3.9.0.28版本数据库和群相关功能

README.md

@@ -1,19 +1,19 @@
 # wxhelper
-wechat hook 。PC端微信逆向学习。支持3.8.0.41，3.8.1.26版本。
+wechat hook 。PC端微信逆向学习。支持3.8.0.41，3.8.1.26,3.9.0.28版本。
 #### 免责声明:
 本仓库发布的内容，仅用于学习研究，请勿用于非法用途和商业用途！如因此产生任何法律纠纷，均与作者无关！
 
 #### 项目说明：
-本项目是个人学习学习逆向的项目，主要参考https://github.com/ttttupup/ComWeChatRobot，在此基础上实现了微信的的其它版本的部分内容。
+本项目是个人学习学习逆向的项目，主要参考   https://github.com/ljc545w/ComWeChatRobot ，在此基础上实现了微信的的其它版本的部分内容。
 
 #### 使用说明：
-支持的版本3.8.0.41，3.8.1.26。
+支持的版本3.8.0.41，3.8.1.26,3.9.0.28。
 src:主要的dll代码
 tool：简单的注入工具，一个是控制台，一个是图形界面。
 python: 简单的服务器，用以接收消息内容。
 release：编译好的dll。
 
-0.首先安装对应的微信版本，主分支是3.8.0.41版本，3.8.1.26分支对应3.8.1.26版本。  
+0.首先安装对应的微信版本，主分支是3.8.0.41版本,分支对应相应的微信版本号.    
 1.通过cmake构建成功后，将wxhelper.dll注入到微信，本地启动tcp server，监听19088端口。  
 2.通过http协议与dll通信，方便客户端操作。  
 3.接口的url为http://127.0.0.1:19088，注入成功后，直接进行调用即可。  
@@ -21,6 +21,8 @@ release：编译好的dll。
 5.相关功能只在win11环境下进行简单测试，其他环境无法保证。  
 6.注意个别接口在3.8.0.41版本没有实现，具体参考源码。  
 7.对应分支接口文档都是支持指定版本的，其他版本不支持，请特别注意版本。
+8.相应分支的文档对应相应版本，带有删除线的接口表示该版本的暂未实现，其他版本有实现。后续会继续实现。
+
 
 #### 编译环境
 
@@ -93,7 +95,11 @@ vcpkg
 
 2023-02-04 ： 新增群消息置顶和取消置顶。  
 
-2023-02-04 ： 新增确认收款。
+2023-02-06 ： 新增确认收款。  
+
+2023-02-08 ： 新增朋友圈消息。  
+
+2023-02-09 ： 新增3.9.0.28版本基础功能。
 
 #### 功能预览：
 0.检查是否登录  
@@ -104,24 +110,26 @@ vcpkg
 9.hook消息  
 10.取消hook消息  
 11.hook图片  
-12.取消hook图片    
-17.删除好友    
+12.取消hook图片  
+~~17.删除好友~~  
 25.获取群成员  
-27.删除群成员  
-28.增加群成员  
+27.删除群成员   
+28.增加群成员    
 31.修改群昵称  
-32.获取数据库句柄  
-34.查询数据库  
-40.转发消息  
+32.获取数据库句柄     
+34.查询数据库    
+40.转发消息     
 44.退出登录  
-45.确认收款  
+~~45.确认收款~~  
 46.联系人列表  
 47.获取群详情  
 48.获取解密图片  
-49.图片提取文字ocr  
-50.拍一拍  
-51.群消息置顶消息  
-52.群消息取消置顶  
+~~49.图片提取文字ocr~~  
+~~50.拍一拍~~  
+~~51.群消息置顶消息~~  
+~~52.群消息取消置顶~~  
+53.朋友圈首页
+54.朋友圈下一页
 ### 接口文档：
 
 
@@ -218,7 +226,7 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|wxid |ture |string| 接收人wxid |
+|wxid |true |string| 接收人wxid |
 |msg|true |string|消息文本内容|
 
 ###### 返回字段
@@ -257,7 +265,7 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|wxid |ture |string| 接收人wxid |
+|wxid |true |string| 接收人wxid |
 |imagePath|true |string|图片路径|
 
 ###### 返回字段
@@ -295,7 +303,7 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|wxid |ture |string| 接收人wxid |
+|wxid |true |string| 接收人wxid |
 |filePath|true |string|文件路径|
 
 ###### 返回字段
@@ -332,8 +340,8 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|port |ture |string| 本地服务端端口，用来接收消息内容 |
-|ip |ture |string| 服务端ip地址，用来接收消息内容，可以是任意ip,即tcp客户端连接的服务端的ip (3.8.1.26版本)|
+|port |true |string| 本地服务端端口，用来接收消息内容 |
+|ip |true |string| 服务端ip地址，用来接收消息内容，可以是任意ip,即tcp客户端连接的服务端的ip (3.8.1.26版本)|
 
 ###### 返回字段
 |返回字段|字段类型|说明                              |
@@ -402,7 +410,7 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|imgDir |ture |string| 图片保存的目录 |
+|imgDir |true |string| 图片保存的目录 |
 
 
 ###### 返回字段
@@ -471,7 +479,7 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|wxid |ture |string| 好友wxid |
+|wxid |true |string| 好友wxid |
 
 
 ###### 返回字段
@@ -508,7 +516,7 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|chatRoomId |ture |string| 群id |
+|chatRoomId |true |string| 群id |
 
 
 ###### 返回字段
@@ -549,8 +557,8 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|chatRoomId |ture |string| 群id |
-|memberIds |ture |string| 成员id，以,分割 |
+|chatRoomId |true |string| 群id |
+|memberIds |true |string| 成员id，以,分割 |
 
 
 ###### 返回字段
@@ -588,8 +596,8 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|chatRoomId |ture |string| 群id |
-|memberIds |ture |string| 成员id，以,分割 |
+|chatRoomId |true |string| 群id |
+|memberIds |true |string| 成员id，以,分割 |
 
