82 lines
2.5 KiB
Python
82 lines
2.5 KiB
Python
#!/usr/bin/env python3
|
|
# -*- coding: utf-8 -*-
|
|
"""查询微信DB表结构和真实数据"""
|
|
import frida, time, json, subprocess
|
|
|
|
PHONE_IP = "192.168.110.80"
|
|
FRIDA_PORT = 27042
|
|
BASE = "/Users/karuo/Documents/开发/2、私域银行/工作手机"
|
|
HOOK_JS = BASE + "/sdk/agent/hook/wechat_full_control.js"
|
|
|
|
# 动态获取PID
|
|
result = subprocess.run(
|
|
["adb", "-s", f"{PHONE_IP}:5555", "shell", "ps -A | grep 'com.tencent.mm$'"],
|
|
capture_output=True, text=True
|
|
)
|
|
pid_line = result.stdout.strip()
|
|
WECHAT_PID = int(pid_line.split()[1]) if pid_line else 9462
|
|
print(f"微信PID: {WECHAT_PID}")
|
|
|
|
dm = frida.get_device_manager()
|
|
device = dm.add_remote_device(f"{PHONE_IP}:{FRIDA_PORT}")
|
|
session = device.attach(WECHAT_PID)
|
|
|
|
events = []
|
|
def on_msg(m, d):
|
|
if m.get("type") == "send":
|
|
p = m["payload"]
|
|
events.append(p)
|
|
if p.get("type") in ("ready", "hook_ok", "real_send_captured"):
|
|
print(f" [EVENT:{p.get('type')}] {json.dumps(p, ensure_ascii=False)[:120]}")
|
|
|
|
with open(HOOK_JS, encoding="utf-8") as f:
|
|
src = f.read()
|
|
script = session.create_script(src)
|
|
script.on("message", on_msg)
|
|
script.load()
|
|
time.sleep(3)
|
|
rpc = script.exports_sync
|
|
|
|
schema_info = {}
|
|
|
|
tables = ["SnsInfo", "label", "labelcontact", "conversation", "message", "rcontact", "chatroom"]
|
|
for t in tables:
|
|
r = rpc.raw_query({"sql": f"PRAGMA table_info({t})"})
|
|
cols = [row.get("name","") for row in r.get("rows", [])]
|
|
schema_info[t] = cols
|
|
print(f"\n=== {t} 字段: {cols}")
|
|
|
|
# 查rcontact type=3前5条
|
|
print("\n=== rcontact type=3 前5条 ===")
|
|
r6 = rpc.raw_query({"sql": "SELECT username, nickname, conRemark, type FROM rcontact WHERE type=3 LIMIT 5"})
|
|
for row in r6.get("rows", []):
|
|
print(f" {row}")
|
|
|
|
# 查DB实例
|
|
print("\n=== DB实例 ===")
|
|
r7 = rpc.get_db_info()
|
|
print(json.dumps(r7, ensure_ascii=False, indent=2))
|
|
|
|
# 查捕获的调用栈
|
|
print("\n=== 捕获的调用栈 ===")
|
|
r8 = rpc.get_captured_stack()
|
|
print(json.dumps(r8, ensure_ascii=False, indent=2))
|
|
|
|
# 查SnsInfo数据
|
|
print("\n=== SnsInfo前3条 ===")
|
|
r9 = rpc.raw_query({"sql": "SELECT * FROM SnsInfo LIMIT 3"})
|
|
print(json.dumps(r9, ensure_ascii=False, indent=2))
|
|
|
|
# 查label数据
|
|
print("\n=== label前5条 ===")
|
|
r10 = rpc.raw_query({"sql": "SELECT * FROM label LIMIT 5"})
|
|
print(json.dumps(r10, ensure_ascii=False, indent=2))
|
|
|
|
# 保存schema
|
|
with open(BASE + "/db_schema_20260518.json", "w", encoding="utf-8") as f:
|
|
json.dump(schema_info, f, ensure_ascii=False, indent=2)
|
|
print(f"\nSchema已保存")
|
|
|
|
session.detach()
|
|
print("完成！")
|