微信HOOK 3.4.5.27 CALL信息留根-2021-12-27

最新推荐文章于 2024-06-30 16:36:42 发布

立心丶大哥

最新推荐文章于 2024-06-30 16:36:42 发布

阅读量1.1k

点赞数 1

文章标签：微信

本文链接：https://blog.csdn.net/weixin_44183918/article/details/122169259

版权

1.二维码获取：

HOOK:5D940000+20517A 5DB4517A
CALL:5D940000+636CF0

特征码：FF 30 E8 ?? ?? ?? ??

5DB4514F CC int3
5DB45150 55 push ebp
5DB45151 8BEC mov ebp,esp
5DB45153 56 push esi
5DB45154 68 D8F3415F push WeChatWi.5F41F3D8
5DB45159 8BF1 mov esi,ecx
5DB4515B E8 20F6FFFF call WeChatWi.5DB44780
5DB45160 68 9CB9395F push WeChatWi.5F39B99C ; @memo:
5DB45165 8BCE mov ecx,esi
5DB45167 E8 14F6FFFF call WeChatWi.5DB44780
5DB4516C 8B45 08 mov eax,dword ptr ss:[ebp+0x8]
5DB4516F 8D8E BC0A0000 lea ecx,dword ptr ds:[esi+0xABC]
5DB45175 FF70 04 push dword ptr ds:[eax+0x4]
5DB45178 FF30 push dword ptr ds:[eax]
5DB4517A E8 711B4300 call WeChatWi.5DF76CF0 ; 二维码HOOK地址
5DB4517F 5E pop esi
5DB45180 5D pop ebp
5DB45181 C2 0400 retn 0x4

2.微信头像

HOOK:5D940000+4398FA 5DD798FA
CALL:5D940000+8AD60

特征码：74 0C 6A FF 6A 00 56 8B C8 11次

02_manager\QRCodeLoginMgr.cpp
02_manager\QRCodeLoginMgr.cpp

5DD798E5 /74 18 je short WeChatWi.5DD798FF
5DD798E7 |E8 141CEAFF call WeChatWi.5DC1B500
5DD798EC |83C0 5C add eax,0x5C
5DD798EF |3BC6 cmp eax,esi
5DD798F1 |74 0C je short WeChatWi.5DD798FF
5DD798F3 |6A FF push -0x1
5DD798F5 |6A 00 push 0x0
5DD798F7 |56 push esi
5DD798F8 |8BC8 mov ecx,eax
5DD798FA |E8 6114C5FF call WeChatWi.5D9CAD60 ; 获取微信头像
5DD798FF \0F1005 40ED335F movups xmm0,dqword ptr ds:[0x5F33ED40]
5DD79906 83EC 10 sub esp,0x10
5DD79909 8BC4 mov eax,esp
5DD7990B 83EC 10 sub esp,0x10

3.登录信息
HOOK:5D940000+439168 5DD79168
CALL:5D940000+2CFB80 5DC0FB80

特征码：C686 DC000000 2次

5DD7912F CC int3
5DD79130 55 push ebp
5DD79131 8BEC mov ebp,esp
5DD79133 6A FF push -0x1
5DD79135 68 70500C5F push WeChatWi.5F0C5070
5DD7913A 64:A1 00000000 mov eax,dword ptr fs:[0]
5DD79140 50 push eax
5DD79141 83EC 4C sub esp,0x4C
5DD79144 A1 A09B725F mov eax,dword ptr ds:[0x5F729BA0]
5DD79149 33C5 xor eax,ebp
5DD7914B 8945 F0 mov dword ptr ss:[ebp-0x10],eax
5DD7914E 56 push esi
5DD7914F 50 push eax
5DD79150 8D45 F4 lea eax,dword ptr ss:[ebp-0xC]
5DD79153 64:A3 00000000 mov dword ptr fs:[0],eax
5DD79159 8BF1 mov esi,ecx
5DD7915B 837E 28 02 cmp dword ptr ds:[esi+0x28],0x2
5DD7915F 75 1C jnz short WeChatWi.5DD7917D
5DD79161 C686 DC000000 0>mov byte ptr ds:[esi+0xDC],0x1
5DD79168 E8 136AE9FF call WeChatWi.5DC0FB80 ; 微信登录信息
5DD7916D 8A40 1C mov al,byte ptr ds:[eax+0x1C]
5DD79170 84C0 test al,al
5DD79172 74 0E je short WeChatWi.5DD79182
5DD79174 8BCE mov ecx,esi
5DD79176 E8 05FDFFFF call WeChatWi.5DD78E80
5DD7917B EB 05 jmp short WeChatWi.5DD79182