 
 ###### 返回字段
@@ -626,9 +634,9 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|chatRoomId |ture |string| 群id |
-|wxid |ture |string| 自己的id，只能修改自己的群名片 |
-|nickName |ture |string| 修改的昵称 |
+|chatRoomId |true |string| 群id |
+|wxid |true |string| 自己的id，只能修改自己的群名片 |
+|nickName |true |string| 修改的昵称 |
 
 ###### 返回字段
 |返回字段|字段类型|说明                              |
@@ -725,8 +733,8 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|dbHandle |ture |int| 句柄 |
-|sql |ture |string| sql语句 |
+|dbHandle |true |int| 句柄 |
+|sql |true |string| sql语句 |
 
 
 ###### 返回字段
@@ -765,8 +773,8 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|wxid |ture |string| 消息接收人wxid |
-|msgid |ture |number| 消息id，hook消息接口中返回的消息id |
+|wxid |true |string| 消息接收人wxid |
+|msgid |true |number| 消息id，hook消息接口中返回的消息id |
 
 
 ###### 返回字段
@@ -923,7 +931,7 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|chatRoomId |ture |string| 群id |
+|chatRoomId |true |string| 群id |
 
 ###### 返回字段
 |返回字段|字段类型|说明                              |
@@ -966,8 +974,8 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|imagePath |ture |string| 图片路径 |
-|savePath |ture |string| 保存路径 |
+|imagePath |true |string| 图片路径 |
+|savePath |true |string| 保存路径 |
 
 ###### 返回字段
 |返回字段|字段类型|说明                              |
@@ -1006,7 +1014,7 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|imagePath |ture |string| 图片路径 |
+|imagePath |true |string| 图片路径 |
 
 ###### 返回字段
 |返回字段|字段类型|说明                              |
@@ -1029,8 +1037,8 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|chatRoomId |ture |string| 微信群聊id |  
-|wxid |ture |string| 要拍的用户wxid，如果使用用户自定义的微信号，则不会显示群内昵称 |
+|chatRoomId |true |string| 微信群聊id |  
+|wxid |true |string| 要拍的用户wxid，如果使用用户自定义的微信号，则不会显示群内昵称 |
 ###### 返回字段
 |返回字段|字段类型|说明                              |
 |---|---|---|
@@ -1067,8 +1075,8 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|wxid |ture |string| 置顶消息的发送人wxid |
-|msgid |ture |string| 消息id |
+|wxid |true |string| 置顶消息的发送人wxid |
+|msgid |true |string| 消息id |
 ###### 返回字段
 |返回字段|字段类型|说明                              |
 |---|---|---|
@@ -1105,8 +1113,8 @@ vcpkg
 ###### 请求参数
 |参数|必选|类型|说明|
 |---|---|---|---|
-|chatRoomId |ture |string| 微信群聊id |  
-|msgid |ture |string| 消息id |
+|chatRoomId |true |string| 微信群聊id |  
+|msgid |true |string| 消息id |
 ###### 返回字段
 |返回字段|字段类型|说明                              |
 |---|---|---|
@@ -1127,6 +1135,110 @@ vcpkg
 响应：
 ``` javascript
 {"code":0,"result":"OK"}
+```   
+
+
+
+#### 53.朋友圈首页消息**
+###### 接口功能
+> 获取朋友圈最新消息，调用之后，会在tcpserver服务中收到朋友圈的消息。格式如下：
+``` javascript
+{
+  'data': [
+    {
+      'content': '朋友圈[玫瑰][玫瑰]',
+      'createTime': 1675827480,
+      'senderId': 'wxid_12333',
+      'snsId': 14057859804711563695,
+      'xml': '<TimelineObject><id><![CDATA[1405712322563695]]></id><username><![CDATA[wxid_12333]]></username><createTime><![CDATA[1675827480]]></createTime><contentDescShowType>0</contentDescShowType><contentDescScene>0</contentDescScene><private><![CDATA[0]]></private><contentDesc><![CDATA[朋友圈[玫瑰][玫瑰]]]></contentDesc><contentattr><![CDATA[0]]></contentattr><sourceUserName></sourceUserName><sourceNickName></sourceNickName><statisticsData></statisticsData><weappInfo><appUserName></appUserName><pagePath></pagePath><version><![CDATA[0]]></version><debugMode><![CDATA[0]]></debugMode><shareActionId></shareActionId><isGame><![CDATA[0]]></isGame><messageExtraData></messageExtraData><subType><![CDATA[0]]></subType><preloadResources></preloadResources></weappInfo><canvasInfoXml></canvasInfoXml><ContentObject><contentStyle><![CDATA[2]]></contentStyle><contentSubStyle><![CDATA[0]]></contentSubStyle><title></title><description></description><contentUrl></contentUrl></ContentObject><actionInfo><appMsg><mediaTagName></mediaTagName><messageExt></messageExt><messageAction></messageAction></appMsg></actionInfo><appInfo><id></id></appInfo><location poiClassifyId="" poiName="" poiAddress="" poiClassifyType="0" city=""></location><publicUserName></publicUserName><streamvideo><streamvideourl></streamvideourl><streamvideothumburl></streamvideothumburl><streamvideoweburl></streamvideoweburl></streamvideo></TimelineObject>'
+    }]
+}
+
+```
+
+###### 接口地址
+> [/api/?type=53](/api/?type=53)
+
+###### HTTP请求方式
+> POST  JSON
+
+###### 请求参数
+|参数|必选|类型|说明|
+|---|---|---|---|
+
+
+   
+
+###### 返回字段
+|返回字段|字段类型|说明                              |
+|---|---|---|
+|code|int|返回状态,1成功, -1失败|
+|result|string|成功提示|
+
+
+
+###### 接口示例
+入参：
+``` javascript
+
+
+```
+响应：
+``` javascript
+{"code":1,"result":"OK"}
+```   
+
+
+#### 54.朋友圈下一页**
+###### 接口功能
+> 朋友圈下一页，会在tcpserver服务中收到朋友圈的消息。格式如下：
+``` javascript
+{
+  'data': [
+    {
+      'content': '朋友圈[玫瑰][玫瑰]',
+      'createTime': 1675827480,
+      'senderId': 'wxid_12333',
+      'snsId': 14057859804711563695,
+      'xml': '<TimelineObject><id><![CDATA[1405712322563695]]></id><username><![CDATA[wxid_12333]]></username><createTime><![CDATA[1675827480]]></createTime><contentDescShowType>0</contentDescShowType><contentDescScene>0</contentDescScene><private><![CDATA[0]]></private><contentDesc><![CDATA[朋友圈[玫瑰][玫瑰]]]></contentDesc><contentattr><![CDATA[0]]></contentattr><sourceUserName></sourceUserName><sourceNickName></sourceNickName><statisticsData></statisticsData><weappInfo><appUserName></appUserName><pagePath></pagePath><version><![CDATA[0]]></version><debugMode><![CDATA[0]]></debugMode><shareActionId></shareActionId><isGame><![CDATA[0]]></isGame><messageExtraData></messageExtraData><subType><![CDATA[0]]></subType><preloadResources></preloadResources></weappInfo><canvasInfoXml></canvasInfoXml><ContentObject><contentStyle><![CDATA[2]]></contentStyle><contentSubStyle><![CDATA[0]]></contentSubStyle><title></title><description></description><contentUrl></contentUrl></ContentObject><actionInfo><appMsg><mediaTagName></mediaTagName><messageExt></messageExt><messageAction></messageAction></appMsg></actionInfo><appInfo><id></id></appInfo><location poiClassifyId="" poiName="" poiAddress="" poiClassifyType="0" city=""></location><publicUserName></publicUserName><streamvideo><streamvideourl></streamvideourl><streamvideothumburl></streamvideothumburl><streamvideoweburl></streamvideoweburl></streamvideo></TimelineObject>'
+    }]
+}
+
+```
+
+###### 接口地址
+> [/api/?type=54](/api/?type=54)
+
+###### HTTP请求方式
+> POST  JSON
+
+###### 请求参数
+|参数|必选|类型|说明|
+|---|---|---|---|
+|snsId |true |string| 朋友圈的snsId |
+
+   
+
+###### 返回字段
+|返回字段|字段类型|说明                              |
+|---|---|---|
+|code|int|返回状态,1成功, -1失败|
+|result|string|成功提示|
+
+
+
+###### 接口示例
+入参：
+``` javascript
+{
+    "snsId":"14056334227327177401"
+   
+}
+
+```
+响应：
+``` javascript
+{"code":1,"result":"OK"}
 ```
 
