commit de63fda86c04a16abcea085dbe39a1e6ef0f3820 Author: AdminTest0 <68320691@qq.com> Date: Sun Jul 17 22:41:47 2022 +0800 SharpWxDump diff --git a/.vs/SharpWxDump/v16/.suo b/.vs/SharpWxDump/v16/.suo new file mode 100644 index 0000000..919f2e7 Binary files /dev/null and b/.vs/SharpWxDump/v16/.suo differ diff --git a/Program.cs b/Program.cs new file mode 100644 index 0000000..b3a3ca8 --- /dev/null +++ b/Program.cs @@ -0,0 +1,524 @@ +using System; +using System.Collections.Generic; +using System.Diagnostics; +using System.Runtime.InteropServices; +using System.Text; + +namespace WeChatGetKey +{ + internal class Program + { + private static void Main(string[] args) + { + try + { + Program.ReadTest(); + } + catch (Exception ex) + { + Console.WriteLine("Error：" + ex.Message); + } + finally + { + //Console.ReadKey(); + } + Console.WriteLine("[+] Done."); + } + private static void ReadTest() + {; + Process WeChatProcess = null; + Process[] WeChatProcessName = Process.GetProcessesByName("WeChat"); + + List list = null; + + foreach (Process WeChatProcess2 in WeChatProcessName) + { + WeChatProcess = WeChatProcess2; + Console.WriteLine("[+] WeChatProcessPID: " + WeChatProcess2.Id.ToString()); + foreach (object obj in WeChatProcess.Modules) + { + ProcessModule processModule = (ProcessModule)obj; + if (processModule.ModuleName == "WeChatWin.dll") + { + Program.WeChatWinBaseAddress = processModule.BaseAddress; + string fileVersion = processModule.FileVersionInfo.FileVersion; + Console.WriteLine("[+] WeChatVersion: " + fileVersion); + + if (!Program.versionlist.TryGetValue(fileVersion, out list)) + { + Console.WriteLine("[-] WeChat Current Version Is: " + fileVersion + " Not Support"); + return; + } + break; + } + } + + if (list == null) + { + Console.WriteLine("[-] WeChat Base Address Get Faild"); + } + else + { + int WeChatName = (int)Program.WeChatWinBaseAddress + list[0]; + Console.WriteLine("[+] WeChatName: " + Program.GetName(WeChatProcess.Handle, (IntPtr)WeChatName, 100)); + int WeChatAccount = (int)Program.WeChatWinBaseAddress + list[1]; + string Account = Program.GetMobile(WeChatProcess.Handle, (IntPtr)WeChatAccount); + if (string.IsNullOrWhiteSpace(Account)) + { + Console.WriteLine("[-] WeChatAccount: Can't Get User Account, Maybe No Login"); + } + else + { + Console.WriteLine("[+] WeChatAccount: " + Program.GetAccount(WeChatProcess.Handle, (IntPtr)WeChatAccount, 100)); + } + int WeChatMobile = (int)Program.WeChatWinBaseAddress + list[2]; + string Mobile = Program.GetMobile(WeChatProcess.Handle, (IntPtr)WeChatMobile); + if (string.IsNullOrWhiteSpace(Mobile)) + { + Console.WriteLine("[-] WeChatMobile: Can't Get User Mobile, Maybe No Login or Maybe User Is No Binding Mobile"); + } + else + { + Console.WriteLine("[+] WeChatMobile: " + Program.GetMobile(WeChatProcess.Handle, (IntPtr)WeChatMobile, 100)); + } + int WeChatMail = (int)Program.WeChatWinBaseAddress + list[3]; + string Mail = Program.GetMail(WeChatProcess.Handle, (IntPtr)WeChatMail); + if (string.IsNullOrWhiteSpace(Mail)) + { + Console.WriteLine("[-] WeChatMail: Can't Get User Mail, Maybe User Is No Binding Email Address or The current is New Version"); + } + else + { + Console.WriteLine("[+] WeChatMail: " + Program.GetMail(WeChatProcess.Handle, (IntPtr)WeChatMail, 