MacOS微信逆向分析-Frida

1

class-dump -H /Applications/WeChat.app

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

# n @ localhost in ~/vscodewsp/wechat/dump [20:58:42]

$ ll -l |grep Message|grep Service|wc -l

       9

# n @ localhost in ~/vscodewsp/wechat/dump [21:02:13]

$ ll -l |grep Message|grep Service

-rw-r--r--  1 n  staff   5.1K  2 15 19:19 FTSFileMessageService.h

-rw-r--r--  1 n  staff   382B  2 15 19:19 IMessageServiceAppExt-Protocol.h

-rw-r--r--  1 n  staff   980B  2 15 19:19 IMessageServiceFileExt-Protocol.h

-rw-r--r--  1 n  staff   381B  2 15 19:19 IMessageServiceFileReTransferExt-Protocol.h

-rw-r--r--  1 n  staff   755B  2 15 19:19 IMessageServiceImageExt-Protocol.h

-rw-r--r--  1 n  staff   780B  2 15 19:19 IMessageServiceVideoExt-Protocol.h

-rw-r--r--  1 n  staff   407B  2 15 19:19 IMessageServiceVideoReTransferExt-Protocol.h

-rw-r--r--  1 n  staff   3.1K  2 15 19:19 MMFTSMessageService.h

-rw-r--r--  1 n  staff    20K  2 15 19:19 MessageService.h

# n @ localhost in ~/vscodewsp/wechat/dump [21:02:25]

$

1

2

3

4

5

6

7

8

9

- (id)SendLocationMsgFromUser:(id)arg1 toUser:(id)arg2 withLatitude:(double)arg3 longitude:(double)arg4 poiName:(id)arg5 label:(id)arg6;

- (id)SendNamecardMsgFromUser:(id)arg1 toUser:(id)arg2 containinGContact:(id)arg3;

- (id)SendStickerStoreEmoticonMsgFromUsr:(id)arg1 toUsrName:(id)arg2 md5:(id)arg3 productID:(id)arg4;

- (id)SendEmoticonMsgFromUsr:(id)arg1 toUsrName:(id)arg2 md5:(id)arg3 emoticonType:(unsigned int)arg4;

- (id)SendImgMessage:(id)arg1 toUsrName:(id)arg2 thumbImgData:(id)arg3 midImgData:(id)arg4 imgData:(id)arg5 imgInfo:(id)arg6;

- (id)SendTextMessage:(id)arg1 toUsrName:(id)arg2 msgText:(id)arg3 atUserList:(id)arg4;

- (id)SendAppMusicMessageFromUser:(id)arg1 toUsrName:(id)arg2 withTitle:(id)arg3 url:(id)arg4 description:(id)arg5 thumbnailData:(id)arg6;

- (id)SendAppURLMessageFromUser:(id)arg1 toUsrName:(id)arg2 withTitle:(id)arg3 url:(id)arg4 description:(id)arg5 thumbnailData:(id)arg6;

- (id)SendAppURLMessageFromUser:(id)arg1 toUsrName:(id)arg2 withTitle:(id)arg3 url:(id)arg4 description:(id)arg5 thumbUrl:(id)arg6 sourceUserName:(id)arg7 sourceDisplayName:(id)arg8;

1

2

3

4

5

6

7

$ frida-trace -m "-[MessageService Send*]" 微信

Instrumenting...                                                       

-[MessageService SendTextMessageWithString:toUser:]: Auto-generated handler at "/Users/n/vscodewsp/wechat/__handlers__/MessageService/SendTextMessageWithString_toUser_.js"

-[MessageService SendAppURLMessageFromUser:toUsrName:withTitle:url:description:thumbUrl:sourceUserName:sourceDisplayName:]: Auto-generated handler at "/Users/n/vscodewsp/wechat/__handlers__/MessageService/SendAppURLMessageFromUser_toUsrN_eaefd0af.js"

------------------------------------------------------------------------------

-[MessageService SendNamecardMsgFromUser:toUser:containingContact:]: Auto-generated handler at "/Users/n/vscodewsp/wechat/__handlers__/MessageService/SendNamecardMsgFromUser_toUser_c_b5899e8d.js"

Started tracing 18 functions. Press Ctrl+C to stop.

1

2

3

4

5

6

7

onEnter(log, args, state) {

    console.log(`-[我的消息测试 SendTextMessage:${args[2]} toUsrName:${args[3]} msgText:${args[4]} atUserList:${args[5]}]`);

    console.log("arg[1] -> " + new ObjC.Object(args[2]))

    console.log("arg[2] -> " + new ObjC.Object(args[3]))

    console.log("arg[3] -> " + new ObjC.Object(args[4]))

    console.log("arg[4] -> " + new ObjC.Object(args[5]))

  },

1

2

3

4

5

6

arg[1] -> wxid_*****63i822

arg[2] -> filehelper

arg[3] -> 这个是消息测试

arg[4] ->

           /* TID 0x307 */

 14534 ms  -[我的消息测试 SendTextMessage:0x600000b6fae0 toUsrName:0x6503cfa934d442eb msgText:0x600000adefd0 atUserList:0x600000add470]

