81 lines
3.2 KiB
JavaScript
81 lines
3.2 KiB
JavaScript
// 微信8.0.56 真实发送类名捕获脚本
|
||
// 策略：Hook WCDB写入 + OkHttp/网络层，捕获真实调用栈
|
||
|
||
var results = {
|
||
send_classes: [],
|
||
sns_classes: [],
|
||
network_calls: [],
|
||
db_writes: []
|
||
};
|
||
|
||
// 1. Hook WCDB SQLiteDatabase.insert - 捕获消息写入调用栈
|
||
try {
|
||
var WCDBClass = Java.use('com.tencent.wcdb.database.SQLiteDatabase');
|
||
WCDBClass.insert.overload('java.lang.String', 'java.lang.String', 'android.content.ContentValues').implementation = function(table, nullColumnHack, values) {
|
||
var result = this.insert(table, nullColumnHack, values);
|
||
if (table === 'message' || table === 'SnsInfo' || table === 'StarSnsInfo') {
|
||
var stack = Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Exception').$new()).split('\n');
|
||
var relevant = stack.filter(function(s) { return s.indexOf('com.tencent.mm') > -1 && s.indexOf('wcdb') === -1; }).slice(0, 8);
|
||
send({type: 'db_write', table: table, stack: relevant.join('\n'), rowId: result});
|
||
}
|
||
return result;
|
||
};
|
||
console.log('[+] WCDB insert hooked');
|
||
} catch(e) { console.log('[-] WCDB insert hook failed: ' + e); }
|
||
|
||
// 2. Hook OkHttp3 发送请求 - 捕获微信HTTP请求
|
||
try {
|
||
var OkHttpClient = Java.use('okhttp3.OkHttpClient');
|
||
var Request = Java.use('okhttp3.Request');
|
||
var RealCall = Java.use('okhttp3.internal.connection.RealCall');
|
||
RealCall.execute.implementation = function() {
|
||
var req = this.request();
|
||
var url = req.url().toString();
|
||
if (url.indexOf('weixin') > -1 || url.indexOf('wx') > -1 || url.indexOf('mm') > -1) {
|
||
var stack = Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Exception').$new()).split('\n');
|
||
var relevant = stack.filter(function(s) { return s.indexOf('com.tencent.mm') > -1; }).slice(0, 6);
|
||
send({type: 'network', url: url, stack: relevant.join('\n')});
|
||
}
|
||
return this.execute();
|
||
};
|
||
console.log('[+] OkHttp3 hooked');
|
||
} catch(e) { console.log('[-] OkHttp3 hook failed: ' + e); }
|
||
|
||
// 3. Hook MMProtocol/网络发送 - 微信自己的协议层
|
||
var netClasses = [
|
||
'com.tencent.mm.protocal.MMProtocol',
|
||
'com.tencent.mm.network.MMNetworkManager',
|
||
'com.tencent.mm.sdk.platformtools.NetWorkUtil',
|
||
'com.tencent.mm.model.b',
|
||
'com.tencent.mm.model.c',
|
||
'com.tencent.mm.model.d',
|
||
];
|
||
netClasses.forEach(function(cls) {
|
||
try {
|
||
var C = Java.use(cls);
|
||
send({type: 'found_class', cls: cls});
|
||
} catch(e) {}
|
||
});
|
||
|
||
// 4. 枚举所有已加载的 com.tencent.mm.model.* 类（发送消息通常在model层）
|
||
Java.enumerateLoadedClasses({
|
||
onMatch: function(name) {
|
||
if (name.indexOf('com.tencent.mm.model') > -1 ||
|
||
name.indexOf('com.tencent.mm.protocal') > -1 ||
|
||
name.indexOf('com.tencent.mm.network') > -1 ||
|
||
name.indexOf('SnsUpload') > -1 ||
|
||
name.indexOf('SendMsg') > -1 ||
|
||
name.indexOf('ChatMsg') > -1) {
|
||
send({type: 'class_found', name: name});
|
||
}
|
||
},
|
||
onComplete: function() {
|
||
send({type: 'enum_done'});
|
||
}
|
||
});
|
||
|
||
console.log('[*] Hook setup complete. Waiting for user to send a message...');
|
||
rpc.exports = {
|
||
getResults: function() { return results; }
|
||
};
|