Python实现向好友发送微信消息

// 微信通用结构体
struct WxBaseStruct
{
	wchar_t* buffer;
	DWORD length;
	DWORD maxLength;
	DWORD fill1;
	DWORD fill2;
	WxBaseStruct(wchar_t* pStr) {
		buffer = pStr;
		length = wcslen(pStr);
		maxLength = wcslen(pStr) * 2;
		fill1 = 0x0;
		fill2 = 0x0;
	}
};
void SendText( wchar_t* wsTextMsg) {
    // 发送的好友，filehelper是文件传输助手
	wchar_t wsWxId[0x10] = L"filehelper";
	WxBaseStruct wxWxid(wsWxId);
	// 发送的消息内容
	WxBaseStruct wxTextMsg(wsTextMsg);
	wchar_t** pWxmsg = &wxTextMsg.buffer;
	char buffer[0x3B0] = { 0 };
	char wxNull[0x100] = { 0 };
	DWORD dllBaseAddress = (DWORD)GetModuleHandleA("WeChatWin.dll");
	// 发消息的函数call地址
	DWORD callAddress = dllBaseAddress + 0x521D30;
	__asm {
		lea eax, wxNull;
		push 0x1;
		push eax;
		mov edi, pWxmsg;
		push edi;
		lea edx, wxWxid;
		lea ecx, buffer;
		call callAddress;
		add esp, 0xC;
	}
}

import ctypes
dll = ctypes.WinDLL('kernel32.dll')
WriteProcessMemory = dll.WriteProcessMemory
WriteProcessMemory.argtypes = [
    ctypes.c_void_p,
    ctypes.c_void_p,
    ctypes.c_void_p,
    ctypes.c_size_t,
    ctypes.POINTER(ctypes.c_size_t)
]
WriteProcessMemory.restype = ctypes.c_long

import pymem
import ctypes
def start_thread(process_handle, address, params=None):
    '''调用CreateRemoteThread
    process_handle： 外部进程句柄
    address: 要调用的函数地址
    params: 参数地址
    '''
    params = params or 0
    NULL_SECURITY_ATTRIBUTES = ctypes.cast(0, pymem.ressources.structure.LPSECURITY_ATTRIBUTES)
    thread_h = pymem.ressources.kernel32.CreateRemoteThread(
        process_handle,
        NULL_SECURITY_ATTRIBUTES,
        0,
        address,
        params,
        0,
        ctypes.byref(ctypes.c_ulong(0))
    )
    last_error = ctypes.windll.kernel32.GetLastError()
    if last_error:
        pymem.logger.warning('Got an error in start thread, code: %s' % last_error)
    pymem.ressources.kernel32.WaitForSingleObject(thread_h, -1)
    return thread_h
def main(wxpid, content):
    # 获取进程句柄
    process_handle = pymem.process.open(wxpid)
    # 这里通过加载dll(sendText.dll) ，获取到 SendText的地址偏移
    # 当然你也可以直接用查看pe的软件直接看SendText函数的偏移
    ctypes.CDLL(r'F:\Code\汇编\sendText\Release\sendText.dll')
    local_sendText_handle = pymem.ressources.kernel32.GetModuleHandleW("sendText.dll")
    SendText_address = pymem.ressources.kernel32.GetProcAddress(local_sendText_handle, b"SendText")
    sendText_Offset = SendText_address - local_sendText_handle
    # 获取到微信进程中sendText.dll的句柄
    process_sendText_handle = pymem.process.module_from_name(process_handle, "sendText.dll")
    # 微信进程内SendText的函数地址就等于 sendText.dll的基址加上偏移
    SendText = process_sendText_handle.lpBaseOfDll + sendText_Offset
    # 开始构造消息，因为是参数是wchar_t类型的，所以需要编码为utf-16的
    msg = content.encode('utf-16')
    # 在微信进程申请一块内存空间，大小为1000个字节
    address = pymem.memory.allocate_memory(process_handle, 1000)
    # 输出SendText地址和申请的内存地址
    print(SendText, "address:", hex(address))
    # 往申请的内存地址写入我们要发送的消息内容
    pymem.ressources.kernel32.WriteProcessMemory(process_handle, address, msg, len(msg), None)
    # 调用CreateRemoteThread发送消息
    thread_h = start_thread(process_handle, SendText, address)
    print(thread_h)
if __name__ == "__main__":
    wxpid = 18196
    main(wxpid, "Python test！")

