【失败】关于微信的逆向（有hook检查，暂未分析）

course/frida/03_frida-node/wechat-devtools/Core/AddressSource.end

+;
+for(var addressname in address){
+    address[addressname] = parseInt(address[addressname]);
+};
+

course/frida/03_frida-node/wechat-devtools/Core/AddressSource.head

+var address = 
\ No newline at end of file

course/frida/03_frida-node/wechat-devtools/WeChatAppEx.exe.js

+// node main.js   9079   x64
+
+import frida from "frida";
+// var frida = require("frida");
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+function onMessage(message, data) {
+  if (message.type === 'send') {
+      console.log(message.payload);
+  } else if (message.type === 'error') {
+      console.error(message.stack);
+  }
+}
+
+function init() {
+  let addressSource = '';
+  let version = process.argv[2] || "8447";
+  let bit = process.argv[3] || "x64";
+
+  try {
+    let addressSourceHeadFilePath = path.join(__dirname, `/Core/AddressSource.head`);
+    let addressSourceEndFilePath = path.join(__dirname, `/Core/AddressSource.end`);
+    
+    let addressFilePath = path.join(__dirname, `/Core/WeChatAppEx.exe/address_${version}_${bit}.json`);
+    let hookFilePath = path.join(__dirname, `/Core/WeChatAppEx.exe/hook.js`);
+
+    fs.accessSync(addressFilePath);
+    addressSource += fs.readFileSync(addressSourceHeadFilePath);
+    addressSource += fs.readFileSync(addressFilePath);
+    addressSource += fs.readFileSync(addressSourceEndFilePath);
+    addressSource += fs.readFileSync(hookFilePath);
+  } catch (error) {
+    console.log(`暂不支持 ${version}_${bit} 的版本!`, error)
+    return '';
+  }
+
+  console.log("HOOK文件组装成功!")
+  return addressSource;
+}
+
+(async () => {
+  let addressSource = init();
+  if (!addressSource) return;
+
+  var device = await frida.getLocalDevice();
+  var processes = await device.enumerateProcesses();
+  var pid = -1;
+  processes.forEach(async (p_) => {
+    if (p_.name == "WeChatAppEx.exe") {
+      console.log(p_.name, p_.pid, p_);
+      // let commandLine = cmdline.getCmdline(p_.pid);
+      // if(commandLine.indexOf("--type=") == -1){
+      //     pid = p_.pid;
+      // }
+
+      // 第一个就是
+      if (pid == -1) {
+        pid = p_.pid;
+      }
+    }
+  });
+  console.log("WeChatAppEx.exe 主进程 pid = " + pid);
+  if (pid == -1) {
+    return;
+  }
+
+  let session = await frida.attach(pid);
+  let script = await session.createScript(addressSource);
+  script.message.connect(onMessage);
+  await script.load();
+})().catch((error) => {
+  console.error(error.stack);
+});

course/frida/03_frida-node/wechat-devtools/WeChatWin.dll.js

+
+let version = (process.argv[2] + "").toLowerCase();
+let bit = (process.argv[3] + "").toLowerCase();
+let exePath = (process.argv[4] + "").toLowerCase();
+
+const fs = require('fs');
+const path = require('path');
+try {
+    fs.accessSync(path.join(exePath, "/WeChatWin_old.dll"));
+    console.log(`已经是替换后的WeChatWin.dll! 请勿重复运行`)
+    return;
+} catch {
+    
+}
+
+
+let addressFilePath =path.join(__dirname, `/Core/WeChatWin.dll/address_${version}_${bit}.json`);
+let address = null;
+try {
+    fs.accessSync(addressFilePath);
+    address = JSON.parse(fs.readFileSync(addressFilePath));
+} catch (error) {
+    console.log(`暂不支持 ${version}_${bit} 的版本!`)
+    return;
+}
+try {
+    address.XwebEnableInspect = parseInt(address.XwebEnableInspect) + 1;
+    fs.copyFileSync(path.join(exePath, "/WeChatWin.dll"), path.join(exePath, "/WeChatWin_old.dll"));
+    console.log("WeChatWin.dll已备份!", path.join(exePath, "/WeChatWin_old.dll"))
+    let fd = fs.openSync(path.join(exePath, "/WeChatWin.dll"), "r+");
+    let buf = Buffer.alloc(1);
+    buf.hexWrite("85");  //JZ 84   JNZ 85
+    fs.writeSync(fd, buf, 0, 1, address.XwebEnableInspect)
+    console.log("完成覆盖!")
+} catch (error) {
+    console.log(error)
+}

