First commit

frida/config/addresses.11581.json

@@ -0,0 +1,6 @@
+{
+    "Version": 11581,
+    "LoadStartHookOffset": "0x28E9190",
+    "CDPFilterHookOffset": "0x38C4350",
+    "SceneOffsets": [1208, 1160]
+}

frida/config/addresses.11633.json

@@ -0,0 +1,6 @@
+{
+    "Version": 11633,
+    "LoadStartHookOffset": "0x28F22A0",
+    "CDPFilterHookOffset": "0x38D41E0",
+    "SceneOffsets": [1208, 1160]
+}

frida/config/addresses.13331.json

@@ -0,0 +1,6 @@
+{
+    "Version": 13331,
+    "LoadStartHookOffset": "0x0FFC200",
+    "CDPFilterHookOffset": "0x2420100",
+    "SceneOffsets": [1272, 1224]
+}

frida/config/addresses.13341.json

@@ -0,0 +1,6 @@
+{
+    "Version": 13341,
+    "LoadStartHookOffset": "0x10009E0",
+    "CDPFilterHookOffset": "0x242E8E0",
+    "SceneOffsets": [1272, 1224]
+}

frida/config/addresses.13487.json

@@ -0,0 +1,6 @@
+{
+    "Version": 13487,
+    "LoadStartHookOffset": "0x0FFB600",
+    "CDPFilterHookOffset": "0x241FEB0",
+    "SceneOffsets": [1272, 1224]
+}

frida/config/addresses.13639.json

@@ -0,0 +1,6 @@
+{
+    "Version": 13639,
+    "LoadStartHookOffset": "0x1000990",
+    "CDPFilterHookOffset": "0x2424DE0",
+    "SceneOffsets": [1272, 1224]
+}

frida/config/addresses.13655.json

@@ -0,0 +1,6 @@
+{
+    "Version": 13655,
+    "LoadStartHookOffset": "0x100F4B0",
+    "CDPFilterHookOffset": "0x244A9E0",
+    "SceneOffsets": [1280, 1232]
+}

frida/config/addresses.13871.json

@@ -0,0 +1,6 @@
+{
+    "Version": 13871,
+    "LoadStartHookOffset": "0x101F160",
+    "CDPFilterHookOffset": "0x246FC40",
+    "SceneOffsets": [1360, 1312]
+}

frida/config/addresses.13909.json

@@ -0,0 +1,6 @@
+{
+    "Version": 13909,
+    "LoadStartHookOffset": "0x101F0E0",
+    "CDPFilterHookOffset": "0x246FDC0",
+    "SceneOffsets": [1360, 1312]
+}

frida/config/addresses.14161.json

@@ -0,0 +1,6 @@
+{
+    "Version": 14161,
+    "LoadStartHookOffset": "0x10246C0",
+    "CDPFilterHookOffset": "0x24839B0",
+    "SceneOffsets": [1360, 1312]
+}

frida/config/addresses.14199.json

@@ -0,0 +1,6 @@
+{
+    "Version": 14199,
+    "LoadStartHookOffset": "0x10246F0",
+    "CDPFilterHookOffset": "0x24839E0",
+    "SceneOffsets": [1360, 1312]
+}

frida/config/addresses.14315.json

@@ -0,0 +1,6 @@
+{
+    "Version": 14315,
+    "LoadStartHookOffset": "0x10004C0",
+    "CDPFilterHookOffset": "0x2424B50",
+    "SceneOffsets": [1272, 1224]
+}

frida/config/addresses.16133.json

@@ -0,0 +1,6 @@
+{
+    "Version": 16133,
+    "LoadStartHookOffset": "0x470FAD0",
+    "CDPFilterHookOffset": "0x90FC7E0",
+    "SceneOffsets": [1360, 1312]
+}

frida/config/addresses.16203.json

@@ -0,0 +1,6 @@
+{
+    "Version": 16203,
+    "LoadStartHookOffset": "0x4710890",
+    "CDPFilterHookOffset": "0x90FD640",
+    "SceneOffsets": [1360, 1312]
+}

