广告

扫码关注官方微信

扫码下载APP
返回顶部
首页 > 资讯 > 后端开发 > Python >Python实现向好友发送微信消息优化篇
  • 226

0
分享到

Python实现向好友发送微信消息优化篇

2024-04-02 19:04:59 226人浏览 薄情痞子

Python 官方文档：入门教程 => 点击学习

摘要

目录前言第二次优化第三次优化前言 之前说了怎么写机器码到内存，然后调用。现在说说怎么优化。 用python发送微信消息给好友 第二次优化 再看一遍C语言的代码 void SendTe

前言

之前说了怎么写机器码到内存，然后调用。现在说说怎么优化。

用python发送微信消息给好友

第二次优化

再看一遍C语言的代码

void SendText( wchar_t* wsTextMsg) {
    // 发送的好友，filehelper是文件传输助手
	wchar_t wsWxId[0x10] = L"filehelper";
	WxBaseStruct wxWxid(wsWxId);
	// 发送的消息内容
	WxBaseStruct wxTextMsg(wsTextMsg);
	wchar_t** pWxmsg = &wxTextMsg.buffer;
	char buffer[0x3B0] = { 0 };
	char wxNull[0x100] = { 0 };
	DWord dllBaseAddress = (DWORD)GetModuleHandleA("WeChatWin.dll");
	// 发消息的函数call地址
	DWORD callAddress = dllBaseAddress + 0x521D30;
	__asm {
		lea eax, wxNull;
		push 0x1;
		push eax;
		mov edi, pWxmsg;
		push edi;
		lea edx, wxWxid;
		lea ecx, buffer;
		call callAddress;
		add esp, 0xC;
	}
}

上面的代码真正发消息的是asm里面的代码，之前的c代码都是在组装内存数据。那我们是不是可以用Python组装数据，只讲下面的汇编转为机器码写入内存调用，这样就少了很多无用的机器码。

改完的SendText函数如下

wchar_t wsWxId[0x10] = L"filehelper";
wchar_t wsTextMsg[0x100] = L"test";
WxBaseStruct wxWxid(wsWxId);
WxBaseStruct wxTextMsg(wsTextMsg);
wchar_t** pWxmsg = &wxTextMsg.buffer;
char buffer[0x3B0] = { 0 };
char wxNull[0x100] = { 0 };
DWORD dllBaseAddress = (DWORD)GetModuleHandleA("WeChatWin.dll");;
DWORD callAddress = dllBaseAddress + 0x521D30;
void SendText() {
    __asm {
        lea eax, wxNull;
        push 0x1;
        push eax;
        mov edi, pWxmsg;
        push edi;
        lea edx, wxWxid;
        lea ecx, buffer;
        call callAddress;
        add esp, 0xC;
    }
}

