feat: publish workphone SDK deployment and API docs

2026-07-14 18:10:52 +08:00
commit 021d633cc1
534 changed files with 122391 additions and 0 deletions
--- a/sdk/agent/hook/hook_capture_send.js
+++ b/sdk/agent/hook/hook_capture_send.js
@@ -0,0 +1,80 @@
+// 微信8.0.56 真实发送类名捕获脚本
+// 策略：Hook WCDB写入 + OkHttp/网络层，捕获真实调用栈
+
+var results = {
+    send_classes: [],
+    sns_classes: [],
+    network_calls: [],
+    db_writes: []
+};
+
+// 1. Hook WCDB SQLiteDatabase.insert - 捕获消息写入调用栈
+try {
+    var WCDBClass = Java.use('com.tencent.wcdb.database.SQLiteDatabase');
+    WCDBClass.insert.overload('java.lang.String', 'java.lang.String', 'android.content.ContentValues').implementation = function(table, nullColumnHack, values) {
+        var result = this.insert(table, nullColumnHack, values);
+        if (table === 'message' || table === 'SnsInfo' || table === 'StarSnsInfo') {
+            var stack = Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Exception').$new()).split('\n');
+            var relevant = stack.filter(function(s) { return s.indexOf('com.tencent.mm') > -1 && s.indexOf('wcdb') === -1; }).slice(0, 8);
+            send({type: 'db_write', table: table, stack: relevant.join('\n'), rowId: result});
+        }
+        return result;
+    };
+    console.log('[+] WCDB insert hooked');
+} catch(e) { console.log('[-] WCDB insert hook failed: ' + e); }
+
+// 2. Hook OkHttp3 发送请求 - 捕获微信HTTP请求
+try {
+    var OkHttpClient = Java.use('okhttp3.OkHttpClient');
+    var Request = Java.use('okhttp3.Request');
+    var RealCall = Java.use('okhttp3.internal.connection.RealCall');
+    RealCall.execute.implementation = function() {
+        var req = this.request();
+        var url = req.url().toString();
+        if (url.indexOf('weixin') > -1 || url.indexOf('wx') > -1 || url.indexOf('mm') > -1) {
+            var stack = Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Exception').$new()).split('\n');
+            var relevant = stack.filter(function(s) { return s.indexOf('com.tencent.mm') > -1; }).slice(0, 6);
+            send({type: 'network', url: url, stack: relevant.join('\n')});
+        }
+        return this.execute();
+    };
+    console.log('[+] OkHttp3 hooked');
+} catch(e) { console.log('[-] OkHttp3 hook failed: ' + e); }
+
+// 3. Hook MMProtocol/网络发送 - 微信自己的协议层
+var netClasses = [
+    'com.tencent.mm.protocal.MMProtocol',
+    'com.tencent.mm.network.MMNetworkManager',
+    'com.tencent.mm.sdk.platformtools.NetWorkUtil',
+    'com.tencent.mm.model.b',
+    'com.tencent.mm.model.c',
+    'com.tencent.mm.model.d',
+];
+netClasses.forEach(function(cls) {
+    try {
+        var C = Java.use(cls);
+        send({type: 'found_class', cls: cls});
+    } catch(e) {}
+});
+
+// 4. 枚举所有已加载的 com.tencent.mm.model.* 类（发送消息通常在model层）
+Java.enumerateLoadedClasses({
+    onMatch: function(name) {
+        if (name.indexOf('com.tencent.mm.model') > -1 ||
+            name.indexOf('com.tencent.mm.protocal') > -1 ||
+            name.indexOf('com.tencent.mm.network') > -1 ||
+            name.indexOf('SnsUpload') > -1 ||
+            name.indexOf('SendMsg') > -1 ||
+            name.indexOf('ChatMsg') > -1) {
+            send({type: 'class_found', name: name});
+        }
+    },
+    onComplete: function() {
+        send({type: 'enum_done'});
+    }
+});
+
+console.log('[*] Hook setup complete. Waiting for user to send a message...');
+rpc.exports = {
+    getResults: function() { return results; }
+};