4.实时消息

HOOK:5D940000+37CD1A 5DCBCD1A
CALL:5D940000+AD7C0 5D9ED7C0

特征码：59 5F 5E 5B 8B E5 5D

5DCBCCDE E8 8D09D3FF call WeChatWi.5D9ED670
5DCBCCE3 8D4D DC lea ecx,dword ptr ss:[ebp-0x24]
5DCBCCE6 51 push ecx
5DCBCCE7 8BC8 mov ecx,eax
5DCBCCE9 8B10 mov edx,dword ptr ds:[eax]
5DCBCCEB FF12 call dword ptr ds:[edx]
5DCBCCED 8B45 D0 mov eax,dword ptr ss:[ebp-0x30]
5DCBCCF0 3B45 D4 cmp eax,dword ptr ss:[ebp-0x2C]
5DCBCCF3 74 0F je short WeChatWi.5DCBCD04
5DCBCCF5 E8 36560000 call WeChatWi.5DCC2330
5DCBCCFA 8D4D D0 lea ecx,dword ptr ss:[ebp-0x30]
5DCBCCFD 51 push ecx
5DCBCCFE 8BC8 mov ecx,eax
5DCBCD00 8B10 mov edx,dword ptr ds:[eax]
5DCBCD02 FF12 call dword ptr ds:[edx]
5DCBCD04 E8 F70CDDFF call WeChatWi.5DA8DA00
5DCBCD09 8D4D B8 lea ecx,dword ptr ss:[ebp-0x48]
5DCBCD0C 51 push ecx
5DCBCD0D 8BC8 mov ecx,eax
5DCBCD0F 8B10 mov edx,dword ptr ds:[eax]
5DCBCD11 8B02 mov eax,dword ptr ds:[edx]
5DCBCD13 FFD0 call eax
5DCBCD15 8D4D E8 lea ecx,dword ptr ss:[ebp-0x18]
5DCBCD18 8AD8 mov bl,al
5DCBCD1A E8 A10AD3FF call WeChatWi.5D9ED7C0 ; 微信实时消息
5DCBCD1F 8D4D DC lea ecx,dword ptr ss:[ebp-0x24]
5DCBCD22 E8 990AD3FF call WeChatWi.5D9ED7C0
5DCBCD27 8D4D D0 lea ecx,dword ptr ss:[ebp-0x30]
5DCBCD2A E8 910AD3FF call WeChatWi.5D9ED7C0
5DCBCD2F 8D4D B8 lea ecx,dword ptr ss:[ebp-0x48]
5DCBCD32 E8 890AD3FF call WeChatWi.5D9ED7C0
5DCBCD37 8D4D C4 lea ecx,dword ptr ss:[ebp-0x3C]
5DCBCD3A E8 810AD3FF call WeChatWi.5D9ED7C0
5DCBCD3F 8AC3 mov al,bl
5DCBCD41 8B4D F4 mov ecx,dword ptr ss:[ebp-0xC]
5DCBCD44 64:890D 0000000>mov dword ptr fs:[0],ecx
5DCBCD4B 59 pop ecx
5DCBCD4C 5F pop edi
5DCBCD4D 5E pop esi
5DCBCD4E 5B pop ebx
5DCBCD4F 8BE5 mov esp,ebp
5DCBCD51 5D pop ebp

