【原创】Firda+typescript SQLite数据库查询

赵庆明老师

已于 2022-06-13 15:09:11 修改

阅读量465

点赞数

分类专栏： vscode typescript WeChat 文章标签： sqlite 数据库 typescript

于 2022-06-01 19:54:33 首次发布

本文链接：https://blog.csdn.net/u013667796/article/details/125089352

版权

typescript 同时被 3 个专栏收录

13 篇文章

订阅专栏

vscode

12 篇文章

订阅专栏

WeChat

12 篇文章

订阅专栏

这篇博客展示了如何利用Frida工具对WeChat的SQLite数据库进行动态查询。作者首先介绍了Frida的版本和模块信息，然后通过注入代码的方式找到了`sqlite3_exec`函数的地址，实现了对特定数据库句柄执行SQL查询的功能，例如获取`database_list`和`sqlite_master`表的信息。博客最后提到了参考资源《Frida快速入门》。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

上代码：

class WeChatSQLiteQuery {
    private moudule_name: string = "WeChatWin.dll";
    private wechat_version: string = "3.6.0.18";
    private moudule: Module;
    private offset_start = 0x223DDF4;
    private heads: number[] = new Array();
    private sqlite_dbheader: any[] = new Array();

    private welcome() {
        console.log("======================", new Date().toISOString(), "==========================");
        console.log("Frida.version\t\t\t", Frida.version);
        console.log('BaseAddress\t\t\t', this.moudule.base);
        console.log("WeChatWin.dll Size", this.moudule.size);
        console.log(`This script only run for Wechat ${this.wechat_version} by Frida`);
    }
    constructor() {
        this.moudule = Process.getModuleByName(this.moudule_name);
        if (this.moudule == undefined) {
            throw Error(`${this.moudule_name} was not found!`);
        }
        this.welcome();
    }
    sqlite_query(db_handle: number, query: string) {
        let offset_sqlite3_exec = 0x01356570;
        let sqlite3_exec = new NativeFunction(this.moudule.base.add(offset_sqlite3_exec), 'int', ['int', 'pointer', 'pointer', 'int', 'int']);

        //查询数据库
        let zSql = Memory.allocAnsiString(query);
        let index1 = 0;
        let xCallback = new NativeCallback((para, nColumn, colValue, colName): number => {
            // console.log(para, nColumn, colValue, colName);
            console.log();
            console.log("------------------------" + index1++ + "------------------------");
            for (let index = 0; index < nColumn; index++) {
                let c_name: any = colName.add(index * 4).readPointer().readUtf8String();
                let c_value: any = "";
                try {
                    c_value = colValue.add(index * 4).readPointer().readUtf8String() ?? "";
                } catch { }
                console.log(c_name, "\t", c_value)
            };
            return 0;
        }, 'int', ['pointer', 'int', 'pointer', 'pointer'], "mscdecl");
        sqlite3_exec(db_handle, zSql, xCallback, 0, 0);
    }
}

let wechat_sqlite_query = new WeChatSQLiteQuery();
wechat_sqlite_query.sqlite_query(0x0eeaad28, "PRAGMA database_list;");
wechat_sqlite_query.sqlite_query(0x0eeaad28, "select * from sqlite_master");
//wechat_sqlite_query.sqlite_query(0x0eeaad28, "select count(*) from MSG");
//wechat_sqlite_query.sqlite_query(0x0eeaad28, "select * from MSG");