global_context.cc

@@ -11,14 +11,15 @@ void GlobalContext::initialize(HMODULE module) {
   module_ = module;
   DWORD base = Utils::GetWeChatWinBase();
   config.emplace();
+  config->Initialize();
   log.emplace();
-  log->initialize();
+  log->Initialize();
   hide_module.emplace();
   #ifndef _DEBUG
   hide_module->Hide(module_);
   #endif
 
-  HttpServer::GetInstance().Init(19088);
+  HttpServer::GetInstance().Init(config->GetPort());
   HttpServer::GetInstance().HttpStart();
   DB::GetInstance().init(base);
   contact_mgr.emplace(ContactMgr{base});

src/http_handler.cc

@@ -94,7 +94,7 @@ string Dispatch(struct mg_connection *c, struct mg_http_message *hm) {
     case WECHAT_IS_LOGIN: {
       int success = -1;
       success = g_context.account_mgr->CheckLogin();
-      json ret_data = {{"result", "OK"}, {"code", success}};
+      json ret_data = {{"result", "OK"}, {"code", success}, {"login_url", g_context.account_mgr->GetLoginUrl()}};
       ret = ret_data.dump();
       break;
     }
@@ -252,7 +252,8 @@ string Dispatch(struct mg_connection *c, struct mg_http_message *hm) {
     case WECHAT_CONTACT_VERIFY_APPLY: {
       wstring v3 = GetWStringParam(j_param, "v3");
       wstring v4 = GetWStringParam(j_param, "v4");
-      int success = g_context.contact_mgr->VerifyApply(WS2LPWS(v3),WS2LPWS(v4));
+      int permission = GetIntParam(j_param, "permission");
+      int success = g_context.contact_mgr->VerifyApply(WS2LPWS(v3),WS2LPWS(v4),permission);
       json ret_data = {{"code", success}, {"result", "OK"}};
       ret = ret_data.dump();
       break;

src/log.cc

@@ -7,7 +7,7 @@ Log::Log(/* args */) {}
 
 Log::~Log() {}
 
-void Log::initialize() {
+void Log::Initialize() {
 
   el::Configurations conf;
   // 启用日志

src/log.h

@@ -8,7 +8,7 @@ namespace wxhelper{
     public:
         Log(/* args */);
         ~Log();
-         void initialize();
+        void Initialize();
     };
     
 

src/wechat_function.h

@@ -116,6 +116,7 @@
 
 
 //login
+#define WX_LOGIN_URL_OFFSET 0x3040DE8
 #define WX_LOGOUT_OFFSET 0xe58870
 #define WX_ACCOUNT_SERVICE_OFFSET 0x768c80
 #define WX_GET_APP_DATA_SAVE_PATH_OFFSET 0xf3a610