wechat_send.sh
4.83 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
#!/bin/bash
# wechat_send.sh — unified WeChat send CLI via the internal hook
#
# Usage:
# ./wechat_send.sh text <wxid> <message>
# ./wechat_send.sh image <wxid> <device_image_path>
# ./wechat_send.sh voice <wxid> <local_silk_path> [duration_ms]
#
# All send operations go through the wechathook LSPosed module's internal API,
# which calls WeChat's own w11.r0/w11.s1 factory — no UI simulation.
# <wxid>: talker id as stored in WeChat DB (e.g. 'filehelper', 'wxid_xxx').
# IMPORTANT: test-only with 'filehelper' to avoid account risk.
#
# Voice notes (SEND_VOICE_CGI — fully synthetic, no recording/hot-swap):
# <local_silk_path> — local SILK V3 file (Tencent prefix \x02#!SILK_V3), e.g. from
# edge-tts → ffmpeg 16k mono → silk-wasm.
# [duration_ms] — playback duration in ms (default: 3000).
# Stages the SILK into WeChat's own data dir (uid + app_data_file ctx) then broadcasts
# the internal uploadvoice cgi: uploads audio inline + delivers to the recipient AND
# inserts a sent bubble on the sender side. Verified end-to-end + both-sides visible.
#
# Examples:
# ./wechat_send.sh text filehelper "hello world"
# ./wechat_send.sh image filehelper /tmp/screenshot.png
# ./wechat_send.sh voice filehelper /tmp/tts_out.silk 4617
set -e
ADB="${ADB:-adb}"
WECHAT_CACHE="/data/data/com.tencent.mm/cache/hook_voice_src.amr"
usage() {
echo "Usage: $0 text <wxid> <message>"
echo " $0 image <wxid> <device_path>"
echo " $0 voice <wxid> <local_silk_path> [duration_ms]"
exit 1
}
[ $# -lt 3 ] && usage
CMD="$1"; WXID="$2"; shift 2
case "$CMD" in
text)
PAYLOAD="$*"
B64_WXID=$(printf '%s' "$WXID" | base64 | tr -d '\n')
B64_TEXT=$(printf '%s' "$PAYLOAD" | base64 | tr -d '\n')
INNER=$(printf 'TO=$(printf "%%s" "%s" | base64 -d); TEXT=$(printf "%%s" "%s" | base64 -d); am broadcast -a com.hermes.wechat.SEND_MSG_INTERNAL --es to "$TO" --es text "$TEXT"' \
"$B64_WXID" "$B64_TEXT")
B64_INNER=$(printf '%s' "$INNER" | base64 | tr -d '\n')
echo "Sending text to $WXID..."
$ADB shell "su -c 'echo $B64_INNER | base64 -d | sh'"
;;
image)
# Internal API: WeChat's own b80.u.oj (insert+prebuild) + v70.w.oj (CDN upload).
# No UI, no contact picker — fire-and-forget to <wxid>. Verified full-res delivery.
IMAGE_PATH="$1"
[ -z "$IMAGE_PATH" ] && usage
EXT="${IMAGE_PATH##*.}"
# Stage into /sdcard/Pictures/ (MediaStore-indexed) + media scan. WeChat's image CDN
# upload resolves the file via MediaStore — a fresh file in /sdcard root (unindexed)
# uploads as a broken image (red !, receiver gets nothing). Unique name avoids a fixed
# path being overwritten mid-upload by a concurrent send.
SHARE="/sdcard/Pictures/wx_send_$$.$EXT"
echo "Staging image to $SHARE + media scan..."
$ADB shell "su -c 'cp \"$IMAGE_PATH\" \"$SHARE\" && chmod 644 \"$SHARE\"'"
$ADB shell "su -c 'am broadcast -a android.intent.action.MEDIA_SCANNER_SCAN_FILE -d \"file://$SHARE\"'" >/dev/null 2>&1
sleep 1
echo "Sending image to $WXID via internal API..."
$ADB shell "su -c 'am broadcast -a com.hermes.wechat.SEND_IMAGE_INTERNAL --es to \"$WXID\" --es path \"$SHARE\"'"
echo "Sent. (Verify via WeChat UI screenshot; full image uploads async via CDN.)"
;;
voice)
# Fully-synthetic voice via the internal uploadvoice cgi (no recording, no hot-swap).
# Uploads the SILK inline + delivers to the recipient AND inserts a sent bubble on the
# sender side. The hook reads src_path AS the WeChat process, so the SILK must live in
# WeChat's own data dir with its uid + app_data_file SELinux context — /sdcard gives
# EACCES and a root cp into the sandbox needs chown+restorecon to the right owner.
SILK_PATH="$1"
DURATION="${2:-3000}"
[ -z "$SILK_PATH" ] && usage
[ ! -f "$SILK_PATH" ] && { echo "File not found: $SILK_PATH"; exit 1; }
WX_UID=$($ADB shell "su -c 'stat -c %U /data/user/0/com.tencent.mm'" | tr -d '\r')
[ -z "$WX_UID" ] && { echo "Could not resolve WeChat uid"; exit 1; }
STAGE="/data/data/com.tencent.mm/files/hook_voice_cgi.silk"
echo "Staging SILK into WeChat data dir (uid=$WX_UID)..."
$ADB push "$SILK_PATH" /sdcard/hook_voice_tmp.silk >/dev/null
$ADB shell "su -c 'cp /sdcard/hook_voice_tmp.silk $STAGE'"
$ADB shell "su -c 'chown $WX_UID:$WX_UID $STAGE'"
$ADB shell "su -c 'chmod 600 $STAGE'"
$ADB shell "su -c 'restorecon $STAGE'" 2>/dev/null
$ADB shell "su -c 'rm -f /sdcard/hook_voice_tmp.silk'"
echo "Sending synthetic voice to $WXID (duration=${DURATION}ms)..."
$ADB shell "su -c 'am broadcast -a com.hermes.wechat.SEND_VOICE_CGI --es to $WXID --es src_path $STAGE --ei duration $DURATION'"
echo "Sent. (Recipient gets a playable voice; sender sees a sent bubble. Verify via WeChat UI.)"
;;
*)
echo "Unknown command: $CMD"
usage
;;
esac