4.获取联系人

HOOK:5D940000+5BC2C8 5DEFC2C8
CALL:5D940000+99610 5D9D9610

特征码：

5DEFC240 55 push ebp
5DEFC241 8BEC mov ebp,esp
5DEFC243 6A FF push -0x1
5DEFC245 68 E0CC0D5F push WeChatWi.5F0DCCE0
5DEFC24A 64:A1 00000000 mov eax,dword ptr fs:[0]
5DEFC250 50 push eax
5DEFC251 83EC 0C sub esp,0xC
5DEFC254 53 push ebx
5DEFC255 56 push esi
5DEFC256 A1 A09B725F mov eax,dword ptr ds:[0x5F729BA0]
5DEFC25B 33C5 xor eax,ebp
5DEFC25D 50 push eax
5DEFC25E 8D45 F4 lea eax,dword ptr ss:[ebp-0xC]
5DEFC261 64:A3 00000000 mov dword ptr fs:[0],eax
5DEFC267 8BF1 mov esi,ecx
5DEFC269 8B45 08 mov eax,dword ptr ss:[ebp+0x8]
5DEFC26C 8945 F0 mov dword ptr ss:[ebp-0x10],eax
5DEFC26F 8D86 EC000000 lea eax,dword ptr ds:[esi+0xEC]
5DEFC275 C745 FC 0000000>mov dword ptr ss:[ebp-0x4],0x0
5DEFC27C 50 push eax
5DEFC27D 8945 E8 mov dword ptr ss:[ebp-0x18],eax
5DEFC280 C745 EC 0000000>mov dword ptr ss:[ebp-0x14],0x0
5DEFC287 FF15 44931C5F call dword ptr ds:[<&KERNEL32.EnterCriti>; ntdll_12.RtlEnterCriticalSection
5DEFC28D 8D45 0C lea eax,dword ptr ss:[ebp+0xC]
5DEFC290 C645 FC 01 mov byte ptr ss:[ebp-0x4],0x1
5DEFC294 8D9E BC000000 lea ebx,dword ptr ds:[esi+0xBC]
5DEFC29A 50 push eax
5DEFC29B 8BCB mov ecx,ebx
5DEFC29D E8 5E51B8FF call WeChatWi.5DA81400
5DEFC2A2 8BF0 mov esi,eax
5DEFC2A4 3B33 cmp esi,dword ptr ds:[ebx]
5DEFC2A6 74 13 je short WeChatWi.5DEFC2BB
5DEFC2A8 8D46 10 lea eax,dword ptr ds:[esi+0x10]
5DEFC2AB 8BCB mov ecx,ebx
5DEFC2AD 50 push eax
5DEFC2AE 8D45 0C lea eax,dword ptr ss:[ebp+0xC]
5DEFC2B1 50 push eax
5DEFC2B2 E8 1948B8FF call WeChatWi.5DA80AD0
5DEFC2B7 84C0 test al,al
5DEFC2B9 74 02 je short WeChatWi.5DEFC2BD
5DEFC2BB 8B33 mov esi,dword ptr ds:[ebx]
5DEFC2BD 3B33 cmp esi,dword ptr ds:[ebx]
5DEFC2BF 74 10 je short WeChatWi.5DEFC2D1
5DEFC2C1 8B4D F0 mov ecx,dword ptr ss:[ebp-0x10]
5DEFC2C4 83C6 28 add esi,0x28
5DEFC2C7 56 push esi
5DEFC2C8 E8 43D3ADFF call WeChatWi.5D9D9610 ; 获取通讯录
5DEFC2CD B3 01 mov bl,0x1
5DEFC2CF EB 02 jmp short WeChatWi.5DEFC2D3

4.获取联系人

HOOK:5D940000+5BC2C8 5DEFC2C8
CALL:5D940000+99610 5D9D9610

特征码：

5DEFC23F CC int3
5DEFC240 55 push ebp
5DEFC241 8BEC mov ebp,esp
5DEFC243 6A FF push -0x1
5DEFC245 68 E0CC0D5F push WeChatWi.5F0DCCE0
5DEFC24A 64:A1 00000000 mov eax,dword ptr fs:[0]
5DEFC250 50 push eax
5DEFC251 83EC 0C sub esp,0xC
5DEFC254 53 push ebx
5DEFC255 56 push esi
5DEFC256 A1 A09B725F mov eax,dword ptr ds:[0x5F729BA0]
5DEFC25B 33C5 xor eax,ebp
5DEFC25D 50 push eax
5DEFC25E 8D45 F4 lea eax,dword ptr ss:[ebp-0xC]
5DEFC261 64:A3 00000000 mov dword ptr fs:[0],eax
5DEFC267 8BF1 mov esi,ecx
5DEFC269 8B45 08 mov eax,dword ptr ss:[ebp+0x8]
5DEFC26C 8945 F0 mov dword ptr ss:[ebp-0x10],eax
5DEFC26F 8D86 EC000000 lea eax,dword ptr ds:[esi+0xEC]
5DEFC275 C745 FC 0000000>mov dword ptr ss:[ebp-0x4],0x0
5DEFC27C 50 push eax
5DEFC27D 8945 E8 mov dword ptr ss:[ebp-0x18],eax
5DEFC280 C745 EC 0000000>mov dword ptr ss:[ebp-0x14],0x0
5DEFC287 FF15 44931C5F call dword ptr ds:[<&KERNEL32.EnterCriti>; ntdll_12.RtlEnterCriticalSection
5DEFC28D 8D45 0C lea eax,dword ptr ss:[ebp+0xC]
5DEFC290 C645 FC 01 mov byte ptr ss:[ebp-0x4],0x1
5DEFC294 8D9E BC000000 lea ebx,dword ptr ds:[esi+0xBC]
5DEFC29A 50 push eax
5DEFC29B 8BCB mov ecx,ebx
5DEFC29D E8 5E51B8FF call WeChatWi.5DA81400
5DEFC2A2 8BF0 mov esi,eax
5DEFC2A4 3B33 cmp esi,dword ptr ds:[ebx]
5DEFC2A6 74 13 je short WeChatWi.5DEFC2BB
5DEFC2A8 8D46 10 lea eax,dword ptr ds:[esi+0x10]
5DEFC2AB 8BCB mov ecx,ebx
5DEFC2AD 50 push eax
5DEFC2AE 8D45 0C lea eax,dword ptr ss:[ebp+0xC]
5DEFC2B1 50 push eax
5DEFC2B2 E8 1948B8FF call WeChatWi.5DA80AD0
5DEFC2B7 84C0 test al,al
5DEFC2B9 74 02 je short WeChatWi.5DEFC2BD
5DEFC2BB 8B33 mov esi,dword ptr ds:[ebx]
5DEFC2BD 3B33 cmp esi,dword ptr ds:[ebx]
5DEFC2BF 74 10 je short WeChatWi.5DEFC2D1
5DEFC2C1 8B4D F0 mov ecx,dword ptr ss:[ebp-0x10]
5DEFC2C4 83C6 28 add esi,0x28
5DEFC2C7 56 push esi
5DEFC2C8 E8 43D3ADFF call WeChatWi.5D9D9610 ; 获取通讯录

