From db0ef111d8c350b825c5e1f24612ef87b14cfbbf Mon Sep 17 00:00:00 2001 From: yibo Date: Sun, 5 Jul 2026 23:04:41 +0800 Subject: [PATCH] feat(wechathook): 语音 API 发送修通 + TTS→SILK 完整管线 --- xhs_lsposed_a16_fix/rebuild_wechathook.sh | 218 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--------------------------------------------------------------- xhs_lsposed_a16_fix/tts_voice_send.sh | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ xhs_lsposed_a16_fix/wechat_send.sh | 85 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ xhs_lsposed_a16_fix/wechathook_src/WeChatHook.java | 960 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--------------------------------------------- xhs_lsposed_a16_fix/wechathook_v2_signed.apk | Bin 37508 -> 0 bytes 5 files changed, 1224 insertions(+), 108 deletions(-) create mode 100755 xhs_lsposed_a16_fix/tts_voice_send.sh create mode 100755 xhs_lsposed_a16_fix/wechat_send.sh diff --git a/xhs_lsposed_a16_fix/rebuild_wechathook.sh b/xhs_lsposed_a16_fix/rebuild_wechathook.sh index 00991cf..550ee8f 100755 --- a/xhs_lsposed_a16_fix/rebuild_wechathook.sh +++ b/xhs_lsposed_a16_fix/rebuild_wechathook.sh @@ -1,6 +1,6 @@ #!/bin/bash -# rebuild_wechathook.sh — compile WeChatHook, repackage into com.example.wechathook APK -# Uses the existing APK from device as a base (preserves binary AndroidManifest). +# rebuild_wechathook.sh — compile WeChatHook, repackage, redeploy to device +# Does not need the LSPosed source tree — uses bundled XposedBridge stubs. set -e SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" @@ -11,79 +11,171 @@ ANDROID_HOME="${ANDROID_HOME:-/opt/homebrew/share/android-commandlinetools}" ANDROID_JAR="$ANDROID_HOME/platforms/android-36/android.jar" D8="$ANDROID_HOME/build-tools/36.0.0/d8" APKSIGNER="$ANDROID_HOME/build-tools/36.0.0/apksigner" -LSPOSED_DIR="${LSPOSED_DIR:-/tmp/LSPosed}" -LEGACY_JAR="$LSPOSED_DIR/legacy/build/intermediates/compile_library_classes_jar/release/bundleLibCompileToJarRelease/classes.jar" +ZIPALIGN="$ANDROID_HOME/build-tools/36.0.0/zipalign" +JAVA_HOME="${JAVA_HOME:-/opt/homebrew/opt/openjdk@17}" +JAVAC="$JAVA_HOME/bin/javac" +KEYTOOL="$JAVA_HOME/bin/keytool" -if [ ! -f "$LEGACY_JAR" ]; then - echo "LSPosed legacy JAR not found at $LEGACY_JAR" - echo "Run: git clone --depth 1 --recursive https://github.com/JingMatrix/LSPosed.git $LSPOSED_DIR && cd $LSPOSED_DIR && ./gradlew :legacy:assembleRelease" - exit 1 -fi +GOLDEN_APK="$SCRIPT_DIR/wechathook_v2_signed.apk" +DEBUG_KS="$HOME/.android/debug.keystore" +STUBS_DIR="/tmp/xposed_stubs" +BUILD_DIR="/tmp/wechathook_rebuild" + +# ── Write XposedBridge stubs (minimal, for compilation only) ────────────────── +echo "== Writing XposedBridge stubs ==" +mkdir -p "$STUBS_DIR/de/robv/android/xposed/callbacks" + +cat > "$STUBS_DIR/de/robv/android/xposed/XposedBridge.java" << 'JAVA' +package de.robv.android.xposed; +public class XposedBridge { + public static void log(String text) {} + public static void log(Throwable t) {} + public static XC_MethodHook.Unhook hookMethod( + java.lang.reflect.Member hookMethod, XC_MethodHook callback) { return null; } +} +JAVA + +cat > "$STUBS_DIR/de/robv/android/xposed/XC_MethodHook.java" << 'JAVA' +package de.robv.android.xposed; +public abstract class XC_MethodHook { + public class Unhook { public void unhook() {} } + public static class MethodHookParam { + public Object thisObject; + public Object[] args; + public Object getResult() { return null; } + public void setResult(Object result) {} + public Throwable getThrowable() { return null; } + public boolean hasThrowable() { return false; } + } + protected void beforeHookedMethod(MethodHookParam param) throws Throwable {} + protected void afterHookedMethod(MethodHookParam param) throws Throwable {} +} +JAVA + +cat > "$STUBS_DIR/de/robv/android/xposed/XposedHelpers.java" << 'JAVA' +package de.robv.android.xposed; +public class XposedHelpers { + public static Class findClass(String className, ClassLoader classLoader) { return null; } + public static Object callStaticMethod(Class clazz, String methodName, Object... args) { return null; } + public static Object callMethod(Object obj, String methodName, Object... args) { return null; } + public static Object callMethod(Object obj, String methodName, Class[] paramTypes, Object... args) { return null; } + public static Object newInstance(Class clazz, Object... args) { return null; } + public static Object newInstance(Class clazz, Class[] paramTypes, Object... args) { return null; } + public static Object getObjectField(Object obj, String fieldName) { return null; } + public static void setObjectField(Object obj, String fieldName, Object value) {} + public static XC_MethodHook.Unhook findAndHookMethod( + String className, ClassLoader cl, String methodName, Object... paramTypesAndCallback) { return null; } + public static XC_MethodHook.Unhook findAndHookMethod( + Class clazz, String methodName, Object... paramTypesAndCallback) { return null; } + public static XC_MethodHook.Unhook findAndHookConstructor( + String className, ClassLoader cl, Object... paramTypesAndCallback) { return null; } + public static class InvocationTargetError extends Error { + public InvocationTargetError(String msg, Throwable cause) { super(msg, cause); } + } +} +JAVA + +cat > "$STUBS_DIR/de/robv/android/xposed/IXposedHookLoadPackage.java" << 'JAVA' +package de.robv.android.xposed; +public interface IXposedHookLoadPackage { + void handleLoadPackage(de.robv.android.xposed.callbacks.XC_LoadPackage.LoadPackageParam lpparam) throws Throwable; +} +JAVA -BUILD_DIR=/tmp/wechathook_rebuild +cat > "$STUBS_DIR/de/robv/android/xposed/callbacks/XC_LoadPackage.java" << 'JAVA' +package de.robv.android.xposed.callbacks; +public class XC_LoadPackage { + public static class LoadPackageParam { + public String packageName; + public String processName; + public ClassLoader classLoader; + public android.content.pm.ApplicationInfo appInfo; + public boolean isFirstApplication; + } +} +JAVA + +# ── Compile ──────────────────────────────────────────────────────────────────── rm -rf "$BUILD_DIR" -mkdir -p "$BUILD_DIR/compiled" "$BUILD_DIR/dex" "$BUILD_DIR/pack/assets" - -# Pull current APK from device to reuse its binary AndroidManifest and resources.arsc -echo "== Pulling current wechathook APK from device ==" -WH_PATH=$($ADB shell "pm path com.example.wechathook 2>/dev/null | tr -d '\r' | sed 's/package://'" 2>/dev/null) -if [ -z "$WH_PATH" ]; then - echo "ERROR: com.example.wechathook not installed on device" - exit 1 -fi -$ADB shell "su -c \"cp $WH_PATH /data/local/tmp/wh_base.apk && chmod 644 /data/local/tmp/wh_base.apk\"" -$ADB pull /data/local/tmp/wh_base.apk "$BUILD_DIR/pack/base.apk" 2>/dev/null +mkdir -p "$BUILD_DIR/compiled" "$BUILD_DIR/dex" "$BUILD_DIR/pack" -# Extract AndroidManifest and resources from existing APK -cd "$BUILD_DIR/pack" && unzip -o base.apk AndroidManifest.xml resources.arsc -d . > /dev/null 2>&1 -rm -f base.apk +echo "== Compiling XposedBridge stubs ==" +"$JAVAC" -source 11 -target 11 -cp "$ANDROID_JAR" \ + -d "$BUILD_DIR/compiled" \ + $(find "$STUBS_DIR" -name "*.java") 2>/dev/null echo "== Compiling WeChatHook.java ==" -javac --release 11 \ - -classpath "$ANDROID_JAR:$LEGACY_JAR" \ - -d "$BUILD_DIR/compiled" \ - "$SCRIPT_DIR/wechathook_src/WeChatHook.java" +"$JAVAC" -source 11 -target 11 \ + -cp "$ANDROID_JAR:$BUILD_DIR/compiled" \ + -d "$BUILD_DIR/compiled" \ + "$SCRIPT_DIR/wechathook_src/WeChatHook.java" echo "== Converting to DEX ==" -$D8 \ - --classpath "$ANDROID_JAR" \ - --classpath "$LEGACY_JAR" \ - --min-api 27 \ - --output "$BUILD_DIR/dex" \ - $(find "$BUILD_DIR/compiled/com/example/wechathook" -name "*.class") +"$D8" --min-api 30 --output "$BUILD_DIR/dex/" \ + $(find "$BUILD_DIR/compiled/com/example/wechathook" -name "*.class") +# ── Package ─────────────────────────────────────────────────────────────────── echo "== Packing APK ==" -cp "$BUILD_DIR/dex/classes.dex" "$BUILD_DIR/pack/" -# Put xposed_init in assets/ (required by lspd) AND root (belt+suspenders) -echo "com.example.wechathook.WeChatHook" > "$BUILD_DIR/pack/assets/xposed_init" -echo "com.example.wechathook.WeChatHook" > "$BUILD_DIR/pack/xposed_init" - +cp "$GOLDEN_APK" "$BUILD_DIR/pack/wechathook.apk" +# Replace