debug_wechat_send3.js
2.36 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
/**
* Frida debug script v3 — trace WCDB insert to find real send API
* Usage: frida -U -p PID -l debug_wechat_send3.js
* Then manually send a message in WeChat UI, watch the stack trace
*/
var pendingStacks = [];
function printStackTrace(tag) {
var trace = Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new());
console.log("[" + tag + "] Stack trace:\n" + trace);
}
Java.perform(function () {
console.log("[TRACE] Hooking WCDB insert...");
console.log("[TRACE] Now send a message manually in WeChat UI");
console.log("[TRACE] The stack trace will show the real send API path");
try {
var SQLiteDatabase = Java.use("com.tencent.wcdb.database.SQLiteDatabase");
SQLiteDatabase.insert.overload('java.lang.String', 'java.lang.String', 'android.content.ContentValues').implementation = function(table, nullCol, values) {
if (table && table.indexOf("message") !== -1) {
var isSend = values.getAsInteger("isSend");
var talker = values.getAsString("talker");
var content = values.getAsString("content");
if (isSend && isSend == 1) {
console.log("\n========== WCDB INSERT SEND ==========");
console.log("talker=" + talker + " content=" + (content ? content.substring(0, 50) : "null"));
printStackTrace("SEND");
console.log("=====================================\n");
}
}
return this.insert(table, nullCol, values);
};
// Also hook execSQL for potential direct SQL execution
SQLiteDatabase.execSQL.overload('java.lang.String').implementation = function(sql) {
if (sql && sql.indexOf("message") !== -1 && sql.indexOf("INSERT") !== -1) {
console.log("\n========== WCDB EXECSQL INSERT ==========");
console.log("sql=" + sql.substring(0, 100));
printStackTrace("EXECSQL");
console.log("========================================\n");
}
return this.execSQL(sql);
};
// Hook NetScene related classes — search for any class with "dispatch" or "doScene"
console.log("[TRACE] Hooks installed. Send a message manually now.");
} catch (e) {
console.log("[TRACE] Hook failed: " + e);
}
});