100)); + } + int WeChatKey = (int)Program.WeChatWinBaseAddress + list[4]; + string HexKey = Program.GetHex(WeChatProcess.Handle, (IntPtr)WeChatKey); + if (string.IsNullOrWhiteSpace(HexKey)) + { + Console.WriteLine("[-] WeChatKey: WeChat Is Run, But Maybe No Login"); + return; + } + else + { + Console.WriteLine("[+] WeChatKey: " + HexKey); + } + } + } + if (WeChatProcess == null) + { + Console.WriteLine("[-] WeChat No Run"); + return; + } + } + private static string GetName(IntPtr hProcess, IntPtr lpBaseAddress, int nSize = 100) + { + byte[] array = new byte[nSize]; + if (Program.ReadProcessMemory(hProcess, lpBaseAddress, array, nSize, 0) == 0) + { + return ""; + } + string text = ""; + foreach (char c in Encoding.UTF8.GetString(array)) + { + if (c == '\0') + { + break; + } + text += c.ToString(); + } + return text; + } + private static string GetAccount(IntPtr hProcess, IntPtr lpBaseAddress, int nSize = 100) + { + byte[] array = new byte[nSize]; + if (Program.ReadProcessMemory(hProcess, lpBaseAddress, array, nSize, 0) == 0) + { + return ""; + } + string text = ""; + foreach (char c in Encoding.UTF8.GetString(array)) + { + if (c == '\0') + { + break; + } + text += c.ToString(); + } + return text; + } + private static string GetMobile(IntPtr hProcess, IntPtr lpBaseAddress, int nSize = 100) + { + byte[] array = new byte[nSize]; + if (Program.ReadProcessMemory(hProcess, lpBaseAddress, array, nSize, 0) == 0) + { + return ""; + } + string text = ""; + foreach (char c in Encoding.UTF8.GetString(array)) + { + if (c == '\0') + { + break; + } + text += c.ToString(); + } + return text; + } + private static string GetMail(IntPtr hProcess, IntPtr lpBaseAddress, int nSize = 100) + { + byte[] array = new byte[nSize]; + if (Program.ReadProcessMemory(hProcess, lpBaseAddress, array, nSize, 0) == 0) + { + return ""; + } + string text = ""; + foreach (char c in Encoding.UTF8.GetString(array)) + { + if (c == '\0') + { + break; + } + text += c.ToString(); + } + return text; + } + private static string GetHex(IntPtr hProcess, IntPtr lpBaseAddress) + { + byte[] array = new byte[4]; + if (Program.ReadProcessMemory(hProcess, lpBaseAddress, array, 4, 0) == 0) + { + return ""; + } + int num = 32; + byte[] array2 = new byte[num]; + IntPtr lpBaseAddress2 = (IntPtr)(((int)array[3] << 24) + ((int)array[2] << 16) + ((int)array[1] << 8) + (int)array[0]); + if (Program.ReadProcessMemory(hProcess, lpBaseAddress2, array2, num, 0) == 0) + { + return ""; + } + return Program.bytes2hex(array2); + } + private static string bytes2hex(byte[] bytes) + { + return BitConverter.ToString(bytes, 0).Replace("-", string.Empty).ToLower().ToUpper(); + } + [DllImport("kernel32.dll")] + public static extern int OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId); + [DllImport("kernel32.dll")] + public static extern int GetModuleHandleA(string moduleName); + [DllImport("kernel32.dll")] + public static extern int ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, int lpNumberOfBytesRead); + public static Dictionary> versionlist = new Dictionary> + { + { + "3.2.1.154", + new List + { + 328121948, + 328122328, + 328123056, + 328121976, + 328123020 + } + }, + { + "3.3.0.115", + new List + { + 31323364, + 31323744, + 31324472, + 31323392, + 31324436 + } + }, + { + "3.3.0.84", + new List + { + 31315212, + 31315592, + 31316320, + 31315240, + 31316284 + } + }, + { + "3.3.0.93", + new List + { + 31323364, + 31323744, + 31324472, + 31323392, + 31324436 + } + }, + { + "3.3.5.34", + new List + { + 30603028, + 30603408, + 30604120, + 30603056, + 30604100 + } + }, + { + "3.3.5.42", + new List + { + 30603012, + 30603392, + 30604120, + 30603040, + 30604084 + } + }, + { + "3.3.5.46", + new List + { + 30578372, + 30578752, + 30579480, + 30578400, + 30579444 + } + }, + { + "3.4.0.37", + new List + { + 31608116, + 31608496, + 31609224, + 31608144, + 31609188 + } + }, + { + "3.4.0.38", + new List + { + 31604044, + 31604424, + 31605152, + 31604072, + 31605116 + } + }, + { + "3.4.0.50", + new List + { + 31688500, + 31688880, + 31689608, + 31688528, + 31689572 + } + }, + { + "3.4.0.54", + new List + { + 31700852, + 31701248, + 31700920, + 31700880, + 31701924 + } + }, + { + "3.4.5.27", + new List + { + 32133788, + 32134168, + 32134896, + 32133816, + 32134860 + } + }, + { + "3.4.5.45", + new List + { + 32147012, + 32147392, + 32147064, + 32147040, + 32148084 + } + }, + { + "3.5.0.20", + new List + { + 35494484, + 35494864, + 35494536, + 35494512, + 35495556 + } + }, + { + "3.5.0.29", + new List + { + 35507980, + 35508360, + 35508032, + 35508008, + 35509052 + } + }, + { + "3.5.0.33", + new List + { + 35512140, + 35512520, + 35512192, + 35512168, + 35513212 + } + }, + { + "3.5.0.39", + new List + { + 35516236, + 35516616, + 35516288, + 35516264, + 35517308 + } + }, + { + "3.5.0.42", + new List + { + 35512140, + 35512520, + 35512192, + 35512168, + 35513212 + } + }, + { + "3.5.0.44", + new List + { + 35510836, + 35511216, + 35510896, + 35510864, + 35511908 + } + }, + { + "3.5.0.46", + new List + { + 35506740, + 35507120, + 35506800, + 35506768, + 35507812 + } + }, + { + "3.6.0.18", + new List + { + 35842996, + 35843376, + 35843048, + 35843024, + 35844068 + } + }, + { + "3.6.5.7", + new List + { + 35864356, + 35864736, + 35864408, + 35864384, + 35865428 + } + }, + { + "3.6.5.16", + new List + { + 35909428, + 35909808, + 35909480, + 35909456, + 35910500 + } + }, + { + "3.7.0.26", + new List + { + 37105908, + 37106288, + 37105960, + 37105936, + 37106980 + } + }, + { + "3.7.0.29", + new List + { + 37105908, + 37106288, + 37105960, + 37105936, + 37106980 + } + }, + { + "3.7.0.30", + new List + { + 37118196, + 37118576, + 37118248, + 37118224, + 37119268 + } + }, + { + "3.7.5.11", + new List + { + 37883280, + 37884088, + 37883136, + 37883008, + 37884052 + } + }, + { + "3.7.5.23", + new List + { + 37895736, + 37896544, + 37895592, + 37883008, + 37896508 + } + } + }; + private static IntPtr WeChatWinBaseAddress = IntPtr.Zero; + } +} \ No newline at end of file diff --git a/Properties/AssemblyInfo.cs b/Properties/AssemblyInfo.cs new file mode 100644 index 0000000..3514608 --- /dev/null +++ b/Properties/AssemblyInfo.cs @@ -0,0 +1,36 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +// 有关程序集的一般信息由以下 +// 控制。更改这些特性值可修改 +// 与程序集关联的信息。 +[assembly: AssemblyTitle("SharpWxDump")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("SharpWxDump")] +[assembly: AssemblyCopyright("Copyright © 2022")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// 将 ComVisible 设置为 false 会使此程序集中的类型 +//对 COM 组件不可见。