宜博 / pixelphone

Commit b4a635a1a730ee2ec24960fb28f15e2b5aa56a2f

Authored by yibo 2026-07-04 19:13:50 +0800

feat(wechathook): 修复 Hermes 破坏的平板登录 + 入库 do_not_break 防护文档

Hermes 重编 APK 时连踩三坑导致平板登录失效：
1. 用 XposedBridgeApi.jar 而非 LSPosed legacy JAR 编译 → 所有 hook NoSuchMethodError
2. xposed_init 放在 APK 根目录而非 assets/ → daemon 验证失败每次重启自动删模块 DB 注册
3. 换了 keystore → INSTALL_FAILED_UPDATE_INCOMPATIBLE

修复：从 wechathook_v2_signed.apk（正确 legacy JAR 编译）提取 DEX 复用，重打包含正确
assets/xposed_init，debug.keystore 签名，fix_lspd_final.py 重建 DB 注册。
2026-07-04 重启后验证平板登录恢复正常，所有 tablet hook 日志无 NoSuchMethodError。

新增文件：
- wechathook_v2_signed.apk: 黄金基准 APK（legacy JAR 编译，DEX 可复用）
- do_not_break.md: 给 Hermes 的禁止事项清单
- hermes_task.md: 已在顶部加 DO NOT BREAK 警告 banner
- analyze_wechathook.py: DEX 字节码分析工具（Tinker patch）
- rebuild_wechathook.sh / update_wechathook_db.sh: Mac 侧重建脚本
- termux_build.sh: Hermes 的手机侧 build script（有编译 JAR bug，留作参考）
- wechat_send_internal/: Hermes 对 WeChat 内部发送 API 的研究产出（进行中）

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Inline Side-by-side

Showing 11 changed files with 1680 additions and 0 deletions

wechat_send_internal/RESEARCH.md 0 → 100644

View file @b4a635a

	1	+# WeChat 非 A11y 发送消息 — 逆向研究报告
	2	+
	3	+目标：WeChat 8.0.74 / Android 16 / Pixel 10 Pro Fold (rooted + LSPosed JingMatrix Vector v1.11.0)
	4	+约束：不封号，Research only，未触发真实发送
	5	+
	6	+---
	7	+
	8	+## 一、三条路线结论
	9	+
	10	+\| 路线 \| 原理 \| 可行性 \| 理由 \|
	11	+\|---\|---\|---\|---\|
	12	+\| Route A \| LSPosed hook 调用 WeChat 内部 `NetSceneSendMsg` API \| ✅ 可行 \| 已找到完整调用链，同正常用户发送路径完全一致 \|
	13	+\| Route B \| Hook 网络层（OkHttp/SSL 拦截） \| ❌ 不可行 \| 消息发送走 MMTLS（WeChat 自定义加密 TCP），不经 OkHttp/HTTPS \|
	14	+\| Route C \| 直写 SQLite `message` 表 \| ❌ 不可行 \| DB 写入只是本地状态，不触发网络发送，消息对方收不到 \|
	15	+
	16	+---
	17	+
	18	+## 二、Route A — 完整调用链（逆向结果）
	19	+
	20	+### 2.1 关键类（DEX 位置）
	21	+
	22	+\| 类名 \| DEX \| 用途 \|
	23	+\|---\|---\|---\|
	24	+\| `w11.s1` \| classes9.dex \| `SendMsgCgiFactory` 工厂入口（static `a(talker)`）\|
	25	+\| `w11.r1` \| classes11.dex \| Builder —— 设置 talker/content/type/pipeline \|
	26	+\| `w11.p1` \| classes9.dex \| PPC Pipeline 枚举：`TEXT(d)` / `IMAGE(e)` / `VIDEO(f)` / ... \|
	27	+\| `w11.r0` \| classes12.dex \| `NetSceneSendMsg` —— 写 DB + 触发网络发送 \|
	28	+\| `w11.c1` \| classes5.dex \| `RevokeMsgManager` —— 发送前的撤回状态检查 \|
	29	+\| `dk5.s5` \| classes9.dex \| `SendMsgMgr` —— 高层 API（`Ni(content,talker,isGroup,kl)`）\|
	30	+\| `tg3.t1` \| classes.dex \| 服务定位器入口 —— `t1.a()` 返回 `dk5.s5` 单例 \|
	31	+\| `com.tencent.mm.storage.f9` \| - \| 消息存储对象（写入 `message` 表的实体）\|
	32	+
	33	+### 2.2 调用链（文本消息）
	34	+
	35	+```
	36	+触发方（BroadcastReceiver in WeChat process）
	37	+ │
	38	+ ├─ [方案 A1 - 直接 Factory]
	39	+ │ w11.s1.a(talker) → 创建 w11.r1（l=p1.TEXT）
	40	+ │ .e(content) → 设置文本内容（fields: d）
	41	+ │ .b() → executeByPPC，无回调
	42	+ │
	43	+ ├─ [方案 A2 - 高层 API]
	44	+ │ (dk5.s5) tg3.t1.a()
	45	+ │ .Ni(content, talker, false, null) → 1 对 1 文本
	46	+ │ .Ni(content, talker, true, null) → 群聊文本
	47	+ │
	48	+ └─ 两种方案最终都走：
	49	+ w11.r0(talker, content, type=1, ...)
	50	+ ├─ f9.setType(1) → message.type = 1（文本）
	51	+ ├─ x3.bj().N9(f9, true) → 写入 message 表（status=SENDING=1）
	52	+ └─ r0.H() → r0.doScene()
	53	+ ├─ lVar.c = "/cgi-bin/micromsg-bin/newsendmsg"
	54	+ ├─ lVar.d = 522 (cmdId)
	55	+ └─ dispatch() → MMTLS TCP 二进制 protobuf
	56	+```
	57	+
	58	+### 2.3 `w11.r1` Builder 字段映射
	59	+
	60	+```java
	61	+r1.a = "" // 未知（sender相关？）
	62	+r1.b = "" // talker（通过 g(talker) 设置）
	63	+r1.d = "" // content（通过 e(content) 设置）
	64	+r1.e = 1 // 消息类型（默认=1文本；通过 h(type) 设置）
	65	+r1.j = new h7() // 消息附加信息
	66	+r1.l = p1.TEXT // PPC Pipeline 类型（s1.a() 默认设为 TEXT）
	67	+```
	68	+
	69	+### 2.4 `doScene()` CGI 参数（在 w11.r0 中）
	70	+
	71	+```java
	72	+lVar.c = "/cgi-bin/micromsg-bin/newsendmsg"; // CGI 路径
	73	+lVar.d = 522; // CmdId
	74	+lVar.e = 237; // SubCmdId
	75	+lVar.f = 1000000237; // FullCmdId
	76	+```
	77	+
	78	+---
	79	+
	80	+## 三、Route B 为何不可行
	81	+
	82	+WeChat 手机端消息不走 HTTPS/OkHttp。发送路径：
	83	+- 持久 TCP 长连接 → MMTLS 加密（WeChat 自研，类似 TLS 但不是 TLS）→ 二进制 protobuf
	84	+- OkHttp 只处理微信里的 Finder（视频号）等 HTTP CGI 业务，不处理 IM 消息
	85	+- SSL Unpinning（Frida/LSPosed）只能解 TLS，对 MMTLS 无效
	86	+- 如要 hook 网络层，需要逆向 `libtencent_mars.so`（Mars 框架的 MMTLS native 实现）——极复杂，不在此路线
	87	+
	88	+---
	89	+
	90	+## 四、Route C 为何不可行
	91	+
	92	+从 `w11.r0` 构造函数逆向结果：
	93	+1. 构造时写入 `message` 表（status = SENDING = 1）
	94	+2. 然后调用 `doScene()` 发起 MMTLS 网络请求
	95	+3. 成功回调后更新 status = SENT = 2
	96	+
	97	+如果直接写 SQLite：
	98	+- 写 status=SENT(2)：本地显示已发，但对方服务器从未收到，对方收不到
	99	+- 写 status=SENDING(1)：消息卡在"发送中"，WeChat 会尝试重发，但重发路径依赖正常 send 逻辑，不一定触发
	100	+- 结论：直写 DB 无法完成实际消息投递
	101	+
	102	+---
	103	+
	104	+## 五、Route A 实现方案
	105	+
	106	+### 5.1 架构
	107	+
	108	+在 LSPosed 模块中，于 `handleLoadPackage` 里注册一个 `BroadcastReceiver`（在 WeChat 进程内），
	109	+监听 `com.hermes.wechat.SEND_MSG_INTERNAL`。外部通过 `adb shell am broadcast` 触发。
	110	+
	111	+```java
	112	+// 在 WeChat 进程内注册 receiver
	113	+context.registerReceiver(new BroadcastReceiver() {
	114	+ public void onReceive(Context ctx, Intent intent) {
	115	+ String talker = intent.getStringExtra("to"); // wxid_xxx 或 xxx@chatroom
	116	+ String content = intent.getStringExtra("text");
	117	+ sendTextViaInternalApi(talker, content);
	118	+ }
	119	+}, new IntentFilter("com.hermes.wechat.SEND_MSG_INTERNAL"),
	120	+ Context.RECEIVER_NOT_EXPORTED);
	121	+```
	122	+
	123	+### 5.2 发送逻辑（Xposed 内）
	124	+
	125	+```java
	126	+private static void sendTextViaInternalApi(String talker, String content) {
	127	+ // 必须在主线程执行（WeChat 的 DB/网络操作绑定主线程）
	128	+ new Handler(Looper.getMainLooper()).post(() -> {
	129	+ try {
	130	+ // 方案 A1（直接 Factory，更底层）
	131	+ ClassLoader cl = /* lpparam.classLoader */;
	132	+ Class<?> s1 = XposedHelpers.findClass("w11.s1", cl);
	133	+ Object r1 = XposedHelpers.callStaticMethod(s1, "a", talker);
	134	+ XposedHelpers.callMethod(r1, "e", content); // set content
	135	+ XposedHelpers.callMethod(r1, "b"); // execute
	136	+ XposedBridge.log("[WeChatHook] Internal send queued: " + talker);
	137	+ } catch (Throwable t) {
	138	+ XposedBridge.log("[WeChatHook] Internal send failed: " + t);
	139	+ }
	140	+ });
	141	+}
	142	+```
	143	+
	144	+### 5.3 Talker ID 格式
	145	+
	146	+\| 场景 \| talker 格式 \| 示例 \|
	147	+\|---\|---\|---\|
	148	+\| 1 对 1 \| `wxid_` 开头或 `<phone>@stranger` \| `wxid_abc123` \|
	149	+\| 群聊 \| `<数字>@chatroom` \| `12345678901@chatroom` \|
	150	+
	151	+从 `EnMicroMsg.db` 查询：
	152	+```sql
	153	+-- 查 1 对 1 的 talker
	154	+SELECT username FROM rcontact WHERE nickname = '目标昵称' LIMIT 1;
	155	+-- 查群 talker
	156	+SELECT roomname FROM chatroom WHERE roomdisplayname = '群名' LIMIT 1;
	157	+```
	158	+
	159	+### 5.4 封号风险评估
	160	+
	161	+- Route A 的发送路径与正常用户操作完全一致：经过同样的 DB 写入、同样的 CGI 请求、同样的 MMTLS 加密
	162	+- 风险主要来自行为模式（频率、时间、内容），而非技术路径
	163	+- 建议：单次发送、不高频、不夜间大量发送
	164	+
	165	+---
	166	+
	167	+## 六、AOT devirtualization 风险（来自平板登录 hook 经验）
	168	+
	169	+WeChat 自身的虚方法（如 `onCreate`/`initView`）在 AOT 编译后绑死直接跳转，Xposed hook 注册成功但不触发。
	170	+
	171	+Route A 不受此影响，因为：
	172	+- `w11.s1.a()` 是静态方法，无 vtable 查找
	173	+- `w11.r1.e()/.b()` 是在 r1 新建对象上调用，引用明确，不经 vtable
	174	+- 触发 Receiver 的 `android.content.BroadcastReceiver.onReceive()` 是跨 APK 调用，框架层无法被 WeChat AOT 内联
	175	+
	176	+即：Route A 的 hook 链路天然对 AOT devirtualization 免疫。
	177	+
	178	+---
	179	+
	180	+## 七、后续：图片发送
	181	+
	182	+从 `p1` 枚举可知 pipeline 类型还有 `IMAGE(e)` / `VIDEO(f)` / `CDN_IMAGE(g)`。
	183	+图片发送需先上传图片到 WeChat CDN 获取 `attachid`，然后再构造 app 消息（type=3/43）。
	184	+
	185	+已验证路径（来自 `wechat-image-sender` Hermes skill，见 CLAUDE.md）：
	186	+`am start -a android.intent.action.SEND -t image/png` → WeChat UI 选择联系人 → 固定坐标点发送
	187	+
	188	+Route A 图片发送尚未逆向，留待后续。
...	...

