UserInfo.cpp 4.5 KB
Newer Older
L
ljc545w 已提交
1 2 3 4 5
#include "pch.h"
#include <typeinfo>
#include <string>
#include <vector>

G
Gogs 已提交
6 7 8 9 10 11
#define GetUserInfoCall1Offset 0x5F917490 - 0x5F230000
#define GetUserInfoCall2Offset 0x5F2BD9A0 - 0x5F230000
#define GetUserInfoCall3Offset 0x5F619F70 - 0x5F230000

#define DeleteCacheCall1Offset 0x56C349A0 - 0x56B80000
#define DeleteCacheCall2Offset 0x56D983B0 - 0x56B80000
L
ljc545w 已提交
12 13 14 15 16 17 18 19 20

struct GetUserInfoStruct {
	DWORD message;
	DWORD length;
};

wstring wUserInfo = L"";
GetUserInfoStruct ret = { 0 };

G
Gogs 已提交
21
struct GetDetailUserInfoParamStruct {
L
ljc545w 已提交
22 23 24 25
	WxString* pWxString;
	DWORD ptr1 = 0;
	DWORD ptr2 = 0;
	char fill[0x18] = { 0 };
G
Gogs 已提交
26
	GetDetailUserInfoParamStruct(WxString* pWxString) {
L
ljc545w 已提交
27 28 29 30 31 32
		this->pWxString = pWxString;
		ptr1 = DWORD(pWxString) + sizeof(WxString);
		ptr2 = DWORD(pWxString) + sizeof(WxString);
	}
};

G
Gogs 已提交
33
struct UserInfoBaseParamStruct {
L
ljc545w 已提交
34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87
	DWORD data;
	DWORD endbuffer1;
	DWORD endbuffer2;
	char fill[0x18] = { 0 };
};


VOID WxUserInfo(DWORD address) {
	vector<DWORD> InfoType{
		address + 0x10,
		address + 0x24,
		address + 0x38,
		address + 0x6C,
		address + 0xFC,
		address + 0x110,
		address + 0x19C,
		address + 0x1B0,
		address + 0x1C4,
		address + 0x1D8,
		address + 0x27C
	};
	vector<wchar_t*> InfoTypeName{
		(WCHAR*)L"\"wxId\"",
		(WCHAR*)L"\"wxNumber\"",
		(WCHAR*)L"\"wxV3\"",
		(WCHAR*)L"\"wxNickName\"",
		(WCHAR*)L"\"wxBigAvatar\"",
		(WCHAR*)L"\"wxSmallAvatar\"",
		(WCHAR*)L"\"wxSignature\"",
		(WCHAR*)L"\"wxNation\"",
		(WCHAR*)L"\"wxProvince\"",
		(WCHAR*)L"\"wxCity\"",
		(WCHAR*)L"\"wxBackground\"",
	};
	wUserInfo += L"{";
	for (unsigned int i = 0; i < InfoType.size(); i++) {
		wchar_t* wstemp = ((*((DWORD*)InfoType[i])) != 0) ? (WCHAR*)(*((LPVOID*)InfoType[i])) : (WCHAR*)L"null";
		wUserInfo = wUserInfo + InfoTypeName[i] + L":\"" + wstemp + L"\"";
		if (i != InfoType.size() - 1) {
			wUserInfo += L",";
		}
	}
	wUserInfo += L"}";
#ifdef _DEBUG
	wcout.imbue(locale("chs"));
	wcout << wUserInfo.c_str() << endl;
#endif
}


DWORD GetWxUserInfoRemote(LPVOID lparamter) {
	wchar_t* userwxid = (wchar_t*)lparamter;
	DWORD address = 0;
	
G
Gogs 已提交
88
	if (!GetUserInfoByWxId(userwxid, address)) {
L
ljc545w 已提交
89 90 91 92 93 94 95
		return 0;
	}
	ret.message = (DWORD)wUserInfo.c_str();
	ret.length = (DWORD)wUserInfo.length();
	return (DWORD)&ret;
}

