124 lines
4.5 KiB
Python
124 lines
4.5 KiB
Python
#!/usr/bin/env python3
|
||
# -*- coding: utf-8 -*-
|
||
"""扫描微信所有23个DB的表结构，找到朋友圈/视频号/收藏/红包/文件真实表"""
|
||
import frida, time, json, subprocess
|
||
from datetime import datetime
|
||
|
||
PHONE_IP = "192.168.110.80"
|
||
FRIDA_PORT = 27042
|
||
ADB_SERIAL = "192.168.110.80:5555"
|
||
BASE = "/Users/karuo/Documents/开发/2、私域银行/工作手机"
|
||
HOOK_JS = BASE + "/sdk/agent/hook/wechat_full_control_v4.js"
|
||
|
||
result = subprocess.run(["adb","-s",ADB_SERIAL,"shell","ps -A | grep 'com.tencent.mm$'"],capture_output=True,text=True)
|
||
WECHAT_PID = int(result.stdout.strip().split()[1]) if result.stdout.strip() else 20745
|
||
print(f"微信PID: {WECHAT_PID}")
|
||
|
||
dm = frida.get_device_manager()
|
||
device = dm.add_remote_device(f"{PHONE_IP}:{FRIDA_PORT}")
|
||
session = device.attach(WECHAT_PID)
|
||
|
||
def on_msg(m,d):
|
||
if m.get("type")=="send":
|
||
p=m["payload"]
|
||
if p.get("type") in ("ready","hook_ok"):
|
||
print(f" [{p['type']}] {p.get('msg','')}")
|
||
|
||
with open(HOOK_JS,encoding="utf-8") as f: src=f.read()
|
||
script=session.create_script(src)
|
||
script.on("message",on_msg)
|
||
script.load()
|
||
time.sleep(3)
|
||
rpc=script.exports_sync
|
||
|
||
print("\n=== 枚举所有DB实例 ===")
|
||
db_info = rpc.get_db_info()
|
||
all_dbs = db_info.get("instances",[])
|
||
print(f"DB总数: {len(all_dbs)}")
|
||
for db in all_dbs:
|
||
print(f" {db.get('path','')}")
|
||
|
||
print("\n=== 枚举所有DB表 ===")
|
||
tables_info = rpc.list_all_tables()
|
||
all_tables = tables_info.get("databases",{})
|
||
|
||
# 关键词匹配
|
||
keywords = {
|
||
"朋友圈": ["sns","Sns","SnsInfo","moment","Moment","feed","Feed"],
|
||
"视频号": ["finder","Finder","video","Video","channel","Channel"],
|
||
"收藏": ["fav","Fav","collect","Collect","star","Star","bookmark"],
|
||
"红包": ["hongbao","HongBao","redpacket","RedPacket","lucky","Lucky","wallet"],
|
||
"文件": ["file","File","attach","Attach","media","Media","storage"],
|
||
"群管理": ["chatroom","Chatroom","group","Group","room","Room"],
|
||
"支付": ["pay","Pay","wallet","Wallet","finance","Finance"],
|
||
"标签": ["label","Label","tag","Tag"],
|
||
"小程序": ["applet","Applet","mini","Mini","plugin","Plugin"],
|
||
}
|
||
|
||
found = {}
|
||
for db_name, tables in all_tables.items():
|
||
for table in tables:
|
||
for category, kws in keywords.items():
|
||
for kw in kws:
|
||
if kw.lower() in table.lower():
|
||
if category not in found:
|
||
found[category] = []
|
||
found[category].append(f"{db_name}.{table}")
|
||
|
||
print("\n=== 关键表定位 ===")
|
||
for cat, tables in found.items():
|
||
print(f"\n【{cat}】")
|
||
for t in tables[:10]:
|
||
print(f" {t}")
|
||
|
||
# 详细查询关键DB
|
||
print("\n=== 详细查询各DB表 ===")
|
||
detail = {}
|
||
for db_name, tables in all_tables.items():
|
||
print(f"\n[{db_name}] {len(tables)}张表: {tables[:20]}")
|
||
detail[db_name] = tables
|
||
|
||
# 特别查询sns相关DB
|
||
for db_name, tables in all_tables.items():
|
||
if "sns" in db_name.lower() or "star" in db_name.lower():
|
||
print(f"\n=== SNS DB详情: {db_name} ===")
|
||
for t in tables:
|
||
r = rpc.raw_query({"sql": f"SELECT COUNT(*) as cnt FROM {t}", "db": db_name})
|
||
cnt = r.get("rows",[{}])[0].get("cnt","?") if r.get("success") else "ERR"
|
||
print(f" {t}: {cnt}条")
|
||
|
||
# 查找红包表
|
||
print("\n=== 查找红包/钱包相关表 ===")
|
||
for db_name, tables in all_tables.items():
|
||
for t in tables:
|
||
if any(kw in t.lower() for kw in ["hongbao","redpacket","wallet","pay","lucky","finance","money"]):
|
||
r = rpc.raw_query({"sql": f"PRAGMA table_info({t})", "db": db_name})
|
||
cols = [row.get("name","") for row in r.get("rows",[])]
|
||
print(f" {db_name}.{t}: {cols[:10]}")
|
||
|
||
# 查找文件/附件表
|
||
print("\n=== 查找文件/附件表 ===")
|
||
for db_name, tables in all_tables.items():
|
||
for t in tables:
|
||
if any(kw in t.lower() for kw in ["file","attach","media","storage","img","voice","video"]):
|
||
r = rpc.raw_query({"sql": f"SELECT COUNT(*) as cnt FROM {t}", "db": db_name})
|
||
cnt = r.get("rows",[{}])[0].get("cnt","?") if r.get("success") else "ERR"
|
||
print(f" {db_name}.{t}: {cnt}条")
|
||
|
||
# 保存完整结果
|
||
output = {
|
||
"time": datetime.now().isoformat(),
|
||
"pid": WECHAT_PID,
|
||
"db_count": len(all_dbs),
|
||
"all_dbs": [db.get("path","") for db in all_dbs],
|
||
"all_tables": all_tables,
|
||
"found_by_category": found
|
||
}
|
||
with open(BASE+"/db_full_scan_20260518.json","w",encoding="utf-8") as f:
|
||
json.dump(output,f,ensure_ascii=False,indent=2)
|
||
print(f"\n完整扫描结果已保存: db_full_scan_20260518.json")
|
||
|
||
try: script.unload()
|
||
except: pass
|
||
session.detach()
|