 #### 感谢

src/api.cc

@@ -21,6 +21,7 @@
 #include "ocr.h"
 #include "pat.h"
 #include "confirm_receipt.h"
+#include "sns.h"
 
 #pragma comment(lib, "ws2_32.lib")
 using namespace std;
@@ -591,6 +592,19 @@ void api_handle(mg_http_message *hm, struct mg_connection *c, string &ret) {
       ret = ret_data.dump();
       break;
     }
+    case WECHAT_SNS_GET_FIRST_PAGE:{
+      int success = GetFirstPage();
+      json ret_data = {{"code", success}, {"result", "OK"}};
+      ret = ret_data.dump();
+      break;
+    }
+     case WECHAT_SNS_GET_NEXT_PAGE:{
+      ULONG64 snsid = get_http_param_ulong64(hm, j_param, "snsId", is_post);
+      int success = GetNextPage(snsid);
+      json ret_data = {{"code", success}, {"result", "OK"}};
+      ret = ret_data.dump();
+      break;
+    }
     default:
       break;
   }

src/api.h

@@ -67,6 +67,8 @@ typedef enum WECHAT_HTTP_APISTag
     WECHAT_SEND_PAT_MSG,
     WECHAT_SET_TOP_MSG,
     WECHAT_REMOVE_TOP_MSG,
+    WECHAT_SNS_GET_FIRST_PAGE,
+    WECHAT_SNS_GET_NEXT_PAGE,
 } WECHAT_HTTP_APIS,
     *PWECHAT_HTTP_APIS;
 

src/chat_room.cc

@@ -7,21 +7,21 @@
 #include "base64.h"
 using namespace std;
 
-#define WX_CHAT_ROOM_MGR_OFFSET 0x67ee70
-#define WX_GET_CHAT_ROOM_DETAIL_INFO_OFFSET 0xa73a80
-#define WX_NEW_CHAT_ROOM_INFO_OFFSET 0xd07010
-#define WX_FREE_CHAT_ROOM_INFO_OFFSET 0xd072f0
-#define WX_DEL_CHAT_ROOM_MEMBER_OFFSET 0xa69a50
-#define WX_INIT_CHAT_MSG_OFFSET 0xdbf380
-#define WX_FREE_CHAT_MSG_OFFSET 0x649ac0
-#define WX_ADD_MEMBER_TO_CHAT_ROOM_OFFSET 0xa69560
-#define WX_GET_MEMBER_FROM_CHAT_ROOM_OFFSET 0xa749b0
-#define WX_INIT_CHAT_ROOM_OFFSET 0xd04d80
-#define WX_FREE_CHAT_ROOM_OFFSET 0xa7c620
-#define WX_MOD_CHAT_ROOM_MEMBER_NICK_NAME_OFFSET 0xa6f8f0
-#define WX_NEW_CHAT_MSG_OFFSET 0x64adc0
-#define WX_TOP_MSG_OFFSET 0xa76e60
-#define WX_REMOVE_TOP_MSG_OFFSET 0xa76c50
+#define WX_CHAT_ROOM_MGR_OFFSET 0x72cf60
+#define WX_GET_CHAT_ROOM_DETAIL_INFO_OFFSET 0xb6f260
+#define WX_NEW_CHAT_ROOM_INFO_OFFSET 0xe15de0
+#define WX_FREE_CHAT_ROOM_INFO_OFFSET 0xe160b0
+#define WX_DEL_CHAT_ROOM_MEMBER_OFFSET 0xb64180
+#define WX_INIT_CHAT_MSG_OFFSET 0xed3be0
+#define WX_ADD_MEMBER_TO_CHAT_ROOM_OFFSET 0xb63c50
+#define WX_GET_MEMBER_FROM_CHAT_ROOM_OFFSET 0xB70260
+#define WX_INIT_CHAT_ROOM_OFFSET 0xe13b30
+#define WX_FREE_CHAT_ROOM_OFFSET 0xe13d50
+#define WX_MOD_CHAT_ROOM_MEMBER_NICK_NAME_OFFSET 0xb6adf0
+#define WX_NEW_CHAT_MSG_OFFSET 0x70e2a0
+#define WX_FREE_CHAT_MSG_OFFSET 0x6f4ea0
+#define WX_TOP_MSG_OFFSET 0xb727e0
+#define WX_REMOVE_TOP_MSG_OFFSET 0xb725a0
 
 int GetChatRoomDetailInfo(wchar_t* chat_room_id, ChatRoomInfoInner& room_info) {
   int success = 0;
@@ -182,8 +182,8 @@ int AddMemberToChatRoom(wchar_t* chat_room_id, wchar_t** wxids,int len){
 
 int GetMemberFromChatRoom(wchar_t* chat_room_id,ChatRoomInner & out){
   int success = 0;
-   WeChatString chat_room(chat_room_id);
-   DWORD chat_room_ptr = (DWORD) &chat_room;
+  WeChatString chat_room(chat_room_id);
+  DWORD chat_room_ptr = (DWORD) &chat_room;
   char buffer[0x1D4] = {0};
   DWORD base = GetWeChatWinBase();
   DWORD get_member_addr =  base + WX_GET_MEMBER_FROM_CHAT_ROOM_OFFSET;
@@ -261,12 +261,12 @@ int ModChatRoomMemberNickName(wchar_t* chat_room_id,wchar_t* wxid,wchar_t * nick
 
 int SetTopMsg(wchar_t* wxid,ULONG64 msg_id){
   int success = -1;
-  char chat_msg[0x2A8] ={0};
+  char chat_msg[0x2C4] ={0};
   DWORD base = GetWeChatWinBase();
   DWORD new_chat_msg_addr = base + WX_NEW_CHAT_MSG_OFFSET;
   DWORD get_chat_room_mgr_addr = base + WX_CHAT_ROOM_MGR_OFFSET;
   DWORD handle_top_msg_addr = base + WX_TOP_MSG_OFFSET;
-  DWORD free_addr = base +  WX_FREE_CHAT_ROOM_OFFSET;
+  DWORD free_addr = base +  WX_FREE_CHAT_MSG_OFFSET;
   vector<string> local_msg = GetChatMsgByMsgId(msg_id);
   if(local_msg.empty()){
     return -2;

src/confirm_receipt.cc

@@ -0,0 +1,49 @@
+#include "pch.h"
+#include "confirm_receipt.h"
+
+#include "common.h"
+#include "wechat_data.h"
+
+#define WX_NEW_WCPAYINFO_OFFSET 0x69d2b0
+#define WX_FREE_WCPAYINFO_OFFSET 0x68d610
+#define WX_CONFIRM_RECEIPT_OFFSET 0x13d5e00
+
+int DoConfirmReceipt(wchar_t *wxid, wchar_t *transcationid,
+                     wchar_t *transferid) {
+  int success = -1;
+  WeChatString recv_id(wxid);
+  WeChatString transcation_id(transcationid);
+  WeChatString transfer_id(transferid);
+  char pay_info[0x134] = {0};
+  DWORD base = GetWeChatWinBase();
+  DWORD new_pay_info_addr = base + WX_NEW_WCPAYINFO_OFFSET;
+  DWORD free_pay_info_addr = base + WX_FREE_WCPAYINFO_OFFSET;
+  DWORD do_confirm_addr = base + WX_CONFIRM_RECEIPT_OFFSET;
+  __asm {
+    PUSHAD
+    LEA        ECX,pay_info
+    CALL       new_pay_info_addr
+    MOV        dword ptr [pay_info + 0x4], 0x1
+    MOV        dword ptr [pay_info + 0x4C], 0x1        
+    POPAD
+  }
+  memcpy(&pay_info[0x1c], &transcation_id, sizeof(transcation_id));
+  memcpy(&pay_info[0x38], &transfer_id, sizeof(transfer_id));
+
+  __asm {
+    PUSHAD
+    PUSH       0x1
+    SUB        ESP,0x8
+    LEA        EDX,recv_id
+    LEA        ECX,pay_info
+    CALL       do_confirm_addr  
+    MOV        success,EAX  
+    ADD        ESP,0xC
+    PUSH       0x0
+    LEA        ECX,pay_info
+    CALL       free_pay_info_addr 
+    POPAD
+  }
+
+  return success;
+}

src/confirm_receipt.h

@@ -0,0 +1,6 @@
+#ifndef CONFIRM_RECEIPT_H
+#define CONFIRM_RECEIPT_H
+
+int  DoConfirmReceipt(wchar_t* wxid,wchar_t *transcationid, wchar_t *transferid);
+
+#endif

src/contact.cc

@@ -4,8 +4,8 @@
 #include "common.h"
 #include "wechat_data.h"
 using namespace std;
-#define WX_CONTACT_MGR_INSTANCE_OFFSET 0x64dc30
-#define WX_CONTACT_GET_LIST_OFFSET 0xa9b000
+#define WX_CONTACT_MGR_INSTANCE_OFFSET 0x6f8990
+#define WX_CONTACT_GET_LIST_OFFSET 0xb97550
 #define WX_CONTACT_DEL_OFFSET 0xa9ef40
 #define WX_INIT_CHAT_MSG_OFFSET 0xdbf380
 #define WX_DB_QUERY_OFFSET 0xa9ec40