G
Gogs 已提交
96 97 98 99 100 101 102
VOID DeleteUserInfoCacheRemote() {
	if (ret.length) {
		ZeroMemory((wchar_t*)ret.message, ret.length * 2 + 2);
		ret.length = 0;
		wUserInfo = L"";
	}
}
L
ljc545w 已提交
103

L
ljc545w 已提交
104
BOOL __stdcall GetUserInfoByWxId(wchar_t* wxid,DWORD &address) {
L
ljc545w 已提交
105
	DWORD WeChatWinBase = GetWeChatWinBase();
G
Gogs 已提交
106 107 108
	DWORD GetUserDetailInfoCall1 = WeChatWinBase + GetUserInfoCall1Offset;
	DWORD GetUserDetailInfoCall2 = WeChatWinBase + GetUserInfoCall2Offset;
	DWORD GetUserDetailInfoCall3 = WeChatWinBase + GetUserInfoCall3Offset;
L
ljc545w 已提交
109

G
Gogs 已提交
110 111
	DWORD DeleteCacheCall1 = WeChatWinBase + DeleteCacheCall1Offset;
	DWORD DeleteCacheCall2 = WeChatWinBase + DeleteCacheCall2Offset;
L
ljc545w 已提交
112 113 114 115 116
	WxString* pWxid = new WxString;
	pWxid->buffer = wxid;
	pWxid->length = wcslen(wxid);
	pWxid->maxLength = wcslen(wxid) * 2;

G
Gogs 已提交
117 118 119
	UserInfoBaseParamStruct temp = { 0 };
	UserInfoBaseParamStruct userinfo = { 0 };
	GetDetailUserInfoParamStruct pUser(pWxid);
L
ljc545w 已提交
120 121 122 123 124
	DWORD isSuccess = 0;

	__asm {
		pushad;
		pushfd;
G
Gogs 已提交
125
		// mov eax, 0x7;
L
ljc545w 已提交
126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142
		lea ecx, pUser;
		lea edx, temp;
		call GetUserDetailInfoCall1;
		call GetUserDetailInfoCall2;
		lea ecx, userinfo;
		push ecx;
		lea ecx, temp;
		push ecx;
		mov ecx, eax;
		call GetUserDetailInfoCall3;
		mov isSuccess, eax;
		popfd;
		popad;
	}
	address = userinfo.data;
	if(isSuccess != 0)
		WxUserInfo(address);
G
Gogs 已提交
143
	// 释放内存
L
ljc545w 已提交
144 145 146 147 148 149 150 151 152 153 154 155 156 157 158
	__asm {
		pushad;
		pushfd;
		lea ecx, temp;
		call DeleteCacheCall1;
		lea ecx, userinfo;
		call DeleteCacheCall2;
		popfd;
		popad;
	}
	delete pWxid;
	pWxid = NULL;
	return (isSuccess != 0);
}

G
Gogs 已提交
159
// 另外一个查询好友信息的地方
L
ljc545w 已提交
160
BOOL __stdcall GetWxUserInfoByWxid2(wchar_t* wxid, DWORD& address) {
L
ljc545w 已提交
161
	DWORD WeChatWinBase = GetWeChatWinBase();
G
Gogs 已提交
162 163 164
	DWORD WxUserDataCall1 = WeChatWinBase + 0x645BD9A0 - 0x64530000;
	DWORD WxUserDataCall2 = WeChatWinBase + 0x64C08420 - 0x64530000;
	DWORD WxUserDataCall3 = WeChatWinBase + 0x64914260 - 0x64530000;
L
ljc545w 已提交
165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189
	char buffer[0xF90] = { 0 };
	WxBaseStruct pWxid(wxid);
	DWORD r_ebx = 0;
	DWORD isSuccess = 0;
	__asm
	{
		pushad;
		call WxUserDataCall1;
		lea ebx, buffer;
		mov esi, eax;
		push ebx;
		sub esp, 0x14;
		lea eax, pWxid;
		mov ecx, esp;
		push eax;
		call WxUserDataCall2;
		mov ecx, esi;
		call WxUserDataCall3;
		mov r_ebx, ebx;
		mov isSuccess, eax;
		popad;
	}
	address = r_ebx;
	return isSuccess;
}