5.撤回消息

HOOK:5D940000+37B21B 5DCBB21B
CALL:5D940000+638F00 5DF78F00

特征码：

5DCBB1D7 50 push eax
5DCBB1D8 8D95 C0FCFFFF lea edx,dword ptr ss:[ebp-0x340]
5DCBB1DE 8D4D C4 lea ecx,dword ptr ss:[ebp-0x3C]
5DCBB1E1 E8 0A090000 call WeChatWi.5DCBBAF0
5DCBB1E6 83C4 08 add esp,0x8
5DCBB1E9 8D85 30FDFFFF lea eax,dword ptr ss:[ebp-0x2D0]
5DCBB1EF C645 FC 04 mov byte ptr ss:[ebp-0x4],0x4
5DCBB1F3 50 push eax
5DCBB1F4 8D8D C0FCFFFF lea ecx,dword ptr ss:[ebp-0x340]
5DCBB1FA E8 019FE3FF call WeChatWi.5DAF5100
5DCBB1FF 8B45 C4 mov eax,dword ptr ss:[ebp-0x3C]
5DCBB202 85C0 test eax,eax
5DCBB204 74 06 je short WeChatWi.5DCBB20C
5DCBB206 66:8338 00 cmp word ptr ds:[eax],0x0
5DCBB20A 75 05 jnz short WeChatWi.5DCBB211
5DCBB20C B8 D8F3415F mov eax,WeChatWi.5F41F3D8
5DCBB211 FF75 C8 push dword ptr ss:[ebp-0x38]
5DCBB214 8D8D 30FDFFFF lea ecx,dword ptr ss:[ebp-0x2D0]
5DCBB21A 50 push eax
5DCBB21B E8 E0DC2B00 call WeChatWi.5DF78F00 ; 撤回消息CALL
5DCBB220 8B85 14FFFFFF mov eax,dword ptr ss:[ebp-0xEC]
5DCBB226 8B8D B4FDFFFF mov ecx,dword ptr ss:[ebp-0x24C]
5DCBB22C 25 00020000 and eax,0x200
5DCBB231 83E0 10 and eax,0x10

