其他
Android微信逆向--实现发朋友圈动态
PC 一台可以调试微信进程的Android手机 微信7.0.11 ddms(用于跟踪调用过程) uiautomatorviewer(用于定位控件id) jadx(用于对微信apk静态分析) frida(用于hook微信，获得相关信息，发布朋友圈)
adb shell dumpsys activity top String unused2 = SnsUploadUI.this.desc = SnsUploadUI.this.tQN.getText().toString();desc是描述（description）的英文单词的缩写 this.desc被赋予this.tQN.getText().toString()
var SnsUploadUI= Java.use('com.tencent.mm.plugin.sns.ui.SnsUploadUI');var ag = SnsUploadUI.ag.overload("android.os.Bundle");//get sns typeag.implementation=function(bundle){ var ret = ag.call(this,bundle); send("sns type = " + this.tMY.value); return ret;}0 带图片的动态，对应：com.tencent.mm.plugin.sns.ui.ai 9 纯文字动态，对应：com.tencent.mm.plugin.sns.ui.ae
public final boolean onMenuItemClick(MenuItem menuItem) { String unused2 = SnsUploadUI.this.desc = SnsUploadUI.this.tQN.getText().toString(); int pasterLen = SnsUploadUI.this.tQN.getPasterLen(); int privated = SnsUploadUI.this.tKm.getPrivated(); int syncFlag2 = SnsUploadUI.this.tKm.getSyncFlag(); ...... PInt pInt = new PInt(); if (SnsUploadUI.this.tQO instanceof a) { Bundle bundle = new Bundle(); bundle.putInt("param_is_privated", privated); bundle.putString("param_description", SnsUploadUI.this.desc); bundle.putStringArrayList("param_with_list", new ArrayList(SnsUploadUI.this.uij.getAtList())); bundle.putInt("param_paste_len", pasterLen); try { bundle.putByteArray("param_localtion", SnsUploadUI.this.uik.getLocation().toByteArray()); } catch (IOException e2) { ab.printErrStackTrace("MicroMsg.SnsUploadUI", e2, "parse location error", new Object[0]); } bundle.putBoolean("param_is_black_group", SnsUploadUI.this.tQS); bundle.putStringArrayList("param_group_user", SnsUploadUI.this.tQR); bundle.putInt("param_contact_tag_count", SnsUploadUI.this.tOk); bundle.putInt("param_temp_user_count", SnsUploadUI.this.tOl); pInt.value = ((a) SnsUploadUI.this.tQO).getContentType(); z unused4 = SnsUploadUI.this.tQO; } else { SnsUploadUI.this.tQO.a(privated, syncFlag2, SnsUploadUI.this.tKm.getTwitterAccessToken(), SnsUploadUI.this.desc, SnsUploadUI.this.uij.getAtList(), SnsUploadUI.this.uik.getLocation(), (LinkedList<Long>) null, pasterLen, SnsUploadUI.this.tQS, SnsUploadUI.this.tQR, pInt, SnsUploadUI.this.tOj, SnsUploadUI.this.tOk, SnsUploadUI.this.tOl); }}var ae = Java.use('com.tencent.mm.plugin.sns.ui.ae');var ae_a = ae.a.overload("int","int","org.b.d.i","java.lang.String","java.util.List","com.tencent.mm.protocal.protobuf.bdi","java.util.LinkedList","int","boolean","java.util.List","com.tencent.mm.pointers.PInt","java.lang.String","int","int");ae_a.implementation = function(isPrivate,syncFlag2,twitterAccessToken,desc,atList,location,list1,pasterLen,bool1,list2,pint1,str1,num1,num2){ var ret = ae_a.call(this,isPrivate,syncFlag2,twitterAccessToken,desc,atList,location,list1,pasterLen,bool1,list2,pint1,str1,num1,num2); console.log("************Basic Info************"); console.log("isPrivate = " + isPrivate); console.log("syncFlag2 = " + syncFlag2); console.log("twitterAccessToken = " + twitterAccessToken); console.log("desc = " + "'" + desc + "'"); if(atList.size()>0){ for(var i=0;i<atList.size();i++){ console.log("atList[" + i + "] = " + atList.get(0)); } } if(location != null){
if(location.yRD.value != null){ console.log("location.yRD = " + location.yRD.value); }
if(location.yRE.value != null){ console.log("location.yRE = " + location.yRE.value); }
} console.log("list1 = " + list1); console.log("pasterLen = " + pasterLen); console.log("bool1 = " + bool1); if(list2 != null){ console.log("list2 = " + list2.size()); } else{ console.log("list2 = " + list2); } console.log("pint1 = " + pint1.value.value); console.log("str1 = " + str1); console.log("num1 = " + num1); console.log("num1 = " + num1);
return ret;}//ae.a- privated(int)：动态是否私密：0公开，1私密- desc(String)：朋友圈的文本- AtList(List<String>)：艾特人的wxid- Location(com.tencent.mm.protocal.protobuf.bdi)：定位信息if(Java.available){ Java.perform(function(){ var ay_class = Java.use("com.tencent.mm.plugin.sns.model.ay"); var desc = "To be, or not to be, that is a question."; var ayInstance = ay_class.$new(2); ayInstance.adk(desc); ayInstance.commit(); });}if(Java.available){ Java.perform(function(){ var ay_class = Java.use("com.tencent.mm.plugin.sns.model.ay"); var j_class = Java.use("com.tencent.mm.plugin.sns.data.j") var desc = "To be, or not to be, that is a question."; var likedList_class = Java.use("java.util.LinkedList"); var linkedListInstance = likedList_class.$new(); var ayInstance = ay_class.$new(1); var jInstance1 = j_class.$new("/storage/emulated/0/test1.jpg",2); var jInstance2 = j_class.$new("/storage/emulated/0/test2.jpg",2); var jInstance3 = j_class.$new("/storage/emulated/0/test3.jpg",2);
linkedListInstance.add(jInstance1); linkedListInstance.add(jInstance2); linkedListInstance.add(jInstance3); ayInstance.ey(linkedListInstance); ayInstance.adk(desc); ayInstance.commit(); });}看雪ID：落叶似秋
https://bbs.pediy.com/user-815293.htm
推荐文章++++
好书推荐