通杀修改微信版本（过旧版微信）以及查找微信数据库密钥 - IT评测·应用市场-qidao123.com

import frida
import os
import sys, segno
import re, time
from win32api import HIWORD, LOWORD, GetFileVersionInfo
import binascii
import struct
from pymem import Pymem, pattern, process

复制代码

module = pymem.process.module_from_name(pm.process_handle, module_name)
base_address = module.lpBaseOfDll
module_size = module.SizeOfImage
print(f"{module_name} 基地址: 0x{base_address:x}")
print(f"{module_name} 大小: 0x{module_size:x}")
found_phone_numbers = []
# 遍历模块内存，搜索字符串
for address in range(base_address, base_address + module_size, 4096):
try:
# 读取内存块
data = pm.read_bytes(address, 4096)
# 提取可打印的ASCII字符串
printable_data = ''.join([chr(b) if 32 <= b < 127 else '\0' for b in data])
# 使用正则表达式匹配手机号码
phone_numbers = re.findall(r'\b1\d{10}\b', printable_data)
for number in phone_numbers:
# 添加找到的手机号码及其地址
number_address = address + printable_data.index(number)
found_phone_numbers.append((number_address, number))
except pymem.exception.MemoryReadError:
pass
if not found_phone_numbers:
print("[!] 未找到符合条件的手机号码")
else:
for number_address, number in found_phone_numbers:
print(f"找到手机号码 '{number}'，地址: 0x{number_address:x}")
# 在手机号附近遍历内存，搜索符合规则的字符串
search_range = 200 # 设置搜索范围为手机号附近50字节
try:
data = pm.read_bytes(number_address - search_range, search_range * 2)
# 提取可打印的ASCII字符串
printable_data = ''.join([chr(b) if 32 <= b < 127 else '\0' for b in data])
# 使用正则表达式匹配符合规则的字符串
valid_strings = re.findall(r'\b[A-Za-z_][A-Za-z0-9_-]{5,19}\b', printable_data)
for string in valid_strings:
if string.lower() not in ["iphone", "android"]:
string_address = number_address - search_range + printable_data.index(string)
print(f"找到符合规则的字符串 '{string}'，地址: 0x{string_address:x}")
except (pymem.exception.MemoryReadError, UnicodeDecodeError):
pass

复制代码

import pefile
import re
import capstone
import struct
pe = pefile.PE("D:\\Wechat\\[3.9.10.19]\\WeChatWin.dll")
target_bytes = b"\x4F\x6E\x20\x53\x65\x74\x20\x49\x6E\x66\x6F\x20\x69\x6E\x66\x6F\x20\x6D\x64\x35"
def find_byte_sequence(data, pattern):
return [m.start() for m in re.finditer(re.escape(pattern), data)]
rdata_sections = [section for section in pe.sections if b'.rdata' in section.Name]
data_offset = 0
for section in rdata_sections:
section_data = section.get_data()
start_address = section.VirtualAddress
matches = find_byte_sequence(section_data, target_bytes)
if matches:
for offset in matches:
data_offset = offset + section.VirtualAddress
# print(f"{data_offset:04x}")
target_bytes = b"\x48\x8D\x05"
code_sections = [section for section in pe.sections if b'.text' in section.Name]
for section in code_sections:
section_data = section.get_data()
start_address = section.VirtualAddress
cs = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)
matches = find_byte_sequence(section_data, target_bytes)
if matches:
for offset in matches:
inst = list(cs.disasm(section_data[offset:offset + 7], offset + start_address))[0]
unpacked_value = struct.unpack("<I", inst.bytes[3:])[0]
if inst.address + inst.size + unpacked_value == data_offset:
instructions = list(
cs.disasm(section_data[inst.address - start_address:inst.address - start_address + 256],
inst.address))
call = 0
for inst in instructions:
if inst.mnemonic == "call":
call = call + 1
if call == 2:
addr = int(inst.op_str, 16)
instructions = list(
cs.disasm(section_data[addr - start_address:addr - start_address + 256], addr))
for inst in instructions:
# print(f"{inst.address:04x}: {inst.mnemonic} {inst.op_str}")
opcode = inst.bytes
if len(opcode) == 1 and opcode[0] == 0xC3:
break
if len(opcode) > 3:
if opcode[0] == 0x48 and opcode[1] == 0x8D and opcode[2] == 0x05:
unpacked_value = struct.unpack("<I", opcode[3:])[0]
as_addr = inst.address + inst.size + unpacked_value
dbkey_offset = 1760
print("final AccoutService addr:", as_addr, hex(as_addr))
print("final DBkey addr:", as_addr + dbkey_offset, hex(as_addr + dbkey_offset))
break

复制代码

frida_script = """
const moduleName = 'WeChatWin.dll';
const targetValue = {target_value};
const newValue = {new_value};
function intToBytesLE(value) {{
let bytes = [];
for (let i = 0; i < 4; i++) {{
bytes.push(value & 0xFF);
value = value >> 8;
}}
return bytes;
}}
function bytesToHex(bytes) {{
return bytes.map(byte => ('0' + (byte & 0xFF).toString(16)).slice(-2)).join('');
}}
const targetBytes = intToBytesLE(targetValue);
const targetPattern = bytesToHex(targetBytes);
function searchAndModifyMemory() {{
var module = Process.findModuleByName(moduleName);
if (!module) {{
console.log(moduleName + ' 模块未找到');
send(null);
return;
}}
var baseAddress = module.base;
var moduleSize = module.size;
console.log(moduleName + ' 基地址: ' + baseAddress);
console.log(moduleName + ' 大小: ' + moduleSize);
var modifiedAddresses = [];
Memory.scan(baseAddress, moduleSize, targetPattern, {{
onMatch: function(address, size) {{
console.log('找到目标数值 0x' + targetValue.toString(16) + ' 在地址: ' + address);
Memory.writeUInt(address, newValue);
modifiedAddresses.push(address.toString());
}},
onComplete: function() {{
if (modifiedAddresses.length === 0) {{
console.log('未在内存中搜索到目标数值');
send(null);
}} else {{
console.log('数值修改完成');
send(modifiedAddresses);
}}
}}
}});
}}
searchAndModifyMemory();
""".format(target_value=target_value, new_value=new_value)

复制代码