debug_wechat_send6.js
3.62 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
/**
* Frida debug script v6 — inspect u01.f2 and related classes
* Hooks u01.f2 constructor + run, u01.r1, messenger.foundation.a2
*/
function log(tag, msg) {
console.log("[" + tag + "] " + msg);
}
function inspectObject(obj, tag) {
if (!obj) {
log(tag, "object is null");
return;
}
var cls = obj.getClass();
log(tag, "class=" + cls.getName());
var fields = cls.getDeclaredFields();
for (var i = 0; i < fields.length; i++) {
var f = fields[i];
f.setAccessible(true);
try {
var val = f.get(obj);
var valStr = val ? val.toString() : "null";
if (valStr.length > 100) valStr = valStr.substring(0, 100) + "...";
log(tag, " field: " + f.getName() + " = " + valStr);
} catch (e) {
log(tag, " field: " + f.getName() + " [error: " + e + "]");
}
}
}
Java.perform(function () {
log("MAIN", "Hooking u01.f2 and related classes...");
// Hook u01.f2.run
try {
var f2 = Java.use("u01.f2");
f2.run.implementation = function() {
log("F2", "===== u01.f2.run() called =====");
inspectObject(this, "F2");
log("F2", "===== running original =====");
this.run();
log("F2", "===== u01.f2.run() done =====");
};
log("MAIN", "u01.f2.run hooked");
} catch (e) {
log("MAIN", "u01.f2 hook failed: " + e);
}
// Hook u01.f2 constructor (if any)
try {
var f2cls = Java.use("u01.f2");
var constructors = f2cls.class.getDeclaredConstructors();
for (var i = 0; i < constructors.length; i++) {
var ctor = constructors[i];
var params = ctor.getParameterTypes();
var sig = "";
for (var j = 0; j < params.length; j++) {
sig += params[j].getName() + ",";
}
log("MAIN", "u01.f2 constructor: (" + sig + ")");
}
} catch (e) {
log("MAIN", "u01.f2 constructor inspect failed: " + e);
}
// Hook messenger.foundation.a2.a() to see args
try {
var a2 = Java.use("com.tencent.mm.plugin.messenger.foundation.a2");
var methods = a2.class.getDeclaredMethods();
for (var i = 0; i < methods.length; i++) {
var m = methods[i];
if (m.getModifiers() & 0x0001) { // public
var params = m.getParameterTypes();
var sig = m.getName() + "(";
for (var j = 0; j < params.length; j++) sig += params[j].getName() + ",";
sig += ") -> " + m.getReturnType().getName();
log("MAIN", "a2 method: " + sig);
}
}
} catch (e) {
log("MAIN", "a2 inspect failed: " + e);
}
// Also hook WCDB insert to confirm
try {
var SQLiteDatabase = Java.use("com.tencent.wcdb.database.SQLiteDatabase");
SQLiteDatabase.insert.overload('java.lang.String', 'java.lang.String', 'android.content.ContentValues').implementation = function(table, nullCol, values) {
if (table && table.toLowerCase().indexOf("message") !== -1) {
var isSend = values ? values.getAsInteger("isSend") : null;
var talker = values ? values.getAsString("talker") : null;
if (isSend && isSend == 1) {
log("WCDB", "INSERT SEND talker=" + talker);
}
}
return this.insert(table, nullCol, values);
};
log("MAIN", "WCDB hook installed");
} catch (e) {
log("MAIN", "WCDB hook failed: " + e);
}
log("MAIN", "All hooks installed. Send a message manually.");
});