iOS微信抢红包实践记录

1.消息框数父TableView

%hook YYTableView
- (void)setCell:(id)arg1 displayed:(_Bool)arg2{
    NSLog(@"arg1:", arg1);
    %orig;
}
%end

arg1 = <ChatTableViewCell: 0x10c1f2e00; baseClass = UITableViewCell;> 
[[[(ChatTableViewCell*)arg1 nextResponder] nextResponder] nextResponder] = <BaseMsgContentViewController: 0x10f812a00>

---

2.接受新消息

WeChat`-[BaseMsgContentViewController onNewSyncStart]:
WeChat`-[BaseMsgContentViewController tableView:didEndDisplayingCell:forRowAtIndexPath:]:
WeChat`-[BaseMsgContentViewController onNewSyncFinish]: //扬声器

-[BaseMsgContentLogicController OnAddMsg:MsgWrap:]⭐️
-[BaseMsgContentLogicController DidAddMsg:]
-[BaseMsgContentViewController addMessageNode:layout:addMoreMsg:]
-[MMTableView reloadData]

-[CMessageWrap m_nsContent]

<msg>
    <appmsg appid="" sdkver="">
        <des><![CDATA[我给你发了一个红包，赶紧去拆!]]></des>
        <url><![CDATA[https://wxapp.tenpay.com/mmpayhb/wxhb_personalreceive?showwxpaytitle=1&msgtype=1&channelid=1&sendid=1000039501201901237001412288783&ver=6&sign=7d96114cb4447898db786f7991f71d02440b4bb673227175b88289ee3a0c54e782ad4cca2f68517871f0bfe1c2ecd250909e83fbf1f2d46c1642cf659be9e07bc7a7b05e3c6982a4c4a13b8ef1d96cc4]]></url>
        <type><![CDATA[2001]]></type>
        <title><![CDATA[微信红包]]></title>
        <thumburl><![CDATA[https://wx.gtimg.com/hongbao/1800/hb.png]]></thumburl>
        <wcpayinfo>
            <templateid><![CDATA[7a2a165d31da7fce6dd77e05c300028a]]></templateid>
            <url><![CDATA[https://wxapp.tenpay.com/mmpayhb/wxhb_personalreceive?showwxpaytitle=1&msgtype=1&channelid=1&sendid=1000039501201901237001412288783&ver=6&sign=7d96114cb4447898db786f7991f71d02440b4bb673227175b88289ee3a0c54e782ad4cca2f68517871f0bfe1c2ecd250909e83fbf1f2d46c1642cf659be9e07bc7a7b05e3c6982a4c4a13b8ef1d96cc4]]></url>
            <iconurl><![CDATA[https://wx.gtimg.com/hongbao/1800/hb.png]]></iconurl>
            <receivertitle><![CDATA[恭喜发财，大吉大利]]></receivertitle>
            <sendertitle><![CDATA[恭喜发财，大吉大利]]></sendertitle>
            <scenetext><![CDATA[微信红包]]></scenetext>
            <senderdes><![CDATA[查看红包]]></senderdes>
            <receiverdes><![CDATA[领取红包]]></receiverdes>
            <nativeurl><![CDATA[wxpay://c2cbizmessagehandler/hongbao/receivehongbao?msgtype=1&channelid=1&sendid=1000039501201901237001412288783&sendusername=smiling19960909&ver=6&sign=7d96114cb4447898db786f7991f71d02440b4bb673227175b88289ee3a0c54e782ad4cca2f68517871f0bfe1c2ecd250909e83fbf1f2d46c1642cf659be9e07bc7a7b05e3c6982a4c4a13b8ef1d96cc4]]></nativeurl>
            <sceneid><![CDATA[1002]]></sceneid>
            <innertype><![CDATA[0]]></innertype>
            <paymsgid><![CDATA[1000039501201901237001412288783]]></paymsgid>
            <scenetext>微信红包</scenetext>
            <locallogoicon><![CDATA[c2c_hongbao_icon_cn]]></locallogoicon>
            <invalidtime><![CDATA[1548276626]]></invalidtime>
            <broaden />
        </wcpayinfo>
    </appmsg>
    <fromusername><![CDATA[smiling19960909]]></fromusername>
</msg>