DEX in place (the golden APK already has correct manifest + xposed_init) cd "$BUILD_DIR/pack" -zip -0 wechathook.apk AndroidManifest.xml resources.arsc classes.dex xposed_init 2>/dev/null || true -zip -0 wechathook.apk assets/xposed_init - -# Sign -if [ ! -f /tmp/debug.keystore ]; then - keytool -genkey -v -keystore /tmp/debug.keystore -alias androiddebugkey \ - -keyalg RSA -keysize 2048 -validity 10000 \ - -storepass android -keypass android \ - -dname "CN=Android Debug,O=Android,C=US" 2>/dev/null -fi +zip -u wechathook.apk -j "$BUILD_DIR/dex/classes.dex" > /dev/null + +"$ZIPALIGN" -v -f 4 wechathook.apk wechathook_aligned.apk > /dev/null +# ── Sign with Android debug keystore (same as golden APK) ──────────────────── echo "== Signing ==" -OUT="$SCRIPT_DIR/wechathook_v2_signed.apk" -$APKSIGNER sign \ - --ks /tmp/debug.keystore \ - --ks-key-alias androiddebugkey \ - --ks-pass pass:android \ - --key-pass pass:android \ - --out "$OUT" \ - "$BUILD_DIR/pack/wechathook.apk" 2>/dev/null - -echo "== Done: $OUT ==" +OUT="$BUILD_DIR/wechathook_signed.apk" +"$APKSIGNER" sign \ + --ks "$DEBUG_KS" \ + --ks-key-alias androiddebugkey \ + --ks-pass pass:android \ + --key-pass pass:android \ + --out "$OUT" \ + wechathook_aligned.apk 2>/dev/null + echo "APK size: $(wc -c < "$OUT") bytes" + +# ── Deploy to device ────────────────────────────────────────────────────────── +echo "== Deploying to device ==" + +# Push to stable path +$ADB push "$OUT" /data/local/tmp/wechathook.apk + +# Install via PKMS (use -r to update in-place if same sig; if first time, just install) +INSTALL_OUT=$($ADB shell "su 0 sh -c 'pm install -r /data/local/tmp/wechathook.apk 2>&1'" | tr -d '\r') +echo "pm install: $INSTALL_OUT" +if echo "$INSTALL_OUT" | grep -q "FAILED"; then + echo "Retrying without -r (signature mismatch or first install)..." + $ADB shell "su 0 sh -c 'pm uninstall com.example.wechathook 2>&1 || true'" + $ADB shell "su 0 sh -c 'pm install /data/local/tmp/wechathook.apk 2>&1'" +fi + +# Get new PKMS path +NEW_PATH=$($ADB shell "pm path com.example.wechathook 2>/dev/null | tr -d '\r' | sed 's/package://'" 2>/dev/null) +echo "New PKMS path: $NEW_PATH" + +# Update lspd DB (device must be unlocked — Termux CE storage must be accessible) +SQLITE3="LD_LIBRARY_PATH=/data/data/com.termux/files/usr/lib /data/data/com.termux/files/usr/bin/sqlite3" +DB="/data/adb/lspd/config/modules_config.db" + +$ADB shell "su -c \"printf \\\"INSERT OR REPLACE INTO modules(module_pkg_name,apk_path,enabled) VALUES('com.example.wechathook','$NEW_PATH',1);\\n\ +INSERT OR IGNORE INTO scope(mid,app_pkg_name,user_id) SELECT mid,'com.tencent.mm',0 FROM modules WHERE module_pkg_name='com.example.wechathook';\\n\ +SELECT mid,module_pkg_name,apk_path FROM modules;\\n\\\" > /data/local/tmp/update.sql\"" +$ADB shell "su -c '$SQLITE3 $DB < /data/local/tmp/update.sql 2>&1'" + +# Ensure scope file exists +$ADB shell "su -c 'mkdir -p /data/adb/lspd/config/modules/com.example.wechathook && echo com.tencent.mm > /data/adb/lspd/config/modules/com.example.wechathook/scope && chmod 644 /data/adb/lspd/config/modules/com.example.wechathook/scope'" + +# WAL checkpoint + sync to all .bak files +$ADB shell "su -c '$SQLITE3 $DB \"PRAGMA wal_checkpoint(TRUNCATE);\" && \ + cp $DB ${DB}.bak && cp $DB ${DB}.bak2 && cp $DB ${DB}.bak3 && cp $DB ${DB}.bak4 && echo baks_done'" + +# Restart WeChat to pick up new module (no reboot needed) +$ADB shell "su 0 sh -c 'am force-stop com.tencent.mm'" +sleep 2 +$ADB shell "am start -n com.tencent.mm/.ui.LauncherUI 2>/dev/null || true" + echo "" -echo "Next steps:" -echo " adb install -r --no-incremental $OUT" -echo " bash $SCRIPT_DIR/update_wechathook_db.sh" -echo " adb reboot" +echo "== Done. Test with: ==" +echo " $ADB shell \"su 0 sh -c 'am broadcast -a com.hermes.wechat.SEND_MSG_INTERNAL --es to filehelper --es text test'\"" diff --git a/xhs_lsposed_a16_fix/tts_voice_send.sh b/xhs_lsposed_a16_fix/tts_voice_send.sh new file mode 100755 index 0000000..84d47d7 --- /dev/null +++ b/xhs_lsposed_a16_fix/tts_voice_send.sh @@ -0,0 +1,69 @@ +#!/bin/bash +# tts_voice_send.sh — generate TTS audio and send as WeChat voice message +# +# Usage: +# ./tts_voice_send.sh [voice] +# +# Args: +# — talker id (use 'filehelper' for safe testing) +# — Chinese text to synthesize +# [voice] — edge-tts voice name (default: zh-CN-XiaoxiaoNeural) +# +# Examples: +# ./tts_voice_send.sh filehelper "你好，今天天气不错。" +# ./tts_voice_send.sh filehelper "下午三点开会" zh-CN-YunxiNeural +# +# IMPORTANT: test only with 'filehelper' to avoid account risk. +# +# Dependencies (Mac): +# pip3 install edge-tts +# brew install ffmpeg +# npm install -g silk-wasm (or use openclaw's bundled one) +# adb in PATH or set ADB env var + +set -e + +WXID="${1:?Usage: $0 [voice]}" +TEXT="${2:?Missing text argument}" +VOICE="${3:-zh-CN-XiaoxiaoNeural}" + +ADB="${ADB:-/opt/homebrew/share/android-commandlinetools/platform-tools/adb}" +SILK_WASM="${SILK_WASM:-/opt/homebrew/lib/node_modules/openclaw/node_modules/silk-wasm}" +TMPDIR="$(mktemp -d /tmp/tts_send_XXXXXX)" +trap "rm -rf $TMPDIR" EXIT + +echo "[1/4] TTS: \"$TEXT\" (voice=$VOICE)" +python3 -c " +import asyncio, edge_tts +async def go(): + tts = edge_tts.Communicate('''$TEXT''', '$VOICE') + await tts.save('$TMPDIR/out.mp3') +asyncio.run(go()) +" + +echo "[2/4] Convert MP3 → PCM 16kHz mono" +ffmpeg -y -i "$TMPDIR/out.mp3" -ar 16000 -ac 1 -f s16le "$TMPDIR/out.pcm" -loglevel error + +echo "[3/4] Encode PCM → SILK V3" +DURATION=$(node -e " +const silk = require('$SILK_WASM'); +const fs = require('fs'); +silk.encode(fs.readFileSync('$TMPDIR/out.pcm'), 16000).then(r => { + fs.writeFileSync('$TMPDIR/out.amr', r.data); + process.stdout.write(String(r.duration)); +}); +") +echo " → SILK $(wc -c < "$TMPDIR/out.amr" | tr -d ' ') bytes, duration=${DURATION}ms" + +echo "[4/4] Push + send to WeChat ($WXID)" +$ADB push "$TMPDIR/out.amr" /sdcard/hook_voice_tmp.amr -q +$ADB shell "su -c 'cp /sdcard/hook_voice_tmp.amr /data/data/com.tencent.mm/cache/hook_voice_src.amr \ + && chmod 644 /data/data/com.tencent.mm/cache/hook_voice_src.amr \ + && chown u0_a330:u0_a330 /data/data/com.tencent.mm/cache/hook_voice_src.amr \ + && rm /sdcard/hook_voice_tmp.amr'" +$ADB shell "su -c 'am broadcast -a com.hermes.wechat.SEND_VOICE_INTERNAL \ + --es to $WXID \ + --es src_path /data/data/com.tencent.mm/cache/hook_voice_src.amr \ + --ei duration $DURATION'" + +echo "Done." diff --git a/xhs_lsposed_a16_fix/wechat_send.sh b/xhs_lsposed_a16_fix/wechat_send.sh new file mode 100755 index 0000000..d73866a --- /dev/null +++ b/xhs_lsposed_a16_fix/wechat_send.sh @@ -0,0 +1,85 @@ +#!/bin/bash +# wechat_send.sh — unified WeChat send CLI via the internal hook +# +# Usage: +# ./wechat_send.sh text +# ./wechat_send.sh image +# ./wechat_send.sh voice [duration_ms] +# +# All send operations go through the wechathook LSPosed module's internal API, +# which calls WeChat's own w11.r0/w11.s1 factory — no UI simulation. +# : talker id as stored in WeChat DB (e.g. 'filehelper', 'wxid_xxx'). +# IMPORTANT: test-only with 'filehelper' to avoid account risk. +# +# Voice notes: +# — local SILK V3 file (Tencent prefix \x02#!SILK_V3). +# [duration_ms] — playback duration in ms (default: 3000). +# The script pushes the SILK to WeChat's cache dir and fires the broadcast. +# +# Examples: +# ./wechat_send.sh text filehelper "hello world" +# ./wechat_send.sh image filehelper /tmp/screenshot.png +# ./wechat_send.sh voice filehelper /tmp/tts_out.silk 4617 + +set -e + +ADB="${ADB:-adb}" +WECHAT_CACHE="/data/data/com.tencent.mm/cache/hook_voice_src.amr" + +usage() { + echo "Usage: $0 text " + echo " $0 image " + echo " $0 voice [duration_ms]" + exit 1 +} + +[ $# -lt 3 ] && usage + +CMD="$1"; WXID="$2"; shift 2 + +case "$CMD" in +text) + PAYLOAD="$*" + B64_WXID=$(printf '%s' "$WXID" | base64 | tr -d '\n') + B64_TEXT=$(printf '%s' "$PAYLOAD" | base64 | tr -d '\n') + INNER=$(printf 'TO=$(printf "%%s" "%s" | base64 -d); TEXT=$(printf "%%s" "%s" | base64 -d); am broadcast -a com.hermes.wechat.SEND_MSG_INTERNAL --es to "$TO" --es text "$TEXT"' \ + "$B64_WXID" "$B64_TEXT") + B64_INNER=$(printf '%s' "$INNER" | base64 | tr -d '\n') + echo "Sending text to $WXID..." + $ADB shell "su -c 'echo $B64_INNER | base64 -d | sh'" + ;; + +image) + IMAGE_PATH="$1" + EXT="${IMAGE_PATH##*.