Skip to content

[config] support WMPF 25558 (Windows x86_64) - #270

Open
potacotion wants to merge 1 commit into
evi0s:mainfrom
potacotion:support-25558
Open

[config] support WMPF 25558 (Windows x86_64)#270
potacotion wants to merge 1 commit into
evi0s:mainfrom
potacotion:support-25558

Conversation

@potacotion

Copy link
Copy Markdown
Contributor

New WMPF version support: 25558 (Windows x86_64)

Adds frida/config/win32/addresses.25558.json:

{
    "Version": 25558,
    "LoadStartHookOffset": "0x2ce7c50",
    "CDPFilterHookOffset": "0x3978930",
    "SceneOffsets": [64, 1536, 8, 1472, 16, 456]
}

Compared to 25510 (PR #265): LoadStartHookOffset +0x3610, CDPFilterHookOffset +0x3940, SceneOffsets unchanged (structures identical).

How offsets were located

Same methodology as #265, automated into a static pipeline (byte-level scan + capstone, no IDA required):

  • Scene check function 0x363a690: located via the unique cmp dword ptr [x+0x1C8], 0x44D encoding (constant 1101 appears exactly once in the whole binary), contains the ws:__localhost:9421 construction; chain tail +8 → +0x5C0 → +0x10 → +0x1C8
  • LoadStartHookOffset 0x2ce7c50: the only direct caller of the scene check function (call @ 0x2ce7e80); register backtracking at the call site yields *(*(this+0x40) + 0x600); corroborated by the ..\..\flue\browser\applet\applet_index_container.cc literal reference and the debug flag (edx) read at entry
  • CDPFilterHookOffset 0x3978930: first callee of the SendToClientFilter string xref function; call site followed by cmp dword ptr [rdi+8], 6 (matches the retval+8 == 6 patch semantics)

Verification

Verified live on WeChat 4.x with WMPF 25558:

[frida] script loaded, WMPF version: 25558, pid: 39496
[frida client] [inteceptor] AppletIndexContainer::OnLoadStart onEnter, indexContainer.this: 0x3f8c09149e80
[frida client] [hook] scene: 1101
[frida client] [hook] hook scene condition -> 1101
[miniapp] miniapp client connected
[cdp] CDP client connected
[frida client] [patch] CDP filter on enter, original value of input: 0x3f8c0d38e878
[frida client] [patch] CDP filter on leave, patch input, now value: 0x3f8c0c4040c0; *(input + 8) = 6

End-to-end: Runtime.evaluate("1+1") through the CDP proxy (ws://127.0.0.1:62000) returned {"type":"number","value":2} executed inside the mini program.

Also updates the Support Status lists in both READMEs.

Located via the same static pipeline as 25510 (scene magic 1101 unique encoding, direct-caller backtracking, SendToClientFilter anchor). Verified live: OnLoadStart hooked, scene patched to 1101, miniapp connected, Runtime.evaluate round-trip succeeded.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant