在电脑上直接调试微信WxApkg小程序

效果图

思路：打开WeChatAppEx的调试日志

技术选型

1. 免维护：我使用的是8391版本的WeChatAppEx。考虑到我们以后估计也会经常调试小程序，我设计的时候希望能尽可能通用。

2. 方便挂载调试器：我们希望能在一开始就attach上debugger。而WeChatAppEx的初始化速度很快，如果十几秒内没有响应，微信就会重启一个新的WeChatAppEx，如果重启5次之后都不成功，那么就必须重启微信来恢复小程序功能。所以我们既不能sleep太久，也不能不sleep。

让微信不删除第三方dll

寻找关键patch逻辑

自动化寻找patch位置（patchfinder） - 寻找函数

1. 找到”debug.log”的位置，转为VA

2. 然后对着每个位置用上面的条件判断

3. 判断对了之后，向上找CC CC CC CC 这样的int3序列标识的函数对齐字节，这样就能找到这个函数的开头

自动化寻找patch位置（patchfinder） - 寻找函数内引用的全局变量

完成DLL注入

实现等待debugger

思路：控制小程序的输入参数来允许patch wxapkg、允许devtool

跳过PC端小程序的wxapkg加密

跳过wxapkg的MD5校验

寻找wxapkg配置的下发逻辑

• AppletPackage::loadModule

• AppletRuntime::InitAppletPkg

• AppletRuntime::ParseInitConfig（从类结构体里面取出来进一步使用）

• RealLaunchPreloadRuntime（将参数复制到类结构体里面）

• AppletRuntimeManager::LaunchApplet(this, appid, init_config [这就是我们的参数] )

理解传入配置

尝试使用debugger inspect config内容

ParseTypes XXX.h
EnumTypes
VisitType AppletInitConfig

意外收获：找到了config结构体的deserializer

struct __declspec(align(8)) AppletInitConfig
{
  std_string appId;
  std_string brandName;
  std_string iconUrl;
  _DWORD debugType;
  _BYTE gap_4C[4];
  std_string orientation;
  std_string pkgDirPath;
  std_string publicPkgDirPath;
  _DWORD publicVer;
  _BYTE gap_9C[4];
  std_string moduleListInfo;
  std_string dataPath;
  std_string tmpPath_or_appIconPath;
  std_string username;
  std_string nickName;
  std_string signature;
  std_string logPath;
  std_string clientJsExtInfo;
  std_string operationInfo;
  std_string shareName;
  std_string shareKey;
  std_string remote_debug_endpoint;
  _DWORD appVersion;
  int versionState;
  _WORD width;
  __int16 height;
  int sysBtn;
  _DWORD launchScene;
  _BYTE gap_1D4[4];
  std_string appId2;
  std_string extraData;
  std_string privateExtraData;
  std_string messageExtraData;
  std_string url;
  std_string agentId;
  _DWORD sourceType;
  _BYTE gap_26C[4];
  std_string openapiInvokeData;
  std_string transitiveData;
  std_string enterPath;
  _DWORD originalFlag;
  _BYTE gap_2BC[4];
  std_string originalRedirectUrl;
  _BYTE isNativeView;
  _DWORD version_type;
  std_string field_2E0;
  std_string uin;
  std_string deviceType;
  _DWORD clientVersion;
  _BYTE isTest;
  char isPreload;
  char field_32E;
  char field_32F;
  std_string wxIconUrl;
  std_string wxNickName;
  _DWORD productId;
  _DWORD gap_364;
  std_string commonJsInfo;
  _BYTE isMiniGame;
  _BYTE gap_381[7];
  std_string ozone_platform;
  std_string pluginDir;
  std_string hostAppId;
};

自动化patchfinder

使用Frida来改写传入配置

LaunchApplet! wx6eefcfd533448458
got str: wx6eefcfd533448458
got str: http://mmbiz.qpic.cn/mmbiz_png/JicUuN5XqU396yST0kgCs14GiaP3S8FMh5YjP8FazplXgawibjOep5D47zE3vhgwiaKchBmPLztpSjCHumkWMBAFBg/640?wx_fmt=png&wxfrom=200
got str: E:\WXFileRecv\WeChat Files\Applet\wx6eefcfd533448458\22\
got str: E:\WXFileRecv\WeChat Files\Applet\publicLib\318\clientPublicLib.wxapkg
got str: [{"independent":false,"md5":"150dc46169dbec55f62d7992474b3279","name":"/subpackages/main3/"},{"independent":false,"md5":"8f1dc195d6b94bda201816d4fc9fd7be","name":"/subpackages/main2/"},{"independent":false,"md5":"4e3bd83ff8900f875b17eeebbd934c2f","name":"/subpackages/main1/"},{"independent":false,"md5":"15f849542615f20ef6c29692c014da93","name":"/subpackages/main/"},{"independent":false,"md5":"a5933d359e3d7985253283cdeccf6599","name":"/subpackages/wx/"},{"independent":false,"md5":"648658f39959782a1d4a0b0f27c9266c","name":"__APP__"}]