6.未读消息

HOOK:5D940000+3106DD 5DC506DD

特征码：

5DC5068E /75 24 jnz short WeChatWi.5DC506B4
5DC50690 |C645 FC 08 mov byte ptr ss:[ebp-0x4],0x8
5DC50694 |E8 E7451300 call WeChatWi.5DD84C80
5DC50699 |68 205D195F push WeChatWi.5F195D20
5DC5069E |E8 96FD0801 call WeChatWi.5ECE0439
5DC506A3 |68 1C5D7E5F push WeChatWi.5F7E5D1C ; 5
5DC506A8 |C645 FC 00 mov byte ptr ss:[ebp-0x4],0x0
5DC506AC |E8 D5FE0801 call WeChatWi.5ECE0586
5DC506B1 |83C4 08 add esp,0x8
5DC506B4 \8D45 D0 lea eax,dword ptr ss:[ebp-0x30]
5DC506B7 B9 605C7E5F mov ecx,WeChatWi.5F7E5C60
5DC506BC 50 push eax
5DC506BD E8 0E0D1400 call WeChatWi.5DD913D0
5DC506C2 8B45 B4 mov eax,dword ptr ss:[ebp-0x4C]
5DC506C5 3998 B8000000 cmp dword ptr ds:[eax+0xB8],ebx
5DC506CB 74 18 je short WeChatWi.5DC506E5
5DC506CD 8B0D C07F7B5F mov ecx,dword ptr ds:[0x5F7B7FC0]
5DC506D3 6A 00 push 0x0
5DC506D5 6A 00 push 0x0
5DC506D7 8998 B8000000 mov dword ptr ds:[eax+0xB8],ebx ; 获取未读消息
5DC506DD 8B01 mov eax,dword ptr ds:[ecx] ; HOOK这里
5DC506DF 53 push ebx
5DC506E0 6A 02 push 0x2
5DC506E2 FF50 1C call dword ptr ds:[eax+0x1C]
5DC506E5 8D4D D0 lea ecx,dword ptr ss:[ebp-0x30]
5DC506E8 E8 03FAEDFF call WeChatWi.5DB300F0
5DC506ED 8B4D F4 mov ecx,dword ptr ss:[ebp-0xC] ; KernelBa.749B72E0
5DC506F0 64:890D 0000000>mov dword ptr fs:[0],ecx
5DC506F7 59 pop ecx ; ntdll_12.7713018D
5DC506F8 5F pop edi ; ntdll_12.7713018D
5DC506F9 5E pop esi ; ntdll_12.7713018D
5DC506FA 5B pop ebx ; ntdll_12.7713018D
5DC506FB 8BE5 mov esp,ebp
5DC506FD 5D pop ebp ; ntdll_12.7713018D

7.发送文本消息

CALL:5D940000+442540 5DD82540

5DA937F2 /0F8E F5000000 jle WeChatWi.5DA938ED
5DA937F8 |8D4D 98 lea ecx,dword ptr ss:[ebp-0x68]
5DA937FB |E8 505A4E00 call WeChatWi.5DF79250
5DA93800 |8B4D 9C mov ecx,dword ptr ss:[ebp-0x64]
5DA93803 |8945 B8 mov dword ptr ss:[ebp-0x48],eax
5DA93806 |0FB70450 movzx eax,word ptr ds:[eax+edx*2]
5DA9380A |83F8 20 cmp eax,0x20
5DA9380D |74 0F je short WeChatWi.5DA9381E
5DA9380F |83F8 0A cmp eax,0xA
5DA93812 |74 0A je short WeChatWi.5DA9381E
5DA93814 |83F8 09 cmp eax,0x9
5DA93817 |74 05 je short WeChatWi.5DA9381E
5DA93819 |83F8 0D cmp eax,0xD
5DA9381C |75 0E jnz short WeChatWi.5DA9382C
5DA9381E |42 inc edx
5DA9381F |3BD1 cmp edx,ecx
5DA93821 |0F8D C6000000 jge WeChatWi.5DA938ED
5DA93827 |8B45 B8 mov eax,dword ptr ss:[ebp-0x48]
5DA9382A ^|EB DA jmp short WeChatWi.5DA93806
5DA9382C |E8 6F51F4FF call WeChatWi.5D9D89A0
5DA93831 |6A 01 push 0x1
5DA93833 |8D47 34 lea eax,dword ptr ds:[edi+0x34]
5DA93836 |50 push eax ; @消息
5DA93837 |57 push edi ; 消息内容
5DA93838 |8D95 70FFFFFF lea edx,dword ptr ss:[ebp-0x90] ; 群ID 微信ID
5DA9383E |8D8D 08FAFFFF lea ecx,dword ptr ss:[ebp-0x5F8] ; 缓冲区
5DA93844 |E8 F7EC2E00 call WeChatWi.5DD82540 ; 发送消息CALL
5DA93849 |83C4 0C add esp,0xC
5DA9384C |50 push eax
5DA9384D |8D8D 80FCFFFF lea ecx,dword ptr ss:[ebp-0x380]
5DA93853 |C645 FC 05 mov byte ptr ss:[ebp-0x4],0x5
5DA93857 |E8 E4B4F3FF call WeChatWi.5D9CED40
5DA9385C |8D8D 08FAFFFF lea ecx,dword ptr ss:[ebp-0x5F8]
5DA93862 |C645 FC 07 mov byte ptr ss:[ebp-0x4],0x7
5DA93866 |E8 95E2F3FF call WeChatWi.5D9D1B00
5DA9386B |E8 A0262200 call WeChatWi.5DCB5F10
5DA93870 |8BC8 mov ecx,eax