import pymem
import ctypes
def copy_code(wxpid, source_addr, buffer_len, class="lazy" data-src_addr):
    # 获取进程句柄
    process_handle = pymem.process.open(wxpid)
    # 申请一块临时内存空间存放读取的机器码
    buffer = ctypes.create_string_buffer(buffer_len)
    # 读出source_addr地址里的内容到buffer，长度为buffer_len
    pymem.ressources.kernel32.ReadProcessMemory(process_handle, source_addr, buffer, buffer_len, None)
    # 写入buffer.raw内容到class="lazy" data-src_addr，长度为buffer_len
    pymem.ressources.kernel32.WriteProcessMemory(process_handle, class="lazy" data-src_addr, buffer.raw, buffer_len, None)
    # 打印内容
    print(buffer.raw.hex())
if __name__ == "__main__":
    wxpid = 18196
    source_addr = 0x508C1010
    buffer_len = 0x127
    class="lazy" data-src_addr = 0x508C1D80
    copy_code(wxpid, source_addr, buffer_len, class="lazy" data-src_addr )

import os
import pymem
import ctypes
import time
def calc_code(calladdr, codeaddr):
    code = calladdr - codeaddr - 5
    hex_code = hex(code & 0xFFFFFFFF)
    return hex_code
def convert_addr(addr):
    if isinstance(addr, int):
        addr = hex(addr)
    if addr.startswith("0x") or addr.startswith("0X"):
        addr = addr[2:]
    if len(addr) < 8:
        addr = (8-len(addr))*'0' + addr
    tmp = []
    for i in range(0, 8, 2):
        tmp.append(addr[i:i+2])
    tmp.reverse()
    return ''.join(tmp)
def start_thread(process_handle, address, params=None):
    '''调用CreateRemoteThread
    process_handle： 外部进程句柄
    address: 要调用的函数地址
    params: 参数地址
    '''
    params = params or 0
    NULL_SECURITY_ATTRIBUTES = ctypes.cast(0, pymem.ressources.structure.LPSECURITY_ATTRIBUTES)
    thread_h = pymem.ressources.kernel32.CreateRemoteThread(
        process_handle,
        NULL_SECURITY_ATTRIBUTES,
        0,
        address,
        params,
        0,
        ctypes.byref(ctypes.c_ulong(0))
    )
    last_error = ctypes.windll.kernel32.GetLastError()
    if last_error:
        pymem.logger.warning('Got an error in start thread, code: %s' % last_error)
    pymem.ressources.kernel32.WaitForSingleObject(thread_h, -1)
    return thread_h
def main(wxpid, content):
    format_code = '558bec81ecfc040000a1{filehelper10}0f1005{filehelper}8945c466a1{buffer}668945c88d45b48bc866c745d200000f1145b4560f57c08945d457660fd645ca8d5102668b0183c1026685c075f52bcac745e000000000d1f9894dd8c745e4000000008d04098b4d088bd18945dc894de88d7202668b0283c2026685c075f52bd6d1fa8955ec8d5102668b0183c1026685c075f52bcac745f400000000d1f968b00300006a00c745f8000000008d04098945f08d45e88945088d8504fbffff50e8{memset1}68000100008d85b4feffff6a0050e8{memset2}83c41868{wechatwin}ff15{GetModuleHandleA}05301d52008945fc8d85b4feffff6a01508b7d08578d55d48d8d04fbffffff55fc83c40c5f5e8be55dc3'
    process_handle = pymem.process.open(wxpid)
    filehelper_address = pymem.memory.allocate_memory(process_handle, 50)
    text = "filehelper".encode("utf-16le")
    pymem.ressources.kernel32.WriteProcessMemory(process_handle, filehelper_address, text, len(text), None)
    filehelper_hex_code = convert_addr(filehelper_address)