src/forward.cc

@@ -4,8 +4,8 @@
 #include "common.h"
 #include "get_db_handle.h"
 #include "wechat_data.h"
-#define WX_FORWARD_MSG_OFFSET 0xb6a4e0
-#define WX_INIT_CHAT_MSG_OFFSET 0xdbf380
+#define WX_FORWARD_MSG_OFFSET 0xc715f0
+#define WX_INIT_CHAT_MSG_OFFSET 0xed3be0
 
 int ForwardMsg(wchar_t *wxid, unsigned long long msgid) {
   int success = 0;

src/get_db_handle.cc

@@ -5,7 +5,7 @@
 #include "new_sqlite3.h"
 #include "pch.h"
 #include "wechat_data.h"
-#define CONTACT_G_PINSTANCE 0x2c42e78
+#define CONTACT_G_PINSTANCE_OFFSET 0x2e2d628
 #define DB_MICRO_MSG_OFFSET 0x68
 #define DB_CHAT_MSG_OFFSET 0x1C0
 #define DB_MISC_OFFSET 0x3D8
@@ -15,10 +15,10 @@
 #define DB_FUNCTION_MSG_OFFSET 0x11B0
 #define DB_NAME_OFFSET 0x14
 
-#define PUBLIC_MSG_MGR_OFFSET  0x2c7ec88
-#define MULTI_DB_MSG_MGR_OFFSET  0x2c807d0
-#define FAVORITE_STORAGE_MGR_OFFSET  0x2c801f8
-#define FTS_FAVORITE_MGR_OFFSET  0x2c439b8
+#define PUBLIC_MSG_MGR_OFFSET  0x2e6ce20
+#define MULTI_DB_MSG_MGR_OFFSET  0x2e6ec84
+#define FAVORITE_STORAGE_MGR_OFFSET  0x2e6e630
+#define FTS_FAVORITE_MGR_OFFSET  0x2e2e168
 
 using namespace std;
 map<wstring, DatabaseInfo> dbmap;
@@ -64,7 +64,7 @@ std::vector<void *> GetDbHandles() {
   dbs.clear();
   dbmap.clear();
   DWORD base = GetWeChatWinBase();
-  DWORD p_contact_addr = *(DWORD *)(base + CONTACT_G_PINSTANCE);
+  DWORD p_contact_addr = *(DWORD *)(base + CONTACT_G_PINSTANCE_OFFSET);
   DWORD micro_msg_db_addr = *(DWORD *)(p_contact_addr + DB_MICRO_MSG_OFFSET);
   DWORD chat_msg_db_addr = *(DWORD *)(p_contact_addr + DB_CHAT_MSG_OFFSET);
   DWORD misc_db_addr = *(DWORD *)(p_contact_addr + DB_MISC_OFFSET);

src/hook_img.cc

@@ -6,9 +6,9 @@ using namespace std;
 
 // #define WX_HOOK_IMG_OFFSET 0xd7eaa5
 // #define WX_HOOK_IMG_NEXT_OFFSET 0xda56e0
-#define WX_HOOK_IMG_OFFSET 0xc672cc
-#define WX_HOOK_IMG_NEXT_OFFSET 0xd82370
-#define WX_SELF_ID_OFFSET 0x2C42A38
+#define WX_HOOK_IMG_OFFSET 0xd723dc
+#define WX_HOOK_IMG_NEXT_OFFSET 0xe91d90
+#define WX_SELF_ID_OFFSET 0x2E2CD3C
 #define BUFSIZE 1024
 
 #define JPEG0 0xFF

src/hook_recv_msg.cc

@@ -10,8 +10,10 @@
 using namespace nlohmann;
 
 using namespace std;
-#define WX_RECV_MSG_HOOK_OFFSET 0xb97126
-#define WX_RECV_MSG_HOOK_NEXT_OFFSET 0x6fc850
+#define WX_RECV_MSG_HOOK_OFFSET 0xca0284
+#define WX_RECV_MSG_HOOK_NEXT_OFFSET 0x7d5030
+#define WX_SNS_HOOK_OFFSET  0x143ef09
+#define WX_SNS_HOOK_NEXT_OFFSET 0x143f1b0
 
 // SyncMgr::addMsgListToDB
 // #define WX_RECV_MSG_HOOK_OFFSET 0xB9C919
@@ -29,6 +31,13 @@ static DWORD kReceMsgJmpBackAddress =
 static DWORD kReceMsgNextAddress =
     kWeChatWinBase + WX_RECV_MSG_HOOK_NEXT_OFFSET;
 