frida/config/addresses.16389.json

@@ -0,0 +1,6 @@
+{
+    "Version": 16389,
+    "LoadStartHookOffset": "0x24E4830",
+    "CDPFilterHookOffset": "0x2E2A880",
+    "SceneOffsets": [1360, 1312]
+}

frida/config/addresses.16467.json

@@ -0,0 +1,6 @@
+{
+    "Version": 16467,
+    "LoadStartHookOffset": "0x24E4FD0",
+    "CDPFilterHookOffset": "0x2E2CC90",
+    "SceneOffsets": [1360, 1312]
+}

frida/config/addresses.16771.json

@@ -0,0 +1,6 @@
+{
+    "Version": 16771,
+    "LoadStartHookOffset": "0x24E9130",
+    "CDPFilterHookOffset": "0x2E3C470",
+    "SceneOffsets": [1360, 1312]
+}

frida/config/addresses.16815.json

@@ -0,0 +1,6 @@
+{
+    "Version": 16815,
+    "LoadStartHookOffset": "0x2509690",
+    "CDPFilterHookOffset": "0x2E768D0",
+    "SceneOffsets": [1416, 1360]
+}

frida/config/addresses.16965.json

@@ -0,0 +1,6 @@
+{
+    "Version": 16965,
+    "LoadStartHookOffset": "0x2570220",
+    "CDPFilterHookOffset": "0x2F844A0",
+    "SceneOffsets": [1416, 1360]
+}

frida/config/addresses.17037.json

@@ -0,0 +1,6 @@
+{
+    "Version": 17037,
+    "LoadStartHookOffset": "0x257D0A0",
+    "CDPFilterHookOffset": "0x2FB2310",
+    "SceneOffsets": [1408, 1352]
+}

frida/config/addresses.17071.json

@@ -0,0 +1,6 @@
+{
+    "Version": 17071,
+    "LoadStartHookOffset": "0x258F370",
+    "CDPFilterHookOffset": "0x2FD3080",
+    "SceneOffsets": [1408, 1352]
+}

frida/config/addresses.17127.json

@@ -0,0 +1,6 @@
+{
+    "Version": 17127,
+    "LoadStartHookOffset": "0x2590910",
+    "CDPFilterHookOffset": "0x2FD4040",
+    "SceneOffsets": [1408, 1352]
+}

frida/config/addresses.18055.json

@@ -0,0 +1,6 @@
+{
+    "Version": 18055,
+    "LoadStartHookOffset": "0x25A1040",
+    "CDPFilterHookOffset": "0x30031E0",
+    "SceneOffsets": [1416, 1352]
+}

frida/config/addresses.18151.json

@@ -0,0 +1,6 @@
+{
+    "Version": 18151,
+    "LoadStartHookOffset": "0x25A2E20",
+    "CDPFilterHookOffset": "0x3013D20",
+    "SceneOffsets": [1416, 1352]
+}

frida/config/addresses.18787.json

@@ -0,0 +1,6 @@
+{
+    "Version": 18787,
+    "LoadStartHookOffset": "0x25B2870",
+    "CDPFilterHookOffset": "0x3028AD0",
+    "SceneOffsets": [1408, 1344]
+}

frida/config/addresses.18891.json

@@ -0,0 +1,6 @@
+{
+    "Version": 18891,
+    "LoadStartHookOffset": "0x25B50C0",
+    "CDPFilterHookOffset": "0x30245E0",
+    "SceneOffsets": [1408, 1344]
+}

frida/config/addresses.18955.json

@@ -0,0 +1,6 @@
+{
+    "Version": 18955,
+    "LoadStartHookOffset": "0x25B52C0",
+    "CDPFilterHookOffset": "0x30248B0",
+    "SceneOffsets": [1408, 1344]
+}

frida/config/addresses.19027.json

@@ -0,0 +1,6 @@
+{
+    "Version": 19027,
+    "LoadStartHookOffset": "0x25B52D0",
+    "CDPFilterHookOffset": "0x3024AD0",
+    "SceneOffsets": [1408, 1344]
+}

