微信机器人

Posted 2022-12-11 xxzblog

原文地址：https://uyiplus.com/2020/pcwechat_helper

注入dll到微信

0x0 首先要打开微信进程

wchar_t wxPath[] = L"C:\\\\Program Files (x86)\\\\Tencent\\\\WeChat\\\\WeChat.exe";
STARTUPINFO si =  0 ;
PROCESS_INFORMATION pi =  0 ;
ZeroMemory(&si, sizeof(si));
si.cb = sizeof(si);
ZeroMemory(&pi, sizeof(pi));
si.dwFlags = STARTF_USESHOWWINDOW;
si.wShowWindow = SW_SHOW;

// 打开进程
BOOL bCp = CreateProcess(NULL, wxPath, NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);
if (bCp == 0)

  MessageBox(NULL, L"启动微信失败", L"错误", 0);
  return;

0x1 获取自己编写的dll写入到微信

// 获取进程ID
DWORD processID = pi.dwProcessId;
// 打开进程
HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);

// 获取自己的dll路径
string dllPath = GetDllPath();
// 申请内存
LPVOID dllBuffer = VirtualAllocEx(process, NULL, MAX_PATH, MEM_COMMIT, PAGE_READWRITE);
// 写入dll路径
BOOL bWp = WriteProcessMemory(process, dllBuffer, dllPath.c_str(), MAX_PATH, NULL);
if (bWp == 0)

  MessageBox(NULL, L"写入dll路径失败", L"错误", 0);
  return;

0x2 加载dll，创建远程线程

// 获取LoadLibrary()函数
FARPROC proc = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");

// 创建远程线程
HANDLE hThread = CreateRemoteThread(process, NULL, 0, (LPTHREAD_START_ROUTINE)proc, dllBuffer, 0, NULL);
if (hThread == NULL) 
  MessageBox(NULL, L"创建线程失败", L"错误", MB_OK);
  return;

WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
CloseHandle(process);

0x3 写入dll完成后，自己的dll就可以操作微信任意内存了

获取个人信息

DWORD GetWeChatWinAddr()

	if (weChatWinDllAddr == 0)
	
		weChatWinDllAddr = (DWORD) LoadLibrary(L"WeChatWin.dll");
	
	return weChatWinDllAddr;


// 2.7.1.88
DWORD base = GetWeChatWinAddr();
char* wxid = (char*) (base + 0x1397440); // 微信号
char* nickname = (char*) (base + 0x13972DC); // 昵称
char* head = (char*) (*(DWORD*)(base + 0x13975A4)); // 头像

0x4 成品展示