+
+static char kOriginSnsMsgAsmCode[5] = {0};
+static DWORD kSnsMsgJmpBackAddress =
+    kWeChatWinBase + WX_SNS_HOOK_OFFSET + 0x5;
+static DWORD kSnsMsgNextAddress =
+    kWeChatWinBase + WX_SNS_HOOK_NEXT_OFFSET;
+
 struct InnerMessageStruct {
   char *buffer;
   int length;
@@ -112,7 +121,7 @@ void SendSocketMessage(InnerMessageStruct *msg) {
 }
 /// @brief msg handle
 /// @param msg_addr msg address in memory
-void OnRecvMsg(DWORD msg_addr) {
+void __cdecl OnRecvMsg(DWORD msg_addr) {
   json j_msg;
   unsigned long long msgid = *(unsigned long long *)(msg_addr + 0x30);
   j_msg["msgId"] = msgid;
@@ -138,9 +147,6 @@ void OnRecvMsg(DWORD msg_addr) {
   if (content_len > 0) {
     j_msg["content"] =
         unicode_to_utf8((wchar_t *)READ_WSTRING(msg_addr, 0x70).c_str());
-#ifdef _DEBUG
-    printf("%s", j_msg["content"].get<std::string>().c_str());
-#endif
   }
   int sign_len = *(DWORD *)(msg_addr + 0x18C);
   if (sign_len > 0) {
@@ -175,6 +181,50 @@ void OnRecvMsg(DWORD msg_addr) {
     CloseHandle(thread);
   }
 }
+
+
+
+ void __cdecl OnSnsTimeLineMsg(DWORD msg_addr) {
+  json j_sns;
+  DWORD begin_addr = *(DWORD *)(msg_addr + 0x20);
+  DWORD end_addr = *(DWORD *)(msg_addr + 0x24);
+   #ifdef _DEBUG
+   cout << "begin" <<begin_addr<<endl;
+   cout << "end" <<end_addr<<endl;
+  #endif
+  if (begin_addr == 0) {
+    j_sns = {{"data", json::array()}};
+  } else {
+    while (begin_addr < end_addr) {
+      json j_item;
+      j_item["snsId"] = *(unsigned long long *)(begin_addr);
+      j_item["createTime"] = *(DWORD *)(begin_addr + 0x2C);
+
+      j_item["senderId"] =
+          unicode_to_utf8((wchar_t *)READ_WSTRING(begin_addr, 0x18).c_str());
+
+      j_item["content"] =
+          unicode_to_utf8((wchar_t *)READ_WSTRING(begin_addr, 0x3c).c_str());
+
+      j_item["xml"] =
+          unicode_to_utf8((wchar_t *)READ_WSTRING(begin_addr, 0x384).c_str());
+
+      j_sns["data"].push_back(j_item);
+      begin_addr += 0xB48;
+    }
+  }
+  string jstr = j_sns.dump() + '\n';
+  InnerMessageStruct *inner_msg = new InnerMessageStruct;
+  inner_msg->buffer = new char[jstr.size() + 1];
+  memcpy(inner_msg->buffer, jstr.c_str(), jstr.size() + 1);
+  inner_msg->length = jstr.size();
+  HANDLE thread = CreateThread(
+      NULL, 0, (LPTHREAD_START_ROUTINE)SendSocketMessage, inner_msg, NULL, 0);
+  if (thread) {
+    CloseHandle(thread);
+  }
+}
+
 /// @brief  hook implement
 _declspec(naked) void handle_sync_msg() {
   __asm {
@@ -190,6 +240,23 @@ _declspec(naked) void handle_sync_msg() {
   }
 }
 
+
+/// @brief  hook sns msg implement
+_declspec(naked) void handle_sns_msg() {
+  __asm {
+    PUSHAD
+		PUSHFD
+    PUSH    [ESP + 0x24]
+		CALL    OnSnsTimeLineMsg
+		ADD     ESP, 0x4
+    POPFD
+		POPAD
+		CALL    kSnsMsgNextAddress
+		JMP     kSnsMsgJmpBackAddress
+  }
+}
+
+
 /// @brief hook any address   address+0x5
 /// @param port 端口
 /// @return 成功返回1,已经hook返回2,失败返回-1
@@ -210,6 +277,14 @@ int HookRecvMsg(char* client_ip,int port) {
   kReceMsgJmpBackAddress = hook_recv_msg_addr + 0x5;
   HookAnyAddress(hook_recv_msg_addr, (LPVOID)handle_sync_msg,
                  kOriginReceMsgAsmCode);
+  
+  DWORD hook_sns_msg_addr = kWeChatWinBase + WX_SNS_HOOK_OFFSET;
+  kSnsMsgNextAddress = kWeChatWinBase + WX_SNS_HOOK_NEXT_OFFSET;
+  kSnsMsgJmpBackAddress = hook_sns_msg_addr + 0x5;
+  HookAnyAddress(hook_sns_msg_addr, (LPVOID)handle_sns_msg,
+                 kOriginSnsMsgAsmCode);
+  
+
   kMessageHooked = TRUE;
   return 1;
 }
@@ -218,7 +293,9 @@ int UnHookRecvMsg() {
   kServerPort = 0;
   if (!kMessageHooked) return 2;
   DWORD hook_recv_msg_addr = kWeChatWinBase + WX_RECV_MSG_HOOK_OFFSET;
+  DWORD hook_sns_addr = kWeChatWinBase + WX_SNS_HOOK_OFFSET;
   UnHookAnyAddress(hook_recv_msg_addr, kOriginReceMsgAsmCode);
+  UnHookAnyAddress(hook_sns_addr, kOriginSnsMsgAsmCode);
   kMessageHooked = FALSE;
   return 1;
 }