}" + SHARE="/sdcard/wechat_share_tmp.$EXT" + MIME="image/jpeg" + [ "$EXT" = "png" ] && MIME="image/png" + echo "Copying image to $SHARE..." + $ADB shell "su -c 'cp \"$IMAGE_PATH\" \"$SHARE\" && chmod 644 \"$SHARE\"'" + echo "Sending image to $WXID via share intent..." + $ADB shell "am start -a android.intent.action.SEND -t $MIME \ + --eu android.intent.extra.STREAM 'file://$SHARE' \ + -p com.tencent.mm" + echo "WeChat share intent fired. Select '$WXID' in WeChat's contact picker and tap 发送." + ;; + +voice) + SILK_PATH="$1" + DURATION="${2:-3000}" + [ -z "$SILK_PATH" ] && usage + [ ! -f "$SILK_PATH" ] && { echo "File not found: $SILK_PATH"; exit 1; } + + echo "Pushing SILK to WeChat cache..." + $ADB push "$SILK_PATH" /sdcard/hook_voice_tmp.amr + $ADB shell "su -c 'cp /sdcard/hook_voice_tmp.amr $WECHAT_CACHE && chmod 644 $WECHAT_CACHE && chown u0_a330:u0_a330 $WECHAT_CACHE && rm /sdcard/hook_voice_tmp.amr'" + + echo "Sending voice to $WXID (duration=${DURATION}ms)..." + $ADB shell "su -c 'am broadcast -a com.hermes.wechat.SEND_VOICE_INTERNAL --es to $WXID --es src_path $WECHAT_CACHE --ei duration $DURATION'" + ;; + +*) + echo "Unknown command: $CMD" + usage + ;; +esac diff --git a/xhs_lsposed_a16_fix/wechathook_src/WeChatHook.java b/xhs_lsposed_a16_fix/wechathook_src/WeChatHook.java index ebcd2e3..e223101 100644 --- a/xhs_lsposed_a16_fix/wechathook_src/WeChatHook.java +++ b/xhs_lsposed_a16_fix/wechathook_src/WeChatHook.java @@ -18,12 +18,25 @@ import de.robv.android.xposed.callbacks.XC_LoadPackage; public class WeChatHook implements IXposedHookLoadPackage { - private static final String ACTION_SEND = "com.hermes.wechat.SEND_MSG_INTERNAL"; - private static ClassLoader sWeChatCL; + private static final String ACTION_SEND = "com.hermes.wechat.SEND_MSG_INTERNAL"; + private static final String ACTION_SEND_IMAGE = "com.hermes.wechat.SEND_IMAGE_INTERNAL"; + private static final String ACTION_SEND_VOICE = "com.hermes.wechat.SEND_VOICE_INTERNAL"; + private static final String ACTION_DUMP_API = "com.hermes.wechat.DUMP_WECHAT_API"; + // Cached f9 setter map (column -> methodName), built once on first voice send + // (sF9SetterMap is declared alongside probeAllF9Setters below) + // Thread-locals for voice send: voiceId and SILK bytes to inject into f9 ctor + private static final ThreadLocal sPendingVoiceId = new ThreadLocal<>(); + private static final ThreadLocal sPendingLvBuffer = new ThreadLocal<>(); + // Captures the f9 that called convertTo() (= the one written to DB); used to populate r0.i. + private static final ThreadLocal sDatabaseF9 = new ThreadLocal<>(); + private static ClassLoader sWeChatCL; // pre-Tinker classloader (from handleLoadPackage) + private static volatile ClassLoader sTinkerCL; // Tinker-patched classloader (from App.onCreate) private static volatile Context sAppContext; private static volatile boolean sFsGReady = false; // Set true while WE are calling newInstance so r0Hook can distinguish us from WeChat private static volatile boolean sCalledByUs = false; + // Logged-in user's wxid, auto-discovered from first real voice message send + private static volatile String sMyWxid = null; // Pending send: stored when broadcast arrives before gm0.j1 is initialized private static volatile String sPendingTalker = null; private static volatile String sPendingText = null; @@ -48,9 +61,17 @@ public class WeChatHook implements IXposedHookLoadPackage { hookLoginSelectUICheck(cl); hookLoginButtonClick(cl); - // WCDB diagnostic: which process writes to WeChat message table? + // WCDB diagnostic: which process writes? + media ContentValues dump hookWCDB(cl, lpparam.processName); + // Factory method discovery: dumps w11.s1 signatures + hooks all static methods + // so that when WeChat UI sends image/voice we capture the exact API call. + hookFactoryMethods(cl, lpparam.processName); + + // MediaPlayer hook: captures voice file paths when WeChat plays voice messages. + // This reveals the voice2/{dir1}/{dir2}/msg_{id}.amr naming formula. + hookMediaPlayer(lpparam.processName); + // Hook gm0.j1.g() to detect when DI kernel is ready — runs in ALL processes. // This enables the pending-send mechanism: if broadcast arrives before DI init, // we store the args and retry once g() fires. @@ -62,8 +83,10 @@ public class WeChatHook implements IXposedHookLoadPackage { hookSendMessage(cl, lpparam.processName); } - // Diagnostic: hook WeChat's WCDB to find which process writes to the message table. - // com.tencent.wcdb.database.SQLiteDatabase is WeChat's encrypted SQLite wrapper. + // ── WCDB hook ────────────────────────────────────────────────────────────── + // Intercepts every INSERT into the message table. + // For msgtype 3 (image) and 34 (voice) logs the full ContentValues so we can + // reverse-engineer the exact schema WeChat uses when building those messages. private void hookWCDB(ClassLoader cl, String procName) { try { XposedHelpers.findAndHookMethod( @@ -71,22 +94,47 @@ public class WeChatHook implements IXposedHookLoadPackage { "insertWithOnConflict", String.class, String.class, android.content.ContentValues.class, int.class, new XC_MethodHook() { - private boolean logged = false; + private boolean textLogged = false; @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { String table = (String) param.args[0]; - if (table == null || (!table.contains("message") && !table.equals("msg"))) return; - if (!logged) { - logged = true; + if (table == null) return; + android.content.ContentValues cv = + (android.content.ContentValues) param.args[2]; + + // Determine msgtype from ContentValues (key may be "type" or "msgtype") + Object rawType = null; + if (cv != null) { + rawType = cv.get("type"); + if (rawType == null) rawType = cv.get("msgtype"); + if (rawType == null) rawType = cv.get("msgType"); + } + int msgtype = -1; + try { if (rawType != null) msgtype = Integer.parseInt(rawType.toString()); } + catch (NumberFormatException ignored) {} + + if (msgtype == 3 || msgtype == 34) { + // Image (3) or Voice (34): dump full ContentValues + stack + String cvStr = cv != null ? cv.toString() : "null"; String stack = android.util.Log.getStackTraceString(new Throwable()); - // Truncate to keep logcat readable - if (stack.length() > 3000) stack = stack.substring(0, 3000) + "…"; - XposedBridge.log("[WeChatHook] WCDB INSERT table=" + table - + " proc=" + procName + " pid=" + android.os.Process.myPid() - + "\n" + stack); - } else { - XposedBridge.log("[WeChatHook] WCDB INSERT table=" + table - + " proc=" + procName); + if (stack.length() > 4000) stack = stack.substring(0, 4000) + "…"; + XposedBridge.log("[WeChatHook] WCDB MEDIA INSERT table=" + table + + " msgtype=" + msgtype + + " proc=" + procName + + "\nContentValues=" + cvStr + + "\nStack=" + stack); + } else if (msgtype == 1) { + // Text: only log once (to confirm which process writes) + if (!textLogged) { + textLogged = true; + String stack = android.util.Log.getStackTraceString(new Throwable()); + if (stack.length() > 3000) stack = stack.substring(0, 3000) + "…"; + XposedBridge.log("[WeChatHook] WCDB TEXT INSERT table=" + table + + " proc=" + procName + "\n" + stack); + } else { + XposedBridge.log("[WeChatHook] WCDB TEXT table=" + table + + " proc=" + procName); + } } } }); @@ -96,6 +144,642 @@ public class WeChatHook implements IXposedHookLoadPackage { } } + // ── MediaPlayer hook: reveals voice file path format ───────────────────── + // When WeChat plays a voice message it calls MediaPlayer.setDataSource(path). + // We log any path under voice2/ to see the full path including subdirectory, + // which reveals the formula WeChat uses to map voice file IDs to directories. + private void hookMediaPlayer(String procName) { + try { + XposedHelpers.findAndHookMethod("android.media.MediaPlayer", null, + "setDataSource", String.class, new XC_MethodHook() { + @Override + protected void beforeHookedMethod(MethodHookParam p) throws Throwable { + String path = (String) p.args[0]; + if (path != null && path.contains("voice2")) { + XposedBridge.log("[WeChatHook] MediaPlayer.setDataSource VOICE=" + + path + " proc=" + procName); + } + } + }); + XposedBridge.log("[WeChatHook] MediaPlayer