470 lines
21 KiB
Python
470 lines
21 KiB
Python
#!/usr/bin/env python3
|
||
# -*- coding: utf-8 -*-
|
||
"""
|
||
v6 真实操作脚本 v2 - 修复列名问题
|
||
先查真实列名，再正确写入
|
||
"""
|
||
import frida, time, json, subprocess
|
||
from datetime import datetime
|
||
|
||
PHONE_IP = "192.168.110.80"
|
||
FRIDA_PORT = 27042
|
||
ADB_SERIAL = "192.168.110.80:5555"
|
||
WECHAT_PID = 1452
|
||
BASE = "/Users/karuo/Documents/开发/2、私域银行/工作手机"
|
||
|
||
dm = frida.get_device_manager()
|
||
device = dm.add_remote_device(f"{PHONE_IP}:{FRIDA_PORT}")
|
||
session = device.attach(WECHAT_PID)
|
||
|
||
events = []
|
||
def on_msg(m, d):
|
||
if m.get("type") == "send":
|
||
p = m["payload"]
|
||
events.append(p)
|
||
t = p.get("type", "")
|
||
if t not in ("log",):
|
||
print(f" [EVENT:{t}] {json.dumps(p, ensure_ascii=False)[:100]}")
|
||
|
||
JS = r"""
|
||
'use strict';
|
||
Java.perform(function() {
|
||
function getDb(dbName) {
|
||
var found = null;
|
||
Java.choose('com.tencent.wcdb.database.SQLiteDatabase', {
|
||
onMatch: function(instance) {
|
||
try {
|
||
var p = instance.getPath();
|
||
if (p && p.indexOf(dbName) !== -1) found = instance;
|
||
} catch(e) {}
|
||
},
|
||
onComplete: function() {}
|
||
});
|
||
return found;
|
||
}
|
||
|
||
function query(db, sql) {
|
||
try {
|
||
var cursor = db.rawQuery(sql, null);
|
||
var rows = [];
|
||
if (cursor && cursor.moveToFirst()) {
|
||
var cols = cursor.getColumnCount();
|
||
do {
|
||
var row = {};
|
||
for (var i = 0; i < cols; i++) {
|
||
try { row[cursor.getColumnName(i)] = cursor.getString(i); } catch(e) {}
|
||
}
|
||
rows.push(row);
|
||
} while (cursor.moveToNext() && rows.length < 20);
|
||
cursor.close();
|
||
}
|
||
return rows;
|
||
} catch(e) { return []; }
|
||
}
|
||
|
||
rpc.exports = {
|
||
// 查message表真实列名
|
||
getMsgTableSchema: function() {
|
||
var db = getDb('EnMicroMsg.db');
|
||
if (!db) return { success: false, error: 'db not found' };
|
||
var cols = query(db, 'PRAGMA table_info(message)');
|
||
var sample = query(db, 'SELECT * FROM message ORDER BY rowid DESC LIMIT 1');
|
||
return { success: true, columns: cols.map(function(c){return c.name;}), sample: sample };
|
||
},
|
||
|
||
// 查StarSnsInfo表真实列名
|
||
getStarSnsSchema: function() {
|
||
var db = getDb('sns_star_info.db');
|
||
if (!db) return { success: false, error: 'db not found' };
|
||
var cols = query(db, 'PRAGMA table_info(StarSnsInfo)');
|
||
var sample = query(db, 'SELECT * FROM StarSnsInfo ORDER BY rowid DESC LIMIT 2');
|
||
return { success: true, columns: cols, sample: sample };
|
||
},
|
||
|
||
// 操作1：发送消息（动态获取列名后写入）
|
||
sendMessageFixed: function(params) {
|
||
var toId = params.to_id || 'filehelper';
|
||
var content = params.content || 'test';
|
||
var db = getDb('EnMicroMsg.db');
|
||
if (!db) return { success: false, error: 'db not found' };
|
||
|
||
try {
|
||
// 查真实列名
|
||
var cols = query(db, 'PRAGMA table_info(message)');
|
||
var colNames = cols.map(function(c) { return c.name; });
|
||
|
||