got str: E:\WXFileRecv\WeChat Files\wxid_wpxxxxxxxxxxxx\Applet\
got str: E:\WXFileRecv\WeChat Files\wxid_wpxxxxxxxxxxxx\FileStorage\Cache\2023-08\8e70c81429b77a1df6f13d646ebc628e.jpg
got str: gh_9965d5174ba6@app
got str: 火源战纪
got str: 我本是一个小小火柴人，为打败那个背带裤猎人加入王者骑士团，每天冒险是砍砍咸鱼挂挂机，今天遇上他，握紧手中武器，或许这次我能赢
got str: C:\Users\Misty\AppData\Roaming\Tencent\WeChat\log\
got str: {"call_plugin_info":[{"alias":"MiniGameCommon","contexts":[],"inner_version":23,"md5_list":[],"plugin_id":"wxaed5ace05d92b218","plugin_user_name":"\u5c0f\u6e38\u620f\u5b98\u65b9\u63d2\u4ef6","plugin_version":1001011,"semver":""}],"user_version":"1.26437.26800"}

got str: {"apiAvailable":{"authorize":0,"bluetoothContactAndCanlanderNeedAuth":0,"gameSceneFromMyApp":0,"getUserInfo":0,"h5PayDisableForward":0,"navigateToMiniProgram":1,"navigateToMiniProgramConfig":0,"openData":0,"openSetting":0,"screenCanvasReadPixelsFreely":0,"share":0,"shareCustomImageUrl":1},"bgKeepAlive":{"music":0},"jumpWeAppFromLongPressCodeBanInfo":{"banJumpApp":0,"banJumpGame":0},"misc_ban_info":{"minigame_freeze_status":0},"privacy":{"banGetWifiListIfEmptyDesc":1,"banLocationIfEmptyDesc":1},"wxaAppSwitch":{"userProfile":1},"navigate_ban_info":{"navigate_ban_rule_list":[],"do_report":0},"op_info":{"grow_protect":1},"warning_info":{"jsapi_alter":[]}}
got str: filehelper
got str: 357394753
got str: Windows%2011%20x64
got str: https://wx.qlogo.cn/mmhead/ver_1/..............
got str: Misty
got str: {"SubContextImgDomain":["https://wx.qlogo.cn/","https://thirdwx.qlogo.cn/"],"enable_vconsole":false,"frameset":false,"isAttrSync":false,"isStar":false,"is_game_debug":false,"landscape":false,"mini_game_config_switchs":"show_fps_info=0 ","mini_game_debug_port_number":11223,"mini_game_debug_proxy_url":"","mini_game_launch_from_file":false,"needCloseAni":true,"pluginDir":"E:\\WXFileRecv\\WeChat Files\\Applet\\","pluginList":"[{\"md5\":\"e3fc805ffe6ad46fe26fa6c89c8cc841\",\"name\":\"wxaed5ace05d92b218\",\"prefix_path\":\"__plugin__/wxaed5ace05d92b218\",\"version\":23}]\n","preScene":1,"preScene_note":"wxid_wpxxxxxxxxxxxx","proxy":"","resizable":false,"scene_note":"filehelper:0_wx6eefcfd533448458_9453b50c40d97628e23db9246fd72a2d_1692909890_0","sessionId":"SessionId@357394753_6#1692991585814","show_image_debug_info":false,"startClickTime":1692991585815.0,"usedstate":2,"versionType":0}

var base = Process.enumerateModules()[0].base

function readStdString(s) {
    var flag = s.add(23).readU8()
    if (flag == 0x80) {
        // heap
        var size = s.add(8).readUInt()
        return s.readPointer().readUtf8String(size)
    } else {
        // stack
        return s.readUtf8String(flag)
    }
}

function writeStdString(s, content) {
    var flag = s.add(23).readU8()
    if (flag == 0x80) {
        // heap
        var orisize = s.add(8).readUInt()
        if (content.length > orisize) {
            throw "must below orisize!"
        }
        s.readPointer().writeUtf8String(content)
        s.add(8).writeUInt(content.length)
    } else {
        // stack
        if (content.length > 22) {
            throw "max 23 for stack str"
        }
        s.writeUtf8String(content)
        s.add(23).writeU8(content.length)
    }
}

var pvLaunchAppletBegin = base.add(0x301663c)

Interceptor.attach(pvLaunchAppletBegin, {
    onEnter(args) {
        send("LaunchApplet! " + readStdString(args[1]))
        for (var i = 0; i < 0x400; i+=8) {
            try {
                var s = readStdString(args[2].add(i))
                if (s) {
                    send("got str: " + s)
                }
                var s1 = s.replaceAll("md5", "md6").replaceAll('"enable_vconsole":false', '"enable_vconsole": true')
                if (s === s1) {
                    
                } else {
                    send("changing to str: " + s1)
                    writeStdString(args[2].add(i), s1)
                }
            } catch (a) {

            }
        }
    }
})
send("loaded!")

恢复为满血 Devtool