7.发送图片信息

5DA938F5 B8 398EE338 mov eax,0x38E38E39
5DA938FA F7E9 imul ecx
5DA938FC C1FA 04 sar edx,0x4
5DA938FF 8BC2 mov eax,edx
5DA93901 C1E8 1F shr eax,0x1F
5DA93904 03C2 add eax,edx
5DA93906 83F8 01 cmp eax,0x1
5DA93909 75 3B jnz short WeChatWi.5DA93946
5DA9390B 68 B0000000 push 0xB0
5DA93910 E8 A5C72401 call WeChatWi.5ECE00BA
5DA93915 83C4 04 add esp,0x4
5DA93918 8985 18FFFFFF mov dword ptr ss:[ebp-0xE8],eax
5DA9391E FF75 94 push dword ptr ss:[ebp-0x6C]
5DA93921 8BC8 mov ecx,eax
5DA93923 C645 FC 04 mov byte ptr ss:[ebp-0x4],0x4
5DA93927 E8 E46D3500 call WeChatWi.5DDEA710
5DA9392C 50 push eax
5DA9392D 6A 00 push 0x0
5DA9392F 6A 00 push 0x0
5DA93931 68 40030000 push 0x340
5DA93936 C645 FC 03 mov byte ptr ss:[ebp-0x4],0x3
5DA9393A E8 D13C3500 call WeChatWi.5DDE7610
5DA9393F 8BC8 mov ecx,eax
5DA93941 E8 BA4F3500 call WeChatWi.5DDE8900
5DA93946 8D4D 98 lea ecx,dword ptr ss:[ebp-0x68]
5DA93949 E8 A2544E00 call WeChatWi.5DF78DF0
5DA9394E E9 8C060000 jmp WeChatWi.5DA93FDF
5DA93953 83EC 14 sub esp,0x14 ; 发送图片开始
5DA93956 8D41 E0 lea eax,dword ptr ds:[ecx-0x20]
5DA93959 8BCC mov ecx,esp
5DA9395B 8965 B8 mov dword ptr ss:[ebp-0x48],esp
5DA9395E 50 push eax ; Wxid缓冲
5DA9395F E8 1C524E00 call WeChatWi.5DF78B80 ; call 1
5DA93964 57 push edi ; 图片数据结构
5DA93965 8D85 70FFFFFF lea eax,dword ptr ss:[ebp-0x90]
5DA9396B C645 FC 08 mov byte ptr ss:[ebp-0x4],0x8
5DA9396F 50 push eax ; Wxid 数据结构
5DA93970 8D85 80FCFFFF lea eax,dword ptr ss:[ebp-0x380]
5DA93976 50 push eax ; 生成的消息缓冲
5DA93977 E8 2450F4FF call WeChatWi.5D9D89A0 ; call 2
5DA9397C 8BC8 mov ecx,eax
5DA9397E C645 FC 01 mov byte ptr ss:[ebp-0x4],0x1
5DA93982 E8 29E52E00 call WeChatWi.5DD81EB0 ; call 3
5DA93987 C645 FC 09 mov byte ptr ss:[ebp-0x4],0x9
5DA9398B E8 80252200 call WeChatWi.5DCB5F10
5DA93990 8BC8 mov ecx,eax
5DA93992 E8 29AD4400 call WeChatWi.5DEDE6C0
5DA93997 8D8D 80FCFFFF lea ecx,dword ptr ss:[ebp-0x380]
5DA9399D 8955 B8 mov dword ptr ss:[ebp-0x48],edx
5DA939A0 8BF8 mov edi,eax
5DA939A2 E8 19AD4400 call WeChatWi.5DEDE6C0
5DA939A7 3BC7 cmp eax,edi
5DA939A9 75 3D jnz short WeChatWi.5DA939E8
5DA939AB 3B55 B8 cmp edx,dword ptr ss:[ebp-0x48]
5DA939AE 75 38 jnz short WeChatWi.5DA939E8
5DA939B0 6A 01 push 0x1
5DA939B2 6A 01 push 0x1
5DA939B4 6A 0D push 0xD
5DA939B6 6A 5F push 0x5F