src/new_sqlite3.h

@@ -135,24 +135,24 @@
 #define SQLITE_NULL     5
 #define SQLITE_TEXT     3
 
-#define SQLITE3_EXEC_OFFSET 0x1ba9de0
-#define SQLITE3_BACKUP_INIT_OFFSET 0x1b6f760
-#define SQLITE3_PREPARE_OFFSET 0x1bb0730
-#define SQLITE3_OPEN_OFFSET 0x1bde730
-#define SQLITE3_BACKUP_STEP_OFFSET 0x1b6fb60
-#define SQLITE3_BACKUP_REMAINING_OFFSET 0x1b702a0
-#define SQLITE3_BACKUP_PAGECOUNT_OFFSET 0x1b702b0
-#define SQLITE3_BACKUP_FINISH_OFFSET 0x1b701a0
-#define SQLITE3_SLEEP_OFFSET 0x1bdef70
-#define SQLITE3_ERRCODE_OFFSET 0x1bdd3d0
-#define SQLITE3_CLOSE_OFFSET 0x1bdbb20
-#define SQLITE3_STEP_OFFSET 0x1b785d0
-#define SQLITE3_COLUMN_COUNT_OFFSET 0x1b78ae0
-#define SQLITE3_COLUMN_NAME_OFFSET 0x1b793d0
-#define SQLITE3_COLUMN_TYPE_OFFSET 0x1b79270
-#define SQLITE3_COLUMN_BLOB_OFFSET 0x1b78b20
-#define SQLITE3_COLUMN_BYTES_OFFSET 0x1b78c00
-#define SQLITE3_FINALIZE_OFFSET 0x1b775a0
+#define SQLITE3_EXEC_OFFSET 0x1d5cf70
+#define SQLITE3_BACKUP_INIT_OFFSET 0x1d228d0
+#define SQLITE3_PREPARE_OFFSET 0x1d638c0
+#define SQLITE3_OPEN_OFFSET 0x1d918b0
+#define SQLITE3_BACKUP_STEP_OFFSET 0x1d22ce0
+#define SQLITE3_BACKUP_REMAINING_OFFSET 0x1d23420
+#define SQLITE3_BACKUP_PAGECOUNT_OFFSET 0x1d23430
+#define SQLITE3_BACKUP_FINISH_OFFSET 0x1d23320
+#define SQLITE3_SLEEP_OFFSET 0x1d920f0
+#define SQLITE3_ERRCODE_OFFSET 0x1d90550
+#define SQLITE3_CLOSE_OFFSET 0x1d8ecd0
+#define SQLITE3_STEP_OFFSET 0x1d2b750
+#define SQLITE3_COLUMN_COUNT_OFFSET 0x1d2bc60
+#define SQLITE3_COLUMN_NAME_OFFSET 0x1d2c550
+#define SQLITE3_COLUMN_TYPE_OFFSET 0x1d2c3f0
+#define SQLITE3_COLUMN_BLOB_OFFSET 0x1d2bca0
+#define SQLITE3_COLUMN_BYTES_OFFSET 0x1d2bd80
+#define SQLITE3_FINALIZE_OFFSET 0x1d2a720
 
 typedef int (*Sqlite3_callback)(void*, int, char**, char**);
 

src/pat.cc

@@ -4,9 +4,9 @@
 #include "common.h"
 #include "wechat_data.h"
 
-#define  WX_PAT_MGR_OFFSET  0x7e91c0
+#define  WX_PAT_MGR_OFFSET  0x8d0c00
 #define  WX_SEND_PAT_MSG_OFFSET  0x1228510
-#define  WX_RET_OFFSET   0x1AE4A45
+#define  WX_RET_OFFSET   0x1C94D34
 
 int SendPatMsg(wchar_t* chat_room_id, wchar_t* wxid) {
   int success = -1;

src/self_info.cc

@@ -6,22 +6,22 @@
 #include "wechat_data.h"
 using namespace std;
 
-#define WX_SELF_NAME_OFFSET 0x2C426E8
-#define WX_SELF_MOBILE_OFFSET 0x2C42658
-#define WX_SELF_CITY_OFFSET 0x2C426B8
-#define WX_SELF_PROVINCE_OFFSET 0x2C426A0
-#define WX_SELF_COUNTRY_OFFSET 0x2C42688
-#define WX_SELF_ACCOUNT_OFFSET 0x2C42640
-#define WX_SELF_ID_OFFSET 0x2C42A38
-#define WX_SELF_SMALL_IMG_OFFSET 0x2C4289C
-#define WX_SELF_BIG_IMG_OFFSET 0x2C428B4
-#define WX_LOGIN_STATUS_OFFSET 0x2c42a10
-#define WX_APP_DATA_ROOT_PATH_OFFSET 0x2c84ae0
-#define WX_APP_DATA_SAVE_PATH_OFFSET 0x2c65728
-#define WX_CURRENT_DATA_PATH_OFFSET 0x2c636fc
+#define WX_SELF_NAME_OFFSET 0x2E2CE48
+#define WX_SELF_MOBILE_OFFSET 0x2E2CDB8
+#define WX_SELF_CITY_OFFSET 0x2E2CE18
+#define WX_SELF_PROVINCE_OFFSET 0x2E2CE00
+#define WX_SELF_COUNTRY_OFFSET 0x2E2CDE8
+#define WX_SELF_ACCOUNT_OFFSET 0x2e2d1d0
+#define WX_SELF_ID_OFFSET 0x2E2CD3C
+#define WX_SELF_SMALL_IMG_OFFSET 0x2E2D014
+#define WX_SELF_BIG_IMG_OFFSET 0x2E2CFFC
+#define WX_LOGIN_STATUS_OFFSET 0x2E2D1C0
+#define WX_APP_DATA_ROOT_PATH_OFFSET 0x2E73010
+#define WX_APP_DATA_SAVE_PATH_OFFSET 0x2E52DB0
+#define WX_CURRENT_DATA_PATH_OFFSET 0x2E4F290
 
-#define WX_LOGOUT_OFFSET  0xccc320
-#define WX_ACCOUT_SERVICE_OFFSET 0x65bcc0
+#define WX_LOGOUT_OFFSET  0xdd5c90
+#define WX_ACCOUT_SERVICE_OFFSET 0x707960
 
 int GetSelfInfo(SelfInfoInner &out) {
   DWORD base = GetWeChatWinBase();

src/send_file.cc

@@ -3,16 +3,16 @@
 #include "common.h"
 #include "wechat_data.h"
 
-#define WX_APP_MSG_MGR_OFFSET   0x65df50
-#define WX_SEND_FILE_OFFSET     0xa10190
-#define WX_INIT_CHAT_MSG_OFFSET 0xdbf380
-#define WX_FREE_CHAT_MSG_OFFSET 0x649ac0
+#define WX_APP_MSG_MGR_OFFSET   0x709bb0
+#define WX_SEND_FILE_OFFSET     0xb06240
+#define WX_INIT_CHAT_MSG_OFFSET 0xed3be0
+#define WX_FREE_CHAT_MSG_OFFSET 0x6f4ea0
 
 int  SendFile(wchar_t *wxid, wchar_t *file_path){
   int success = 0;
   WeChatString to_user(wxid);
   WeChatString path(file_path);
-  char chat_msg[0x2A8] = {0};
+  char chat_msg[0x2C4] = {0};
   DWORD base = GetWeChatWinBase();
   DWORD app_msg_mgr_addr = base + WX_APP_MSG_MGR_OFFSET;
   DWORD init_chat_msg_addr = base + WX_INIT_CHAT_MSG_OFFSET;

src/send_image.cc

@@ -3,17 +3,17 @@
 #include "common.h"
 #include "wechat_data.h"
 