hook OK in " + procName); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] MediaPlayer hook failed in " + procName + ": " + t); + } + } + + // ── f9.convertTo() hook: maps f9 fields to DB columns ───────────────────── + // Captures ContentValues produced by convertTo() for image (3) and voice (34). + // From these ContentValues we know which f9 setter corresponds to which DB column + // (imgPath, content, talker, etc.) so we can construct f9 programmatically. + private void hookF9ConvertTo(ClassLoader cl, String procName) { + try { + XposedHelpers.findAndHookMethod("com.tencent.mm.storage.f9", cl, + "convertTo", new XC_MethodHook() { + @Override + protected void afterHookedMethod(MethodHookParam p) throws Throwable { + if (p.hasThrowable()) return; + android.content.ContentValues cv = + (android.content.ContentValues) p.getResult(); + if (cv == null) return; + Object rawType = cv.get("type"); + if (rawType == null) rawType = cv.get("msgtype"); + if (rawType == null) return; + int msgtype = -1; + try { msgtype = Integer.parseInt(rawType.toString()); } catch (Throwable e) {} + if (msgtype == 34) { + // Auto-discover logged-in user's wxid from real UI voice sends. + // We look for isSend=1 messages (user's own sends) and extract + // fromusername from the voicemsg XML, cache as sMyWxid. + if (sMyWxid == null && !sCalledByUs) { + Object isSend = cv.get("isSend"); + Object contentVal = cv.get("content"); + if (isSend instanceof Integer && ((Integer)isSend) == 1 + && contentVal instanceof String) { + String c = (String) contentVal; + int fi = c.indexOf("fromusername=\""); + if (fi >= 0) { + int start = fi + "fromusername=\"".length(); + int end = c.indexOf("\"", start); + if (end > start) { + String wxid = c.substring(start, end); + if (!wxid.isEmpty()) { + sMyWxid = wxid; + XposedBridge.log("[WeChatHook] auto-discovered sMyWxid=" + wxid); + } + } + } + } + } + } + if (msgtype == 3 || msgtype == 34) { + // Inject lvbuffer (SILK bytes) if we're sending voice via hook. + // sPendingLvBuffer is still set here — convertTo fires INSIDE + // the r0 constructor which runs before our finally-block clears it. + byte[] pendingLv = sPendingLvBuffer.get(); + if (pendingLv != null && !(cv.get("lvbuffer") instanceof byte[])) { + cv.put("lvbuffer", pendingLv); + XposedBridge.log("[WeChatHook] convertTo: injected lvbuffer " + pendingLv.length + " bytes"); + } + // Capture the DB-bound f9 (the one convertTo() runs on). + // This is the correct object for r0.i: it has content + msgId set. + if (pendingLv != null) { + sDatabaseF9.set(p.thisObject); + // Force status=4 (delivered) so no spinner appears. + // Real WeChat gets status=4 via CDN upload→server ACK push, which + // we skip. Directly setting it here is safe for filehelper sends. + cv.put("status", 4); + // Ensure flag and msgSvrId are present (missing from our sends). + if (cv.get("flag") == null) cv.put("flag", 0); + if (cv.get("msgSvrId") == null) cv.put("msgSvrId", 0L); + // Also set the in-memory f9 status field via setter (r1). + // Without this, K(0)'s subsequent convertTo() reads the stale + // in-memory status=1 and overwrites our status=4 back to 1. + if (sF9SetterMap != null && sF9SetterMap.containsKey("status")) { + try { + XposedHelpers.callMethod(p.thisObject, sF9SetterMap.get("status"), 4); + } catch (Throwable ignored) {} + } + XposedBridge.log("[WeChatHook] convertTo: forced status=4 (CV+field) for voice hook send"); + } + // Log full ContentValues including lvbuffer details + StringBuilder sb = new StringBuilder(); + sb.append("[WeChatHook] f9.convertTo() msgtype=").append(msgtype) + .append(" proc=").append(procName).append("\nContentValues=").append(cv); + Object lvbuf = cv.get("lvbuffer"); + if (lvbuf instanceof byte[]) { + byte[] b = (byte[]) lvbuf; + StringBuilder hex = new StringBuilder(); + int show = Math.min(b.length, 32); + for (int i = 0; i < show; i++) + hex.append(String.format("%02x", b[i] & 0xff)); + sb.append("\nlvbuffer len=").append(b.length).append(" hex=").append(hex); + } else { + sb.append("\nlvbuffer=null"); + } + XposedBridge.log(sb.toString()); + } + } + }); + XposedBridge.log("[WeChatHook] f9.convertTo hook OK in " + procName); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] f9.convertTo hook failed in " + procName + ": " + t); + } + } + + // ── f9 constructor imgPath injector ─────────────────────────────────────── + // Hooks ALL f9 constructors. When sPendingVoiceId is set on the calling thread, + // immediately calls the discovered imgPath setter on the newly created f9 object. + // This fires INSIDE the r0 constructor (before its internal f9.convertTo() call), + // so the DB insert from r0 constructor already has the correct voice file ID. + private void hookF9ImgPathInjector(ClassLoader cl, String procName) { + try { + Class f9Class = XposedHelpers.findClass("com.tencent.mm.storage.f9", cl); + XC_MethodHook injHook = new XC_MethodHook() { + @Override + protected void afterHookedMethod(MethodHookParam param) throws Throwable { + String pending = sPendingVoiceId.get(); + if (pending == null) return; + java.util.Map sm = sF9SetterMap; + if (sm == null) return; + // Inject imgPath + String setter = sm.get("imgPath"); + if (setter != null) { + XposedHelpers.callMethod(param.thisObject, setter, pending); + XposedBridge.log("[WeChatHook] f9 ctor injected imgPath=" + pending + " via " + setter); + } + // Inject lvbuffer (SILK bytes) so WeChat treats the voice as locally available + byte[] lvbuf = sPendingLvBuffer.get(); + String lvSetter = sm.get("lvbuffer:bytes"); + if (lvbuf != null && lvSetter != null) { + XposedHelpers.callMethod(param.thisObject, lvSetter, (Object) lvbuf); + XposedBridge.log("[WeChatHook] f9 ctor injected lvbuffer len=" + lvbuf.length + " via " + lvSetter); + } else { + XposedBridge.log("[WeChatHook] f9 ctor lvbuffer skip: lvbuf=" + (lvbuf==null?"null":"ok") + " setter=" + lvSetter); + } + // sDatabaseF9 is captured in convertTo() — that's the correct DB-bound f9. + } + }; + int hooked = 0; + for (java.lang.reflect.Constructor ctor : f9Class.getDeclaredConstructors()) { + XposedBridge.hookMethod(ctor, injHook); + hooked++; + } + XposedBridge.log("[WeChatHook] f9 ctor injector OK in " + procName + " (" + hooked + " ctors)"); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] f9 ctor injector failed in " + procName + ": " + t); + } + } + + // ── Image send via internal API ──────────────────────────────────────────── + // Calls w11.s1.b(talker, p1.IMAGE, 0, localImagePath) → w11.r1 → r1.b(). + // WeChat handles thumbnail generation and CDN upload internally. + private static void sendImageViaAPI(String talker, String imagePath) throws Throwable { + ClassLoader cl = sTinkerCL != null ? sTinkerCL : sWeChatCL; + if (cl == null) throw new IllegalStateException("classloader null"); + + Class s1Cls = XposedHelpers.findClass("w11.s1", cl); + Class p1Cls = XposedHelpers.findClass("w11.p1", cl); + + // p1.IMAGE is ordinal 1 (confirmed from enum dump: TEXT=0, IMAGE=1) + Object[] p1Values = (Object[]) p1Cls.getMethod("values").invoke(null); + if (p1Values.length < 2) throw new IllegalStateException("p1 enum too short: " + p1Values.length); + Object imageEnum = p1Values[1]; + + XposedBridge.log("[WeChatHook] sendImageViaAPI: s1.b talker=" + talker + + " p1=" + imageEnum + "(" + imageEnum.getClass().getSimpleName() + ")" + + " path=" + imagePath); + + // XposedHelpers.callStaticMethod has no explicit-paramTypes overload; just pass args + // and let findMethodBestMatch resolve b(String, w11.p1, int, Object). + Object r1 = XposedHelpers.callStaticMethod(s1Cls, "b", talker, imageEnum, 0, imagePath); + + if (r1 == null) throw new IllegalStateException("w11.s1.b() returned null"); + + dumpBuilderMethods(r1, "s1.b[image]"); + XposedBridge.log("[WeChatHook] sendImageViaAPI: calling r1.b() on " + r1.getClass().getName()); + XposedHelpers.callMethod(r1, "b"); + XposedBridge.log("[WeChatHook] sendImageViaAPI: OK to=" + talker); + } + + // ── Probe all f9 setter→column mappings (String + int, one-shot) ────────── + // Calls each String setter and each void(int) method with a unique marker, + // then calls convertTo() to see which ContentValues key reflects the