8.发送文件

5DA93AFA BA CC96355F mov edx,WeChatWi.5F3596CC ; 01_ui\chat\ChatViewModel.cpp
5DA93AFF 68 DC9A355F push WeChatWi.5F359ADC ; copy wechat video,path=%s
5DA93B04 68 A896355F push WeChatWi.5F3596A8 ; ChatModel
5DA93B09 8948 08 mov dword ptr ds:[eax+0x8],ecx
5DA93B0C B9 02000000 mov ecx,0x2
5DA93B11 68 1C9C355F push WeChatWi.5F359C1C ; ChatViewModel::batchSendMsg
5DA93B16 68 17050000 push 0x517
5DA93B1B C600 02 mov byte ptr ds:[eax],0x2
5DA93B1E E8 1D3F4E00 call WeChatWi.5DF77A40
5DA93B23 83C4 70 add esp,0x70
5DA93B26 8D8D 34FFFFFF lea ecx,dword ptr ss:[ebp-0xCC]
5DA93B2C E8 BF524E00 call WeChatWi.5DF78DF0
5DA93B31 83EC 14 sub esp,0x14 ; 发送文件开始
5DA93B34 8D47 14 lea eax,dword ptr ds:[edi+0x14]
5DA93B37 8BCC mov ecx,esp
5DA93B39 8965 B8 mov dword ptr ss:[ebp-0x48],esp
5DA93B3C 50 push eax ; 缓冲区
5DA93B3D E8 3E504E00 call WeChatWi.5DF78B80
5DA93B42 FF75 90 push dword ptr ss:[ebp-0x70]
5DA93B45 83EC 14 sub esp,0x14
5DA93B48 8BCC mov ecx,esp
5DA93B4A 8965 88 mov dword ptr ss:[ebp-0x78],esp
5DA93B4D 6A FF push -0x1
5DA93B4F 68 D8F3415F push WeChatWi.5F41F3D8
5DA93B54 E8 E74F4E00 call WeChatWi.5DF78B40
5DA93B59 83EC 14 sub esp,0x14
5DA93B5C 8BCC mov ecx,esp
5DA93B5E 8965 84 mov dword ptr ss:[ebp-0x7C],esp
5DA93B61 57 push edi ; 文件目录
5DA93B62 E8 19504E00 call WeChatWi.5DF78B80
5DA93B67 83EC 14 sub esp,0x14
5DA93B6A 8D85 70FFFFFF lea eax,dword ptr ss:[ebp-0x90]
5DA93B70 8BCC mov ecx,esp
5DA93B72 8965 AC mov dword ptr ss:[ebp-0x54],esp
5DA93B75 50 push eax ; 接收ID
5DA93B76 E8 05504E00 call WeChatWi.5DF78B80
5DA93B7B 8D85 80FCFFFF lea eax,dword ptr ss:[ebp-0x380]
5DA93B81 C645 FC 0F mov byte ptr ss:[ebp-0x4],0xF
5DA93B85 50 push eax ; 缓冲区
5DA93B86 E8 A5A4F4FF call WeChatWi.5D9DE030
5DA93B8B 8BC8 mov ecx,eax
5DA93B8D C645 FC 0B mov byte ptr ss:[ebp-0x4],0xB
5DA93B91 E8 9A281F00 call WeChatWi.5DC86430
5DA93B96 C645 FC 10 mov byte ptr ss:[ebp-0x4],0x10
5DA93B9A E8 71232200 call WeChatWi.5DCB5F10
5DA93B9F 8BC8 mov ecx,eax
5DA93BA1 E8 1AAB4400 call WeChatWi.5DEDE6C0
5DA93BA6 8D8D 80FCFFFF lea ecx,dword ptr ss:[ebp-0x380]
5DA93BAC 8955 B8 mov dword ptr ss:[ebp-0x48],edx
5DA93BAF 8BF8 mov edi,eax
5DA93BB1 E8 0AAB4400 call WeChatWi.5DEDE6C0
5DA93BB6 3BC7 cmp eax,edi