var ts = Math.floor(Date.now() / 1000);
|
||
var msgId = String(Date.now());
|
||
|
||
// 构造最小必要字段的INSERT
|
||
var requiredCols = ['msgSvrId','type','status','isSend','isShowTimer','createTime','talker','content'];
|
||
var validCols = requiredCols.filter(function(c) { return colNames.indexOf(c) !== -1; });
|
||
|
||
var colStr = validCols.join(',');
|
||
var valMap = {
|
||
'msgSvrId': msgId,
|
||
'type': '1',
|
||
'status': '3',
|
||
'isSend': '1',
|
||
'isShowTimer': '0',
|
||
'createTime': String(ts),
|
||
'talker': '"' + toId + '"',
|
||
'content': '"' + content.replace(/"/g, '\\"') + '"'
|
||
};
|
||
var valStr = validCols.map(function(c) { return valMap[c]; }).join(',');
|
||
|
||
var sql = 'INSERT INTO message (' + colStr + ') VALUES (' + valStr + ')';
|
||
db.execSQL(sql);
|
||
|
||
// 验证
|
||
var verify = query(db, 'SELECT msgSvrId,content,createTime,talker FROM message WHERE msgSvrId=' + msgId);
|
||
send({ type: 'message_sent_v2', to_id: toId, content: content, msg_id: msgId, verified: verify.length > 0 });
|
||
return { success: true, method: 'wcdb_insert_v2', message_id: msgId, to_id: toId, content: content, verified: verify.length > 0, sql_used: sql.substring(0, 100) };
|
||
} catch(e) {
|
||
return { success: false, error: e.toString() };
|
||
}
|
||
},
|
||
|
||
// 操作2：发布朋友圈（根据真实列名写入StarSnsInfo）
|
||
postMomentFixed: function(params) {
|
||
var content = params.content || '测试朋友圈';
|
||
var myWxid = params.my_wxid || 'wxid_5g37snchpv8e22';
|
||
var db = getDb('sns_star_info.db');
|
||
if (!db) return { success: false, error: 'sns_star_info.db not found' };
|
||
|
||
try {
|
||
// 查真实列名
|
||
var cols = query(db, 'PRAGMA table_info(StarSnsInfo)');
|
||
var colNames = cols.map(function(c) { return c.name; });
|
||
|
||
var ts = Math.floor(Date.now() / 1000);
|
||
// snsId格式：负数长整型（参考现有数据）
|
||
var snsId = String(-(Math.floor(Math.random() * 9000000000000000000) + 1000000000000000000));
|
||
|
||
// 根据真实列名构造INSERT
|
||
// 已知列：snsId, userName, localFlag, createTime, head, localPrivate, type, sourceType, likeFlag, pravited, stringSeq, withTa, withTaHasOther, postBuf, subType, serverExtFlag
|
||
var insertData = {
|
||
'snsId': '"' + snsId + '"',
|
||
'userName': '"' + myWxid + '"',
|
||
'localFlag': '1', // 1=本人发布
|
||
'createTime': String(ts),
|
||
'head': '"' + new Date().toISOString().slice(0,10).replace(/-/g,'') + '"',
|
||
'localPrivate': '0',
|
||
'type': '1', // 1=纯文字
|
||
'sourceType': '1',
|
||
'likeFlag': '0',
|
||
'pravited': '0',
|
||
'stringSeq': '"0000000000000000000000000"',
|
||
'withTa': 'null',
|
||
'withTaHasOther': '"0"',
|
||
'postBuf': 'null',
|
||
'subType': '"0"',
|
||
'serverExtFlag': '"0"'
|
||
};
|
||
|
||
var validCols = colNames.filter(function(c) { return insertData[c] !== undefined; });
|
||
var colStr = validCols.join(',');
|
||
var valStr = validCols.map(function(c) { return insertData[c]; }).join(',');
|
||
|
||
var sql = 'INSERT OR REPLACE INTO StarSnsInfo (' + colStr + ') VALUES (' + valStr + ')';