wechat_send_internal/WeChatSendHook.java 0 → 100644

View file @b4a635a

	1	+package com.example.wechathook;
	2	+
	3	+import android.content.BroadcastReceiver;
	4	+import android.content.Context;
	5	+import android.content.Intent;
	6	+import android.content.IntentFilter;
	7	+import android.os.Handler;
	8	+import android.os.Looper;
	9	+import de.robv.android.xposed.IXposedHookLoadPackage;
	10	+import de.robv.android.xposed.XposedBridge;
	11	+import de.robv.android.xposed.XposedHelpers;
	12	+import de.robv.android.xposed.callbacks.XC_LoadPackage;
	13	+
	14	+/**
	15	+ * WeChatSendHook: Route A — 通过 WeChat 内部 API 发送文本消息。
	16	+ *
	17	+ * 调用链（逆向 WeChat 8.0.74）：
	18	+ * 外部 am broadcast → BroadcastReceiver (WeChat 进程内)
	19	+ * → w11.s1.a(talker) → w11.r1 (SendMsgCgiFactory, p1.TEXT pipeline)
	20	+ * → r1.e(content) → 设置文本
	21	+ * → r1.b() → executeByPPC
	22	+ * → w11.r0(talker, content, type=1, ...)
	23	+ * → message 表写入 (status=SENDING)
	24	+ * → /cgi-bin/micromsg-bin/newsendmsg over MMTLS
	25	+ *
	26	+ * 触发：
	27	+ * adb shell am broadcast -a com.hermes.wechat.SEND_MSG_INTERNAL \
	28	+ * --es to "wxid_xxx" --es text "Hello from hook"
	29	+ *
	30	+ * Talker 格式：
	31	+ * 1 对 1: wxid_xxx (对方 WeChat ID)
	32	+ * 群聊: 12345678901@chatroom
	33	+ *
	34	+ * 注意：发送在 WeChat 主线程执行，与用户正常发送路径完全一致。
	35	+ * 不触发 A11y，不走 UI 自动化，消息经 MMTLS 加密发出。
	36	+ *
	37	+ * 类位置（WeChat 8.0.74 多 DEX）：
	38	+ * w11.s1 — classes9.dex
	39	+ * w11.r1 — classes11.dex
	40	+ * w11.r0 — classes12.dex
	41	+ * p1.TEXT — classes9.dex (enum value 'd')
	42	+ */
	43	+public class WeChatSendHook implements IXposedHookLoadPackage {
	44	+
	45	+ private static final String ACTION = "com.hermes.wechat.SEND_MSG_INTERNAL";
	46	+ private static ClassLoader sWeChat;
	47	+
	48	+ @Override
	49	+ public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
	50	+ if (!"com.tencent.mm".equals(lpparam.packageName)) return;
	51	+ // Only hook the main process (not :push/:tools sub-processes)
	52	+ if (!lpparam.processName.equals("com.tencent.mm")) return;
	53	+
	54	+ sWeChat = lpparam.classLoader;
	55	+ XposedBridge.log("[WeChatSendHook] Injected, registering receiver");
	56	+
	57	+ // Hook Application.onCreate to get Context for receiver registration.
	58	+ // android.app.Application.onCreate() is a framework call — never AOT-inlined.
	59	+ XposedHelpers.findAndHookMethod(
	60	+ "android.app.Application", null,
	61	+ "onCreate",
	62	+ new de.robv.android.xposed.XC_MethodHook() {
	63	+ @Override
	64	+ protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	65	+ Context ctx = (Context) param.thisObject;
	66	+ if (ctx.getPackageName().equals("com.tencent.mm")) {
	67	+ registerSendReceiver(ctx);
	68	+ }
	69	+ }
	70	+ });
	71	+ }
	72	+
	73	+ private static void registerSendReceiver(Context ctx) {
	74	+ BroadcastReceiver receiver = new BroadcastReceiver() {
	75	+ @Override
	76	+ public void onReceive(Context context, Intent intent) {
	77	+ String talker = intent.getStringExtra("to");
	78	+ String text = intent.getStringExtra("text");
	79	+ if (talker == null \|\| talker.isEmpty() \|\| text == null \|\| text.isEmpty()) {
	80	+ XposedBridge.log("[WeChatSendHook] Received intent missing 'to' or 'text'");
	81	+ return;
	82	+ }
	83	+ XposedBridge.log("[WeChatSendHook] Queuing send to=" + talker + " len=" + text.length());
	84	+ sendOnMainThread(talker, text);
	85	+ }
	86	+ };
	87	+ IntentFilter filter = new IntentFilter(ACTION);
	88	+ // NOT_EXPORTED (0x4) — only accept from root/same-uid callers via am broadcast
	89	+ ctx.registerReceiver(receiver, filter, Context.RECEIVER_NOT_EXPORTED);
	90	+ XposedBridge.log("[WeChatSendHook] Receiver registered for " + ACTION);
	91	+ }
	92	+
	93	+ private static void sendOnMainThread(String talker, String text) {
	94	+ // WeChat's send path touches SQLite and the network dispatcher from the main thread.
	95	+ new Handler(Looper.getMainLooper()).post(() -> {
	96	+ try {
	97	+ sendTextInternal(talker, text);
	98	+ } catch (Throwable t) {
	99	+ XposedBridge.log("[WeChatSendHook] Send failed: " + t);
	100	+ }
	101	+ });
	102	+ }
	103	+
	104	+ /**
	105	+ * Core send via w11.s1 factory (SendMsgCgiFactory):
	106	+ * s1.a(talker) → r1 with pipeline=p1.TEXT, talker pre-set
	107	+ * r1.e(content) → set field d (content)
	108	+ * r1.b() → executeByPPC (no callback)
	109	+ *
	110	+ * r1 field mapping (WeChat 8.0.74):
	111	+ * field b = talker (set by g())
	112	+ * field d = content (set by e())
	113	+ * field e = type (default 1=text, set by h())
	114	+ * field l = pipeline (set to p1.TEXT by s1.a())
	115	+ */
	116	+ private static void sendTextInternal(String talker, String text) throws Throwable {
	117	+ Class<?> s1 = XposedHelpers.findClass("w11.s1", sWeChat);
	118	+ // s1.a(talker) → r1 with g(talker) pre-called and l=p1.TEXT
	119	+ Object r1 = XposedHelpers.callStaticMethod(s1, "a", talker);
	120	+ // r1.e(content) → sets field d
	121	+ XposedHelpers.callMethod(r1, "e", text);
	122	+ // r1.b() → d(this,null,1,null) → c(q1.d) → executeByPPC
	123	+ XposedHelpers.callMethod(r1, "b");
	124	+ XposedBridge.log("[WeChatSendHook] Sent: to=" + talker);
	125	+ }
	126	+}
...	...

wechat_send_internal/test_send.sh 0 → 100644

View file @b4a635a

	1	+#!/usr/bin/env bash
	2	+# Test Route A send hook via adb
	3	+# Usage: bash test_send.sh <wxid> "<text>"
	4	+# Example: bash test_send.sh wxid_abc123 "Hello from hook"
	5	+#
	6	+# NOTE: This is a TEST SCRIPT — read-only / dry-run by default.
	7	+# Set DRY_RUN=0 to actually trigger the broadcast.
	8	+
	9	+set -euo pipefail
	10	+
	11	+TALKER="${1:-}"
	12	+TEXT="${2:-}"
	13	+DRY_RUN="${DRY_RUN:-1}" # Default: print only, don't fire
	14	+
	15	+if [ -z "$TALKER" ] \|\| [ -z "$TEXT" ]; then
	16	+ echo "Usage: DRY_RUN=0 bash test_send.sh <talker> '<text>'"
	17	+ echo " talker examples:"
	18	+ echo " wxid_abc123 (1-on-1)"
	19	+ echo " 12345678901@chatroom (group)"
	20	+ exit 1
	21	+fi
	22	+
	23	+CMD="adb shell am broadcast \
	24	+ -a com.hermes.wechat.SEND_MSG_INTERNAL \
	25	+ --es to \"$TALKER\" \
	26	+ --es text \"$TEXT\""
	27	+
	28	+echo "Command to run:"
	29	+echo " $CMD"
	30	+echo ""
	31	+
	32	+if [ "$DRY_RUN" = "1" ]; then
	33	+ echo "[DRY RUN] Not executing. Set DRY_RUN=0 to actually send."
	34	+else
	35	+ echo "[SENDING] Executing broadcast..."
	36	+ eval "$CMD"
	37	+ echo ""
	38	+ echo "Check logcat for: [WeChatSendHook]"
	39	+ echo " adb logcat -s Xposed:D \| grep WeChatSendHook"
	40	+fi
...	...

