ttttupup / wxhelper

Hook WeChat / 微信逆向
MIT License
2.22k stars 605 forks source link

3.9.5.81版 downloadAttach下载图片时,文件为C:\wxhelper\WeChat Files\wxid_xxx\wxhelper(1) #426

Open Yuanyuan1Xu opened 4 months ago

Yuanyuan1Xu commented 4 months ago

手机给自己的微信号发一张图片,TcpServer()处理消息时downloadAttach下载该图片,msgId.dat图片文件本该生成在C:\wxhelper\WeChat Files\wxid_xxx\wxhelper\image下,结果保存在C:\wxhelper\WeChat Files\wxid_xxx\目录下,与文件夹wxhelper同名,变为C:\wxhelper\WeChat Files\wxid_xxx\wxhelper(1)。 找源码INT64 Manager::DoDownloadTask(UINT64 msg_id) 。。。。 if (!Utils::FindOrCreateDirectoryW(save_path.c_str())) { return -3; } INT64 type = (INT64 )(chat_msg + 0x38); wchar_t content = (wchar_t *)(chat_msg + 0x88); DWORD len = (DWORD )(chat_msg + 0x94); std::wstring tmp_content(content, len); prototype::WeChatString we_content = BuildWechatString(tmp_content);

switch (type) { case 0x3: { save_path += L"\image"; if (!Utils::FindOrCreateDirectoryW(save_path.c_str())) { return -3; } thumb_path = save_path + L"\" + std::to_wstring(msg_id) + L"_t.dat"; save_path = save_path + L"\" + std::to_wstring(msg_id) + L".dat"; break; } case 0x3E: case 0x2B: { save_path += L"\video"; if (!Utils::FindOrCreateDirectoryW(save_path.c_str())) { return -3; } thumb_path = save_path + L"\" + std::to_wstring(msg_id) + L".jpg"; save_path = save_path + L"\" + std::to_wstring(msg_id) + L".mp4";

  break;
}
case 0x31: {
  save_path += L"\\file";
  if (!Utils::FindOrCreateDirectoryW(save_path.c_str())) {
    return -3;
  }
  char *p_xml_app_msg = Utils::WxHeapAlloc<char>(0x3000);
  UINT64 xml_msg =
      new_app_msg_info(reinterpret_cast<UINT64>(p_xml_app_msg));
  UINT64 result =
      xml_to_app_info(xml_msg, reinterpret_cast<UINT64>(we_content), 1);
  if (result != 1) {
    return -4;
  }
  std::wstring file_name = Utils::ReadWstring(xml_msg + 0x70);
  save_path =
      save_path + L"\\" + std::to_wstring(msg_id) + L"_" + file_name;
  free_app_msg_info(xml_msg);
  break;
}
default:
  break;

} prototype::WeChatString we_save_path = BuildWechatString(save_path); prototype::WeChatString we_thumb_path = BuildWechatString(thumb_path); int temp = 1; memcpy(chat_msg + 0x280, we_thumb_path, sizeof(prototype::WeChatString)); memcpy(chat_msg + 0x2A0, we_save_path, sizeof(prototype::WeChatString)); memcpy(chat_msg + 0x40C, &temp, sizeof(temp)); UINT64 mgr = get_pre_download_mgr(); success = push_attach_task(mgr, p_chat_msg, 0, 1); free_chat_msg(p_chat_msg);

return success; ......................................................................................... INT64 type = (INT64 )(chat_msg + 0x38); type = default 使得文件名为wxhelper目录名,

但是这不知道是什么原因引起的,如何解决?