    filehelper10_hex_code = convert_addr(filehelper_address+0x10)
    buffer_address = pymem.memory.allocate_memory(process_handle, 16)
    buffer_hex_code = convert_addr(buffer_address)
    WeChatWin_address = pymem.memory.allocate_memory(process_handle, 100)
    msg = "WeChatWin.dll".encode("ascii")
    pymem.ressources.kernel32.WriteProcessMemory(process_handle, WeChatWin_address, msg, len(msg), None)
    wechatwin_hex_code = convert_addr(WeChatWin_address)
    ctypes.CDLL('kernel32.dll')
    local_kernel32_handle = pymem.ressources.kernel32.GetModuleHandleW("kernel32.dll")
    GetModuleHandleA_address = pymem.ressources.kernel32.GetProcAddress(local_kernel32_handle, b"GetModuleHandleA")
    GetModuleHandleA_Offset = GetModuleHandleA_address - local_kernel32_handle
    process_kernel32_handle = pymem.process.module_from_name(process_handle, "kernel32.dll")
    GetModuleHandleA = process_kernel32_handle.lpBaseOfDll + GetModuleHandleA_Offset
    GetModuleHandleA_address = pymem.memory.allocate_memory(process_handle, 4)
    pymem.memory.write_int(process_handle, GetModuleHandleA_address, GetModuleHandleA)
    GetModuleHandleA_hex_code = convert_addr(GetModuleHandleA_address)
    process_vcruntime140_handle = pymem.process.module_from_name(process_handle, "vcruntime140.dll")
    if not process_vcruntime140_handle:
        pymem.process.inject_dll(process_handle, r'C:\Software\WeChat\3.7.0.26\vcruntime140.dll'.encode("ascii"))
    process_vcruntime140_handle = pymem.process.module_from_name(process_handle, "vcruntime140.dll")
    memset = process_vcruntime140_handle.lpBaseOfDll + 0xDA10
    code_address = pymem.memory.allocate_memory(process_handle, 500)
    memset1 = convert_addr(calc_code(memset, code_address+0xBE))
    memset2 = convert_addr(calc_code(memset, code_address+0xD1))
    hex_code = format_code.format(filehelper10=filehelper10_hex_code, filehelper=filehelper_hex_code, 
        buffer=buffer_hex_code, wechatwin=wechatwin_hex_code, memset1=memset1, memset2=memset2,
        GetModuleHandleA=GetModuleHandleA_hex_code)
    hex_code = bytes.fromhex(hex_code)
    pymem.ressources.kernel32.WriteProcessMemory(process_handle, code_address, hex_code, len(hex_code), None)
    msg = content.encode('utf-16le')
    address = pymem.memory.allocate_memory(process_handle, 1000)
    pymem.ressources.kernel32.WriteProcessMemory(process_handle, address, msg, len(msg), None)
    print(hex(code_address))
    # 调用CreateRemoteThread发送消息
    thread_h = start_thread(process_handle, code_address, address)
    time.sleep(0.5)
    pymem.memory.free_memory(process_handle, filehelper_address)
    pymem.memory.free_memory(process_handle, buffer_address)
    pymem.memory.free_memory(process_handle, WeChatWin_address)
    pymem.memory.free_memory(process_handle, code_address)
    pymem.memory.free_memory(process_handle, GetModuleHandleA_address)
if __name__ == "__main__":
    wxpid = 24600
    process_handle = pymem.process.open(wxpid)
    main(wxpid, "你好")