course/frida/03_frida-node/wechat-devtools/all.bat

+node WeChatWin.dll.js
+ping 127.0.0.1 -n 3
+
+cd /d J:\_ALL\CODE\gitcode\kinghzking\MyOpen\course\frida\03_frida-node\wechat-devtools
+node WeChatAppEx.exe.js   9079   x64

course/frida/03_frida-node/wechat-devtools/cpp-hook/test/test.sln

+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.33529.622
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "wechat-devtools", "wechat-devtools\wechat-devtools.vcxproj", "{8C4064E2-3CD3-4706-B746-D1129A52A875}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{8C4064E2-3CD3-4706-B746-D1129A52A875}.Debug|x64.ActiveCfg = Debug|x64
+		{8C4064E2-3CD3-4706-B746-D1129A52A875}.Debug|x64.Build.0 = Debug|x64
+		{8C4064E2-3CD3-4706-B746-D1129A52A875}.Debug|x86.ActiveCfg = Debug|Win32
+		{8C4064E2-3CD3-4706-B746-D1129A52A875}.Debug|x86.Build.0 = Debug|Win32
+		{8C4064E2-3CD3-4706-B746-D1129A52A875}.Release|x64.ActiveCfg = Release|x64
+		{8C4064E2-3CD3-4706-B746-D1129A52A875}.Release|x64.Build.0 = Release|x64
+		{8C4064E2-3CD3-4706-B746-D1129A52A875}.Release|x86.ActiveCfg = Release|Win32
+		{8C4064E2-3CD3-4706-B746-D1129A52A875}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {73CAA0D8-B022-4FD6-9D86-A964B3925154}
+	EndGlobalSection
+EndGlobal

course/frida/03_frida-node/wechat-devtools/cpp-hook/test/wechat-devtools/common/EZDetour.cpp

+#include "stdafx.h"
+#include "EZDetour.h"
+#include <assert.h>
+#include <detours/detours.h>
+#include "log/my_log.h"
+//#include "MyCommon.h"
+extern FARPROC MyGetProcAddress(const char* dll_name, const char* fun_name);
+
+
+namespace my
+{
+
+LONG WINAPI EZDetour::Attach(_Inout_ PVOID &ppPointer, _In_ PVOID pDetour)
+{
+    if (ppPointer == 0 || pDetour == 0) {
+        assert(true);
+        return 0;
+    }
+
+    addr_ = ppPointer;
+    pDetourFunc_ = pDetour;
+    DetourRestoreAfterWith();
+    DetourTransactionBegin();
+    LONG result = 0;
+    MyLogD("addr_, pDetourFunc_ = %016I64X, %016I64X.\n", addr_, pDetourFunc_);
+    result = DetourAttach(&(PVOID&)addr_, pDetourFunc_);
+    LONG result2 = DetourTransactionCommit();
+    MyLogD("result, result2 = %08X, %08X.\n", result, result2);
+    return result2;
+}
+
+LONG WINAPI EZDetour::Attach(const char* dll_name, const char* fun_name, _In_ PVOID pDetour)
+{
+    FARPROC addr = MyGetProcAddress(dll_name, fun_name);
+    return this->Attach((PVOID&)addr, pDetour);
+}
+
+
+LONG WINAPI EZDetour::detach(_Inout_ PVOID &ppPointer, _In_ PVOID pDetour)
+{
+    MyLogD("ppPointer, pDetour = %08X, %08X.\n", ppPointer, pDetour);
+
+    if (ppPointer == 0 || pDetour == 0) {
+        assert(true);
+        return 0;
+    }
+
+    DetourRestoreAfterWith();
+    DetourTransactionBegin();
+    LONG result = 0;
+    result = DetourDetach(&(PVOID&)ppPointer, pDetour);
+    LONG result2 = DetourTransactionCommit();
+    MyLogD("result, result2 = %08X, %08X.\n", result, result2);
+    // Ѿж
+    ppPointer = 0;
+    return result2;
+}
+
+void detour_func_null()
+{
+    MY_ENTER_FUNCTION;
+}
+
+}
\ No newline at end of file

course/frida/03_frida-node/wechat-devtools/cpp-hook/test/wechat-devtools/common/EZDetour.h