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

/* @class MMMessageSendLogic */

-(unsigned char)sendTextMessageWithString:(void *)arg2 mentionedUsers:(void *)arg3 {

    r14 = self;

    r15 = [arg2 retain];

    r12 = [arg3 retain];

    r13 = [[CUtility filterStringForTextMessage:r15] retain];

    [r15 release];

    if ([r13 length] != 0x0) {

            stack[-64] = r12;

            rax = [r13 lengthOfBytesUsingEncoding:0x4];

            rbx = rax;

            if (rax >= 0x4001) {

                    rax = [[NSString alloc] initWithFORMat:@"ERROR: Text too long, length: %lu, utf8 length: %lu", [r13 length], rbx];

                    stack[0] = "-[MMMessageSendLogic sendTextMessageWithString:mentionedUsers:]";

                    [MMLogger logWithMMLogLevel:0x2 module:"ComposeInputView" file:0x103e0e162 line:0x112 func:stack[0] message:rax];

                    [rax release];

                    rax = [NSBundle mainBundle];

                    rax = [rax retain];

                    stack[-72] = rax;

                    r15 = [[rax localizedStringForKey:@"Message.Input.Too.Long.Title" value:@"" table:0x0] retain];

                    rax = [NSBundle mainBundle];

                    rax = [rax retain];

                    r14 = rax;

                    rax = [rax localizedStringForKey:@"Message.Input.Too.Long.Content" value:@"" table:0x0];

                    rax = [rax retain];

                    [NSAlert showAlertSheetWithTitle:r15 message:rax completion:0x0];

                    [rax release];

                    [r14 release];

                    [r15 release];

                    [stack[-72] release];

                    r14 = 0x0;

                    r12 = stack[-64];

            }

            else {

                    rax = [WeChat sharedInstance];

                    rax = [rax retain];

                    r15 = [[rax CurrentUserName] retain];

                    [rax release];

                    rax = [r14 currnetChatContact];

                    rax = [rax retain];

                    r14 = [[rax m_nsUsrName] retain];

                    [rax release];

                    r12 = [[MMServiceCenter defaultCenter] retain];

                    objc_unsafeClaimAutoreleasedReturnValue([[[r12 getService:[MessageService class]] retain] SendTextMessage:r15 toUsrName:r14 msgText:r13 atUserList:stack[-64]]);

                    [rax release];

                    [r12 release];

                    [r14 release];

                    [r15 release];

                    r14 = 0x1;

                    r12 = stack[-64];

                    r13 = r13;

            }

    }

    else {

            rax = [[NSString alloc] initWithFormat:@"ERROR: Text is empty, can't send"];

            stack[0] = "-[MMMessageSendLogic sendTextMessageWithString:mentionedUsers:]";

            [MMLogger logWithMMLogLevel:0x2 module:"ComposeInputView" file:0x103e0e162 line:0x10c func:stack[0] message:rax];

            [rax release];

            r14 = 0x0;

    }

    [r13 release];

    [r12 release];

    rax = r14 & 0xff;

    return rax;

}

1

2

3

4

5

6

7

8

9

10

-(void *)CurrentUserName {

    if ([self isLoggedIn] != 0x0) {

            rdi = [[CUtility GetCurrentUserName] retain];

    }

    else {

            rdi = 0x0;

    }

    rax = [rdi autorelease];

    return rax;

}

1

2

3

4

5

6

7

8

9

10

11

console.log("init success");

function SendTextMessage(wxid, msg) {

    var message = ObjC.chooseSync(ObjC.classes.MessageService)[0]

    var username = ObjC.classes.CUtility.GetCurrentUserName();

    console.log(username)

    console.log("Type of arg[0] -> " + message)

    var toUsrName = ObjC.classes.NSString.stringWithString_(wxid);

    var msgText = ObjC.classes.NSString.stringWithString_(msg);

    message["- SendTextMessage:toUsrName:msgText:atUserList:"](username, toUsrName, msgText, null);

}

SendTextMessage("filehelper","主动调用发送信息！")

1

frida-trace -m "-[MessageService notify*]" 微信

1

2

3

4

5

6

           /* TID 0x307 */

157082 ms  -[MessageService notifyAddMsgOnMainThread:0x6503cfa934d442eb msgData:0x7fd903c9fa00]

           /* TID 0x31e17 */

157092 ms  -[MessageService notifyUnreadCntChangeOnMainThread:0x6503cfa934d442eb]

           /* TID 0xb5c27 */

157228 ms  -[MessageService notifyModMsgOnMainThread:0x6503cfa934d442eb msgData:0x7fd903c9fa00]

1

2

3

onEnter(log, args, state) {

  log(`-[MessageService notifyAddMsgOnMainThread:${args[2]} msgData:${args[3]}]`);

},

1

2

console.log("Type of arg[2] -> " + new ObjC.Object(args[2]).$className)

console.log("Type of arg[3] -> " + new ObjC.Object(args[3]).$className)

1

frida-trace -m "-[MessageService notifyAddMsgOnMainThread*]" 微信

1

2

3

4

5

6

7

8

$ frida-trace -m "-[MessageService notifyAddMsgOnMainThread*]" 微信

Instrumenting...                                                       

-[MessageService notifyAddMsgOnMainThread:msgData:]: Loaded handler at "/Users/n/vscodewsp/wechat/__handlers__/MessageService/notifyAddMsgOnMainThread_msgData_.js"

Started tracing 1 function. Press Ctrl+C to stop.                      

