wechat_frida2.py
1.81 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
import frida, sys, time
script_code = """
var found = false;
// 查找所有模块中的 sqlite3_key
Process.enumerateModules().forEach(function(m) {
var exp = m.findExportByName('sqlite3_key');
if (exp) {
found = true;
send('[+] sqlite3_key in: ' + m.name + ' @ ' + exp);
Interceptor.attach(exp, {
onEnter: function(args) {
var len = args[2].toInt32();
if (len > 0 && len < 256) {
var key = Memory.readByteArray(args[1], len);
send('[KEY] ' + Array.from(new Uint8Array(key)).map(b=>b.toString(16).padStart(2,'0')).join(''));
}
}
});
}
});
// 同时 hook sqlite3_exec 抓 PRAGMA key
var sqlite3exec = Module.findExportByName(null, 'sqlite3_exec');
if (sqlite3exec) {
Interceptor.attach(sqlite3exec, {
onEnter: function(args) {
try {
var sql = args[1].readCString();
if (sql && (sql.toLowerCase().includes('pragma key') || sql.toLowerCase().includes('key='))) {
send('[PRAGMA] ' + sql);
}
} catch(e) {}
}
});
send('[+] Hooked sqlite3_exec');
}
// WeChat 内部 cipher 字符串位置
var wechat = Process.findModuleByName('WeChat');
send('[*] WeChat module: ' + wechat.base + ' size=' + wechat.size);
if (!found) {
send('[-] sqlite3_key not in exports (statically linked)');
}
"""
def on_message(msg, data):
if msg['type'] == 'send':
print(msg['payload'])
elif msg['type'] == 'error':
print('[ERR]', msg['stack'][:200])
session = frida.attach(93592)
script = session.create_script(script_code)
script.on('message', on_message)
script.load()
print('[*] Hooked, waiting 10s for key calls...')
time.sleep(10)
session.detach()
print('[*] Done')