如果需要从 COM 访问此程序集中的类型 +//请将此类型的 ComVisible 特性设置为 true。 +[assembly: ComVisible(false)] + +// 如果此项目向 COM 公开，则下列 GUID 用于类型库的 ID +[assembly: Guid("9a708a39-ed10-4d57-b23d-76b1847f7e90")] + +// 程序集的版本信息由下列四个值组成: +// +// 主版本 +// 次版本 +// 生成号 +// 修订号 +// +//可以指定所有这些值，也可以使用“生成号”和“修订号”的默认值 +//通过使用 "*"，如下所示: +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/SharpWxDump.csproj b/SharpWxDump.csproj new file mode 100644 index 0000000..092a136 --- /dev/null +++ b/SharpWxDump.csproj @@ -0,0 +1,66 @@ + + + + + Debug + AnyCPU + {9A708A39-ED10-4D57-B23D-76B1847F7E90} + Exe + SharpWxDump + SharpWxDump + v4.0 + 512 + true + + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + + + true + bin\x86\Debug\ + DEBUG;TRACE + full + x86 + 7.3 + prompt + + + bin\x86\Release\ + TRACE + true + pdbonly + x86 + 7.3 + prompt + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/SharpWxDump.sln b/SharpWxDump.sln new file mode 100644 index 0000000..4e5dea8 --- /dev/null +++ b/SharpWxDump.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.32510.428 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SharpWxDump", "SharpWxDump.csproj", "{9A708A39-ED10-4D57-B23D-76B1847F7E90}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Debug|x86 = Debug|x86 + Release|Any CPU = Release|Any CPU + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {9A708A39-ED10-4D57-B23D-76B1847F7E90}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {9A708A39-ED10-4D57-B23D-76B1847F7E90}.Debug|Any CPU.Build.0 = Debug|Any CPU + {9A708A39-ED10-4D57-B23D-76B1847F7E90}.Debug|x86.ActiveCfg = Debug|x86 + {9A708A39-ED10-4D57-B23D-76B1847F7E90}.Debug|x86.Build.0 = Debug|x86 + {9A708A39-ED10-4D57-B23D-76B1847F7E90}.Release|Any CPU.ActiveCfg = Release|Any CPU + {9A708A39-ED10-4D57-B23D-76B1847F7E90}.Release|Any CPU.Build.0 = Release|Any CPU + {9A708A39-ED10-4D57-B23D-76B1847F7E90}.Release|x86.ActiveCfg = Release|x86 + {9A708A39-ED10-4D57-B23D-76B1847F7E90}.Release|x86.Build.0 = Release|x86 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {80DA3A70-3223-4AC2-8227-3138A24B74C6} + EndGlobalSection +EndGlobal diff --git a/bin/x86/Release/SharpWxDump.exe b/bin/x86/Release/SharpWxDump.exe new file mode 100644 index 0000000..91e59d2 Binary files /dev/null and b/bin/x86/Release/SharpWxDump.exe differ diff --git a/bin/x86/Release/SharpWxDump.pdb b/bin/x86/Release/SharpWxDump.pdb new file mode 100644 index 0000000..da5b1e5 Binary files /dev/null and b/bin/x86/Release/SharpWxDump.pdb differ diff --git a/obj/Debug/.NETFramework,Version=v4.0.AssemblyAttributes.cs b/obj/Debug/.NETFramework,Version=v4.0.AssemblyAttributes.cs new file mode 100644 index 0000000..5d01041 --- /dev/null +++ b/obj/Debug/.NETFramework,Version=v4.0.AssemblyAttributes.cs @@ -0,0 +1,4 @@ +// +using System; +using System.Reflection; +[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.0", FrameworkDisplayName = ".NET Framework 4")] diff --git a/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache b/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache new file mode 100644 index 0000000..7bfc790 Binary files /dev/null and b/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache differ diff --git a/obj/Debug/SharpWxDump.csproj.AssemblyReference.cache b/obj/Debug/SharpWxDump.csproj.AssemblyReference.cache