Type of arg[2] -> NSTaggedPointerString

Type of arg[3] -> MessageData

           /* TID 0x307 */

  2170 ms  -[MessageService notifyAddMsgOnMainThread:0x6503cfa934d442eb msgData:0x7fd90401c960]

1

2

3

4

5

6

7

8

9

10

# n @ localhost in ~/vscodewsp/wechat/dump [7:46:01] C:1

$ ll -l|grep MessageData       

-rw-r--r--  1 n  staff   2.5K  2 15 19:19 FTSFileMessageData.h

-rw-r--r--  1 n  staff   2.0K  2 15 19:19 FTSMessageData.h

-rw-r--r--  1 n  staff   794B  2 15 19:19 IMessageDataExt-Protocol.h

-rw-r--r--  1 n  staff   6.2K  2 15 19:19 MMChatMessageDataSource.h

-rw-r--r--  1 n  staff    25K  2 15 19:19 MessageData.h

-rw-r--r--  1 n  staff   550B  2 15 19:19 MessageDataGroup.h

-rw-r--r--  1 n  staff   2.9K  2 15 19:19 MessageDataPackedInfo.h

-rw-r--r--  1 n  staff   262B  2 15 19:19 NSPasteboard-MessageData.h

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

@interface MessageData : NSObject

{

    unsigned int mesLocalID;

    long long mesSvrID;

    NSString *fromUsrName;

    NSString *toUsrName;

    unsigned int messageType;

    NSString *msgContent;

    NSString *msgVoiceText;

    unsigned int m_uiVoiceToTextStatus;

    unsigned int msgStatus;

    unsigned int msgImgStatus;

    NSString *msgRealChatUsr;

    NSString *msgPushContent;

    unsigned int m_uiTranslateStatus;

    NSString *msgSource;

    unsigned int mesDes;

    unsigned int msgSeq;

    BOOL bForward;

    NSData *m_dtThumbnail;

    unsigned int msgCreateTime;

    unsigned int m_uiSendTime;

    unsigned int m_uiDownloadStatus;

    id  m_extendInfoWithMsgType;

    id  m_extendInfoWithFromUsr;

    BOOL isAutoIncrement;

    BOOL m_bShouldShowAll;

    BOOL m_bIsMultiForwardMessage;

    BOOL m_shouldReloadOriginal;

    BOOL m_bHasOriginalMessage;

    unsigned int IntRes1;

    unsigned int IntRes2;

    unsigned int m_uiFileUploadStatus;

    unsigned int m_uiOriginalImgHeight;

    unsigned int m_uiOriginalImgWidth;

    unsigned int m_uiSrcCreateTime;

    unsigned int _m_nsMsgCrc32;

    unsigned int _m_uiUploadedBytes;

    unsigned int _m_uiDownloadedBytes;

    unsigned int _m_uiTotalBytes;

    int _m_nCdnServerRetCode;

    unsigned int _m_uiResendMessageCount;

    long long lastInsertedRowID;

    NSString *StrRes1;

    NSString *StrRes2;

    MMTranslateResult *m_nsTranslationResult;

    NSString *m_nsFilePath;

    NSString *m_nsVideoPath;

    NSString *m_nsVideoThumbPath;

    NSString *dataMd5;

    MessageData *m_refMessageData;

    MessageDataPackedInfo *m_packedInfo;

    NSString *m_nsSrcUserName;

    NSString *m_nsSrcNickName;

    NSString *m_nsAtUserList;

    NSString *_m_nsImgFileName;

    NSString *_m_nsBigFileErrMsg;

    SecondMsgnode *_secondMsgNode;

    MessageData *_referHostMsg;

}

1

2

3

4

    var MessageData = new ObjC.Object(args[3]).$ivars;

console.log("fromUsrName -> " + MessageData.fromUsrName)

console.log("toUsrName -> " + MessageData.toUsrName)

console.log("msgContent -> " + MessageData.msgContent)

1

2

3

4

5

6

7

8

9

-[MessageService notifyAddMsgOnMainThread:msgData:]: Loaded handler at "/Users/n/vscodewsp/wechat/__handlers__/MessageService/notifyAddMsgOnMainThread_msgData_.js"

Started tracing 1 function. Press Ctrl+C to stop.                      

Type of arg[2] -> NSTaggedPointerString

Type of arg[3] -> MessageData

fromUsrName -> wxid_pk1reltk63i822

toUsrName -> filehelper

msgContent -> 消息监听测试

           /* TID 0x307 */

 14909 ms  -[MessageService notifyAddMsgOnMainThread:0x6503cfa934d442eb msgData:0x7fd904426980]