debug_wechat_send8.js
2.88 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
/**
* Frida debug script v8 — trace u01.f2 creator and LinkedList add
*/
function log(tag, msg) {
console.log("[" + tag + "] " + msg);
}
function printStack(tag) {
try {
var Thread = Java.use("java.lang.Thread");
var stack = Thread.currentThread().getStackTrace();
var lines = [];
for (var i = 0; i < stack.length; i++) {
lines.push(" at " + stack[i].toString());
}
console.log("[" + tag + " STACK]\n" + lines.join("\n") + "\n[END STACK]");
} catch (e) {
console.log("[" + tag + " STACK] failed: " + e + "\n[END STACK]");
}
}
Java.perform(function () {
log("MAIN", "Tracing u01.f2 creator and message queue...");
// Hook u01.f2 constructor with stack trace
try {
var f2 = Java.use("u01.f2");
f2.$init.overload("u01.g2").implementation = function(g2) {
log("F2_CTOR", "===== u01.f2 created =====");
printStack("F2_CTOR");
this.$init(g2);
};
log("MAIN", "u01.f2 constructor hooked");
} catch (e) {
log("MAIN", "f2 ctor hook failed: " + e);
}
// Hook LinkedList.add to see when message IDs are added
try {
var LinkedList = Java.use("java.util.LinkedList");
LinkedList.add.overload("java.lang.Object").implementation = function(obj) {
var objStr = obj ? obj.toString() : "null";
if (objStr.indexOf("_") !== -1 && objStr.length > 10 && objStr.length < 50) {
log("LL_ADD", "LinkedList.add: " + objStr);
printStack("LL_ADD");
}
return this.add(obj);
};
log("MAIN", "LinkedList.add hooked");
} catch (e) {
log("MAIN", "LinkedList.add hook failed: " + e);
}
// Hook u01.g2 constructor
try {
var g2 = Java.use("u01.g2");
g2.$init.overload("u01.t").implementation = function(t) {
log("G2_CTOR", "===== u01.g2 created =====");
printStack("G2_CTOR");
this.$init(t);
};
log("MAIN", "u01.g2 constructor hooked");
} catch (e) {
log("MAIN", "g2 ctor hook failed: " + e);
}
// Also hook u01.e2 (field a of g2) to see its role
try {
var e2 = Java.use("u01.e2");
var methods = e2.class.getDeclaredMethods();
for (var i = 0; i < methods.length; i++) {
var m = methods[i];
if (m.getModifiers() & 0x0001) {
var params = "";
var pts = m.getParameterTypes();
for (var j = 0; j < pts.length; j++) {
params += pts[j].getName() + ",";
}
log("MAIN", "u01.e2 method: " + m.getName() + "(" + params + ") -> " + m.getReturnType().getName());
}
}
} catch (e) {
log("MAIN", "e2 inspect failed: " + e);
}
log("MAIN", "All hooks installed. Send a message manually.");
});