汇编代码：

[]里面包含的类型和变量名其实就是地址，只需要将地址改成用Python构造的地址就可以了

完整代码如下：

import os
import pymem
import ctypes
import time
def convert_addr(addr):
    if isinstance(addr, int):
        addr = hex(addr)
    if addr.startswith("0x") or addr.startswith("0X"):
        addr = addr[2:]
    if len(addr) < 8:
        addr = (8-len(addr))*'0' + addr
    tmp = []
    for i in range(0, 8, 2):
        tmp.append(addr[i:i+2])
    tmp.reverse()
    return ''.join(tmp)
def WxBaseStruct(process_handle, content):
    struct_address = pymem.memory.allocate_memory(process_handle, 20)
    bcontent = content.encode('utf-16le')
    content_address = pymem.memory.allocate_memory(process_handle, len(bcontent)+16)
    pymem.ressources.kernel32.WriteProceSSMemory(process_handle, content_address, bcontent, len(bcontent), None)
    pymem.memory.write_int(process_handle, struct_address, content_address)
    pymem.memory.write_int(process_handle, struct_address+0x4, len(content))
    pymem.memory.write_int(process_handle, struct_address+0x8, len(content)*2)
    pymem.memory.write_int(process_handle, struct_address+0xC, 0)
    pymem.memory.write_int(process_handle, struct_address+0x10, 0)
    return struct_address, content_address
def start_thread(process_handle, address, params=None):
    params = params or 0
    NULL_SECURITY_ATTRIBUTES = ctypes.cast(0, pymem.ressources.structure.LPSECURITY_ATTRIBUTES)
    thread_h = pymem.ressources.kernel32.CreateRemoteThread(
        process_handle,
        NULL_SECURITY_ATTRIBUTES,
        0,
        address,
        params,
        0,
        ctypes.byref(ctypes.c_ulong(0))
    )
    last_error = ctypes.windll.kernel32.GetLastError()
    if last_error:
        pymem.logger.warning('Got an error in start thread, code: %s' % last_error)
    pymem.ressources.kernel32.WaitForSingleObject(thread_h, -1)
    return thread_h
def main(wxpid, wxid, msg):
    process_handle = pymem.process.open(wxpid)
    wxNull_address = pymem.memory.allocate_memory(process_handle, 0x100)
    buffer_address = pymem.memory.allocate_memory(process_handle, 0x3B0)
    wxid_struct_address, wxid_address = WxBaseStruct(process_handle, wxid)
    msg_struct_address, msg_address = WxBaseStruct(process_handle, msg)
    process_WeChatWin_handle = pymem.process.module_from_name(process_handle, "WeChatWin.dll")
    call_address = process_WeChatWin_handle.lpBaseOfDll + 0x521D30
    call_p_address = pymem.memory.allocate_memory(process_handle, 4)
    pymem.memory.write_int(process_handle, call_p_address, call_address)
    fORMat_code = '''
    57
    8D05 {wxNull}
    6A 01
    50
    8D3D {wxTextMsg}
    57
    8D15 {wxWxid}
    8D0D {buffer}
    FF15 {callAddress}
    83C4 0C
    5F
    C3
    '''
    shellcode = format_code.format(wxNull=convert_addr(wxNull_address), 
                wxTextMsg=convert_addr(msg_struct_address),
                wxWxid=convert_addr(wxid_struct_address),
                buffer=convert_addr(buffer_address),
                callAddress=convert_addr(call_p_address))
    shellcode = bytes.fromhex(shellcode.replace(' ', '').replace('\n', ''))
    shellcode_address = pymem.memory.allocate_memory(process_handle, len(shellcode)+5)
    pymem.ressources.kernel32.WriteProcessMemory(process_handle, shellcode_address, shellcode, len(shellcode), None)
    thread_h = start_thread(process_handle, shellcode_address)
    time.sleep(0.5)
    pymem.memory.free_memory(process_handle, wxNull_address)
    pymem.memory.free_memory(process_handle, buffer_address)
    pymem.memory.free_memory(process_handle, wxid_struct_address)
    pymem.memory.free_memory(process_handle, wxid_address)
    pymem.memory.free_memory(process_handle, msg_struct_address)
    pymem.memory.free_memory(process_handle, msg_address)
    pymem.memory.free_memory(process_handle, call_p_address)
    pymem.memory.free_memory(process_handle, shellcode_address)
    pymem.process.close_handle(process_handle)
if __name__ == "__main__":
    wxpid = 16892
    wxid = "filehelper"
    msg = "python test"
    main(wxpid, wxid, msg)

