forked from JaveleyQAQ/WeChatOpenDevTools-Python
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathhook.js
More file actions
79 lines (70 loc) · 2.52 KB
/
hook.js
File metadata and controls
79 lines (70 loc) · 2.52 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
;
//获取WeChatAppEx.exe的基址
var base = Process.findModuleByName("WeChatAppEx.exe").base
for (let key in address) {
address[key] = base.add(address[key]);
}
function readStdString(s) {
var flag = s.add(23).readU8()
if (flag == 0x80) {
// 从堆中读取
var size = s.add(8).readUInt()
return s.readPointer().readUtf8String(size)
} else {
// 从栈中读取
return s.readUtf8String(flag)
}
}
function writeStdString(s, content) {
var flag = s.add(23).readU8()
if (flag == 0x80) {
// 从堆中写入
var orisize = s.add(8).readUInt()
if (content.length > orisize) {
throw "must below orisize!"
}
s.readPointer().writeUtf8String(content)
s.add(8).writeUInt(content.length)
} else {
// 从栈中写入
if (content.length > 22) {
throw "max 23 for stack str"
}
s.writeUtf8String(content)
s.add(23).writeU8(content.length)
}
}
//过新版8555检测
if(address.MenuItemDevToolsString){
var menuItemDevToolsStringCr = new Uint8Array(address.MenuItemDevToolsString.readByteArray(7));
var intptr_ = (menuItemDevToolsStringCr[3] & 0xFF) | ((menuItemDevToolsStringCr[4] & 0xFF) << 8) | ((menuItemDevToolsStringCr[5] & 0xFF) << 16) | ((menuItemDevToolsStringCr[6] & 0xFF) << 24);
var menuItemDevToolsStringPtrData = address.MenuItemDevToolsString.add(intptr_+7);
Memory.protect(menuItemDevToolsStringPtrData, 8, 'rw-')
menuItemDevToolsStringPtrData.writeUtf8String("DevTools");
}
Interceptor.attach(address.LaunchAppletBegin, {
onEnter(args) {
send("[+] HOOK到小程序加载! " + readStdString(args[1]))
for (var i = 0; i < 0x1000; i+=8) {
try {
var s = readStdString(args[2].add(i))
var s1 = s.replaceAll("md5", "md6")
.replaceAll('"enable_vconsole":false', '"enable_vconsole": true')
.replaceAll('"frameset":false', '"frameset": true')
//"frameset":false
if (s !== s1) {
//send(s1)
writeStdString(args[2].add(i), s1)
}
} catch (a) {
}
}
}
})
Interceptor.attach(address.WechatAppHtml, {
onEnter(args) {
this.context.rdx = address.WechatWebHtml;
send("[+] 已还原完整F12")
}
})
send("[+] WeChatAppEx.exe 注入成功!")