+#pragma once
+#include <Windows.h>
+
+namespace my
+{
+// hook通用函数，置空目标函数逻辑
+void detour_func_null();
+
+
+class EZDetour
+{
+public:
+    EZDetour() : addr_(0) {}
+    ~EZDetour()
+    {
+        this->detach(addr_, pDetourFunc_);
+    }
+
+public:
+    //DWORD     GetAddr() { return addr_; }
+    LONG WINAPI Attach(_Inout_ PVOID &ppPointer, _In_ PVOID pDetour);
+    LONG WINAPI Attach(const char* dll_name, const char* fun_name, _In_ PVOID pDetour);
+    LONG WINAPI Detach()
+    {
+        return this->detach(addr_, pDetourFunc_);
+    }
+
+private:
+    // 不需要主动调用，析构函数自动处理
+    LONG WINAPI detach(_Inout_ PVOID &ppPointer, _In_ PVOID pDetour);
+
+public:
+    PVOID                       addr_;
+private:
+    PVOID                       pDetourFunc_;
+};
+}

course/frida/03_frida-node/wechat-devtools/cpp-hook/test/wechat-devtools/dllmain.cpp

+// dllmain.cpp : 定义 DLL 应用程序的入口点。
+#include "pch.h"
+
+BOOL APIENTRY DllMain( HMODULE hModule,
+                       DWORD  ul_reason_for_call,
+                       LPVOID lpReserved
+                     )
+{
+    switch (ul_reason_for_call)
+    {
+    case DLL_PROCESS_ATTACH:
+    case DLL_THREAD_ATTACH:
+    case DLL_THREAD_DETACH:
+    case DLL_PROCESS_DETACH:
+        break;
+    }
+    return TRUE;
+}
+

course/frida/03_frida-node/wechat-devtools/cpp-hook/test/wechat-devtools/framework.h

+#pragma once
+
+#define WIN32_LEAN_AND_MEAN             // 从 Windows 头文件中排除极少使用的内容
+// Windows 头文件
+#include <windows.h>

course/frida/03_frida-node/wechat-devtools/cpp-hook/test/wechat-devtools/pch.cpp

+// pch.cpp: 与预编译标头对应的源文件
+
+#include "pch.h"
+
+// 当使用预编译的头时，需要使用此源文件，编译才能成功。

course/frida/03_frida-node/wechat-devtools/cpp-hook/test/wechat-devtools/pch.h

+// pch.h: 这是预编译标头文件。
+// 下方列出的文件仅编译一次，提高了将来生成的生成性能。
+// 这还将影响 IntelliSense 性能，包括代码完成和许多代码浏览功能。
+// 但是，如果此处列出的文件中的任何一个在生成之间有更新，它们全部都将被重新编译。
+// 请勿在此处添加要频繁更新的文件，这将使得性能优势无效。
+
+#ifndef PCH_H
+#define PCH_H
+
+// 添加要在此处预编译的标头
+#include "framework.h"
+
+#endif //PCH_H

course/frida/03_frida-node/wechat-devtools/cpp-hook/test/wechat-devtools/wechat-devtools.vcxproj

+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{8c4064e2-3cd3-4706-b746-d1129a52a875}</ProjectGuid>
+    <RootNamespace>wechatdevtools</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;WECHATDEVTOOLS_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;WECHATDEVTOOLS_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;WECHATDEVTOOLS_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;WECHATDEVTOOLS_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClInclude Include="common\EZDetour.h" />
+    <ClInclude Include="framework.h" />
+    <ClInclude Include="pch.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="common\EZDetour.cpp" />
+    <ClCompile Include="dllmain.cpp" />
+    <ClCompile Include="pch.cpp">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
+    </ClCompile>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file

course/frida/03_frida-node/wechat-devtools/cpp-hook/test/wechat-devtools/wechat-devtools.vcxproj.filters

+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="源文件">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="头文件">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="资源文件">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+    <Filter Include="common">
+      <UniqueIdentifier>{06fa8db7-3a12-40e6-ba40-7076342bd4db}</UniqueIdentifier>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="framework.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="pch.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="common\EZDetour.h">
+      <Filter>common</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="pch.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="common\EZDetour.cpp">
+      <Filter>common</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
\ No newline at end of file