frida/hook.js

@@ -0,0 +1,124 @@
+const getMainModule = (version) => {
+    if (version >= 13331) {
+        return Process.findModuleByName("flue.dll");
+    }
+    return Process.findModuleByName("WeChatAppEx.exe");
+};
+
+const patchCDPFilter = (base, config) => {
+    // xref: SendToClientFilter OR devtools_message_filter_applet_webview.cc
+    const offset = config.CDPFilterHookOffset;
+    Interceptor.attach(base.add(offset), {
+        onEnter(args) {
+            send(
+                `[patch] CDP filter on enter, original value of input: ${args[0].readPointer()}`,
+            );
+            this.inputValue = args[0];
+        },
+        onLeave(retval) {
+            const inputValue = this.inputValue.readPointer();
+            if (inputValue.isNull() || inputValue.add(8).isNull()) {
+                // there's a chance the value could be null
+                // return here to avoid crash
+                return;
+            }
+
+            send(
+                `[patch] CDP filter on leave, patch input, now value: ${inputValue}; ` +
+                    `*(input + 8) = ${inputValue.add(8).readU32()}`,
+            );
+            if (inputValue.add(8).readU32() == 6) {
+                inputValue.add(8).writeU32(0x0);
+            }
+        },
+    });
+};
+
+const hookOnLoadScene = (a1, sceneOffsets) => {
+    const miniappConfigPtr = a1
+        .add(56)
+        .readPointer()
+        .add(sceneOffsets[0])
+        .readPointer();
+    const miniappScenePtr = miniappConfigPtr
+        .add(8)
+        .readPointer()
+        .add(sceneOffsets[1])
+        .readPointer()
+        .add(16)
+        .readPointer()
+        .add(488);
+    send(`[hook] scene: ${miniappScenePtr.readInt()}`);
+
+    // 1000: from issue #83 <-- will crash the process
+    // 1007: from issue #80
+    // 1008: from issue #53
+    // 1027: from issue #78
+    // 1035: from issue #78
+    // 1053: from issue #25
+    // 1074: from issue #32
+    // 1145: from search
+    // 1178: from phone (issue #117)
+    // 1256: from recent
+    // 1260: from frequently used
+    // 1302: from services
+    // 1308: minigame?
+    const sceneNumberArray = [
+        1005, 1007, 1008, 1027, 1035, 1053, 1074, 1145, 1178, 1256, 1260, 1302,
+        1308,
+    ];
+    if (!sceneNumberArray.includes(miniappScenePtr.readInt())) {
+        return;
+    }
+    send("[hook] hook scene condition -> 1101");
+    miniappScenePtr.writeInt(1101);
+
+    // TODO: customize debugging endpoint
+    // const websocketServerStringPtr = passArgs.add(8).readPointer().add(520);
+    // VERBOSE && console.log("[hook] hook websocket server, original: ", websocketServerStringPtr.readUtf8String());
+    // websocketServerStringPtr.writeUtf8String("ws://127.0.0.1:8189/");
+};
+
+const patchOnLoadStart = (base, config) => {
+    // xref: AppletIndexContainer::OnLoadStart
+    Interceptor.attach(base.add(config.LoadStartHookOffset), {
+        onEnter(args) {
+            send(
+                `[inteceptor] AppletIndexContainer::OnLoadStart onEnter, ` +
+                    `indexContainer.this: ${this.context.rcx}`,
+            );
+            // write dl to 0x1
+            if ((this.context.rdx & 0xff) !== 1) {
+                this.context.rdx = (this.context.rdx & ~0xff) | 0x1;
+            }
+            // handle onLoad scene
+            hookOnLoadScene(this.context.rcx, config.SceneOffsets);
+        },
+        onLeave(retval) {
+            // do nothing
+        },
+    });
+};
+
+const parseConfig = () => {
+    const rawConfig = `@@CONFIG@@`;
+    if (rawConfig.includes("@@")) {
+        // test addresses
+        return {
+            Version: 18955,
+            LoadStartHookOffset: "0x25B52C0",
+            CDPFilterHookOffset: "0x30248B0",
+            SceneOffsets: [1408, 1344],
+        };
+    }
+    return JSON.parse(rawConfig);
+};
+
+const main = () => {
+    const config = parseConfig();
+    const mainModule = getMainModule(config.Version);
+    patchOnLoadStart(mainModule.base, config);
+    patchCDPFilter(mainModule.base, config);
+};
+
+main();