第三次优化

直接在Python里写汇编，然后自动转机器码写入内存。使用的是Python的keystone库

# -*- coding: utf-8 -*-
import os
import pymem
import ctypes
import time
from keystone import Ks, KS_ARCH_X86, KS_MODE_32
def asm2code(asm_code, syntax=0):
    ks = Ks(KS_ARCH_X86, KS_MODE_32)
    bytes_code, _ = ks.asm(asm_code, as_bytes=True)
    return bytes_code
def WxBaseStruct(process_handle, content):
    struct_address = pymem.memory.allocate_memory(process_handle, 20)
    bcontent = content.encode('utf-16le')
    content_address = pymem.memory.allocate_memory(process_handle, len(bcontent)+16)
    pymem.ressources.kernel32.WriteProcessMemory(process_handle, content_address, bcontent, len(bcontent), None)
    pymem.memory.write_int(process_handle, struct_address, content_address)
    pymem.memory.write_int(process_handle, struct_address+0x4, len(content))
    pymem.memory.write_int(process_handle, struct_address+0x8, len(content)*2)
    pymem.memory.write_int(process_handle, struct_address+0xC, 0)
    pymem.memory.write_int(process_handle, struct_address+0x10, 0)
    return struct_address, content_address
def start_thread(process_handle, address, params=None):
    params = params or 0
    NULL_SECURITY_ATTRIBUTES = ctypes.cast(0, pymem.ressources.structure.LPSECURITY_ATTRIBUTES)
    thread_h = pymem.ressources.kernel32.CreateRemoteThread(
        process_handle,
        NULL_SECURITY_ATTRIBUTES,
        0,
        address,
        params,
        0,
        ctypes.byref(ctypes.c_ulong(0))
    )
    last_error = ctypes.windll.kernel32.GetLastError()
    if last_error:
        pymem.logger.warning('Got an error in start thread, code: %s' % last_error)
    pymem.ressources.kernel32.WaitForSingleObject(thread_h, -1)
    return thread_h
def main(wxpid, wxid, msg):
    process_handle = pymem.process.open(wxpid)
    wxNull_address = pymem.memory.allocate_memory(process_handle, 0x100)
    buffer_address = pymem.memory.allocate_memory(process_handle, 0x3B0)
    wxid_struct_address, wxid_address = WxBaseStruct(process_handle, wxid)
    msg_struct_address, msg_address = WxBaseStruct(process_handle, msg)
    process_WeChatWin_handle = pymem.process.module_from_name(process_handle, "WeChatWin.dll")
    call_address = process_WeChatWin_handle.lpBaseOfDll + 0x521D30
    call_p_address = pymem.memory.allocate_memory(process_handle, 4)
    pymem.memory.write_int(process_handle, call_p_address, call_address)
    format_asm_code = '''
    push edi;
    lea eax,dword ptr ds:[{wxNull:#02x}];
    push 0x1;
    push eax;
    lea edi,dword ptr ds:[{wxTextMsg:#02x}];
    push edi;
    lea edx,dword ptr ds:[{wxWxid:#02x}];
    lea ecx,dword ptr ds:[{buffer:#02x}];
    call dword ptr ds:[{callAddress:#02x}];
    add esp, 0xC;
    pop edi;
    ret;
    '''
    asm_code = format_asm_code.format(wxNull=wxNull_address, 
                wxTextMsg=msg_struct_address,
                wxWxid=wxid_struct_address,
                buffer=buffer_address,
                callAddress=call_p_address)
    shellcode = asm2code(asm_code.encode())
    shellcode_address = pymem.memory.allocate_memory(process_handle, len(shellcode)+5)
    pymem.ressources.kernel32.WriteProcessMemory(process_handle, shellcode_address, shellcode, len(shellcode), None)
    thread_h = start_thread(process_handle, shellcode_address)
    time.sleep(0.5)
    pymem.memory.free_memory(process_handle, wxNull_address)
    pymem.memory.free_memory(process_handle, buffer_address)
    pymem.memory.free_memory(process_handle, wxid_struct_address)
    pymem.memory.free_memory(process_handle, wxid_address)
    pymem.memory.free_memory(process_handle, msg_struct_address)
    pymem.memory.free_memory(process_handle, msg_address)
    pymem.memory.free_memory(process_handle, call_p_address)
    pymem.memory.free_memory(process_handle, shellcode_address)
    pymem.process.close_handle(process_handle)
if __name__ == "__main__":
    wxpid = 18604
    wxid = "filehelper"
    msg = "python test msg"
    main(wxpid, wxid, msg)

到此这篇关于Python实现向好友发送微信消息优化篇的文章就介绍到这了,更多相关Python微信消息内容请搜索编程网以前的文章或继续浏览下面的相关文章希望大家以后多多支持编程网！

您可能感兴趣的文档:
点击免费下载>>软考高级考试备考技巧/历年真题/备考精华资料

--结束END--

本文标题: Python实现向好友发送微信消息优化篇

本文链接: https://www.lsjlt.com/news/118599.html(转载时请注明来源链接)