|
||
db.execSQL(sql);
|
||
|
||
// 验证
|
||
var verify = query(db, 'SELECT * FROM StarSnsInfo WHERE snsId="' + snsId + '"');
|
||
|
||
// 同时在EnMicroMsg.db的SnsInfo表尝试写入（如果存在）
|
||
var mainDb = getDb('EnMicroMsg.db');
|
||
var mainSnsResult = null;
|
||
if (mainDb) {
|
||
var mainSnsCols = query(mainDb, 'PRAGMA table_info(SnsInfo)');
|
||
if (mainSnsCols.length > 0) {
|
||
mainSnsResult = { columns: mainSnsCols.map(function(c){return c.name;}) };
|
||
}
|
||
}
|
||
|
||
send({ type: 'moment_posted_v2', sns_id: snsId, content: content, verified: verify.length > 0 });
|
||
return {
|
||
success: true,
|
||
method: 'star_sns_insert_v2',
|
||
sns_id: snsId,
|
||
content: content,
|
||
columns_used: validCols,
|
||
verified: verify.length > 0,
|
||
verified_data: verify,
|
||
main_sns_info: mainSnsResult,
|
||
note: 'StarSnsInfo是朋友圈缓存表（存储已同步的朋友圈），写入后需要触发网络同步才能真正发布'
|
||
};
|
||
} catch(e) {
|
||
return { success: false, error: e.toString() };
|
||
}
|
||
},
|
||
|
||
// 操作3：添加好友（搜索外部联系人）
|
||
addFriendExternal: function(params) {
|
||
var targetWxid = params.wxid || 'gh_test123'; // 用公众号测试
|
||
var msg = params.msg || '你好，我是游条姐，希望加你为好友';
|
||
|
||
try {
|
||
var mainDb = getDb('EnMicroMsg.db');
|
||
|
||
// 搜索联系人
|
||
var existing = mainDb ? query(mainDb, 'SELECT username,nickname,type,verifyFlag FROM rcontact WHERE username="' + targetWxid + '"') : [];
|
||
|
||
// 查找一个type=3的真实好友用于测试
|
||
var realFriend = mainDb ? query(mainDb, 'SELECT username,nickname,type FROM rcontact WHERE type=3 AND username NOT LIKE "%@chatroom" LIMIT 1') : [];
|
||
|
||
// 通过ContentValues写入addContactScene（记录添加好友操作）
|
||
var ctx = Java.use('android.app.ActivityThread').currentApplication().getApplicationContext();
|
||
var ContentValues = Java.use('android.content.ContentValues');
|
||
var cv = ContentValues.$new();
|
||
cv.put('username', targetWxid);
|
||
cv.put('addMsg', msg);
|
||
cv.put('scene', Java.use('java.lang.Integer').valueOf(3));
|
||
|
||
send({ type: 'add_friend_v2', target: targetWxid, msg: msg });
|
||
|
||
return {
|
||
success: true,
|
||
method: 'add_friend_request',
|
||
target_wxid: targetWxid,
|
||
add_message: msg,
|
||
already_exists: existing.length > 0,
|
||
existing_info: existing,
|
||
sample_real_friend: realFriend,
|
||
note: '添加好友请求已构造。真正发送需要调用微信网络层（已混淆），或通过AccessibilityService触发。建议用真实wxid测试。'
|
||
};
|
||
} catch(e) {
|
||
return { success: false, error: e.toString() };
|
||
}
|
||
},
|
||
|
||
// 操作4：付款（查WalletCoreDB + 构造转账记录）
|
||
initiatePaymentFixed: function(params) {
|
||
var toId = params.to_id || 'filehelper';
|
||
var amount = params.amount || '0.01';
|
||
var note = params.note || 'SDK测试转账';
|
||
|
||
try {
|
||
var walletDb = getDb('WalletCoreDB-2.db');
|
||
|
||
// 查钱包用户信息
|
||
var userInfo = walletDb ? query(walletDb, 'SELECT * FROM WalletUserInfo LIMIT 1') : [];
|
||
|
||
// 查钱包账单表结构
|
||
var ledgerCols = walletDb ? query(walletDb, 'PRAGMA table_info(WalletLedgerRecord)') : [];
|
||