xhs_lsposed_a16_fix/analyze_wechathook.py 0 → 100644

View file @b4a635a

	1	+#!/usr/bin/env python3
	2	+"""
	3	+analyze_wechathook.py — 从 Tinker patch DEX 分析 WeChat 8.0.74 消息发送路径
	4	+在 Termux 上运行: python3 /sdcard/wechathook/analyze_wechathook.py
	5	+
	6	+目标:
	7	+1. 解码 w11.r0 构造器字节码，看它调了什么
	8	+2. 解码 gm0.j1.i() 字节码，确认它检查的是字段 m
	9	+3. 检查 gm0.j1.m 在运行时是否 null（通过分析 gm0.j1.g() 是否被调用）
	10	+"""
	11	+import struct, os, subprocess
	12	+
	13	+# Tinker patch DEX (需要有 root 才能访问)
	14	+TINKER_APK = "/data/user/0/com.tencent.mm/tinker/patch-cf87f687/dex/tinker_classN.apk"
	15	+WORK_DIR = "/data/local/tmp/wh_dex_analysis"
	16	+
	17	+def ensure_dex():
	18	+ os.makedirs(WORK_DIR, exist_ok=True)
	19	+ dex = f"{WORK_DIR}/classes12.dex"
	20	+ if not os.path.exists(dex):
	21	+ # 需要 root 拷贝
	22	+ r = subprocess.run(["su", "-c", f"cp {TINKER_APK} /data/local/tmp/_tinker.apk && chmod 644 /data/local/tmp/_tinker.apk"],
	23	+ capture_output=True, text=True)
	24	+ if r.returncode != 0:
	25	+ print("需要 root 权限:", r.stderr)
	26	+ return None
	27	+ import zipfile
	28	+ with zipfile.ZipFile("/data/local/tmp/_tinker.apk") as z:
	29	+ z.extract("classes12.dex", WORK_DIR)
	30	+ print(f"Extracted classes12.dex ({os.path.getsize(dex)} bytes)")
	31	+ return dex
	32	+
	33	+def uleb128(data, off):
	34	+ r, s = 0, 0
	35	+ while True:
	36	+ b = data[off]; off += 1
	37	+ r \|= (b & 0x7F) << s
	38	+ if not (b & 0x80): break
	39	+ s += 7
	40	+ return r, off
	41	+
	42	+def parse_dex(path):
	43	+ data = open(path, "rb").read()
	44	+ h = lambda o: struct.unpack_from('<I', data, o)[0]
	45	+ ss, so = h(56), h(60)
	46	+ ts, to = h(64), h(68)
	47	+ fs, fo = h(80), h(84)
	48	+ ms, mo = h(88), h(92)
	49	+ cs, co = h(96), h(100)
	50	+ ps, po = h(72), h(76)
	51	+
	52	+ def gs(i):
	53	+ if i >= ss: return f"?s{i}"
	54	+ off = h(so + i*4); _, o2 = uleb128(data, off)
	55	+ return data[o2:data.index(b'\x00', o2)].decode('utf-8', errors='replace')
	56	+ def gt(i):
	57	+ if i >= ts: return f"?t{i}"
	58	+ return gs(h(to + i*4))
	59	+ def gp(pi):
	60	+ if pi >= ps: return "?proto"
	61	+ pb = po + pi*12
	62	+ ret = gt(h(pb+4)); poff = h(pb+8); params = []
	63	+ if poff:
	64	+ n = h(poff)
	65	+ for k in range(n): params.append(gt(struct.unpack_from('<H', data, poff+4+k*2)[0]))
	66	+ return f"({','.join(params)}){ret}"
	67	+
	68	+ classes = {}
	69	+ for i in range(cs):
	70	+ base = co + i*32
	71	+ ci = h(base)
	72	+ if ci >= ts: continue
	73	+ name = gt(ci)
	74	+ cdo = h(base+24)
	75	+ if cdo == 0: continue
	76	+ off = cdo
	77	+ sf, off = uleb128(data, off)
	78	+ inf, off = uleb128(data, off)
	79	+ dm, off = uleb128(data, off)
	80	+ vm, off = uleb128(data, off)
	81	+
	82	+ fields, methods = [], []
	83	+ fi = 0
	84	+ for _ in range(sf+inf):
	85	+ d, off = uleb128(data, off); fi += d
	86	+ fl, off = uleb128(data, off)
	87	+ if fi < fs:
	88	+ fb = fo+fi*8
	89	+ ft = struct.unpack_from('<H', data, fb+2)[0]
	90	+ fn = struct.unpack_from('<I', data, fb+4)[0]
	91	+ fields.append((gs(fn), gt(ft), fl))
	92	+
	93	+ mi = 0
	94	+ for _ in range(dm+vm):
	95	+ d, off = uleb128(data, off); mi += d
	96	+ fl, off = uleb128(data, off)
	97	+ co2, off = uleb128(data, off)
	98	+ if mi < ms:
	99	+ mb = mo+mi*8
	100	+ pi = struct.unpack_from('<H', data, mb+2)[0]
	101	+ mn = struct.unpack_from('<I', data, mb+4)[0]
	102	+ methods.append((gs(mn), gp(pi), fl, co2))
	103	+ classes[name] = {'fields': fields, 'methods': methods}
	104	+ return classes, data, to, ts, fo, fs, mo, ms, po, ps, so, ss
	105	+
	106	+def dump_bytecode(data, code_off, max_insns=80):
	107	+ """简单 Dalvik 字节码 dump（只看调用指令）"""
	108	+ if code_off == 0: return " (abstract)"
	109	+ # code_item header: registers_size(2) ins_size(2) outs_size(2) tries_size(2) debug_info_off(4) insns_size(4)
	110	+ insns_size = struct.unpack_from('<I', data, code_off+12)[0]
	111	+ insns_off = code_off + 16
	112	+ lines = []
	113	+ i = 0
	114	+ while i < insns_size and len(lines) < max_insns:
	115	+ op = data[insns_off + i*2]
	116	+ # Only show invoke-* and sget/sput/iget/iput
	117	+ if op in (0x6e, 0x6f, 0x70, 0x71, 0x72, # invoke-virtual, super, direct, static, interface
	118	+ 0x74, 0x75, 0x76, 0x77, 0x78, # invoke-virtual/range etc
	119	+ 0x60, 0x61, 0x62, 0x63, 0x64, # iget, iget-wide, iget-object, iget-bool, iget-byte
	120	+ 0x68, 0x69, 0x6a, 0x6b, 0x6c, # sget, sget-wide, sget-object, sget-bool, sget-byte
	121	+ 0x59, 0x5a, 0x5b, 0x5c, 0x5d, # iput, iput-wide, iput-object, iput-bool, iput-byte
	122	+ 0x67, 0x69, 0x6b): # sput, sput-object, sput-bool
	123	+ ref = struct.unpack_from('<H', data, insns_off + i*2 + 2)[0]
	124	+ lines.append(f" +{i*2:04x} op=0x{op:02x} ref={ref}")
	125	+ i += 3
	126	+ elif op in (0x0e, 0x0f, 0x10, 0x11): # return-void, return, return-wide, return-object
	127	+ lines.append(f" +{i*2:04x} return")
	128	+ break
	129	+ elif op == 0x27: # throw
	130	+ lines.append(f" +{i*2:04x} throw")
	131	+ i += 2
	132	+ else:
	133	+ # Rough skip — most insns are 1-2 units
	134	+ fmt = (op >> 4) & 0xf
	135	+ i += 2 if op in range(0x02, 0x0e) or op in range(0x1a, 0x22) or op >= 0x26 else 1
	136	+ return '\n'.join(lines) if lines else " (no invoke/field ops)"
	137	+
	138	+def main():
	139	+ dex = ensure_dex()
	140	+ if not dex:
	141	+ return
	142	+
	143	+ print("Parsing DEX...")
	144	+ classes, data, to, ts, fo, fs, mo, ms, po, ps, so, ss = parse_dex(dex)
	145	+
	146	+ # ── 1. gm0.j1 structure ──────────────────────────────────────────
	147	+ print("\n" + "="*60)
	148	+ print("1. gm0.j1 class")
	149	+ print("="*60)
	150	+ j1 = classes.get("Lgm0/j1;")
	151	+ if j1:
	152	+ print("Static fields:")
	153	+ for name, typ, flags in j1['fields']:
	154	+ print(f" {name}: {typ} flags=0x{flags:x}")
	155	+ print("\nMethods with signatures:")
	156	+ for name, proto, flags, co2 in j1['methods']:
	157	+ flag_s = '+'.join(f for f, b in [('public',1),('static',8),('sync',0x20),('ctor',0x10000)] if flags&b)
	158	+ print(f" {name}: {proto} [{flag_s}]")
	159	+ else:
	160	+ print("NOT FOUND")
	161	+
	162	+ # ── 2. w11.r0 structure ──────────────────────────────────────────
	163	+ print("\n" + "="*60)
	164	+ print("2. w11.r0 class")
	165	+ print("="*60)
	166	+ r0 = classes.get("Lw11/r0;")
	167	+ if r0:
	168	+ print("Static fields:")
	169	+ for name, typ, flags in r0['fields']:
	170	+ print(f" {name}: {typ}")
	171	+ print(f"\nConstructors (looking for (String,String,int,int,long)):")
	172	+ for name, proto, flags, co2 in r0['methods']:
	173	+ if name == "<init>":
	174	+ print(f" <init>{proto} code_off=0x{co2:x}")
	175	+ else:
	176	+ print("NOT FOUND")
	177	+
	178	+ # ── 3. Decode gm0.j1.i() bytecode ───────────────────────────────
	179	+ print("\n" + "="*60)
	180	+ print("3. gm0.j1.i() bytecode (key ops)")
	181	+ print("="*60)
	182	+ if j1:
	183	+ for name, proto, flags, co2 in j1['methods']:
	184	+ if name == "i" and "()Lgm0/j1;" in proto:
	185	+ print(f"gm0.j1.i() code_off=0x{co2:x}")
	186	+ print(dump_bytecode(data, co2))
	187	+ break
	188	+
	189	+ # ── 4. Decode w11.r0 (String,String,int,int,long) ctor ──────────
	190	+ print("\n" + "="*60)
	191	+ print("4. w11.r0 constructor bytecode (key invoke ops)")
	192	+ print("="*60)
	193	+ if r0:
	194	+ for name, proto, flags, co2 in r0['methods']:
	195	+ if name == "<init>" and "Ljava/lang/String;Ljava/lang/String;IIJ" in proto:
	196	+ print(f"<init>(String,String,int,int,long) code_off=0x{co2:x}")
	197	+ print(dump_bytecode(data, co2, max_insns=40))
	198	+ break
	199	+
	200	+ # ── 5. Who initializes gm0.j1.m? Search for sput-object on field m ─
	201	+ print("\n" + "="*60)
	202	+ print("5. Searching gm0.j1.g() bytecode")
	203	+ print("="*60)
	204	+ if j1:
	205	+ for name, proto, flags, co2 in j1['methods']:
	206	+ if name == "g":
	207	+ print(f"gm0.j1.g{proto} code_off=0x{co2:x}")
	208	+ print(dump_bytecode(data, co2))
	209	+ break
	210	+
	211	+ print("\n== Done ==")
	212	+
	213	+if __name__ == "__main__":
	214	+ main()
...	...

xhs_lsposed_a16_fix/do_not_break.md 0 → 100644

View file @b4a635a

	1	+# WeChatHook — DO NOT BREAK 清单
	2	+
	3	+## 当前状态（2026-07-04 已验证）
	4	+
	5	+已安装 APK: `com.example.wechathook` (versionCode=1)
	6	+签名: `~/.android/debug.keystore` (CN=Android Debug,O=Android,C=US)
	7	+APK 路径: `/data/app/~~UUcd24uZ9ch3W7ZmJpIxlQ==/com.example.wechathook-Jns-UMdjPSZgIGeeIqFAwQ==/base.apk`
	8	+LSPosed DB: mid=42, scope=(42, com.tencent.mm, 0), enabled=1
	9	+功能: 微信平板登录 + WCDB hook + gm0.j1.g hook + w11.r0 hook
	10	+
	11	+## 绝对禁止事项
	12	+
	13	+### 1. 不要用 XposedBridgeApi.jar 重新编译
	14	+LSPosed Vector 运行时用的是自己混淆的 XposedHelpers，标准 XposedBridgeApi.jar 编译出来的
	15	+APK 所有 findAndHookMethod 调用全部 NoSuchMethodError。
	16	+
	17	+必须用的 JAR: `/tmp/LSPosed/legacy/build/intermediates/compile_library_classes_jar/release/bundleLibCompileToJarRelease/classes.jar`
	18	+（在 Mac 上，Pixel 上没有这个 JAR）
	19	+
	20	+如果 Mac 上没有这个 JAR，不要重新编译。只改 Java 源码而不重编是可以的（改 /sdcard/wechathook/WeChatHook.java），但必须用正确 JAR 编译才能安装新版本。
	21	+
	22	+### 2. APK 必须包含 assets/xposed_init
	23	+打包时必须: `zip APK.apk assets/xposed_init ...`（注意 assets/ 子目录层级）
	24	+文件内容: `com.example.wechathook.WeChatHook`
	25	+
	26	+LSPosed daemon 每次启动都验证这个文件。缺失 → 自动从 DB 删除模块 → 平板登录消失。
	27	+
	28	+根目录的 `xposed_init`（不在 assets/ 下）不够，daemon 不认。
	29	+
	30	+### 3. 不要换 keystore 签名
	31	+当前已安装版本用 `~/.android/debug.keystore`。
	32	+如果用不同 keystore 重签 → INSTALL_FAILED_UPDATE_INCOMPATIBLE → 必须先 uninstall（会丢失 LSPosed DB 注册）。
	33	+
	34	+### 4. 不要直接改 LSPosed DB 而不做 WAL checkpoint
	35	+改完必须: `PRAGMA wal_checkpoint(TRUNCATE)` + 把主 DB 拷覆盖 .bak .bak2 .bak3 .bak4 四个文件。
	36	+
	37	+## 安全测试约束（严禁违反）
	38	+
	39	+只用 filehelper（文件传输助手）测试发消息，绝对不能发给真实联系人。
	40	+微信对异常行为会封号，一旦封号无法找回。
	41	+
	42	+## 如果你需要重新安装 APK
	43	+
	44	+```bash
	45	+# 1. 备份 DB（万一要恢复）
	46	+adb shell su -c 'cp /data/adb/lspd/config/modules_config.db /data/local/tmp/modules_backup.db'
	47	+
	48	+# 2. 卸载旧版本
	49	+adb shell pm uninstall com.example.wechathook
	50	+
	51	+# 3. 安装新版本（必须已按上面规则编译 + 打包 + 签名）
	52	+adb install --no-incremental /path/to/new.apk
	53	+
	54	+# 4. 修复 DB（参考 /sdcard/wechathook/fix_lspd_final.py）
	55	+adb shell su -c '/path/to/python3 /sdcard/wechathook/fix_lspd_final.py'
	56	+
	57	+# 5. 重启
	58	+adb shell su -c reboot
	59	+
	60	+# 6. 验证
	61	+adb shell su -c 'grep -i "WeChatHook\\|hookInTablet\\|NoSuchMethod" /data/adb/lspd/log/modules_*.log'
	62	+```
	63	+
	64	+## 验证钩子是否正常的命令
	65	+
	66	+```bash
	67	+adb shell su -c 'grep "\[WeChatHook\]" /data/adb/lspd/log/modules_*.log \| head -30'
	68	+```
	69	+
	70	+正常输出应包含（无 NoSuchMethodError）:
	71	+- Hooked bk.B(x0) + bk.A()
	72	+- Hooked Activity.onResume for tablet button
	73	+- Hooked LoginPasswordUI.onCreate()
	74	+- Hooked MobileInputUI.initView() / LoginUI.initView()
	75	+- WCDB hook OK
	76	+- gm0.j1.g hook OK
...	...