new file mode 100644 index 0000000..b283946 Binary files /dev/null and b/obj/Debug/SharpWxDump.csproj.AssemblyReference.cache differ diff --git a/obj/Release/.NETFramework,Version=v4.0.AssemblyAttributes.cs b/obj/Release/.NETFramework,Version=v4.0.AssemblyAttributes.cs new file mode 100644 index 0000000..5d01041 --- /dev/null +++ b/obj/Release/.NETFramework,Version=v4.0.AssemblyAttributes.cs @@ -0,0 +1,4 @@ +// +using System; +using System.Reflection; +[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.0", FrameworkDisplayName = ".NET Framework 4")] diff --git a/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache b/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache new file mode 100644 index 0000000..d226770 Binary files /dev/null and b/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache differ diff --git a/obj/x86/Release/.NETFramework,Version=v4.0.AssemblyAttributes.cs b/obj/x86/Release/.NETFramework,Version=v4.0.AssemblyAttributes.cs new file mode 100644 index 0000000..5d01041 --- /dev/null +++ b/obj/x86/Release/.NETFramework,Version=v4.0.AssemblyAttributes.cs @@ -0,0 +1,4 @@ +// +using System; +using System.Reflection; +[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.0", FrameworkDisplayName = ".NET Framework 4")] diff --git a/obj/x86/Release/DesignTimeResolveAssemblyReferencesInput.cache b/obj/x86/Release/DesignTimeResolveAssemblyReferencesInput.cache new file mode 100644 index 0000000..5fb62fe Binary files /dev/null and b/obj/x86/Release/DesignTimeResolveAssemblyReferencesInput.cache differ diff --git a/obj/x86/Release/SharpWxDump.csproj.AssemblyReference.cache b/obj/x86/Release/SharpWxDump.csproj.AssemblyReference.cache new file mode 100644 index 0000000..1f3ec3a Binary files /dev/null and b/obj/x86/Release/SharpWxDump.csproj.AssemblyReference.cache differ diff --git a/obj/x86/Release/SharpWxDump.csproj.CoreCompileInputs.cache b/obj/x86/Release/SharpWxDump.csproj.CoreCompileInputs.cache new file mode 100644 index 0000000..16ac762 --- /dev/null +++ b/obj/x86/Release/SharpWxDump.csproj.CoreCompileInputs.cache @@ -0,0 +1 @@ +e66559610e57bfe84ca5df05c65daee7b02d0806 diff --git a/obj/x86/Release/SharpWxDump.csproj.FileListAbsolute.txt b/obj/x86/Release/SharpWxDump.csproj.FileListAbsolute.txt new file mode 100644 index 0000000..dd7bd8d --- /dev/null +++ b/obj/x86/Release/SharpWxDump.csproj.FileListAbsolute.txt @@ -0,0 +1,6 @@ +C:\Users\Admin\source\repos\SharpWxDump\bin\x86\Release\SharpWxDump.exe +C:\Users\Admin\source\repos\SharpWxDump\bin\x86\Release\SharpWxDump.pdb +C:\Users\Admin\source\repos\SharpWxDump\obj\x86\Release\SharpWxDump.csproj.AssemblyReference.cache +C:\Users\Admin\source\repos\SharpWxDump\obj\x86\Release\SharpWxDump.csproj.CoreCompileInputs.cache +C:\Users\Admin\source\repos\SharpWxDump\obj\x86\Release\SharpWxDump.exe +C:\Users\Admin\source\repos\SharpWxDump\obj\x86\Release\SharpWxDump.pdb diff --git a/obj/x86/Release/SharpWxDump.exe b/obj/x86/Release/SharpWxDump.exe new file mode 100644 index 0000000..91e59d2 Binary files /dev/null and b/obj/x86/Release/SharpWxDump.exe differ diff --git a/obj/x86/Release/SharpWxDump.pdb b/obj/x86/Release/SharpWxDump.pdb new file mode 100644 index 0000000..da5b1e5 Binary files /dev/null and b/obj/x86/Release/SharpWxDump.pdb differ