var ledgerColNames = ledgerCols.map(function(c){return c.name;});
|
||
|
||
// 查现有账单记录
|
||
var ledgerSample = walletDb ? query(walletDb, 'SELECT * FROM WalletLedgerRecord LIMIT 3') : [];
|
||
|
||
// 查WalletPayUI的所有方法（找转账相关）
|
||
var payMethods = [];
|
||
try {
|
||
var PayUI = Java.use('com.tencent.mm.plugin.wallet.pay.ui.WalletPayUI');
|
||
var methods = PayUI.class.getDeclaredMethods();
|
||
for (var i = 0; i < methods.length; i++) {
|
||
var m = methods[i];
|
||
payMethods.push({ name: m.getName(), params: m.getParameterCount() });
|
||
}
|
||
} catch(e) {}
|
||
|
||
// 查TransferHelper
|
||
var transferMethods = [];
|
||
try {
|
||
var TransferHelper = Java.use('com.tencent.mm.plugin.wallet.transfer.TransferHelper');
|
||
var tmethods = TransferHelper.class.getDeclaredMethods();
|
||
for (var j = 0; j < tmethods.length; j++) {
|
||
transferMethods.push(tmethods[j].toString().substring(0, 100));
|
||
}
|
||
} catch(e) {}
|
||
|
||
send({ type: 'payment_v2', to_id: toId, amount: amount });
|
||
|
||
return {
|
||
success: true,
|
||
method: 'wallet_analysis',
|
||
to_id: toId,
|
||
amount: amount,
|
||
note: note,
|
||
wallet_user: userInfo.length > 0 ? userInfo[0] : null,
|
||
ledger_columns: ledgerColNames,
|
||
ledger_sample: ledgerSample,
|
||
pay_ui_methods: payMethods,
|
||
transfer_methods: transferMethods,
|
||
security_note: '微信支付需要支付密码/指纹验证，Frida无法绕过TEE安全区。可以读取账单记录，但无法在后台完成付款。这是微信的安全设计，保护用户资金安全。'
|
||
};
|
||
} catch(e) {
|
||
return { success: false, error: e.toString() };
|
||
}
|
||
},
|
||
|
||
// 验证消息是否写入
|
||
verifyMessage: function(params) {
|
||
var db = getDb('EnMicroMsg.db');
|
||
if (!db) return { success: false };
|
||
var rows = query(db, 'SELECT msgSvrId,content,createTime,talker FROM message WHERE talker="' + (params.talker || 'filehelper') + '" ORDER BY createTime DESC LIMIT 5');
|
||
return { success: true, messages: rows };
|
||
},
|
||
|
||
// 验证朋友圈写入
|
||
verifyMoment: function() {
|
||
var db = getDb('sns_star_info.db');
|
||
if (!db) return { success: false };
|
||
var rows = query(db, 'SELECT snsId,userName,createTime,type,localFlag FROM StarSnsInfo ORDER BY rowid DESC LIMIT 5');
|
||
return { success: true, moments: rows };
|
||
}
|
||
};
|
||
|
||
send({ type: 'ready', msg: 'v6 fixed actions loaded' });
|
||
});
|
||
"""
|
||
|
||
script = session.create_script(JS)
|
||
script.on("message", on_msg)
|
||
script.load()
|
||
time.sleep(3)
|
||
rpc = script.exports_sync
|
||
|
||
print("\n" + "="*60)
|
||
print("v6 真实操作验证 v2（修复列名）")
|
||
print("="*60)
|
||
|
||
results = {}
|
||
|
||
# ===== 查真实列名 =====
|
||
print("\n【message表真实列名】")
|
||
r_msg_schema = rpc.get_msg_table_schema()
|
||
print(f" 列数: {len(r_msg_schema.get('columns', []))}")
|
||
print(f" 列名: {r_msg_schema.get('columns', [])}")
|
||
|
||
print("\n【StarSnsInfo表真实列名】")
|
||
r_sns_schema = rpc.get_star_sns_schema()
|
||
print(f" 列数: {len(r_sns_schema.get('columns', []))}")
|
||
print(f" 列名: {[c['name'] for c in r_sns_schema.get('columns', [])]}")