xhs_lsposed_a16_fix/hermes_task.md 0 → 100644

View file @b4a635a

	1	+# 任务：修通 WeChat Xposed 内部发送接口
	2	+
	3	+## 🔒 安全约束（不得违反）
	4	+
	5	+只能用 `filehelper`（文件传输助手）测试，绝对不能给真实联系人发消息。
	6	+测试命令固定格式：
	7	+```bash
	8	+su -c 'am broadcast -a com.hermes.wechat.SEND_MSG_INTERNAL --es to "filehelper" --es text "测试"'
	9	+```
	10	+
	11	+---
	12	+
	13	+## 目标
	14	+
	15	+让 LSPosed 模块 `com.example.wechathook` 能通过 broadcast 真正把消息发进微信 message 数据库（EnMicroMsg.db），在文件传输助手收到消息。
	16	+
	17	+设备：Pixel 10 Pro Fold，Android 16，WeChat 8.0.74，LSPosed JingMatrix Vector v1.11.0。
	18	+
	19	+---
	20	+
	21	+## 工作目录
	22	+
	23	+```
	24	+/sdcard/wechathook/
	25	+ WeChatHook.java ← 当前源码（已是最新版）
	26	+ termux_build.sh ← Termux 上编译+安装脚本
	27	+ analyze_wechathook.py ← DEX 字节码分析工具（Python，读 Tinker patch）
	28	+ XposedBridgeApi.jar ← 编译依赖
	29	+ android.jar ← 编译依赖（API 36）
	30	+ d8.jar ← DEX 转换工具
	31	+ wechathook_current.apk ← 当前安装版本
	32	+```
	33	+
	34	+---
	35	+
	36	+## 当前状态（已做了什么、失败在哪）
	37	+
	38	+### 已实现
	39	+
	40	+模块已注入所有 WeChat 进程（main / push / appbrand0 / appbrand1）。每个进程里：
	41	+1. 注册了 `com.hermes.wechat.SEND_MSG_INTERNAL` broadcast receiver
	42	+2. 挂钩了 `w11.r0` 的 4 种构造器（(String,String,int,int,long) 等）
	43	+3. 挂钩了 `w11.r0.H(String)`（发送 dispatch 方法）
	44	+4. 挂钩了 `gm0.j1.g(km0.c)`（DI 内核初始化检测）
	45	+5. 挂钩了 WCDB `insertWithOnConflict`（诊断用）
	46	+
	47	+### 关键发现（失败原因）
	48	+
	49	+发现 1：`w11.r0` 构造器永远不被 WeChat 自己调用。
	50	+用户在 UI 点发送时，`w11.r0` 的构造器 hook 从未触发过。说明 WeChat 8.0.74（Tinker patch 版）的文字发送路径根本不经过 `w11.r0` 这个类，或走的是完全不同的入口（native / 另一个类名）。
	51	+
	52	+发现 2：WCDB Java hook 从未触发。
	53	+`com.tencent.wcdb.database.SQLiteDatabase.insertWithOnConflict` 在发消息时从未被调用。说明消息写库走的是纯 native 路径（JNI），绕开了 Java 层的 WCDB wrapper。
	54	+
	55	+发现 3：`gm0.j1.g(km0.c)` hook 注册成功但从不触发。
	56	+WeChat 正常运行（包括收发消息）期间，`gm0.j1.g()` 这个我们以为是 DI 初始化点的方法从未被调用过。说明 WeChat 用了另一条路初始化 DI 内核（或者混淆后方法名已变）。
	57	+
	58	+发现 4：我们调用 `w11.r0(String,String,int,int,long)` 时：
	59	+- main 进程：`NullPointerException`（某个 Context 对象是 null）
	60	+- 其他进程：`iz5.b: Kernel not initialized by MMApplication!`（`gm0.j1.i()` 抛出，说明 `gm0.j1.m` 静态字段是 null）
	61	+
	62	+---
	63	+
	64	+## 需要你做什么
	65	+
	66	+### 第 1 步：用 Frida 找 WeChat 真正的发送路径（最重要）
	67	+
	68	+我们不知道 WeChat 8.0.74 Tinker 版实际用哪个 Java 方法发文字消息。用 Frida 在用户点「发送」按钮时抓调用栈：
	69	+
	70	+```python
	71	+# 在 Mac 端 Frida bridge 调用，或者直接在设备上用 frida-ps / frida-trace
	72	+# 目标：com.tencent.mm（主进程）
	73	+# 找到发送文字消息时调用的 Java 方法
	74	+```
	75	+
	76	+具体建议：hook `com.tencent.wcdb.database.SQLiteDatabase` 的 native 层，或者用 Frida 的 Java.enumerateMethods 搜含 "sendMsg" / "sendTextMsg" 关键词的方法，在用户点发送时看 logcat。
	77	+
	78	+如果 Frida 不方便，另一条路是用 Xposed hook `android.os.MessageQueue.next()` + 过滤调用栈，找 WeChat 发消息时进入的第一个 WeChat 内部类。
	79	+
	80	+### 第 2 步：运行 DEX 分析脚本
	81	+
	82	+```bash
	83	+# 在 Termux 里（需要 root）
	84	+python3 /sdcard/wechathook/analyze_wechathook.py
	85	+```
	86	+
	87	+这个脚本会从 Tinker patch 的 classes12.dex 里提取：
	88	+- `gm0.j1` 的所有字段和方法签名
	89	+- `w11.r0` 的所有构造器签名
	90	+- `gm0.j1.i()` 的字节码（关键调用）
	91	+- `gm0.j1.g()` 的字节码（看它究竟做了什么）
	92	+
	93	+看输出里 `gm0.j1.i()` 的字节码，找它检查的是哪个字段（sget-object 指令）；找谁会真正设置那个字段（sput-object 指令在哪个方法里）。
	94	+
	95	+### 第 3 步：根据发现修改 WeChatHook.java
	96	+
	97	+修改路径两选一：
	98	+
	99	+路径 A（推荐）：换用 WeChat 真实的发送方法
	100	+如果 Frida 或字节码分析找到了真实发送入口（比如 `xxx.sendTextMessage(talker, text)` 这种），直接在 hook 里反射调用它，完全绕开 `w11.r0`。
	101	+
	102	+路径 B：修复 DI 初始化
	103	+找到真正初始化 `gm0.j1.m` 的方法（替代 `gm0.j1.g()`），hook 那个方法，在它完成后触发发送。
	104	+
	105	+### 第 4 步：编译 + 安装 + 测试
	106	+
	107	+```bash
	108	+# 修改 WeChatHook.java 后，在 Termux 里：
	109	+cd /sdcard/wechathook
	110	+bash termux_build.sh
	111	+
	112	+# 脚本会自动：编译 → DEX → 签名 → pm install -r → 更新 LSPosed DB
	113	+# 完成后重启 WeChat（脚本末尾会提示命令）
	114	+
	115	+# 然后测试（只用 filehelper）：
	116	+su -c 'am broadcast -a com.hermes.wechat.SEND_MSG_INTERNAL --es to "filehelper" --es text "测试123"'
	117	+
	118	+# 看 LSPosed 日志确认有没有走到 Send OK：
	119	+su -c 'logcat -d -s WeChatHook:* WeChatHookEarly:* \| tail -50'
	120	+```
	121	+
	122	+---
	123	+
	124	+## 关键类名参考（WeChat 8.0.74 Tinker patch，classes12.dex）
	125	+
	126	+\| 类 \| 作用 \|
	127	+\|---\|---\|
	128	+\| `gm0.j1` \| DI 容器单例；`i()→Lgm0/j1;` 取单例；`m` 是静态字段 \|
	129	+\| `km0.c` \| WeChat kernel/application 对象，传给 `gm0.j1.g()` \|
	130	+\| `gm0.b0` \| mCoreStorage，从 `gm0.j1.u()` 取 \|
	131	+\| `w11.r0` \| 疑似 NetSceneSendMsg，但 WeChat 自己不走这里 \|
	132	+\| `iz5.b` \| 异常类：Kernel not initialized by MMApplication! \|
	133	+\| `fs.g` \| DI enum；`a[0]` 是当前实现 \|
	134	+\| `fs.k2` \| DI 实现枚举；`e` 是目标值 \|
	135	+
	136	+Tinker patch APK（root 权限才能访问）：
	137	+```
	138	+/data/user/0/com.tencent.mm/tinker/patch-cf87f687/dex/tinker_classN.apk
	139	+```
	140	+包含 classes2.dex ~ classes17.dex，关键类在 classes12.dex。
	141	+
	142	+---
	143	+
	144	+## 当前 WeChatHook.java 的核心逻辑（方便你快速理解）
	145	+
	146	+```
	147	+broadcast 到达
	148	+ → trySendWithRetry(talker, text, 0, procName)
	149	+ → isDIReady()? 调 gm0.j1.i() 看是否抛异常
	150	+ → 如果不 ready：挂 pending，等 gm0.j1.g() hook 触发（但 g() 从没触发过！）
	151	+ → 如果 ready：sendViaR0(talker, text)
	152	+ → new w11.r0(talker, text, 1, 0, ts) ← 在所有进程都失败
	153	+ → r0.H("") ← 从没执行到
	154	+```
	155	+
	156	+关键 bug：整条路的前提假设（`gm0.j1.g()` 是初始化点，`w11.r0` 是发送入口）可能都是错的。需要从真实调用栈重新定位。
	157	+
	158	+---
	159	+
	160	+## 输出期望
	161	+
	162	+完成后，以下命令应该能让文件传输助手收到消息：
	163	+```bash
	164	+su -c 'am broadcast -a com.hermes.wechat.SEND_MSG_INTERNAL --es to "filehelper" --es text "hello from hermes"'
	165	+```
	166	+
	167	+LSPosed 日志里应该看到 `[WeChatHook] Send OK to=filehelper`。
	168	+
	169	+把修改后的 `WeChatHook.java` 回写到 `/sdcard/wechathook/WeChatHook.java`，方便 Mac 端同步。
...	...

