微信Hook实战，读取微信内存里的信息

原始文章标题:读取微信内存里的信息本文作者:九世发布时间:2021-07-21, 00:34:51最后更新:2021-07-21, 00:55:42原始链接:http://422926799.github.io/posts/26c63b49.html版权声明: "署名-非商用-相同方式共享 4.0" 转载请保留原文链接及作者。

from ctypes import *from win32con import *from ctypes.wintypes import *from win32process import (EnumProcessModules,GetModuleFileNameEx)import os

CreateToolhelp32Snapshot=windll.Kernel32.CreateToolhelp32SnapshotProcess32First=windll.kernel32.Process32FirstProcess32Next=windll.kernel32.Process32NextOpenProcess = windll.kernel32.OpenProcessReadProcessMemory = windll.kernel32.ReadProcessMemoryCloseHandle = windll.kernel32.CloseHandle

TH32CS_SNAPPROCESS=0x00000002TH32CS_SNAPMODULE = 0x00000008

MAX_MODULE_NAME32 = 255

class PROCESSENTRY32A(Structure): #定义PROCESSENTRY32A类型    _fields_ = [ ( 'dwSize' , c_ulong ) ,                 ( 'cntUsage' , c_ulong) ,                 ( 'th32ProcessID' , c_ulong) ,                 ( 'th32DefaultHeapID' , c_size_t) ,                 ( 'th32ModuleID' , c_ulong) ,                 ( 'cntThreads' , c_ulong) ,                 ( 'th32ParentProcessID' , c_ulong) ,                 ( 'pcPriClassBase' , c_long) ,                 ( 'dwFlags' , c_ulong) ,                 ( 'szExeFile' , c_char * MAX_PATH ) ]





def getprocess_pid(processname):    processimage=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0)    pe32=PROCESSENTRY32A()    pe32.dwSize=sizeof(PROCESSENTRY32A)    ret=Process32First(processimage,pointer(pe32))    while ret:        if pe32.szExeFile.decode()==processname:            return pe32.th32ProcessID        ret=Process32Next(processimage,pointer(pe32))

def getmodule_address(handle,dllname):    for module in EnumProcessModules(handle):        dllpath=GetModuleFileNameEx(handle,module)        print(module,dllpath)

def main():    wetchatwindlladdress=0x63B60000 #枚举WetChatWin.dll加载地址失败，就直接手动定义了    phome = create_string_buffer(11)    wxname=create_string_buffer(20)    wxnumber=c_int(20)    number=create_string_buffer(20)    pid=getprocess_pid("WeChatStore.exe")    print("WeChat PID:{}".format(pid))    process=OpenProcess(PROCESS_ALL_ACCESS,False,pid)    ReadProcessMemory(process,wetchatwindlladdress+0x104F560,byref(phome),11,None)    ReadProcessMemory(process,wetchatwindlladdress+0x104F52C,byref(wxname),20,None)    ReadProcessMemory(process,wetchatwindlladdress+0x104F690,byref(wxnumber),20,None)    print("WX Phome:"+hex(wetchatwindlladdress + 0x104F560),phome.value.decode())    print("WX Name:"+hex(wetchatwindlladdress+0x104F52C),wxname.value.decode())    wxnumberaddress=wxnumber.value #可以不用转十六进制，直接十进制即可,py转十六进制默认是str类型。。hex函数转后填进地址读不到    ReadProcessMemory(process,wxnumberaddress,byref(number),20,None)    print("WX Number:"+number.value.decode())    #getmodule_address(handle,"WeChatWin.dll")



if __name__ == '__main__':    main()

* 调用EnumProcess和用Thread32First枚举模块，结果根本不能完全枚举。原本想模仿Process Explorer调用ZwQueryVirtualMemory函数枚举模块，py写起来太麻烦。。算了