有问题或投稿请发送至: 邮箱/279061341@qq.com    QQ/279061341

本篇文章演示代码以及资料文档资料下载

下载Word文档到电脑，方便收藏和打印～

下载Word文档
去做题
猜你喜欢
  • Python实现向好友发送微信消息优化篇
    目录前言第二次优化第三次优化前言 之前说了怎么写机器码到内存，然后调用。现在说说怎么优化。 用Python发送微信消息给好友 第二次优化 再看一遍c语言的代码 void SendTe...
    99+
    2022-11-11
  • Python实现向好友发送微信消息
    目录前言c语言发微信消息Python调用不用c编写dll如何发消息调用我们写入的机器码第一次优化第二次优化x86/x64 Call Jmp指令区别前言 原理：Windows逆向，通过...
    99+
    2022-11-11
  • Python怎么实现自动给指定好友发送消息
    这篇文章主要讲解了“Python怎么实现自动给指定好友发送消息”，文中的讲解内容简单清晰，易于学习与理解，下面请大家跟着小编的思路慢慢深入，一起来研究和学习“Python怎么实现自动给指定好友发送消息”吧！...
    99+
    2022-10-19
  • python实现半自动化发送微信信息
    本文实例为大家分享了python半自动化发送微信信息的具体代码，供大家参考，具体内容如下 相关第三方库 1.pyautogui 自动操作鼠标、键盘的第三方库 2.pyperclip...
    99+
    2022-11-12
  • 教你利用python实现企业微信发送消息
    目录一、需要的参数二、获取通讯用户/组三、获取企业ID四、获取应用ID/密钥五、脚本代码六、效果一、需要的参数 1、通讯用户：touser 或 通讯组：toparty ...
    99+
    2022-11-12
  • 使用python怎么实现企业微信发送消息
    这篇文章给大家介绍使用python怎么实现企业微信发送消息，内容非常详细，感兴趣的小伙伴们可以参考借鉴，希望对大家能有所帮助。一、需要的参数1、通讯用户：touser 或 通讯组：toparty  &...
    99+
    2023-06-15
  • 使用Python实现给企业微信发送消息功能
    目录一、概述二、python脚本三、企业微信设置1. 注册企业微信2. 点击进入管理后台3. 创建应用完成后4. 查看企业id5. 查看部门id四、测试脚本一、概述 本文将介绍如何使...
    99+
    2022-11-12
  • Python如何实现APP自动化发微信群消息
    本篇内容主要讲解“Python如何实现APP自动化发微信群消息”，感兴趣的朋友不妨来看看。本文介绍的方法操作简单快捷，实用性强。下面就让小编来带大家学习“Python如何实现APP自动化发微信群消息”吧!1. 前言但是对于很多人来说，首先编...
    99+
    2023-06-26
  • 如何使用Python实现给企业微信发送消息功能
    如何使用Python实现给企业微信发送消息功能，针对这个问题，这篇文章详细介绍了相对应的分析和解答，希望可以帮助更多想解决这个问题的小伙伴找到更简单易行的方法。一、概述下面将介绍如何使用python3给企业微信发送消息。我的环境是linux...
    99+
    2023-06-22
  • Python实现APP自动化发微信群消息的示例代码
    目录1. 前言2. 爬虫及服务3. 自动化发送群聊​4. 最后1. 前言 但是对于很多人来说，首先编写一款 App 需要一定的移动端开发经验，其次还需要另外编写无障碍服务应用，如此显...
    99+
    2022-11-12
软考高级职称资格查询
软考职称历年真题下载
软考职称资料下载
热门wiki
近期文章
推荐阅读
热门问答
热门标签
编程网，编程工程师的家园，是目前国内优秀的开源技术社区之一，形成了由开源软件库、代码分享、资讯、协作翻译、讨论区和博客等几大频道内容，为IT开发者提供了一个发现、使用、并交流开源技术的平台。

  • 官方手机版

  • 微信公众号

  • 商务合作