// 微信8.0.56 真实发送类名捕获脚本
// 策略：Hook WCDB写入 + OkHttp/网络层，捕获真实调用栈

var results = {
    send_classes: [],
    sns_classes: [],
    network_calls: [],
    db_writes: []
};

// 1. Hook WCDB SQLiteDatabase.insert - 捕获消息写入调用栈
try {
    var WCDBClass = Java.use('com.tencent.wcdb.database.SQLiteDatabase');
    WCDBClass.insert.overload('java.lang.String', 'java.lang.String', 'android.content.ContentValues').implementation = function(table, nullColumnHack, values) {
        var result = this.insert(table, nullColumnHack, values);
        if (table === 'message' || table === 'SnsInfo' || table === 'StarSnsInfo') {
            var stack = Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Exception').$new()).split('\n');
            var relevant = stack.filter(function(s) { return s.indexOf('com.tencent.mm') > -1 && s.indexOf('wcdb') === -1; }).slice(0, 8);
            send({type: 'db_write', table: table, stack: relevant.join('\n'), rowId: result});
        }
        return result;
    };
    console.log('[+] WCDB insert hooked');
} catch(e) { console.log('[-] WCDB insert hook failed: ' + e); }

// 2. Hook OkHttp3 发送请求 - 捕获微信HTTP请求
try {
    var OkHttpClient = Java.use('okhttp3.OkHttpClient');
    var Request = Java.use('okhttp3.Request');
    var RealCall = Java.use('okhttp3.internal.connection.RealCall');
    RealCall.execute.implementation = function() {
        var req = this.request();
        var url = req.url().toString();
        if (url.indexOf('weixin') > -1 || url.indexOf('wx') > -1 || url.indexOf('mm') > -1) {
            var stack = Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Exception').$new()).split('\n');
            var relevant = stack.filter(function(s) { return s.indexOf('com.tencent.mm') > -1; }).slice(0, 6);
            send({type: 'network', url: url, stack: relevant.join('\n')});
        }
        return this.execute();
    };
    console.log('[+] OkHttp3 hooked');
} catch(e) { console.log('[-] OkHttp3 hook failed: ' + e); }

// 3. Hook MMProtocol/网络发送 - 微信自己的协议层
var netClasses = [
    'com.tencent.mm.protocal.MMProtocol',
    'com.tencent.mm.network.MMNetworkManager',
    'com.tencent.mm.sdk.platformtools.NetWorkUtil',
    'com.tencent.mm.model.b',
    'com.tencent.mm.model.c',
    'com.tencent.mm.model.d',
];
netClasses.forEach(function(cls) {
    try {
        var C = Java.use(cls);
        send({type: 'found_class', cls: cls});
    } catch(e) {}
});

// 4. 枚举所有已加载的 com.tencent.mm.model.* 类（发送消息通常在model层）
Java.enumerateLoadedClasses({
    onMatch: function(name) {
        if (name.indexOf('com.tencent.mm.model') > -1 ||
            name.indexOf('com.tencent.mm.protocal') > -1 ||
            name.indexOf('com.tencent.mm.network') > -1 ||
            name.indexOf('SnsUpload') > -1 ||
            name.indexOf('SendMsg') > -1 ||
            name.indexOf('ChatMsg') > -1) {
            send({type: 'class_found', name: name});
        }
    },
    onComplete: function() {
        send({type: 'enum_done'});
    }
});

console.log('[*] Hook setup complete. Waiting for user to send a message...');
rpc.exports = {
    getResults: function() { return results; }
};