xhs_lsposed_a16_fix/rebuild_wechathook.sh 0 → 100755

View file @b4a635a

	1	+#!/bin/bash
	2	+# rebuild_wechathook.sh — compile WeChatHook, repackage into com.example.wechathook APK
	3	+# Uses the existing APK from device as a base (preserves binary AndroidManifest).
	4	+set -e
	5	+
	6	+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
	7	+ADB="${ADB:-$SCRIPT_DIR/../platform-tools/adb}"
	8	+[ ! -f "$ADB" ] && ADB=adb
	9	+
	10	+ANDROID_HOME="${ANDROID_HOME:-/opt/homebrew/share/android-commandlinetools}"
	11	+ANDROID_JAR="$ANDROID_HOME/platforms/android-36/android.jar"
	12	+D8="$ANDROID_HOME/build-tools/36.0.0/d8"
	13	+APKSIGNER="$ANDROID_HOME/build-tools/36.0.0/apksigner"
	14	+LSPOSED_DIR="${LSPOSED_DIR:-/tmp/LSPosed}"
	15	+LEGACY_JAR="$LSPOSED_DIR/legacy/build/intermediates/compile_library_classes_jar/release/bundleLibCompileToJarRelease/classes.jar"
	16	+
	17	+if [ ! -f "$LEGACY_JAR" ]; then
	18	+ echo "LSPosed legacy JAR not found at $LEGACY_JAR"
	19	+ echo "Run: git clone --depth 1 --recursive https://github.com/JingMatrix/LSPosed.git $LSPOSED_DIR && cd $LSPOSED_DIR && ./gradlew :legacy:assembleRelease"
	20	+ exit 1
	21	+fi
	22	+
	23	+BUILD_DIR=/tmp/wechathook_rebuild
	24	+rm -rf "$BUILD_DIR"
	25	+mkdir -p "$BUILD_DIR/compiled" "$BUILD_DIR/dex" "$BUILD_DIR/pack/assets"
	26	+
	27	+# Pull current APK from device to reuse its binary AndroidManifest and resources.arsc
	28	+echo "== Pulling current wechathook APK from device =="
	29	+WH_PATH=$($ADB shell "pm path com.example.wechathook 2>/dev/null \| tr -d '\r' \| sed 's/package://'" 2>/dev/null)
	30	+if [ -z "$WH_PATH" ]; then
	31	+ echo "ERROR: com.example.wechathook not installed on device"
	32	+ exit 1
	33	+fi
	34	+$ADB shell "su -c \"cp $WH_PATH /data/local/tmp/wh_base.apk && chmod 644 /data/local/tmp/wh_base.apk\""
	35	+$ADB pull /data/local/tmp/wh_base.apk "$BUILD_DIR/pack/base.apk" 2>/dev/null
	36	+
	37	+# Extract AndroidManifest and resources from existing APK
	38	+cd "$BUILD_DIR/pack" && unzip -o base.apk AndroidManifest.xml resources.arsc -d . > /dev/null 2>&1
	39	+rm -f base.apk
	40	+
	41	+echo "== Compiling WeChatHook.java =="
	42	+javac --release 11 \
	43	+ -classpath "$ANDROID_JAR:$LEGACY_JAR" \
	44	+ -d "$BUILD_DIR/compiled" \
	45	+ "$SCRIPT_DIR/wechathook_src/WeChatHook.java"
	46	+
	47	+echo "== Converting to DEX =="
	48	+$D8 \
	49	+ --classpath "$ANDROID_JAR" \
	50	+ --classpath "$LEGACY_JAR" \
	51	+ --min-api 27 \
	52	+ --output "$BUILD_DIR/dex" \
	53	+ $(find "$BUILD_DIR/compiled/com/example/wechathook" -name "*.class")
	54	+
	55	+echo "== Packing APK =="
	56	+cp "$BUILD_DIR/dex/classes.dex" "$BUILD_DIR/pack/"
	57	+# Put xposed_init in assets/ (required by lspd) AND root (belt+suspenders)
	58	+echo "com.example.wechathook.WeChatHook" > "$BUILD_DIR/pack/assets/xposed_init"
	59	+echo "com.example.wechathook.WeChatHook" > "$BUILD_DIR/pack/xposed_init"
	60	+
	61	+cd "$BUILD_DIR/pack"
	62	+zip -0 wechathook.apk AndroidManifest.xml resources.arsc classes.dex xposed_init 2>/dev/null \|\| true
	63	+zip -0 wechathook.apk assets/xposed_init
	64	+
	65	+# Sign
	66	+if [ ! -f /tmp/debug.keystore ]; then
	67	+ keytool -genkey -v -keystore /tmp/debug.keystore -alias androiddebugkey \
	68	+ -keyalg RSA -keysize 2048 -validity 10000 \
	69	+ -storepass android -keypass android \
	70	+ -dname "CN=Android Debug,O=Android,C=US" 2>/dev/null
	71	+fi
	72	+
	73	+echo "== Signing =="
	74	+OUT="$SCRIPT_DIR/wechathook_v2_signed.apk"
	75	+$APKSIGNER sign \
	76	+ --ks /tmp/debug.keystore \
	77	+ --ks-key-alias androiddebugkey \
	78	+ --ks-pass pass:android \
	79	+ --key-pass pass:android \
	80	+ --out "$OUT" \
	81	+ "$BUILD_DIR/pack/wechathook.apk" 2>/dev/null
	82	+
	83	+echo "== Done: $OUT =="
	84	+echo "APK size: $(wc -c < "$OUT") bytes"
	85	+echo ""
	86	+echo "Next steps:"
	87	+echo " adb install -r --no-incremental $OUT"
	88	+echo " bash $SCRIPT_DIR/update_wechathook_db.sh"
	89	+echo " adb reboot"
...	...

xhs_lsposed_a16_fix/termux_build.sh 0 → 100644

View file @b4a635a

	1	+#!/data/data/com.termux/files/usr/bin/bash
	2	+# termux_build.sh — 在 Termux 上编译 WeChatHook 并安装
	3	+# 所有依赖已在 /sdcard/wechathook/ 准备好
	4	+set -e
	5	+
	6	+BASE=/sdcard/wechathook
	7	+SRC=$BASE/WeChatHook.java
	8	+XPOSED_JAR=$BASE/XposedBridgeApi.jar
	9	+ANDROID_JAR=$BASE/android.jar
	10	+D8_JAR=$BASE/d8.jar
	11	+
	12	+BUILD=/data/data/com.termux/files/home/wh_build
	13	+rm -rf "$BUILD"
	14	+mkdir -p "$BUILD/compiled" "$BUILD/dex" "$BUILD/pack/assets"
	15	+
	16	+# 1. 取当前 APK 的 AndroidManifest + resources（二进制，不重新生成）
	17	+WH_PATH=$(pm path com.example.wechathook \| tr -d '\r' \| sed 's/package://')
	18	+echo "Base APK: $WH_PATH"
	19	+su -c "cp '$WH_PATH' /data/local/tmp/wh_base.apk && chmod 644 /data/local/tmp/wh_base.apk"
	20	+cp /data/local/tmp/wh_base.apk "$BUILD/pack/base.apk"
	21	+cd "$BUILD/pack" && unzip -o base.apk AndroidManifest.xml resources.arsc -d . > /dev/null
	22	+rm -f base.apk
	23	+
	24	+# 2. 编译
	25	+echo "== javac =="
	26	+javac --release 11 \
	27	+ -classpath "$ANDROID_JAR:$XPOSED_JAR" \
	28	+ -d "$BUILD/compiled" \
	29	+ "$SRC"
	30	+
	31	+# 3. DEX
	32	+echo "== d8 =="
	33	+java -cp "$D8_JAR" com.android.tools.r8.D8 \
	34	+ --classpath "$ANDROID_JAR" \
	35	+ --classpath "$XPOSED_JAR" \
	36	+ --min-api 27 \
	37	+ --output "$BUILD/dex" \
	38	+ $(find "$BUILD/compiled" -name "*.class")
	39	+
	40	+# 4. 打包
	41	+echo "== pack =="
	42	+cp "$BUILD/dex/classes.dex" "$BUILD/pack/"
	43	+echo "com.example.wechathook.WeChatHook" > "$BUILD/pack/assets/xposed_init"
	44	+echo "com.example.wechathook.WeChatHook" > "$BUILD/pack/xposed_init"
	45	+cd "$BUILD/pack"
	46	+zip -0 wechathook.apk AndroidManifest.xml resources.arsc classes.dex xposed_init > /dev/null
	47	+zip -0 wechathook.apk assets/xposed_init > /dev/null
	48	+
	49	+# 5. 签名（用 jarsigner，Termux JDK 自带）
	50	+KEYSTORE=/data/data/com.termux/files/home/.wh_debug.keystore
	51	+if [ ! -f "$KEYSTORE" ]; then
	52	+ echo "== 生成 keystore =="
	53	+ keytool -genkey -v -keystore "$KEYSTORE" -alias androiddebugkey \
	54	+ -keyalg RSA -keysize 2048 -validity 10000 \
	55	+ -storepass android -keypass android \
	56	+ -dname "CN=Android Debug,O=Android,C=US" 2>/dev/null
	57	+fi
	58	+echo "== jarsigner =="
	59	+jarsigner -keystore "$KEYSTORE" -storepass android -keypass android \
	60	+ -signedjar "$BUILD/pack/wechathook_signed.apk" \
	61	+ "$BUILD/pack/wechathook.apk" androiddebugkey 2>/dev/null
	62	+
	63	+OUT=$BASE/wechathook_new.apk
	64	+cp "$BUILD/pack/wechathook_signed.apk" "$OUT"
	65	+echo "== APK ready: $OUT ($(wc -c < "$OUT") bytes) =="
	66	+
	67	+# 6. 安装
	68	+echo "== pm install =="
	69	+su -c "pm install -r '$OUT'"
	70	+
	71	+# 7. 更新 LSPosed DB（apk_path 变了需要更新）
	72	+NEW_PATH=$(pm path com.example.wechathook \| tr -d '\r' \| sed 's/package://')
	73	+echo "== 更新 LSPosed DB: $NEW_PATH =="
	74	+su -c "python3 -c \"
	75	+import sqlite3
	76	+db = sqlite3.connect('/data/adb/lspd/config/modules_config.db')
	77	+db.execute(\\\"UPDATE modules SET apk_path='$NEW_PATH' WHERE module_pkg_name='com.example.wechathook'\\\")
	78	+db.commit()
	79	+db.close()
	80	+print('LSPosed DB updated')
	81	+\""
	82	+
	83	+echo ""
	84	+echo "== 完成，需要重启 WeChat 进程（或 reboot）使新模块生效 =="
	85	+echo " su -c 'killall com.tencent.mm' && am start -n com.tencent.mm/.ui.LauncherUI"
...	...

xhs_lsposed_a16_fix/update_wechathook_db.sh 0 → 100755

View file @b4a635a

	1	+#!/bin/bash
	2	+# update_wechathook_db.sh — 重装 wechathook APK 后更新 LSPosed modules_config.db
	3	+set -e
	4	+
	5	+ADB="${ADB:-$(dirname "$0")/../platform-tools/adb}"
	6	+[ ! -f "$ADB" ] && ADB=adb
	7	+
	8	+TERMUX_PY=/data/data/com.termux/files/usr/bin/python3
	9	+NEW_PATH=$($ADB shell 'pm path com.example.wechathook' \| tr -d '\r' \| sed 's/package://')
	10	+echo "New APK path: $NEW_PATH"
	11	+
	12	+# Phase 1: in-place UPDATE via Python (WAL commit visible to running lspd)
	13	+$ADB shell "su -c \"$TERMUX_PY -c \\\"
	14	+import sqlite3
	15	+db = sqlite3.connect('/data/adb/lspd/config/modules_config.db')
	16	+db.execute(\\\\\\\"UPDATE modules SET apk_path='${NEW_PATH}' WHERE module_pkg_name='com.example.wechathook'\\\\\\\")
	17	+db.commit()
	18	+try:
	19	+ db.execute('PRAGMA wal_checkpoint(TRUNCATE)')
	20	+except:
	21	+ pass
	22	+db.close()
	23	+print('phase1 done')
	24	+\\\"\"" 2>&1
	25	+
	26	+# Phase 2: pull + checkpoint locally + push clean main file
	27	+$ADB shell 'su -c "cp /data/adb/lspd/config/modules_config.db /data/local/tmp/mc_wh.db && cp /data/adb/lspd/config/modules_config.db-wal /data/local/tmp/mc_wh.db-wal 2>/dev/null; chmod 644 /data/local/tmp/mc_wh.db /data/local/tmp/mc_wh.db-wal 2>/dev/null; true"'
	28	+$ADB pull /data/local/tmp/mc_wh.db /tmp/mc_wh.db 2>/dev/null
	29	+$ADB pull /data/local/tmp/mc_wh.db-wal /tmp/mc_wh.db-wal 2>/dev/null \|\| true
	30	+sqlite3 /tmp/mc_wh.db "PRAGMA wal_checkpoint(TRUNCATE);" 2>/dev/null \|\| true
	31	+
	32	+ACTUAL=$(sqlite3 /tmp/mc_wh.db "SELECT apk_path FROM modules WHERE module_pkg_name='com.example.wechathook';")
	33	+echo "Verified path: $ACTUAL"
	34	+
	35	+$ADB push /tmp/mc_wh.db /data/local/tmp/mc_wh_clean.db
	36	+$ADB shell 'su -c "cp /data/local/tmp/mc_wh_clean.db /data/adb/lspd/config/modules_config.db && rm -f /data/adb/lspd/config/modules_config.db-wal /data/adb/lspd/config/modules_config.db-shm && echo phase2 done"'
	37	+
	38	+# Phase 3: verify scope (mid=18, com.tencent.mm)
	39	+MID=$(sqlite3 /tmp/mc_wh.db "SELECT mid FROM modules WHERE module_pkg_name='com.example.wechathook';")
	40	+echo "mid: $MID"
	41	+SCOPE=$(sqlite3 /tmp/mc_wh.db "SELECT count(*) FROM scope WHERE mid=$MID AND app_pkg_name='com.tencent.mm';")
	42	+if [ "$SCOPE" -eq 0 ]; then
	43	+ echo "scope missing — inserting mid=$MID → com.tencent.mm"
	44	+ sqlite3 /tmp/mc_wh.db "INSERT OR REPLACE INTO scope (mid, app_pkg_name, user_id) VALUES ($MID, 'com.tencent.mm', 0);"
	45	+ $ADB push /tmp/mc_wh.db /data/local/tmp/mc_wh_scope.db
	46	+ $ADB shell "su -c 'cp /data/local/tmp/mc_wh_scope.db /data/adb/lspd/config/modules_config.db && rm -f /data/adb/lspd/config/modules_config.db-wal /data/adb/lspd/config/modules_config.db-shm && echo scope fixed'"
	47	+else
	48	+ echo "scope OK (mid=$MID, com.tencent.mm exists)"
	49	+fi
	50	+
	51	+echo "DB updated. Reboot required."
...	...

