debug_wechat_send5.js
1.77 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
/**
* Frida debug script v5 — get proper Java stack trace
* Usage: frida -U -p PID -l debug_wechat_send5.js
*/
function log(tag, msg) {
console.log("[" + tag + "] " + msg);
}
function printJavaStack(tag) {
try {
var Thread = Java.use("java.lang.Thread");
var stack = Thread.currentThread().getStackTrace();
var lines = [];
for (var i = 0; i < stack.length; i++) {
lines.push(" at " + stack[i].toString());
}
console.log("[" + tag + " STACK]\n" + lines.join("\n") + "\n[END STACK]");
} catch (e) {
console.log("[" + tag + " STACK] failed: " + e + "\n[END STACK]");
}
}
Java.perform(function () {
log("MAIN", "Installing WCDB insert hook with proper stack trace...");
try {
var SQLiteDatabase = Java.use("com.tencent.wcdb.database.SQLiteDatabase");
SQLiteDatabase.insert.overload('java.lang.String', 'java.lang.String', 'android.content.ContentValues').implementation = function(table, nullCol, values) {
if (table && table.toLowerCase().indexOf("message") !== -1) {
var isSend = values ? values.getAsInteger("isSend") : null;
var talker = values ? values.getAsString("talker") : null;
var content = values ? values.getAsString("content") : null;
log("INSERT", "table=" + table + " isSend=" + isSend + " talker=" + talker + " content=" + (content ? content.substring(0, 40) : "null"));
if (isSend && isSend == 1) {
printJavaStack("INSERT_SEND");
}
}
return this.insert(table, nullCol, values);
};
log("MAIN", "Hook installed. Send a message manually.");
} catch (e) {
log("MAIN", "Hook failed: " + e);
}
});