BaseChatCellView->BaseChatViewModel->modelType

---

3.猜测关键函数并Hook

%hook BaseMsgContentLogicController
- (void)OnAddMsg:(id)arg1 MsgWrap:(id)arg2{
    NSLog(@"收到新消息..");
    %orig;
}
%end

po [arg2 class]:输出arg2类型

CMessageWrap

po [arg2 m_nsContent]:输出接受到的信息内容
po [arg2 m_uiMessageType]:输出接收到信息类型

0x0000000000000001 常规文字消息
0x000000000000002f 表情包消息(动图)
0x0000000000000003 图片消息（静态）
0x0000000000000031 红包消息/转账         --->十进制：49

4.领取红包

---

4.1模拟收红包

WCRedEnvelopesReceiveHomeView

po [0x1531374f0 allTargets]:获取按钮所有targets

{(
    <WCRedEnvelopesReceiveHomeView: 0x1532303c0; frame = (0 0; 375 812); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x2817a0100>>
)}

po [0x1531374f0 allControlEvents]:获取target事件

0x0000000000000040

po [0x1531374f0 actionsForTarget:0x0000000000000040 forControlEvent:UIControlEventTouchDown]:获取按钮按下事件

<__NSArrayM 0x281cbf930>(
OnOpenRedEnvelopes
)

---

4.2逆向自动收红包

-[WCRedEnvelopesReceiveHomeView OnOpenRedEnvelopes]:

- (_Bool)mmSendAction:(SEL)arg1 to:(id)arg2 from:(id)arg3 forEvent:(id)arg4{
    return %orig;
}
arg1:"OnOpenRedEnvelopes"
arg2:<WCRedEnvelopesReceiveHomeView: 0x10d909770; frame = (0 0; 375 812); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x281630d60>>
arg3:<UIButton: 0x10d916710; frame = (107.5 233; 110 110); opaque = NO; layer = <CALayer: 0x281614440>>
arg4:<UITouchesEvent: 0x282555560> timestamp: 116746 touches: {(<UITouch: 0x10d827f40> phase: Ended tap count: 1 force: 0.133 window: <iConsoleWindow: 0x109710df0; baseClass = UIWindow; frame = (0 0; 375 812); gestureRecognizers = <NSArray: 0x2819dd680>; layer = <UIWindowLayer: 0x2817611a0>> view: <UIButton: 0x10d916710; frame = (107.5 233; 110 110); opaque = NO; layer = <CALayer: 0x281614440>> location in window: {212, 464} previous location in window: {212, 464} location in view: {79.5, 42} previous location in view: {79.5, 42})}

4.3Hook红包事件

%hook CMessageMgr//调用原来的AsyncOnAddMsg:MsgWrap:方法
- (void)AsyncOnAddMsg:(id)arg1 MsgWrap:(id)arg2{
    NSLog(@"CMessageMgr -> AsyncOnAddMsg");
    %orig;
}
%end
arg1:smiling19960909
arg2:{m_uiMesLocalID=10, m_ui64MesSvrID=0, m_nsFromUsr=smi*909~15, m_nsToUsr=wxi*v12~19, m_uiStatus=4, type=10000, msgSource="(null)"} 

%hook WCRedEnvelopesLogicMgr//红包逻辑管理器
- (void)OpenRedEnvelopesRequest:(id)arg1{
    NSLog(@"WCRedEnvelopesLogicMgr -> OpenRedEnvelopesRequest");
    %orig;
}
%end

arg1:(class)__NSDictionaryM

{
    channelId = 1;
    headImg = "http://wx.qlogo.cn/mmhead/ver_1/9NpCM491I8Mh23LiaEcuZLpU4QewVYVT6pnlcfq3210eTiaRwm1ogGibicfCO75ZwYIAR0grvpARf7Bls9zVKqjqlKeuCyINYoN3FroicXZTE8O4/132";
    msgType = 1;
    nativeUrl = "wxpay://c2cbizmessagehandler/hongbao/receivehongbao?msgtype=1&channelid=1&sendid=1000039501201901237001392358533&sendusername=smiling19960909&ver=6&sign=4f40536bad8bf298c1a79fa663b3eefefe89ad64ff2e89f218003a2f37c5a4188d9a3a66dc5ceb0ea16e77c65a266464e7e6cdd2879a54eab76ee8480ce1c267d266fe55a5e9dc8974b97716e053dc8f";
    nickName = Jasonandchristine;
    sendId = 1000039501201901237001392358533;
    sessionUserName = smiling19960909;
    timingIdentifier = BDC6D89D9823F5754E280375548A2099;
}