xhs_lsposed_a16_fix/wechathook_src/WeChatHook.java 0 → 100644

View file @b4a635a

	1	+package com.example.wechathook;
	2	+
	3	+import android.app.Activity;
	4	+import android.content.BroadcastReceiver;
	5	+import android.content.Context;
	6	+import android.content.Intent;
	7	+import android.content.IntentFilter;
	8	+import android.os.Bundle;
	9	+import android.os.Handler;
	10	+import android.os.Looper;
	11	+import android.view.View;
	12	+import java.lang.reflect.Proxy;
	13	+import de.robv.android.xposed.IXposedHookLoadPackage;
	14	+import de.robv.android.xposed.XC_MethodHook;
	15	+import de.robv.android.xposed.XposedBridge;
	16	+import de.robv.android.xposed.XposedHelpers;
	17	+import de.robv.android.xposed.callbacks.XC_LoadPackage;
	18	+
	19	+public class WeChatHook implements IXposedHookLoadPackage {
	20	+
	21	+ private static final String ACTION_SEND = "com.hermes.wechat.SEND_MSG_INTERNAL";
	22	+ private static ClassLoader sWeChatCL;
	23	+ private static volatile Context sAppContext;
	24	+ private static volatile boolean sFsGReady = false;
	25	+ // Set true while WE are calling newInstance so r0Hook can distinguish us from WeChat
	26	+ private static volatile boolean sCalledByUs = false;
	27	+ // Pending send: stored when broadcast arrives before gm0.j1 is initialized
	28	+ private static volatile String sPendingTalker = null;
	29	+ private static volatile String sPendingText = null;
	30	+ private static volatile String sPendingProc = null;
	31	+
	32	+ @Override
	33	+ public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
	34	+ if (!"com.tencent.mm".equals(lpparam.packageName)) return;
	35	+ // Use android.util.Log directly so it appears even before VectorLegacyBridge is ready
	36	+ android.util.Log.i("WeChatHookEarly", "INIT proc=" + lpparam.processName
	37	+ + " pid=" + android.os.Process.myPid());
	38	+ XposedBridge.log("[WeChatHook] Injected into WeChat " + lpparam.processName
	39	+ + " pid=" + android.os.Process.myPid());
	40	+ ClassLoader cl = lpparam.classLoader;
	41	+ sWeChatCL = cl;
	42	+
	43	+ // Tablet login hooks (main process + any process)
	44	+ hookInTabletEnv(cl);
	45	+ hookProbe(cl);
	46	+ hookLoginHistoryUIInitView(cl);
	47	+ hookLoginUIInitView(cl);
	48	+ hookLoginSelectUICheck(cl);
	49	+ hookLoginButtonClick(cl);
	50	+
	51	+ // WCDB diagnostic: which process writes to WeChat message table?
	52	+ hookWCDB(cl, lpparam.processName);
	53	+
	54	+ // Hook gm0.j1.g() to detect when DI kernel is ready — runs in ALL processes.
	55	+ // This enables the pending-send mechanism: if broadcast arrives before DI init,
	56	+ // we store the args and retry once g() fires.
	57	+ hookDIInit(cl, lpparam.processName);
	58	+
	59	+ // Send hook in ALL WeChat processes — we need to find which one can actually send.
	60	+ // The broadcast receiver registered in each process will all receive the intent;
	61	+ // whichever process has gm0.j1 initialized will succeed.
	62	+ hookSendMessage(cl, lpparam.processName);
	63	+ }
	64	+
	65	+ // Diagnostic: hook WeChat's WCDB to find which process writes to the message table.
	66	+ // com.tencent.wcdb.database.SQLiteDatabase is WeChat's encrypted SQLite wrapper.
	67	+ private void hookWCDB(ClassLoader cl, String procName) {
	68	+ try {
	69	+ XposedHelpers.findAndHookMethod(
	70	+ "com.tencent.wcdb.database.SQLiteDatabase", cl,
	71	+ "insertWithOnConflict",
	72	+ String.class, String.class, android.content.ContentValues.class, int.class,
	73	+ new XC_MethodHook() {
	74	+ private boolean logged = false;
	75	+ @Override
	76	+ protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	77	+ String table = (String) param.args[0];
	78	+ if (table == null \|\| (!table.contains("message") && !table.equals("msg"))) return;
	79	+ if (!logged) {
	80	+ logged = true;
	81	+ String stack = android.util.Log.getStackTraceString(new Throwable());
	82	+ // Truncate to keep logcat readable
	83	+ if (stack.length() > 3000) stack = stack.substring(0, 3000) + "…";
	84	+ XposedBridge.log("[WeChatHook] WCDB INSERT table=" + table
	85	+ + " proc=" + procName + " pid=" + android.os.Process.myPid()
	86	+ + "\n" + stack);
	87	+ } else {
	88	+ XposedBridge.log("[WeChatHook] WCDB INSERT table=" + table
	89	+ + " proc=" + procName);
	90	+ }
	91	+ }
	92	+ });
	93	+ XposedBridge.log("[WeChatHook] WCDB hook OK in " + procName);
	94	+ } catch (Throwable t) {
	95	+ XposedBridge.log("[WeChatHook] WCDB hook failed in " + procName + ": " + t);
	96	+ }
	97	+ }
	98	+
	99	+ // PRIMARY FIX: WeChat's own methods (LoginPasswordUI.onCreate etc.) are AOT-compiled
	100	+ // in a way that bypasses ArtMethod entry point replacement. But framework-dispatched
	101	+ // base class methods like Activity.onResume() always go through the entry point.
	102	+ // We hook onResume, filter for the login screens, and force the tablet button visible.
	103	+ // By onResume time, all views are initialized (onCreate + initView have run).
	104	+ private void hookProbe(ClassLoader cl) {
	105	+ try {
	106	+ final Class<?> m4Class = XposedHelpers.findClass(
	107	+ "com.tencent.mm.plugin.account.ui.m4", cl);
	108	+
	109	+ XposedHelpers.findAndHookMethod(
	110	+ "android.app.Activity", null,
	111	+ "onResume", new XC_MethodHook() {
	112	+ @Override
	113	+ protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	114	+ String cls = param.thisObject.getClass().getName();
	115	+ if (!cls.equals("com.tencent.mm.plugin.account.ui.LoginPasswordUI")
	116	+ && !cls.equals("com.tencent.mm.plugin.account.ui.LoginHistoryUI")) {
	117	+ return;
	118	+ }
	119	+ Object obj = param.thisObject;
	120	+ View tabletBtn = null;
	121	+ try {
	122	+ tabletBtn = (View) XposedHelpers.getObjectField(obj, "N");
	123	+ } catch (Throwable e) {
	124	+ XposedBridge.log("[WeChatHook] onResume getField N failed: " + e);
	125	+ }
	126	+ if (tabletBtn == null) {
	127	+ XposedBridge.log("[WeChatHook] onResume: N is null for " + cls);
	128	+ return;
	129	+ }
	130	+ tabletBtn.setVisibility(View.VISIBLE);
	131	+ try {
	132	+ // m4 constructor is m4(LoginHistoryUI), but obj is LoginPasswordUI
	133	+ // (a subclass). XposedHelpers.newInstance infers types from runtime
	134	+ // class which is LoginPasswordUI, not LoginHistoryUI — no match.
	135	+ // Use explicit param type to force the right constructor lookup.
	136	+ Class<?> loginHistoryUIClass = XposedHelpers.findClass(
	137	+ "com.tencent.mm.plugin.account.ui.LoginHistoryUI",
	138	+ obj.getClass().getClassLoader());
	139	+ tabletBtn.setOnClickListener(
	140	+ (View.OnClickListener) XposedHelpers.newInstance(
	141	+ m4Class, new Class<?>[]{loginHistoryUIClass}, obj));
	142	+ } catch (Throwable e) {
	143	+ XposedBridge.log("[WeChatHook] onResume setListener failed: " + e);
	144	+ }
	145	+ XposedBridge.log("[WeChatHook] onResume -> N VISIBLE + m4 attached for " + cls);
	146	+ }
	147	+ });
	148	+ XposedBridge.log("[WeChatHook] Hooked Activity.onResume for tablet button");
	149	+ } catch (Throwable t) {
	150	+ XposedBridge.log("[WeChatHook] hookProbe/onResume failed: " + t);
	151	+ }
	152	+ }
	153	+
	154	+ private void hookInTabletEnv(ClassLoader cl) {
	155	+ try {
	156	+ Class<?> bkClass = XposedHelpers.findClass("com.tencent.mm.ui.bk", cl);
	157	+ Class<?> x0Class = XposedHelpers.findClass("bm5.x0", cl);
	158	+ XposedHelpers.findAndHookMethod(bkClass, "B", x0Class, new XC_MethodHook() {
	159	+ @Override
	160	+ protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	161	+ param.setResult(Boolean.TRUE);
	162	+ }
	163	+ });
	164	+ XposedHelpers.findAndHookMethod(bkClass, "A", new XC_MethodHook() {
	165	+ @Override
	166	+ protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	167	+ XposedBridge.log("[WeChatHook] bk.A() called -> TRUE");
	168	+ param.setResult(Boolean.TRUE);
	169	+ }
	170	+ });
	171	+ XposedBridge.log("[WeChatHook] Hooked bk.B(x0) + bk.A()");
	172	+ } catch (Throwable t) {
	173	+ XposedBridge.log("[WeChatHook] hookInTabletEnv failed: " + t);
	174	+ }
	175	+ }
	176	+
	177	+ // PRIMARY FIX: Hook LoginPasswordUI.onCreate(Bundle) afterHookedMethod.
	178	+ //
	179	+ // Previous attempts to hook initView() and LoginHistoryUI.initView() both failed
	180	+ // because ART AOT devirtualizes the call to this.initView() inside
	181	+ // LoginHistoryUI.onCreate() — the compiled native code jumps directly past the
	182	+ // Xposed entry point replacement.
	183	+ //
	184	+ // onCreate() itself is called by the Android framework via the ArtMethod pointer
	185	+ // directly (no vtable devirtualization possible), so this hook fires reliably.
	186	+ // By the time afterHookedMethod runs, super.onCreate() has completed which means
	187	+ // LoginHistoryUI.initView() has already run and this.N is assigned.
	188	+ private void hookLoginHistoryUIInitView(ClassLoader cl) {
	189	+ final Class<?> m4Class;
	190	+ try {
	191	+ m4Class = XposedHelpers.findClass("com.tencent.mm.plugin.account.ui.m4", cl);
	192	+ } catch (Throwable t) {
	193	+ XposedBridge.log("[WeChatHook] m4 class not found: " + t);
	194	+ return;
	195	+ }
	196	+
	197	+ try {
	198	+ XposedHelpers.findAndHookMethod(
	199	+ "com.tencent.mm.plugin.account.ui.LoginPasswordUI", cl,
	200	+ "onCreate", Bundle.class, new XC_MethodHook() {
	201	+ @Override
	202	+ protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	203	+ Object obj = param.thisObject;
	204	+ View tabletBtn = (View) XposedHelpers.getObjectField(obj, "N");
	205	+ if (tabletBtn == null) {
	206	+ XposedBridge.log("[WeChatHook] LoginPasswordUI.onCreate: N is null");
	207	+ return;
	208	+ }
	209	+ tabletBtn.setVisibility(View.VISIBLE);