-#define WX_SEND_IMAGE_OFFSET  0xb6a3f0
-#define WX_SEND_MESSAGE_MGR_OFFSET 0x65b2a0
-#define WX_INIT_CHAT_MSG_OFFSET  0xdbf380
-#define WX_FREE_CHAT_MSG_OFFSET 0x649ac0
+#define WX_SEND_IMAGE_OFFSET  0xc71500
+#define WX_SEND_MESSAGE_MGR_OFFSET 0x706d30
+#define WX_INIT_CHAT_MSG_OFFSET  0xed3be0
+#define WX_FREE_CHAT_MSG_OFFSET 0x6f4ea0
 
 int SendImage(wchar_t *wxid, wchar_t *image_path){
 
   int success = 0;
   WeChatString to_user(wxid);
   WeChatString path(image_path);
-  char chat_msg[0x2A8] ={0};
+  char chat_msg[0x2C4] ={0};
   DWORD base = GetWeChatWinBase();
   DWORD send_message_mgr_addr = base + WX_SEND_MESSAGE_MGR_OFFSET;
   DWORD init_chat_msg_addr = base + WX_INIT_CHAT_MSG_OFFSET;

src/send_text.cc

@@ -5,40 +5,43 @@
 #include "common.h"
 #include "wechat_data.h"
 
-#define WX_SEND_TEXT_OFFSET 0xb6a930
+#define WX_SEND_TEXT_OFFSET 0xc71a60
 
-#define WX_SEND_MESSAGE_MGR_OFFSET 0x65b2a0
+#define WX_SEND_MESSAGE_MGR_OFFSET 0x706d30
 
-#define WX_FREE_CHAT_MSG_OFFSET 0x649ac0
+#define WX_FREE_CHAT_MSG_OFFSET 0x6f4ea0
 /// @brief 发生文本消息
 /// @param wxid wxid
 /// @param msg  文本消息
 /// @return  成功返回1
-int SendText(wchar_t* wxid, wchar_t* msg) {
+int  SendText(wchar_t* wxid, wchar_t* msg) {
   int success = 0;
   WeChatString to_user(wxid);
   WeChatString text_msg(msg);
   wchar_t **msg_pptr = &text_msg.ptr;
-  char chat_msg[0x2A8] ={0};
+  
   DWORD base = GetWeChatWinBase();
   DWORD send_message_mgr_addr = base + WX_SEND_MESSAGE_MGR_OFFSET;
   DWORD send_text_msg_addr = base + WX_SEND_TEXT_OFFSET;
-  DWORD free_msg_addr = base + WX_FREE_CHAT_MSG_OFFSET;
+  DWORD free_chat_msg_addr = base + WX_FREE_CHAT_MSG_OFFSET;
+  char chat_msg[0x2C4] ={0};
   __asm{
       PUSHAD
+      CALL       send_message_mgr_addr
+      PUSH       0x0
       PUSH       0x0
       PUSH       0x0
       PUSH       0x1
       PUSH       0x0
-      MOV        EDI,msg_pptr
-      PUSH       EDI
+      MOV        EAX,msg_pptr
+      PUSH       EAX
       LEA        EDX,to_user
       LEA        ECX,chat_msg
-      CALL       send_text_msg_addr               
-      ADD        ESP,0x14
+      CALL       send_text_msg_addr 
       MOV        success,EAX
-      LEA        ECX,chat_msg
-      CALL       free_msg_addr
+      ADD        ESP,0x18
+      LEA        ECX,chat_msg        
+      CALL       free_chat_msg_addr
       POPAD
   }
   return success;

src/sns.cc

@@ -0,0 +1,55 @@
+#include "pch.h"
+#include "sns.h"
+
+#include "common.h"
+#include "wechat_data.h"
+using namespace std;
+#define WX_SNS_DATA_MGR_OFFSET 0xbc4100
+#define WX_SNS_GET_FIRST_PAGE_OFFSET 0x1427be0
+#define WX_SNS_GET_NEXT_PAGE_OFFSET  0x1427c80
+
+int GetFirstPage() {
+  int success = -1;
+  DWORD base = GetWeChatWinBase();
+  DWORD sns_data_mgr_addr = base + WX_SNS_DATA_MGR_OFFSET;
+  DWORD get_first_page_addr = base + WX_SNS_GET_FIRST_PAGE_OFFSET;
+
+  char buff[0xB44] = {};
+  __asm {
+    PUSHAD
+    CALL       sns_data_mgr_addr                                 
+    PUSH       0x1
+    LEA        ECX,buff
+    PUSH       ECX
+    MOV        ECX,EAX
+    CALL       get_first_page_addr   
+    MOV        success,EAX
+    POPAD
+  }
+
+  return success;
+}
+
+
+int GetNextPage(ULONG64 sns_id) {
+  int success = -1;
+  DWORD base = GetWeChatWinBase();
+  DWORD sns_data_mgr_addr = base + WX_SNS_DATA_MGR_OFFSET;
+  DWORD get_next_page_addr = base + WX_SNS_GET_NEXT_PAGE_OFFSET;
+  VectorInner temp = {};
+  __asm{
+    PUSHAD
+    CALL       sns_data_mgr_addr                                    
+    LEA        ECX,temp
+    PUSH       ECX
+    MOV        EBX,dword ptr [sns_id + 0x4]
+    PUSH       EBX
+    MOV        EDI,dword ptr [sns_id ]
+    PUSH       EDI
+    MOV        ECX,EAX
+    CALL       get_next_page_addr
+    MOV        success,EAX
+    POPAD
+  }
+  return success;
+}

src/sns.h

@@ -0,0 +1,6 @@
+#ifndef SNS_H_
+#define SNS_H_
+
+int GetFirstPage();
+int GetNextPage(ULONG64 sns_id);
+#endif