iOS逆向1017-微信抢红包案例（五）

1017-微信抢红包案例（五）

//上节回顾
%hook WCRedEnvelopesLogicMgr
- (void)OnWCToHongbaoCommonResponse:(HongBaoRes *)arg1 Request:(id)arg2{
    
    NSString * str = [[NSString alloc] initWithData:arg1.retText.buffer encoding:NSUTF8StringEncoding];
    NSLog(@"{\n%@\ncgiCmdid:%d\nerrorMsg:%@\nplatMsg:%@\nplatRet:%d\n}",str,arg1.cgiCmdid,arg1.errorMsg,arg1.platMsg,arg1.platRet);
//    NSLog(@"%@",str);
    
    %orig;
}
%end

image.png

调试过程

image.png image.png image.png

升级MokeyApp 后报错

image.png

解决方案:

Cycript.framework 放入静态库，重新编译运行成功！！

image.png image.png image.png

// 最后的步骤： 抽离不同的 类，进行不同的处理

// 创建cell设置的类 cell.xm，编译生成一个 cell.mm 拉入到工程里
// HKSettingCell.xm
// HKSettingCell.mm

// 同样可以创建 自动强红包的类
// AutoGrabRedEnvelops.xm
// AutoGrabRedEnvelops.mm

image.png image.png image.png image.png image.png

//--------------------逻辑分析  --------
// 微信应该有一个专门管理消息的对象!
// 这个方法到底 是谁调用来的!! 看函数调用栈!!


 
* ##### 正常抢红包的逻辑
1、收到消息，判断是否红包消息
2、打开红包  
3、去抢红包，发送请求
4、拆红红包

* ##### Hook 抢红包：//分析拆红包 的参数，略过抢红包，直接拆红包
1、收到消息，判断是否红包消息
2、自动：去抢红包，发送请求，拆红红包


Hook：WCRedEnvelopesLogicMgr
//步骤5
@interface WCRedEnvelopesLogicMgr
// 开红包
- (void)OpenRedEnvelopesRequest:(id)arg1;
//1、接收到红包请求
- (void)ReceiverQueryRedEnvelopesRequest:(id)arg1;
//2、得到红包
- (void)GetHongbaoBusinessRequest:(id)arg1 CMDID:(unsigned int)arg2 OutputType:(unsigned int)arg3;
//3、拆红包后的响应
- (void)OnWCToHongbaoCommonResponse:(id)arg1 Request:(id)arg2;

%hook CMessageMgr

- (void)onNewSyncAddMessage:(CMessageWrap *)msgWrap{
    
    //对方发红包的账号
    NSLog(@"---m_nsFromUsr= %@",MSHookIvar<NSString *>(msgWrap,"m_nsFromUsr"));
    //将WCRedEnvelopesReceiveHomeV

        //拆红包
        //通过字段判断：是群红包 还是个人红包
        BOOL (^isGroupReceiver)() = ^BOOL() {
            return [msgWrap.m_nsFromUsr rangeOfString:@"@chatroom"].location != NSNotFound;
        };
        //拼接参数
        NSMutableDictionary* params =  [%c(NSMutableDictionary) dictionary];
        [params setObject:@"0" forKey:@"agreeDuty"];
        //是否是群红包!
        [params setObject: ( isGroupReceiver() ? @"0" : @"1")  forKey:@"inWay"];
        [params setObject:url_dic[@"channelid"] forKey:@"channelId"];
        [params setObject:@"1" forKey:@"msgType"];
        [params setObject:c2cNativeUrl forKey:@"nativeUrl"];
        [params setObject:url_dic[@"sendid"] forKey:@"sendId"];

}

%end

/*
 * 创建参数队列：存、取参数
 */ 
#import <Foundation/Foundation.h>

@interface WeChatRedEnvelopParamQueue : NSObject

+(instancetype)sharadQueue;
//放参数
-(void)enqueue:(NSMutableDictionary *)param;
//取参数
-(NSMutableDictionary *)dequeue;

@end



%hook WCRedEnvelopesReceiveHomeView
//
- (void)OnOpenRedEnvelopes{
    %orig;
    
}
%end


/*
 * 抢红包的响应
 */ 
%hook WCRedEnvelopesLogicMgr
- (void)OnWCToHongbaoCommonResponse:(HongBaoRes *)arg1 Request:(id)arg2{
    
    %orig;
    
    NSError * err;
    NSDictionary * responseDict = [NSJSONSerialization JSONObjectWithData:arg1.retText.buffer options:NSJSONReadingMutableContainers error:&err];
    NSLog(@"%@",responseDict);
    
    if(arg1 != nil && arg2 != nil && arg1.cgiCmdid == 3 &&[responseDict[@"receiveStatus"] integerValue] == 0 ){//没有抢过的红包!
        NSString * timingIdentifier = responseDict[@"timingIdentifier"];
        NSLog(@"timingIdentifier :%@",timingIdentifier);
        
        NSMutableDictionary * param = [[WeChatRedEnvelopParamQueue sharadQueue] dequeue];
        if(param && timingIdentifier && param[@"timingIdentifier"]){
            [param setObject:timingIdentifier forKey:@"timingIdentifier"];
            
            //开始抢红包!!
            WCRedEnvelopesLogicMgr * redEvenlopsLogicMgr  = [[%c(MMServiceCenter) defaultCenter] getService:[%c(WCRedEnvelopesLogicMgr) class]];
            
            if(redEvenlopsLogicMgr){
                if([HKDefaults valueForKey:HKTIMEKEY]){//如果设置了时间
                    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)[(NSString *)[HKDefaults valueForKey:HKTIMEKEY] floatValue] * NSEC_PER_SEC), dispatch_get_main_queue(), ^{
                        //真正打开红包的请求!!
                        [redEvenlopsLogicMgr OpenRedEnvelopesRequest:param];
                    });
                }else{
                    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)1.0 * NSEC_PER_SEC), dispatch_get_main_queue(), ^{
                        //真正打开红包的请求!!
                        [redEvenlopsLogicMgr OpenRedEnvelopesRequest:param];
                    });
                }
                
            }
        }
        
    }
    
}
%end