	210	+ tabletBtn.setOnClickListener(
	211	+ (View.OnClickListener) XposedHelpers.newInstance(m4Class, obj));
	212	+ XposedBridge.log("[WeChatHook] LoginPasswordUI.onCreate() -> N VISIBLE + m4 attached");
	213	+ }
	214	+ });
	215	+ XposedBridge.log("[WeChatHook] Hooked LoginPasswordUI.onCreate()");
	216	+ } catch (Throwable t) {
	217	+ XposedBridge.log("[WeChatHook] hookLoginPasswordUI.onCreate failed: " + t);
	218	+ }
	219	+
	220	+ // Belt-and-suspenders: also hook LoginHistoryUI.onCreate() for any subclass
	221	+ // that doesn't override onCreate but does have the N button.
	222	+ try {
	223	+ XposedHelpers.findAndHookMethod(
	224	+ "com.tencent.mm.plugin.account.ui.LoginHistoryUI", cl,
	225	+ "onCreate", Bundle.class, new XC_MethodHook() {
	226	+ @Override
	227	+ protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	228	+ Object obj = param.thisObject;
	229	+ if (obj.getClass().getName().equals(
	230	+ "com.tencent.mm.plugin.account.ui.LoginPasswordUI")) return;
	231	+ View tabletBtn = (View) XposedHelpers.getObjectField(obj, "N");
	232	+ if (tabletBtn == null) {
	233	+ XposedBridge.log("[WeChatHook] LoginHistoryUI.onCreate: N is null");
	234	+ return;
	235	+ }
	236	+ tabletBtn.setVisibility(View.VISIBLE);
	237	+ tabletBtn.setOnClickListener(
	238	+ (View.OnClickListener) XposedHelpers.newInstance(m4Class, obj));
	239	+ XposedBridge.log("[WeChatHook] LoginHistoryUI.onCreate() -> N VISIBLE + m4 attached");
	240	+ }
	241	+ });
	242	+ XposedBridge.log("[WeChatHook] Hooked LoginHistoryUI.onCreate()");
	243	+ } catch (Throwable t) {
	244	+ XposedBridge.log("[WeChatHook] hookLoginHistoryUI.onCreate failed: " + t);
	245	+ }
	246	+ }
	247	+
	248	+ private void hookLoginUIInitView(ClassLoader cl) {
	249	+ try {
	250	+ final Class<?> wbClass = XposedHelpers.findClass(
	251	+ "com.tencent.mm.plugin.account.ui.wb", cl);
	252	+ XposedHelpers.findAndHookMethod(
	253	+ "com.tencent.mm.plugin.account.ui.MobileInputUI", cl,
	254	+ "initView", new XC_MethodHook() {
	255	+ @Override
	256	+ protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	257	+ Object mobileInputUI = param.thisObject;
	258	+ View tabletBtn = (View) XposedHelpers.getObjectField(mobileInputUI, "w");
	259	+ if (tabletBtn == null) {
	260	+ XposedBridge.log("[WeChatHook] MobileInputUI.w is null");
	261	+ return;
	262	+ }
	263	+ tabletBtn.setVisibility(View.VISIBLE);
	264	+ tabletBtn.setOnClickListener(
	265	+ (View.OnClickListener) XposedHelpers.newInstance(wbClass, mobileInputUI));
	266	+ XposedBridge.log("[WeChatHook] MobileInputUI.initView() -> w VISIBLE + wb attached");
	267	+ }
	268	+ });
	269	+ XposedBridge.log("[WeChatHook] Hooked MobileInputUI.initView()");
	270	+ } catch (Throwable t) {
	271	+ XposedBridge.log("[WeChatHook] hookLoginUIInitView(MobileInputUI) failed: " + t);
	272	+ }
	273	+ try {
	274	+ final Class<?> g7Class = XposedHelpers.findClass(
	275	+ "com.tencent.mm.plugin.account.ui.g7", cl);
	276	+ XposedHelpers.findAndHookMethod(
	277	+ "com.tencent.mm.plugin.account.ui.LoginUI", cl,
	278	+ "initView", new XC_MethodHook() {
	279	+ @Override
	280	+ protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	281	+ Object loginUI = param.thisObject;
	282	+ View tabletBtn = (View) XposedHelpers.getObjectField(loginUI, "f992u");
	283	+ if (tabletBtn == null) return;
	284	+ tabletBtn.setVisibility(View.VISIBLE);
	285	+ tabletBtn.setOnClickListener(
	286	+ (View.OnClickListener) XposedHelpers.newInstance(g7Class, loginUI));
	287	+ XposedBridge.log("[WeChatHook] LoginUI.initView() -> f992u VISIBLE + g7 attached");
	288	+ }
	289	+ });
	290	+ XposedBridge.log("[WeChatHook] Hooked LoginUI.initView()");
	291	+ } catch (Throwable t) {
	292	+ XposedBridge.log("[WeChatHook] hookLoginUIInitView(LoginUI) failed: " + t);
	293	+ }
	294	+ }
	295	+
	296	+ private void hookLoginSelectUICheck(ClassLoader cl) {
	297	+ try {
	298	+ Class<?> callbackClass = XposedHelpers.findClass(
	299	+ "com.tencent.mm.plugin.account.ui.LoginSelectUI$a", cl);
	300	+ XposedHelpers.findAndHookMethod(callbackClass, "a", boolean.class, new XC_MethodHook() {
	301	+ @Override
	302	+ protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	303	+ XposedBridge.log("[WeChatHook] LoginSelectUI$a.a(" + param.args[0] + ") -> false");
	304	+ param.args[0] = false;
	305	+ }
	306	+ });
	307	+ XposedBridge.log("[WeChatHook] Hooked LoginSelectUI$a.a()");
	308	+ } catch (Throwable t) {
	309	+ XposedBridge.log("[WeChatHook] hookLoginSelectUICheck failed: " + t);
	310	+ }
	311	+ }
	312	+
	313	+ private void hookLoginButtonClick(ClassLoader cl) {
	314	+ try {
	315	+ Class<?> ljClass = XposedHelpers.findClass(
	316	+ "com.tencent.mm.plugin.account.ui.lj", cl);
	317	+ final Class<?> loginSelectUIClass = XposedHelpers.findClass(
	318	+ "com.tencent.mm.plugin.account.ui.LoginSelectUI", cl);
	319	+ XposedHelpers.findAndHookMethod(ljClass, "onClick", View.class, new XC_MethodHook() {
	320	+ @Override
	321	+ protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	322	+ XposedBridge.log("[WeChatHook] lj.onClick() -> forcing LoginSelectUI");
	323	+ Activity welcomeActivity = (Activity) XposedHelpers.getObjectField(
	324	+ param.thisObject, "d");
	325	+ Intent intent = new Intent(welcomeActivity, loginSelectUIClass);
	326	+ intent.putExtra("mobile_input_purpose", 1);
	327	+ welcomeActivity.startActivity(intent);
	328	+ param.setResult(null);
	329	+ }
	330	+ });
	331	+ XposedBridge.log("[WeChatHook] Hooked lj.onClick() -> LoginSelectUI");
	332	+ } catch (Throwable t) {
	333	+ XposedBridge.log("[WeChatHook] hookLoginButtonClick failed: " + t);
	334	+ }
	335	+ }
	336	+
	337	+ // ── Send message via internal API ────────────────────────────────────────
	338	+ //
	339	+ // Registered in ALL WeChat processes. We don't yet know which process has gm0.j1
	340	+ // initialized — the first process where the receiver fires and succeeds wins.
	341	+ //
	342	+ // Trigger from ADB (must run as root — RECEIVER_NOT_EXPORTED):
	343	+ // adb shell su -c 'am broadcast -a com.hermes.wechat.SEND_MSG_INTERNAL \
	344	+ // --es to "filehelper" --es text "hello"'
	345	+ private void hookSendMessage(ClassLoader cl, String procName) {
	346	+ try {
	347	+ XposedHelpers.findAndHookMethod(
	348	+ "android.app.Application", null, "onCreate",
	349	+ new XC_MethodHook() {
	350	+ @Override
	351	+ protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	352	+ Context ctx = (Context) param.thisObject;
	353	+ if (!"com.tencent.mm".equals(ctx.getPackageName())) return;
	354	+ sAppContext = ctx;
	355	+ XposedBridge.log("[WeChatHook] App.onCreate proc=" + procName
	356	+ + " pid=" + android.os.Process.myPid());
	357	+ registerSendReceiver(ctx, procName);
	358	+ }
	359	+ });
	360	+ XposedBridge.log("[WeChatHook] Send hook registered in " + procName);
	361	+ } catch (Throwable t) {
	362	+ XposedBridge.log("[WeChatHook] hookSendMessage failed in " + procName + ": " + t);
	363	+ }
	364	+
	365	+ // ── w11.r0 constructor hooks ───────────────────────────────────────────
	366	+ // Log "by=US" vs "by=WeChat" to tell if WeChat's own UI send uses this ctor.
	367	+ XC_MethodHook r0Hook = new XC_MethodHook() {
	368	+ @Override
	369	+ protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	370	+ String by = sCalledByUs ? "US" : "WeChat";
	371	+ XposedBridge.log("[WeChatHook] w11.r0 ctor by=" + by
	372	+ + " args=" + param.args.length + " proc=" + procName
	373	+ + " pid=" + android.os.Process.myPid());
	374	+ if (sCalledByUs) {
	375	+ forceInitDI();
	376	+ diagMCoreStorage("before-r0-ctor");
	377	+ }
	378	+ }
	379	+ @Override
	380	+ protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	381	+ String by = sCalledByUs ? "US" : "WeChat";
	382	+ if (param.hasThrowable()) {
	383	+ Throwable t = param.getThrowable();
	384	+ XposedBridge.log("[WeChatHook] w11.r0 ctor THREW by=" + by
	385	+ + " proc=" + procName + ": " + t);
	386	+ if (sCalledByUs)
	387	+ XposedBridge.log("[WeChatHook] r0-ctor-stack: "
	388	+ + android.util.Log.getStackTraceString(t));
	389	+ return;
	390	+ }
	391	+ sFsGReady = true;
	392	+ XposedBridge.log("[WeChatHook] w11.r0 ctor OK by=" + by + " proc=" + procName);
	393	+ }
	394	+ };
	395	+ for (Class<?>[] sig : new Class<?>[][]{
	396	+ {String.class, String.class, int.class, int.class, long.class},
	397	+ {String.class, String.class, int.class, int.class, Object.class},
	398	+ {long.class, int.class, String.class},
	399	+ {}}) {
	400	+ try {
	401	+ XposedHelpers.findAndHookConstructor("w11.r0", cl,
	402	+ appendHook(sig, r0Hook));
	403	+ XposedBridge.log("[WeChatHook] Hooked w11.r0(" + sig.length + " params)");
	404	+ } catch (Throwable t) {
	405	+ XposedBridge.log("[WeChatHook] w11.r0(" + sig.length + "p) hook failed: " + t);
	406	+ }
	407	+ }
	408	+
	409	+ // ── w11.r0.H(String) — the actual dispatch method ─────────────────────
	410	+ // Fires for EVERY send (ours AND WeChat UI sends). Shows if WeChat uses r0.
	411	+ try {
	412	+ XposedHelpers.findAndHookMethod("w11.r0", cl, "H", String.class,
	413	+ new XC_MethodHook() {
	414	+ @Override
	415	+ protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
	416	+ String by = sCalledByUs ? "US" : "WeChat";
	417	+ XposedBridge.log("[WeChatHook] w11.r0.H() called by=" + by
	418	+ + " proc=" + procName + " pid=" + android.os.Process.myPid());
	419	+ }
	420	+ @Override
	421	+ protected void afterHookedMethod(MethodHookParam param) throws Throwable {
	422	+ if (param.hasThrowable())
	423	+ XposedBridge.log("[WeChatHook] w11.r0.H() threw: " + param.getThrowable());
	424	+ else
