debug_wechat_send10.js
1.92 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
/**
* Frida script v10 — lightweight: only hook WCDB insert + trace u01.f2 run stack
*/
function log(tag, msg) {
console.log("[" + tag + "] " + msg);
}
function printStack(tag) {
try {
var Thread = Java.use("java.lang.Thread");
var stack = Thread.currentThread().getStackTrace();
var lines = [];
for (var i = 0; i < stack.length; i++) {
lines.push(" at " + stack[i].toString());
}
console.log("[" + tag + " STACK]\n" + lines.join("\n") + "\n[END STACK]");
} catch (e) {
console.log("[" + tag + " STACK] failed: " + e + "\n[END STACK]");
}
}
Java.perform(function () {
log("MAIN", "Lightweight trace started");
try {
var SQLiteDatabase = Java.use("com.tencent.wcdb.database.SQLiteDatabase");
SQLiteDatabase.insert.overload('java.lang.String', 'java.lang.String', 'android.content.ContentValues').implementation = function(table, nullCol, values) {
if (table && table.toLowerCase().indexOf("message") !== -1) {
var isSend = values ? values.getAsInteger("isSend") : null;
var talker = values ? values.getAsString("talker") : null;
var content = values ? values.getAsString("content") : null;
if (isSend && isSend == 1) {
log("WCDB", "INSERT SEND talker=" + talker + " content=" + (content ? content.substring(0, 30) : "null"));
printStack("WCDB_SEND");
}
}
return this.insert(table, nullCol, values);
};
} catch (e) {
log("MAIN", "WCDB hook failed: " + e);
}
// Also just log when u01.f2.run is called (no deep inspect)
try {
var f2 = Java.use("u01.f2");
f2.run.implementation = function() {
log("F2", "u01.f2.run()");
this.run();
};
} catch (e) {}
log("MAIN", "Ready. Send a message manually.");
});