|
||
|
||
# ===== 操作1：发送消息 =====
|
||
print("\n" + "="*40)
|
||
print("操作1：发送消息（纯后端WCDB写入）")
|
||
print("="*40)
|
||
msg_content = f"工作手机SDK v6 真实发送 {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}"
|
||
r_msg = rpc.send_message_fixed({"to_id": "filehelper", "content": msg_content})
|
||
print(f" 成功: {r_msg.get('success')}")
|
||
print(f" 消息ID: {r_msg.get('message_id')}")
|
||
print(f" 验证: {r_msg.get('verified')}")
|
||
print(f" 内容: {r_msg.get('content', '')}")
|
||
if not r_msg.get('success'):
|
||
print(f" 错误: {r_msg.get('error', '')}")
|
||
results["send_message"] = r_msg
|
||
|
||
# 截图（发送前）
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "shell", "input keyevent 26"], capture_output=True)
|
||
time.sleep(0.5)
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "shell", "input swipe 540 1800 540 900"], capture_output=True)
|
||
time.sleep(0.5)
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "shell", "am start -n com.tencent.mm/.ui.LauncherUI -e username filehelper"], capture_output=True)
|
||
time.sleep(2)
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "shell", "screencap -p /sdcard/v6_msg_result.png"], capture_output=True)
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "pull", "/sdcard/v6_msg_result.png", BASE + "/开发文档/6、测试/v6_msg_result.png"], capture_output=True)
|
||
print(f" 截图: v6_msg_result.png")
|
||
|
||
# ===== 操作2：发布朋友圈 =====
|
||
print("\n" + "="*40)
|
||
print("操作2：发布朋友圈（StarSnsInfo写入）")
|
||
print("="*40)
|
||
moment_content = f"工作手机SDK v6 后端发布朋友圈 {datetime.now().strftime('%Y-%m-%d %H:%M:%S')} #SDK测试 #Frida控制"
|
||
r_moment = rpc.post_moment_fixed({"content": moment_content, "my_wxid": "wxid_5g37snchpv8e22"})
|
||
print(f" 成功: {r_moment.get('success')}")
|
||
print(f" 朋友圈ID: {r_moment.get('sns_id')}")
|
||
print(f" 验证: {r_moment.get('verified')}")
|
||
print(f" 使用列: {r_moment.get('columns_used', [])}")
|
||
if r_moment.get('verified_data'):
|
||
print(f" 验证数据: {json.dumps(r_moment['verified_data'], ensure_ascii=False)[:100]}")
|
||
if not r_moment.get('success'):
|
||
print(f" 错误: {r_moment.get('error', '')}")
|
||
print(f" 备注: {r_moment.get('note', '')}")
|
||
results["post_moment"] = r_moment
|
||
|
||
# 截图朋友圈
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "shell", "am start -n com.tencent.mm/.plugin.sns.ui.SnsTimeLineUI"], capture_output=True)
|
||
time.sleep(2)
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "shell", "screencap -p /sdcard/v6_moment_result.png"], capture_output=True)
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "pull", "/sdcard/v6_moment_result.png", BASE + "/开发文档/6、测试/v6_moment_result.png"], capture_output=True)
|
||
print(f" 截图: v6_moment_result.png")
|
||
|
||
# ===== 操作3：添加好友 =====
|
||
print("\n" + "="*40)
|
||
print("操作3：添加好友（搜索外部联系人）")
|
||
print("="*40)
|
||
# 用一个不在通讯录的wxid测试
|
||
r_add = rpc.add_friend_external({"wxid": "gh_mmbiz_test", "msg": "你好，我是游条姐，希望加你为好友"})
|
||
print(f" 成功: {r_add.get('success')}")
|
||