	425	+ XposedBridge.log("[WeChatHook] w11.r0.H() OK proc=" + procName);
	426	+ }
	427	+ });
	428	+ XposedBridge.log("[WeChatHook] Hooked w11.r0.H(String) in " + procName);
	429	+ } catch (Throwable t) {
	430	+ XposedBridge.log("[WeChatHook] w11.r0.H hook failed in " + procName + ": " + t);
	431	+ }
	432	+
	433	+ // ── Diagnostic probes on the constructor call chain ───────────────────
	434	+ // Each probe fires when the method is called from inside the r0 constructor
	435	+ // (by WeChat OR by us). They trace which methods succeed before the NPE.
	436	+ hookProbeMethod(cl, "gm0.j1", "u", "gm0.j1.u");
	437	+ hookProbeMethod(cl, "c01.z1", "r", "c01.z1.r");
	438	+ // gm0.b0.c() is a virtual method — probe it too
	439	+ try {
	440	+ XposedHelpers.findAndHookMethod("gm0.b0", cl, "c",
	441	+ new XC_MethodHook() {
	442	+ @Override protected void beforeHookedMethod(MethodHookParam p) {
	443	+ XposedBridge.log("[WeChatHook] PROBE gm0.b0.c() called");
	444	+ }
	445	+ @Override protected void afterHookedMethod(MethodHookParam p) {
	446	+ if (p.hasThrowable()) XposedBridge.log("[WeChatHook] PROBE gm0.b0.c() THREW: " + p.getThrowable());
	447	+ else XposedBridge.log("[WeChatHook] PROBE gm0.b0.c() → " + p.getResult());
	448	+ }
	449	+ });
	450	+ } catch (Throwable t) {
	451	+ XposedBridge.log("[WeChatHook] gm0.b0.c probe failed: " + t);
	452	+ }
	453	+ }
	454	+
	455	+ private static Object[] appendHook(Class<?>[] params, XC_MethodHook hook) {
	456	+ Object[] result = new Object[params.length + 1];
	457	+ System.arraycopy(params, 0, result, 0, params.length);
	458	+ result[params.length] = hook;
	459	+ return result;
	460	+ }
	461	+
	462	+ private void hookProbeMethod(ClassLoader cl, String cls, String method, String tag) {
	463	+ try {
	464	+ XposedHelpers.findAndHookMethod(cls, cl, method,
	465	+ new XC_MethodHook() {
	466	+ @Override protected void beforeHookedMethod(MethodHookParam p) {
	467	+ XposedBridge.log("[WeChatHook] PROBE " + tag + "() called");
	468	+ }
	469	+ @Override protected void afterHookedMethod(MethodHookParam p) {
	470	+ if (p.hasThrowable()) XposedBridge.log("[WeChatHook] PROBE " + tag + "() THREW: " + p.getThrowable());
	471	+ else XposedBridge.log("[WeChatHook] PROBE " + tag + "() → " + p.getResult());
	472	+ }
	473	+ });
	474	+ XposedBridge.log("[WeChatHook] Probe hooked: " + tag);
	475	+ } catch (Throwable t) {
	476	+ XposedBridge.log("[WeChatHook] Probe " + tag + " failed: " + t);
	477	+ }
	478	+ }
	479	+
	480	+ private static boolean isDIReady() {
	481	+ if (sWeChatCL == null) return false;
	482	+ try {
	483	+ XposedHelpers.callStaticMethod(XposedHelpers.findClass("gm0.j1", sWeChatCL), "i");
	484	+ return true;
	485	+ } catch (Throwable e) { return false; }
	486	+ }
	487	+
	488	+ // Hook gm0.j1.g(km0.c) to detect when WeChat DI kernel is initialized.
	489	+ // gm0.j1.g() sets gm0.j1.m (the singleton) and is called lazily — not during
	490	+ // Application.onCreate, so our broadcast often arrives first. After g() fires,
	491	+ // gm0.j1.i() will succeed and w11.r0 can be constructed.
	492	+ private static void hookDIInit(ClassLoader cl, String procName) {
	493	+ try {
	494	+ Class<?> km0cCls = XposedHelpers.findClass("km0.c", cl);
	495	+ XposedHelpers.findAndHookMethod("gm0.j1", cl, "g", km0cCls,
	496	+ new XC_MethodHook() {
	497	+ @Override
	498	+ protected void afterHookedMethod(MethodHookParam p) throws Throwable {
	499	+ XposedBridge.log("[WeChatHook] gm0.j1.g() fired — DI ready in " + procName);
	500	+ String t = sPendingTalker, x = sPendingText, pr = sPendingProc;
	501	+ if (t != null && x != null && procName.equals(pr)) {
	502	+ sPendingTalker = null; sPendingText = null; sPendingProc = null;
	503	+ XposedBridge.log("[WeChatHook] resuming pending send to=" + t + " proc=" + procName);
	504	+ new Handler(Looper.getMainLooper()).postDelayed(
	505	+ () -> trySendWithRetry(t, x, 0, procName), 50);
	506	+ }
	507	+ }
	508	+ });
	509	+ XposedBridge.log("[WeChatHook] gm0.j1.g hook OK in " + procName);
	510	+ } catch (Throwable t) {
	511	+ XposedBridge.log("[WeChatHook] gm0.j1.g hook failed in " + procName + ": " + t);
	512	+ }
	513	+ }
	514	+
	515	+ private static void diagMCoreStorage(String where) {
	516	+ if (sWeChatCL == null) return;
	517	+ try {
	518	+ Class<?> j1Cls = XposedHelpers.findClass("gm0.j1", sWeChatCL);
	519	+ Object j1 = XposedHelpers.callStaticMethod(j1Cls, "i");
	520	+ Object mCS = (j1 != null) ? XposedHelpers.getObjectField(j1, "d") : null;
	521	+ XposedBridge.log("[WeChatHook] " + where + " mCoreStorage=" + mCS);
	522	+ } catch (Throwable e) {
	523	+ XposedBridge.log("[WeChatHook] " + where + " mCoreStorage-check: " + e);
	524	+ }
	525	+ }
	526	+
	527	+ private static void forceInitDI() {
	528	+ if (sWeChatCL == null) return;
	529	+ try {
	530	+ Class<?> fsgCls = XposedHelpers.findClass("fs.g", sWeChatCL);
	531	+ java.lang.reflect.Field faFld = fsgCls.getDeclaredField("a");
	532	+ faFld.setAccessible(true);
	533	+ Object[] arr = (Object[]) faFld.get(null);
	534	+
	535	+ if (arr == null \|\| arr.length == 0 \|\| arr[0] == null) {
	536	+ Class<?> k2Cls = XposedHelpers.findClass("fs.k2", sWeChatCL);
	537	+ java.lang.reflect.Field k2eFld = k2Cls.getDeclaredField("e");
	538	+ k2eFld.setAccessible(true);
	539	+ Object k2e = k2eFld.get(null);
	540	+ if (k2e == null) {
	541	+ XposedBridge.log("[WeChatHook] forceInitDI: fs.k2.e null");
	542	+ return;
	543	+ }
	544	+ if (arr == null \|\| arr.length == 0) {
	545	+ arr = new Object[1];
	546	+ faFld.set(null, arr);
	547	+ }
	548	+ arr[0] = k2e;
	549	+ XposedBridge.log("[WeChatHook] forceInitDI: fs.g.a[0]=" + k2e.getClass().getName());
	550	+ }
	551	+ } catch (Throwable e) {
	552	+ XposedBridge.log("[WeChatHook] forceInitDI: " + e);
	553	+ }
	554	+ }
	555	+
	556	+ private static void trySendWithRetry(String talker, String text, int attempt, String procName) {
	557	+ // If DI not ready: park the args and wait for gm0.j1.g() hook to trigger retry.
	558	+ // Only the first process to check parks the pending (others may overwrite, which is fine
	559	+ // — the last write wins and gm0.j1.g() fires per-process anyway).
	560	+ if (!isDIReady()) {
	561	+ if (attempt == 0) {
	562	+ XposedBridge.log("[WeChatHook] DI not ready proc=" + procName
	563	+ + " — parking pending send to=" + talker);
	564	+ sPendingTalker = talker;
	565	+ sPendingText = text;
	566	+ sPendingProc = procName;
	567	+ } else {
	568	+ XposedBridge.log("[WeChatHook] DI still not ready proc=" + procName + " attempt=" + attempt);
	569	+ }
	570	+ return;
	571	+ }
	572	+ try {
	573	+ sendViaR0(talker, text);
	574	+ XposedBridge.log("[WeChatHook] Send OK to=" + talker + " proc=" + procName);
	575	+ } catch (Throwable t) {
	576	+ String tMsg = t.getMessage() != null ? t.getMessage() : t.toString();
	577	+ XposedBridge.log("[WeChatHook] Send FAILED proc=" + procName + " to=" + talker + ": " + tMsg);
	578	+ if (attempt < 3) {
	579	+ long delay = 1000L << attempt;
	580	+ new Handler(Looper.getMainLooper()).postDelayed(
	581	+ () -> trySendWithRetry(talker, text, attempt + 1, procName), delay);
	582	+ }
	583	+ }
	584	+ }
	585	+
	586	+ private static void registerSendReceiver(Context ctx, String procName) {
	587	+ BroadcastReceiver recv = new BroadcastReceiver() {
	588	+ @Override
	589	+ public void onReceive(Context context, Intent intent) {
	590	+ String talker = intent.getStringExtra("to");
	591	+ String text = intent.getStringExtra("text");
	592	+ if (talker == null \|\| talker.isEmpty() \|\| text == null \|\| text.isEmpty()) {
	593	+ XposedBridge.log("[WeChatHook] SEND_MSG_INTERNAL: missing 'to' or 'text'");
	594	+ return;
	595	+ }
	596	+ XposedBridge.log("[WeChatHook] SEND_MSG_INTERNAL proc=" + procName
	597	+ + " pid=" + android.os.Process.myPid()
	598	+ + " to=" + talker + " len=" + text.length());
	599	+ new Handler(Looper.getMainLooper()).post(() -> trySendWithRetry(talker, text, 0, procName));
	600	+ }
	601	+ };
	602	+ ctx.registerReceiver(recv, new IntentFilter(ACTION_SEND), Context.RECEIVER_NOT_EXPORTED);
	603	+ XposedBridge.log("[WeChatHook] BroadcastReceiver registered in " + procName);
	604	+ }
	605	+
	606	+ private static void sendViaR0(String talker, String text) throws Throwable {
	607	+ Class<?> r0Class = XposedHelpers.findClass("w11.r0", sWeChatCL);
	608	+ long ts = System.currentTimeMillis();
	609	+ Object msg;
	610	+ sCalledByUs = true;
	611	+ try {
	612	+ try {
	613	+ msg = XposedHelpers.newInstance(r0Class,
	614	+ new Class<?>[]{String.class, String.class, int.class, int.class, long.class},
	615	+ talker, text, 1, 0, ts);
	616	+ } catch (Throwable t) {
	617	+ msg = XposedHelpers.newInstance(r0Class,
	618	+ new Class<?>[]{String.class, String.class, int.class, int.class, Object.class},
	619	+ talker, text, 1, 0, (Object) ts);
	620	+ }
	621	+ } finally {
	622	+ sCalledByUs = false;
	623	+ }
	624	+
	625	+ try {
	626	+ Class<?> u0 = XposedHelpers.findClass("com.tencent.mm.modelbase.u0", sWeChatCL);
	627	+ Object stub = Proxy.newProxyInstance(sWeChatCL, new Class<?>[]{u0},
	628	+ (proxy, method, args) -> {
	629	+ XposedBridge.log("[WeChatHook] send-cb: " + method.getName());
	630	+ return null;
	631	+ });
	632	+ XposedHelpers.setObjectField(msg, "d", stub);
	633	+ } catch (Throwable ignored) {}
	634	+
	635	+ sCalledByUs = true;
	636	+ try {
	637	+ XposedHelpers.callMethod(msg, "H", "");
	638	+ } finally {
	639	+ sCalledByUs = false;
	640	+ }
	641	+ }
	642	+}
...	...

xhs_lsposed_a16_fix/wechathook_v2_signed.apk 0 → 100644

View file @b4a635a

No preview for this file type