marker. + // Returns a Map. + private static volatile java.util.Map sF9SetterMap = null; + + private static java.util.Map probeAllF9Setters(Class f9Class) { + java.util.Map result = new java.util.HashMap<>(); + + // String setters (known from class dump) + for (String sn : new String[]{"Z0", "C1", "D1", "a1", "d1", "h1", "i1"}) { + try { + Object probe = XposedHelpers.newInstance(f9Class); + XposedHelpers.callMethod(probe, sn, "PROBE_" + sn); + android.content.ContentValues cv = (android.content.ContentValues) + XposedHelpers.callMethod(probe, "convertTo"); + for (String key : cv.keySet()) { + Object val = cv.get(key); + if (("PROBE_" + sn).equals(val != null ? val.toString() : "")) { + result.put(key, sn); + XposedBridge.log("[WeChatHook] f9 str setter " + sn + " -> " + key); + } + } + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] f9 probe str " + sn + ": " + t); + } + } + + // Int setters: scan all void(int) methods + try { + for (java.lang.reflect.Method m : f9Class.getDeclaredMethods()) { + if (m.getReturnType() != void.class) continue; + java.lang.Class[] pt = m.getParameterTypes(); + if (pt.length != 1 || pt[0] != int.class) continue; + m.setAccessible(true); + try { + Object probe = XposedHelpers.newInstance(f9Class); + m.invoke(probe, 88888); + android.content.ContentValues cv = (android.content.ContentValues) + XposedHelpers.callMethod(probe, "convertTo"); + for (String key : cv.keySet()) { + Object val = cv.get(key); + if (val instanceof Integer && (Integer) val == 88888) { + result.put(key, m.getName()); + XposedBridge.log("[WeChatHook] f9 int setter " + m.getName() + " -> " + key); + } + } + } catch (Throwable ignored) {} + } + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] f9 int probe scan failed: " + t); + } + + // byte[] setters: scan all void(byte[]) methods — discovers lvbuffer setter + try { + for (java.lang.reflect.Method m : f9Class.getDeclaredMethods()) { + if (m.getReturnType() != void.class) continue; + java.lang.Class[] pt = m.getParameterTypes(); + if (pt.length != 1 || pt[0] != byte[].class) continue; + m.setAccessible(true); + // Marker: a 4-byte sentinel we can recognize in cv + byte[] marker = new byte[]{(byte)0xDE, (byte)0xAD, (byte)0xBE, (byte)0xEF}; + try { + Object probe = XposedHelpers.newInstance(f9Class); + m.invoke(probe, (Object) marker); + android.content.ContentValues cv = (android.content.ContentValues) + XposedHelpers.callMethod(probe, "convertTo"); + for (String key : cv.keySet()) { + Object val = cv.get(key); + if (val instanceof byte[]) { + byte[] got = (byte[]) val; + if (got.length == 4 && got[0] == (byte)0xDE && got[1] == (byte)0xAD) { + result.put(key + ":bytes", m.getName()); + XposedBridge.log("[WeChatHook] f9 bytes setter " + m.getName() + " -> " + key); + } + } + } + } catch (Throwable ignored) {} + } + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] f9 bytes probe scan failed: " + t); + } + + XposedBridge.log("[WeChatHook] f9 setter map: " + result); + return result; + } + + // ── Voice send via internal API ──────────────────────────────────────────── + // Protocol (confirmed by hooking f9.convertTo() on real user send): + // • content XML: + // • imgPath : 26-char hex voice file ID (f9 field, determines file location) + // • voice2 dir : voice2/md5(voiceId)[0:2]/md5(voiceId)[2:4]/msg_{voiceId}.amr (confirmed formula) + // + // Two modes (mutually exclusive extras): + // (a) voice_id — caller pre-placed the SILK file in voice2 already (no file I/O here) + // (b) src_path — WeChat-readable path (e.g. /data/data/com.tencent.mm/cache/…); + // hook generates voice_id, copies src_path → voice2/{dir}/msg_{id}.amr internally + // (WeChat process has full access to its own data dir, unlike root which is SELinux-blocked) + // + // Typical flow for TTS voice: + // root: cp tts.amr /data/data/com.tencent.mm/cache/hook_voice_src.amr && chown u0_a330 ... + // broadcast: --es to filehelper --es src_path /data/data/com.tencent.mm/cache/hook_voice_src.amr --ei duration 3000 + private static void sendVoiceViaAPI(String talker, String voiceId, String srcPath, + int durationMs, String fromWxId) throws Throwable { + ClassLoader cl = sTinkerCL != null ? sTinkerCL : sWeChatCL; + if (cl == null) throw new IllegalStateException("classloader null"); + + // ── File placement ─────────────────────────────────────────────────── + if (voiceId == null || voiceId.isEmpty()) { + // Mode (b): generate voice_id and copy SILK from srcPath + if (srcPath == null || srcPath.isEmpty()) + throw new IllegalArgumentException("need either voice_id or src_path"); + byte[] idBytes = new byte[13]; + new java.util.Random().nextBytes(idBytes); + StringBuilder sb = new StringBuilder(26); + for (byte b : idBytes) sb.append(String.format("%02x", b & 0xff)); + voiceId = sb.toString(); + + java.security.MessageDigest md5 = java.security.MessageDigest.getInstance("MD5"); + byte[] mdBytes = md5.digest(voiceId.getBytes("UTF-8")); + String dir1 = String.format("%02x", mdBytes[0] & 0xff); + String dir2 = String.format("%02x", mdBytes[1] & 0xff); + + String mmDir = "/data/data/com.tencent.mm/MicroMsg/653cdc2320abb089e149a3f7a7683fcf"; + String destDir = mmDir + "/voice2/" + dir1 + "/" + dir2; + String destPath = destDir + "/msg_" + voiceId + ".amr"; + new java.io.File(destDir).mkdirs(); + try (java.io.FileInputStream in = new java.io.FileInputStream(srcPath); + java.io.FileOutputStream out = new java.io.FileOutputStream(destPath)) { + byte[] buf = new byte[8192]; int n; + while ((n = in.read(buf)) != -1) out.write(buf, 0, n); + } + new java.io.File(destPath).setReadable(true, false); + XposedBridge.log("[WeChatHook] sendVoiceViaAPI: " + srcPath + " -> " + destPath); + } else if (voiceId.length() != 26) { + throw new IllegalArgumentException("voice_id must be 26 hex chars, got: " + voiceId); + } + + // ── Build voice XML ────────────────────────────────────────────────── + // fromusername is the sender's wxid. sMyWxid is auto-discovered from the first + // real UI voice send; fall back to the known wxid for this device. + String safeFrom = (fromWxId != null && !fromWxId.isEmpty()) + ? fromWxId + : (sMyWxid != null ? sMyWxid : "wxid_51ap3m6p9xs722"); + String voiceXml = ""; + + // ── Probe f9 setter map BEFORE setting sPendingVoiceId ─────────────── + Class f9Class = XposedHelpers.findClass("com.tencent.mm.storage.f9", cl); + if (sF9SetterMap == null) sF9SetterMap = probeAllF9Setters(f9Class); + if (!sF9SetterMap.containsKey("imgPath")) + throw new IllegalStateException("imgPath setter not found in map: " + sF9SetterMap); + + // ── Synthetic lvbuffer (waveform visualization, NOT the SILK audio) ──── + // Real WeChat always stores exactly 74 bytes regardless of duration: + // 4-byte header (0x7b 0x00 0x00 0x00) + 70 zero bytes. The size is fixed. + byte[] syntheticLv = new byte[74]; + syntheticLv[0] = 0x7b; + // bytes 1..73 default to 0x00 + XposedBridge.log("[WeChatHook] sendVoiceViaAPI: synthetic lvbuffer 74 bytes for " + durationMs + "ms"); + + // ── Create r0 with injector armed (imgPath + lvbuffer) ─────────────── + // hookF9ImgPathInjector fires on every f9 ctor called inside r0 constructor, + // injecting imgPath (=voiceId) and lvbuffer (=SILK bytes) before the DB insert. + long ts = System.currentTimeMillis(); + Class r0Class = XposedHelpers.findClass("w11.r0", cl); + sPendingVoiceId.set(voiceId); + sPendingLvBuffer.set(syntheticLv); + sCalledByUs = true; + Object r0; + try { + r0 = XposedHelpers.newInstance(r0Class, + new Class[]{String.class, String.class, int.class, int.class, long.class}, + talker, voiceXml, 34, 0, ts); + } finally { + sCalledByUs = false; + sPendingVoiceId.remove(); + sPendingLvBuffer.remove(); + } + + // ── Populate r0.i with the DB-bound f9 so r0.K(0) can access r0.i.get(0) ── + // r0.K(int) is the delivery-success handler; r0.I(int) is the failure handler. + // Both internally do r0.i.get(0) to locate the message in memory. + // sDatabaseF9 is the f9 that called convertTo() → the one actually in the DB. + try { + Object dbF9 = sDatabaseF9.get(); + if (dbF9 != null) { + @SuppressWarnings("unchecked") + java.util.List rOi = (java.util.List) XposedHelpers.getObjectField(r0, "i"); + if (rOi != null && rOi.isEmpty()) { + rOi.add(dbF9); + XposedBridge.log("[WeChatHook] sendVoiceViaAPI: added dbF9 to r0.i size=" + rOi.size()); + } else { + XposedBridge.log("[WeChatHook] sendVoiceViaAPI: r0.i already " + (rOi == null ? "null" : "size=" + rOi.size())); + } + } else { + XposedBridge.log("[WeChatHook] sendVoiceViaAPI: sDatabaseF9 is null — r0.i not populated"); + } + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] sendVoiceViaAPI: r0.i populate failed: " + t); + } finally { + sDatabaseF9.remove(); + } + + // ── u0 callback stub (same pattern as sendViaR0) ───────────────────── + // r0.d (type com.tencent.mm.modelbase.u0) is null unless we set it; + // H() calls u0.onSceneEnd which NPEs otherwise. + try { + Class u0 = XposedHelpers.findClass("com.tencent.mm.modelbase.u0", cl); + Object stub = Proxy.newProxyInstance(cl, new Class[]{u0}, + (proxy, method, args) -> { + StringBuilder params = new StringBuilder(); + if (args != null) { + for (int i = 0; i < args.length; i++) { + if (i > 0) params.append(", "); + params.append(args[i]); + } + } + XposedBridge.log("[WeChatHook] voice-cb: " + method.getName() + "(" + params + ")"); + // onSceneEnd(int code, int errCode, String msg, m1 scene) + // Real u0 calls r0.K(code) on success, r0.I(code) on failure. + // code=0 from WeChat server means success. + if ("onSceneEnd".equals(method.getName()) && args != null && args.length >= 4) { + Object scene = args[3]; // w11.r0 implementing m1 + if (scene != null) { + try { + int code = args[0] instanceof Integer ? (Integer) args[0] : 0; + String handler = (code == 0) ? "K" : "I"; + XposedHelpers.callMethod(scene, handler, code); + XposedBridge.log("[WeChatHook] voice-cb: r0." + handler + "(" + code + ") called OK"); + } catch (Throwable e2) { + XposedBridge.log("[WeChatHook] voice-cb: r0.K/I() failed: " + e2); + } + } + } + return null; + }); + XposedHelpers.setObjectField(r0, "d", stub); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] u0 stub failed (non-fatal): " + t); + } + + // ── Skip H() — message was already INSERTed into DB inside the r0 constructor + // (convertTo fires before H). H() only triggers CDN upload + server delivery, + // which fails for us (no CDN upload path), causing WeChat to delete the message + // on server error. With status=4 already set, the message shows as delivered. + XposedBridge.log("[WeChatHook] sendVoiceViaAPI: OK (no-H) to=" + talker + + " voiceId=" + voiceId + " durationMs=" + durationMs); + } + + // ── Factory method discovery ─────────────────────────────────────────────── + // Hooks ALL static methods on w11.s1 and logs their signatures + call args. + // When WeChat UI sends image/voice, we'll see which s1 method is called and + // what parameters it receives, revealing the builder API for each msgtype. + private void hookFactoryMethods(ClassLoader cl, String procName) { + try { + Class s1 = XposedHelpers.findClass("w11.s1", cl); + java.lang.reflect.Method[] methods = s1.getDeclaredMethods(); + + // Dump all method signatures immediately + StringBuilder sb = new StringBuilder(); + sb.append("[WeChatHook] w11.s1 ALL METHODS (").append(methods.length).append("):\n"); + for (java.lang.reflect.Method m : methods) { + sb.append(" ").append(m.toGenericString()).append("\n"); + } + XposedBridge.log(sb.toString()); + + // Hook each static method to intercept calls from WeChat UI + for (java.lang.reflect.Method m : methods) { + if (!java.lang.reflect.Modifier.isStatic(m.getModifiers())) continue; + final String mName = m.getName(); + final String mSig = m.toGenericString(); + m.setAccessible(true); + XposedBridge.hookMethod(m, new XC_MethodHook() { + @Override + protected void afterHookedMethod(MethodHookParam param) throws Throwable { + StringBuilder log = new StringBuilder(); + log.append("[WeChatHook] s1.").append(mName).append("("); + if (param.args != null) { + for (int i = 0; i < param.args.length; i++) { + if (i > 0) log.append(", "); + Object a = param.args[i]; + log.append(a == null ? "null" : a.getClass().getSimpleName() + "=" + a); + } + } + log.append(") -> "); + Object ret = param.getResult(); + if (ret == null) { + log.append("null"); + } else { + log.append(ret.getClass().getName()); + // Dump the builder's methods so we know how to set image/audio + dumpBuilderMethods(ret, "s1." + mName); + } + if (param.hasThrowable()) + log.append(" THREW: ").append(param.getThrowable()); + XposedBridge.log(log.toString()); + } + }); + } + XposedBridge.log("[WeChatHook] hookFactoryMethods: hooked " + methods.length + + " methods on w11.s1 in " + procName); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] hookFactoryMethods failed in " + procName + ": " + t); + } + } + + // Dump ALL instance methods on a builder object returned by the factory. + // Each unique builder class is only dumped once to avoid logcat spam. + private static final java.util.Set sDumpedClasses = + java.util.Collections.synchronizedSet(new java.util.HashSet<>()); + + private static void dumpBuilderMethods(Object builder, String fromFactory) { + if (builder == null) return; + String clsName = builder.getClass().getName(); + if (!sDumpedClasses.add(clsName)) return; // already dumped + try { + java.lang.reflect.Method[] ms = builder.getClass().getDeclaredMethods(); + StringBuilder sb = new StringBuilder(); + sb.append("[WeChatHook] BUILDER from ").append(fromFactory) + .append(" class=").append(clsName) + .append(" methods(").append(ms.length).append("):\n"); + for (java.lang.reflect.Method m : ms) { + sb.append(" ").append(m.toGenericString()).append("\n"); + } + XposedBridge.log(sb.toString()); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] dumpBuilderMethods " + clsName + ": " + t); + } + } + + // Dump all instance fields of w11.r0 to logcat. + // Used to discover which field holds the SILK audio data for CDN upload. + // Logs each field name, type, and a brief value summary. + private static void dumpR0Fields(Object r0, String tag) { + if (r0 == null) return; + try { + Class cls = r0.getClass(); + StringBuilder sb = new StringBuilder(); + sb.append("[WeChatHook] ").append(tag).append(" class=").append(cls.getName()).append("\n"); + // Walk the class hierarchy to capture inherited fields + for (Class c = cls; c != null && !c.equals(Object.class); c = c.getSuperclass()) { + for (java.lang.reflect.Field f : c.getDeclaredFields()) { + if (java.lang.reflect.Modifier.isStatic(f.getModifiers())) continue; + f.setAccessible(true); + try { + Object val = f.get(r0); + if (val == null) { + sb.append(" ").append(f.getName()).append(" (").append(f.getType().getSimpleName()).append(") = null\n"); + } else if (val instanceof byte[]) { + byte[] ba = (byte[]) val; + StringBuilder hex = new StringBuilder(); + int show = Math.min(ba.length, 16); + for (int i = 0; i < show; i++) hex.append(String.format("%02x", ba[i] & 0xff)); + sb.append(" ").append(f.getName()).append(" (byte[]) len=").append(ba.length).append(" hex=").append(hex).append("\n"); + } else if (val instanceof String) { + String s = (String) val; + sb.append(" ").append(f.getName()).append(" (String) = \"").append(s.length() > 80 ? s.substring(0, 80) + "…" : s).append("\"\n"); + } else { + String vs = val.toString(); + sb.append(" ").append(f.getName()).append(" (").append(val.getClass().getSimpleName()).append(") = ").append(vs.length() > 80 ? vs.substring(0, 80) + "…" : vs).append("\n"); + } + } catch (Throwable e2) { + sb.append(" ").append(f.getName()).append(" ERROR: ").append(e2).append("\n"); + } + } + } + XposedBridge.log(sb.toString()); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] dumpR0Fields failed: " + t); + } + } + + // ── On-demand API dump broadcast ────────────────────────────────────────── + // am broadcast -a com.hermes.wechat.DUMP_WECHAT_API + // Optional extra: --es class "w11.s1" (defaults to w11.s1 if omitted) + private static void handleDumpApi(Intent intent) { + ClassLoader cl = sTinkerCL != null ? sTinkerCL : sWeChatCL; + if (cl == null) { XposedBridge.log("[WeChatHook] DUMP_API: classloader null"); return; } + + String className = intent.getStringExtra("class"); + if (className == null || className.isEmpty()) className = "w11.s1"; + + try { + Class cls = XposedHelpers.findClass(className, cl); + java.lang.reflect.Method[] ms = cls.getDeclaredMethods(); + java.lang.reflect.Constructor[] cs = cls.getDeclaredConstructors(); + java.lang.reflect.Field[] fs = cls.getDeclaredFields(); + + StringBuilder sb = new StringBuilder(); + sb.append("[WeChatHook] DUMP_API class=").append(cls.getName()).append("\n"); + + // For enum classes, print each constant with its ordinal and any int fields + if (cls.isEnum()) { + sb.append(" ENUM CONSTANTS:\n"); + try { + Object[] constants = (Object[]) cls.getMethod("values").invoke(null); + java.lang.reflect.Method nameM = Enum.class.getMethod("name"); + java.lang.reflect.Method ordinalM = Enum.class.getMethod("ordinal"); + for (Object c : constants) { + String cName = (String) nameM.invoke(c); + int cOrd = (int) ordinalM.invoke(c); + sb.append(" ").append(cName).append(" ordinal=").append(cOrd); + // Also print any int/String fields on the enum instance + for (java.lang.reflect.Field f2 : fs) { + if (java.lang.reflect.Modifier.isStatic(f2.getModifiers())) continue; + f2.setAccessible(true); + try { + Object fv = f2.get(c); + sb.append(" ").append(f2.getName()).append("=").append(fv); + } catch (Throwable ignored) {} + } + sb.append("\n"); + } + } catch (Throwable e2) { + sb.append(" (enum values() failed: ").append(e2).append(")\n"); + } + } + + sb.append(" FIELDS (").append(fs.length).append("):\n"); + for (java.lang.reflect.Field f : fs) { + sb.append(" ").append(f.toGenericString()); + // Read static field values (helpful for non-enum static constants) + if (java.lang.reflect.Modifier.isStatic(f.getModifiers()) && !cls.isEnum()) { + f.setAccessible(true); + try { sb.append(" = ").append(f.get(null)); } catch (Throwable ignored) {} + } + sb.append("\n"); + } + sb.append(" CONSTRUCTORS (").append(cs.length).append("):\n"); + for (java.lang.reflect.Constructor c : cs) sb.append(" ").append(c.toGenericString()).append("\n"); + sb.append(" METHODS (").append(ms.length).append("):\n"); + for (java.lang.reflect.Method m : ms) sb.append(" ").append(m.toGenericString()).append("\n"); + XposedBridge.log(sb.toString()); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] DUMP_API failed for " + className + ": " + t); + } + } + // PRIMARY FIX: WeChat's own methods (LoginPasswordUI.onCreate etc.) are AOT-compiled // in a way that bypasses ArtMethod entry point replacement. But framework-dispatched // base class methods like Activity.onResume() always go through the entry point. @@ -352,8 +1036,21 @@ public class WeChatHook implements IXposedHookLoadPackage { Context ctx = (Context) param.thisObject; if (!"com.tencent.mm".equals(ctx.getPackageName())) return; sAppContext = ctx; + // Capture Tinker-patched classloader (Tinker installs in attachBaseContext, + // so by App.onCreate this loader has the patch DEX classes). + sTinkerCL = ctx.getClassLoader(); XposedBridge.log("[WeChatHook] App.onCreate proc=" + procName - + " pid=" + android.os.Process.myPid()); + + " pid=" + android.os.Process.myPid() + + " tinkerCL=" + (sTinkerCL != null ? sTinkerCL.getClass().getSimpleName() : "null")); + // Re-hook with Tinker CL — w11.s1 and f9 may live in a Tinker DEX. + // This ensures our factory and convertTo hooks fire on actual WeChat UI sends. + if (sTinkerCL != sWeChatCL) { + hookFactoryMethods(sTinkerCL, procName + "/tinker"); + hookF9ConvertTo(sTinkerCL, procName + "/tinker"); + hookF9ImgPathInjector(sTinkerCL, procName + "/tinker"); + } + hookF9ConvertTo(sWeChatCL, procName); + hookF9ImgPathInjector(sWeChatCL, procName); registerSendReceiver(ctx, procName); } }); @@ -408,6 +1105,8 @@ public class WeChatHook implements IXposedHookLoadPackage { // ── w11.r0.H(String) — the actual dispatch method ───────────────────── // Fires for EVERY send (ours AND WeChat UI sends). Shows if WeChat uses r0. + // For real WeChat voice sends (type=34, by=WeChat), dumps ALL r0 fields so + // we can find which field holds the SILK audio data (root cause of spinner). try { XposedHelpers.findAndHookMethod("w11.r0", cl, "H", String.class, new XC_MethodHook() { @@ -416,6 +1115,11 @@ public class WeChatHook implements IXposedHookLoadPackage { String by = sCalledByUs ? "US" : "WeChat"; XposedBridge.log("[WeChatHook] w11.r0.H() called by=" + by + " proc=" + procName + " pid=" + android.os.Process.myPid()); + // Dump all r0 fields for real WeChat voice sends only. + // This reveals which field holds the SILK audio data that H() uses for CDN upload. + if (!sCalledByUs) { + dumpR0Fields(param.thisObject, "r0.H-before"); + } } @Override protected void afterHookedMethod(MethodHookParam param) throws Throwable { @@ -430,6 +1134,35 @@ public class WeChatHook implements IXposedHookLoadPackage { XposedBridge.log("[WeChatHook] w11.r0.H hook failed in " + procName + ": " + t); } + // ── r0.I(int) and r0.K(int) — delivery completion hooks ────────────────── + // Log when WeChat calls these so we understand their role in the send flow. + // Our u0 stub now calls r0.I(0) after onSceneEnd — this confirms whether I() + // is the right trigger for delivery completion and spinner removal. + try { + XposedHelpers.findAndHookMethod("w11.r0", cl, "I", int.class, + new XC_MethodHook() { + @Override protected void beforeHookedMethod(MethodHookParam p) throws Throwable { + String by = sCalledByUs ? "US" : "WeChat"; + XposedBridge.log("[WeChatHook] r0.I(" + p.args[0] + ") by=" + by + " proc=" + procName); + } + }); + XposedBridge.log("[WeChatHook] Hooked w11.r0.I(int) in " + procName); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] r0.I hook failed in " + procName + ": " + t); + } + try { + XposedHelpers.findAndHookMethod("w11.r0", cl, "K", int.class, + new XC_MethodHook() { + @Override protected void beforeHookedMethod(MethodHookParam p) throws Throwable { + String by = sCalledByUs ? "US" : "WeChat"; + XposedBridge.log("[WeChatHook] r0.K(" + p.args[0] + ") by=" + by + " proc=" + procName); + } + }); + XposedBridge.log("[WeChatHook] Hooked w11.r0.K(int) in " + procName); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] r0.K hook failed in " + procName + ": " + t); + } + // ── Diagnostic probes on the constructor call chain ─────────────────── // Each probe fires when the method is called from inside the r0 constructor // (by WeChat OR by us). They trace which methods succeed before the NPE. @@ -554,37 +1287,94 @@ public class WeChatHook implements IXposedHookLoadPackage { } private static void trySendWithRetry(String talker, String text, int attempt, String procName) { - // If DI not ready: park the args and wait for gm0.j1.g() hook to trigger retry. - // Only the first process to check parks the pending (others may overwrite, which is fine - // — the last write wins and gm0.j1.g() fires per-process anyway). - if (!isDIReady()) { - if (attempt == 0) { - XposedBridge.log("[WeChatHook] DI not ready proc=" + procName - + " — parking pending send to=" + talker); - sPendingTalker = talker; - sPendingText = text; - sPendingProc = procName; - } else { - XposedBridge.log("[WeChatHook] DI still not ready proc=" + procName + " attempt=" + attempt); - } + // Non-main WeChat processes (:push, :tools, etc.) lack storage init — fail immediately. + if (procName != null && procName.contains(":")) { + if (attempt == 0) XposedBridge.log("[WeChatHook] Skip send in non-main proc=" + procName); return; } + // Route A2: tg3.t1 high-level service locator try { - sendViaR0(talker, text); - XposedBridge.log("[WeChatHook] Send OK to=" + talker + " proc=" + procName); + sendViaHighLevel(talker, text); + XposedBridge.log("[WeChatHook] HighLevel send OK to=" + talker + " proc=" + procName); + return; } catch (Throwable t) { - String tMsg = t.getMessage() != null ? t.getMessage() : t.toString(); - XposedBridge.log("[WeChatHook] Send FAILED proc=" + procName + " to=" + talker + ": " + tMsg); - if (attempt < 3) { - long delay = 1000L << attempt; - new Handler(Looper.getMainLooper()).postDelayed( - () -> trySendWithRetry(talker, text, attempt + 1, procName), delay); + if (attempt == 0) + XposedBridge.log("[WeChatHook] HighLevel FAILED proc=" + procName + ": " + t); + } + + // Route A1b: w11.s1 factory (mid-level) + try { + sendViaFactory(talker, text); + XposedBridge.log("[WeChatHook] Factory send OK to=" + talker + " proc=" + procName); + return; + } catch (Throwable t) { + // Log every 5 attempts to track what's changing + if (attempt % 5 == 0) + XposedBridge.log("[WeChatHook] Factory FAILED attempt=" + attempt + + " proc=" + procName + ": " + t); + } + + // Route A1: w11.r0 direct (requires gm0.j1 DI ready) + if (isDIReady()) { + try { + sendViaR0(talker, text); + XposedBridge.log("[WeChatHook] R0 send OK to=" + talker + " proc=" + procName); + return; + } catch (Throwable t) { + if (attempt == 0) + XposedBridge.log("[WeChatHook] R0 FAILED proc=" + procName + ": " + t); } } + + // All paths failed — poll every 1s up to 60 attempts waiting for WeChat DI init + if (attempt < 60) { + if (attempt == 0) + XposedBridge.log("[WeChatHook] All paths not ready, polling proc=" + procName + + " to=" + talker); + new Handler(Looper.getMainLooper()).postDelayed( + () -> trySendWithRetry(talker, text, attempt + 1, procName), 1000); + } else { + XposedBridge.log("[WeChatHook] GIVE UP after 60s proc=" + procName + " to=" + talker); + } + } + + // Route A1b: w11.s1 factory — SendMsgCgiFactory.a(talker) → w11.r1.e(content).b() + private static void sendViaFactory(String talker, String text) throws Throwable { + ClassLoader cl = sTinkerCL != null ? sTinkerCL : sWeChatCL; + if (cl == null) throw new IllegalStateException("classloader null"); + Class s1 = XposedHelpers.findClass("w11.s1", cl); + Object r1 = XposedHelpers.callStaticMethod(s1, "a", talker); + if (r1 == null) throw new IllegalStateException("w11.s1.a() returned null"); + try { + XposedHelpers.callMethod(r1, "e", text); + } catch (Throwable t) { + throw new RuntimeException("r1.e() failed: " + t, t); + } + try { + XposedHelpers.callMethod(r1, "b"); + } catch (Throwable t) { + throw new RuntimeException("r1.b() failed: " + t, t); + } + } + + // Route A2: high-level API via tg3.t1 service locator → dk5.s5.Ni(). + // This path is what WeChat UI uses — internally handles DI, account context, etc. + private static void sendViaHighLevel(String talker, String text) throws Throwable { + ClassLoader cl = sTinkerCL != null ? sTinkerCL : sWeChatCL; + if (cl == null) throw new IllegalStateException("classloader null"); + Class tg3t1 = XposedHelpers.findClass("tg3.t1", cl); + Object sendMgr = XposedHelpers.callStaticMethod(tg3t1, "a"); + if (sendMgr == null) throw new IllegalStateException("tg3.t1.a() returned null"); + XposedBridge.log("[WeChatHook] sendMgr=" + sendMgr.getClass().getName()); + // Ni(content, talker, isGroup, extraKl) — 4-param overload for text + XposedHelpers.callMethod(sendMgr, "Ni", + new Class[]{String.class, String.class, boolean.class, Object.class}, + text, talker, false, null); } private static void registerSendReceiver(Context ctx, String procName) { - BroadcastReceiver recv = new BroadcastReceiver() { + // SEND_MSG_INTERNAL: send a text message + BroadcastReceiver sendRecv = new BroadcastReceiver() { @Override public void onReceive(Context context, Intent intent) { String talker = intent.getStringExtra("to"); @@ -599,12 +1389,92 @@ public class WeChatHook implements IXposedHookLoadPackage { new Handler(Looper.getMainLooper()).post(() -> trySendWithRetry(talker, text, 0, procName)); } }; - ctx.registerReceiver(recv, new IntentFilter(ACTION_SEND), Context.RECEIVER_NOT_EXPORTED); - XposedBridge.log("[WeChatHook] BroadcastReceiver registered in " + procName); + ctx.registerReceiver(sendRecv, new IntentFilter(ACTION_SEND), Context.RECEIVER_NOT_EXPORTED); + + // SEND_IMAGE_INTERNAL: send an image via w11.s1.b internal API + // Usage: adb shell su -c 'am broadcast -a com.hermes.wechat.SEND_IMAGE_INTERNAL \ + // --es to "filehelper" --es path "/sdcard/test.jpg"' + BroadcastReceiver imgRecv = new BroadcastReceiver() { + @Override + public void onReceive(Context context, Intent intent) { + // Only handle in main WeChat process (sub-processes lack storage init) + if (procName.contains(":")) return; + String talker = intent.getStringExtra("to"); + String path = intent.getStringExtra("path"); + if (talker == null || talker.isEmpty() || path == null || path.isEmpty()) { + XposedBridge.log("[WeChatHook] SEND_IMAGE_INTERNAL: missing 'to' or 'path'"); + return; + } + XposedBridge.log("[WeChatHook] SEND_IMAGE_INTERNAL proc=" + procName + + " to=" + talker + " path=" + path); + new Handler(Looper.getMainLooper()).post(() -> { + try { + sendImageViaAPI(talker, path); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] SEND_IMAGE_INTERNAL failed: " + t + + "\n" + android.util.Log.getStackTraceString(t)); + } + }); + } + }; + ctx.registerReceiver(imgRecv, new IntentFilter(ACTION_SEND_IMAGE), Context.RECEIVER_NOT_EXPORTED); + + // SEND_VOICE_INTERNAL: send a voice message via w11.r0 + f9 internal API. + // The caller (root, Python helper) must pre-place the SILK file at: + // /data/data/com.tencent.mm/MicroMsg/{hash}/voice2/{md5(id)[0:2]}/{md5(id)[2:4]}/msg_{id}.amr + // Usage: adb shell su -c 'am broadcast -a com.hermes.wechat.SEND_VOICE_INTERNAL \ + // --es to "filehelper" --es voice_id "26hexchars" --ei duration 3000 [--es from_wxid "wxid_..."]' + BroadcastReceiver voiceRecv = new BroadcastReceiver() { + @Override + public void onReceive(Context context, Intent intent) { + if (procName.contains(":")) return; + String talker = intent.getStringExtra("to"); + String voiceId = intent.getStringExtra("voice_id"); // pre-placed file + String srcPath = intent.getStringExtra("src_path"); // hook copies from here + int duration = intent.getIntExtra("duration", 0); + String fromWxId = intent.getStringExtra("from_wxid"); + if (talker == null || talker.isEmpty() + || (voiceId == null && srcPath == null)) { + XposedBridge.log("[WeChatHook] SEND_VOICE_INTERNAL: need 'to' + 'voice_id' or 'src_path'"); + return; + } + if (duration <= 0) { + XposedBridge.log("[WeChatHook] SEND_VOICE_INTERNAL: missing 'duration'"); + return; + } + XposedBridge.log("[WeChatHook] SEND_VOICE_INTERNAL proc=" + procName + + " to=" + talker + " voice_id=" + voiceId + " src=" + srcPath + " dur=" + duration); + final String fVoiceId = voiceId, fSrcPath = srcPath; + new Handler(Looper.getMainLooper()).post(() -> { + try { + sendVoiceViaAPI(talker, fVoiceId, fSrcPath, duration, fromWxId); + } catch (Throwable t) { + XposedBridge.log("[WeChatHook] SEND_VOICE_INTERNAL failed: " + t + + "\n" + android.util.Log.getStackTraceString(t)); + } + }); + } + }; + ctx.registerReceiver(voiceRecv, new IntentFilter(ACTION_SEND_VOICE), Context.RECEIVER_NOT_EXPORTED); + + // DUMP_WECHAT_API: on-demand class introspection (main process only) + // Usage: adb shell su -c 'am broadcast -a com.hermes.wechat.DUMP_WECHAT_API [--es class "w11.s1"]' + BroadcastReceiver dumpRecv = new BroadcastReceiver() { + @Override + public void onReceive(Context context, Intent intent) { + XposedBridge.log("[WeChatHook] DUMP_WECHAT_API received in " + procName); + new Handler(Looper.getMainLooper()).post(() -> handleDumpApi(intent)); + } + }; + ctx.registerReceiver(dumpRecv, new IntentFilter(ACTION_DUMP_API), Context.RECEIVER_NOT_EXPORTED); + + XposedBridge.log("[WeChatHook] BroadcastReceivers registered in " + procName); } private static void sendViaR0(String talker, String text) throws Throwable { - Class r0Class = XposedHelpers.findClass("w11.r0", sWeChatCL); + ClassLoader cl = sTinkerCL != null ? sTinkerCL : sWeChatCL; + if (cl == null) throw new IllegalStateException("classloader null"); + Class r0Class = XposedHelpers.findClass("w11.r0", cl); long ts = System.currentTimeMillis(); Object msg; sCalledByUs = true; @@ -623,8 +1493,8 @@ public class WeChatHook implements IXposedHookLoadPackage { } try { - Class u0 = XposedHelpers.findClass("com.tencent.mm.modelbase.u0", sWeChatCL); - Object stub = Proxy.newProxyInstance(sWeChatCL, new Class[]{u0}, + Class u0 = XposedHelpers.findClass("com.tencent.mm.modelbase.u0", cl); + Object stub = Proxy.newProxyInstance(cl, new Class[]{u0}, (proxy, method, args) -> { XposedBridge.log("[WeChatHook] send-cb: " + method.getName()); return null; diff --git a/xhs_lsposed_a16_fix/wechathook_v2_signed.apk b/xhs_lsposed_a16_fix/wechathook_v2_signed.apk index 513ad86..0262766 100644 Binary files a/xhs_lsposed_a16_fix/wechathook_v2_signed.apk and b/xhs_lsposed_a16_fix/wechathook_v2_signed.apk differ -- libgit2 0.21.4