9.删除好友

地址：5D940000+23DC51 5DB7DC51

5DB7DC15 83EC 10 sub esp,0x10
5DB7DC18 BA FC6E3A5F mov edx,WeChatWi.5F3A6EFC ; 01_ui\contact\ContactListUI.cpp
5DB7DC1D 8BCC mov ecx,esp
5DB7DC1F 68 D86E3A5F push WeChatWi.5F3A6ED8 ; MenuCmdDeleteFriend username = %s
5DB7DC24 68 3C6F3A5F push WeChatWi.5F3A6F3C ; ContactListUI
5DB7DC29 C601 02 mov byte ptr ds:[ecx],0x2
5DB7DC2C 8941 08 mov dword ptr ds:[ecx+0x8],eax
5DB7DC2F B9 02000000 mov ecx,0x2
5DB7DC34 68 B46E3A5F push WeChatWi.5F3A6EB4 ; ContactListUI::OnMenuItemClicked
5DB7DC39 68 D0000000 push 0xD0
5DB7DC3E E8 FD9D3F00 call WeChatWi.5DF77A40
5DB7DC43 83C4 70 add esp,0x70
5DB7DC46 8D8D F8FEFFFF lea ecx,dword ptr ss:[ebp-0x108]
5DB7DC4C E8 9FB13F00 call WeChatWi.5DF78DF0
5DB7DC51 E8 5AACE5FF call WeChatWi.5D9D88B0
5DB7DC56 51 push ecx
5DB7DC57 57 push edi ; 微信ID
5DB7DC58 E8 E3F81600 call WeChatWi.5DCED540 ; 删除好友CALL
5DB7DC5D 8D4D 98 lea ecx,dword ptr ss:[ebp-0x68]
5DB7DC60 C745 FC FFFFFFF>mov dword ptr ss:[ebp-0x4],-0x1
5DB7DC67 E8 84B13F00 call WeChatWi.5DF78DF0
5DB7DC6C 8B5D F0 mov ebx,dword ptr ss:[ebp-0x10]
5DB7DC6F E9 23050000 jmp WeChatWi.5DB7E197
5DB7DC74 68 806D3A5F push WeChatWi.5F3A6D80 ; menuCmdDeletePublicUser

10.分享名片CALL

5DB762F1 E8 2A3A1700 call WeChatWi.5DCE9D20
5DB762F6 C645 FC 02 mov byte ptr ss:[ebp-0x4],0x2
5DB762FA A3 606D7B5F mov dword ptr ds:[0x5F7B6D60],eax ; WeChatWi.5F7E57D8
5DB762FF C645 FC 01 mov byte ptr ss:[ebp-0x4],0x1
5DB76303 E8 C85B1700 call WeChatWi.5DCEBED0
5DB76308 84C0 test al,al
5DB7630A 74 46 je short WeChatWi.5DB76352
5DB7630C 8D93 B8000000 lea edx,dword ptr ds:[ebx+0xB8]
5DB76312 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28]
5DB76315 E8 866E1400 call WeChatWi.5DCBD1A0
5DB7631A C645 FC 04 mov byte ptr ss:[ebp-0x4],0x4
5DB7631E E8 7D26E6FF call WeChatWi.5D9D89A0
5DB76323 6A 2A push 0x2A ; 发送XMLcall0x2a
5DB76325 8D45 D8 lea eax,dword ptr ss:[ebp-0x28] ; XML 信息
5DB76328 8BD6 mov edx,esi
5DB7632A 6A 00 push 0x0 ; 0x0
5DB7632C 50 push eax ; WeChatWi.5F7E57D8
5DB7632D 8D8D 5CFDFFFF lea ecx,dword ptr ss:[ebp-0x2A4] ; 缓冲区
5DB76333 E8 08C22000 call WeChatWi.5DD82540 ; 分享名片CALL
5DB76338 83C4 0C add esp,0xC
5DB7633B 8D8D 5CFDFFFF lea ecx,dword ptr ss:[ebp-0x2A4]
5DB76341 E8 BAB7E5FF call WeChatWi.5D9D1B00
5DB76346 8D4D D8 lea ecx,dword ptr ss:[ebp-0x28]
5DB76349 C645 FC 01 mov byte ptr ss:[ebp-0x4],0x1
5DB7634D E8 9E2A4000 call WeChatWi.5DF78DF0
5DB76352 83C6 14 add esi,0x14
5DB76355 3BF7 cmp esi,edi
5DB76357 ^ 0F85 E3FEFFFF jnz WeChatWi.5DB76240
5DB7635D 8B45 08 mov eax,dword ptr ss:[ebp+0x8]
5DB76360 85C0 test eax,eax ; WeChatWi.5F7E57D8
5DB76362 74 10 je short WeChatWi.5DB76374
5DB76364 50 push eax ; WeChatWi.5F7E57D8
5DB76365 E8 C72B4D01 call WeChatWi.5F048F31