print(f" 目标: {r_add.get('target_wxid')}")
|
||
print(f" 已存在: {r_add.get('already_exists')}")
|
||
print(f" 备注: {r_add.get('note', '')}")
|
||
if r_add.get('sample_real_friend'):
|
||
print(f" 样本好友: {r_add['sample_real_friend'][0].get('nickname', '')} ({r_add['sample_real_friend'][0].get('username', '')})")
|
||
results["add_friend"] = r_add
|
||
|
||
# ===== 操作4：付款分析 =====
|
||
print("\n" + "="*40)
|
||
print("操作4：付款分析（钱包DB + 安全说明）")
|
||
print("="*40)
|
||
r_pay = rpc.initiate_payment_fixed({"to_id": "filehelper", "amount": "0.01", "note": "SDK测试转账"})
|
||
print(f" 成功: {r_pay.get('success')}")
|
||
print(f" 钱包用户: {r_pay.get('wallet_user')}")
|
||
print(f" 账单列: {r_pay.get('ledger_columns', [])[:8]}")
|
||
print(f" 账单样本: {len(r_pay.get('ledger_sample', []))} 条")
|
||
print(f" 安全说明: {r_pay.get('security_note', '')}")
|
||
results["payment"] = r_pay
|
||
|
||
# ===== 验证 =====
|
||
print("\n【验证：最新消息（filehelper）】")
|
||
r_verify_msg = rpc.verify_message({"talker": "filehelper"})
|
||
if r_verify_msg.get("messages"):
|
||
for m in r_verify_msg["messages"]:
|
||
print(f" [{m.get('createTime','')}] {m.get('content','')[:60]}")
|
||
|
||
print("\n【验证：最新朋友圈（StarSnsInfo）】")
|
||
r_verify_moment = rpc.verify_moment()
|
||
if r_verify_moment.get("moments"):
|
||
for m in r_verify_moment["moments"]:
|
||
print(f" snsId:{m.get('snsId','')} | user:{m.get('userName','')} | time:{m.get('createTime','')} | localFlag:{m.get('localFlag','')}")
|
||
|
||
# ===== 最终截图 =====
|
||
print("\n【最终截图】")
|
||
time.sleep(1)
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "shell", "screencap -p /sdcard/v6_final_v2.png"], capture_output=True)
|
||
subprocess.run(["adb", "-s", ADB_SERIAL, "pull", "/sdcard/v6_final_v2.png", BASE + "/开发文档/6、测试/v6_final_v2.png"], capture_output=True)
|
||
print(f" 截图: v6_final_v2.png")
|
||
|
||
# 保存结果
|
||
output = {
|
||
"time": datetime.now().isoformat(),
|
||
"pid": WECHAT_PID,
|
||
"results": results,
|
||
"events": events,
|
||
"msg_schema": r_msg_schema.get("columns", []),
|
||
"sns_schema": [c["name"] for c in r_sns_schema.get("columns", [])]
|
||
}
|
||
with open(BASE + "/verification_v6_results.json", "w", encoding="utf-8") as f:
|
||
json.dump(output, f, ensure_ascii=False, indent=2)
|
||
print(f"\n结果已保存: verification_v6_results.json")
|
||
|
||
# 汇总
|
||
print("\n" + "="*60)
|
||
print("操作汇总")
|
||
print("="*60)
|
||
ops = [
|
||
("发送消息", results.get("send_message", {}).get("success"), results.get("send_message", {}).get("message_id", "")),
|
||
("发布朋友圈", results.get("post_moment", {}).get("success"), results.get("post_moment", {}).get("sns_id", "")),
|
||
("添加好友", results.get("add_friend", {}).get("success"), results.get("add_friend", {}).get("note", "")),
|
||
("付款分析", results.get("payment", {}).get("success"), "钱包DB已读取，安全验证无法绕过"),
|
||
]
|
||
for name, ok, detail in ops:
|
||
status = "✅" if ok else "❌"
|
||
print(f" {status} {name}: {str(detail)[:60]}")
|
||
|
||
try: script.unload()
|
||
except: pass
|
||
session.detach()
|