WechatSpellbook is a universal Xposed plug-in framework extracted from the wechat wizard author on the basis of wechat wizard. It provides a friendly API to automatically analyze the internal structural features of wechat (ignoring the differences between wechat versions), and optimizes the common problems of Hook wechat. In short, it will be easier to use hook wechat. Thanks for the author’s contribution, the project integration and detailed introduction can be found in Wiki. The implementation of the following steps is based on this framework. The following source code is based on wechat version 6.6.6, due to the use of WechatSpellbook framework dynamic matching principle, most of the wechat version can be automatically adapted.

To reply to a message, the robot needs to find the SENDING message API, hook it, and call it in our code.

Chatting. O.fiz method (chatting.

public final boolean FZ(String str) {
     mS(false);
     ctQ();
     return this.yOg.yRO.dt(str, 0);
 }
Copy the code

Then analyzed the yOg. YRO. Dt method, which is com. Tencent. Mm. UI. Chatting. The method of class b, look at the source code:

public final boolean dt(String str, int i) { int i2 = 0; String Xf = bh.Xf(str); if (Xf == null || Xf.length() == 0) { w.e("MicroMsg.ChattingUI.TextImp", "doSendMessage null"); return false; } x xVar = this.yXC; if (! ah.oB(Xf)) { az azVar = new az(); azVar.setContent(Xf); azVar.eW(1); xVar.aB(azVar); } bt btVar = new bt(); / / omit}Copy the code

You can see in azvar.setContent (Xf); SetContent () is a method of the parent class of az, com.tencent. Mm.

Public final void av(long j) {this.field_createTime = j; this.eRw = true; } public final long wQ() { return this.field_createTime; } public final void ed(String str) { this.field_talker = str; this.feh = true; } public final String wR() { return this.field_talker; } public final void setContent(String str) { this.field_content = str; this.eRE = true; }Copy the code

This class contains not only the text of the message, but also the receiver field_talker, the sending time field_createTime, etc. Bold guess, this class is a wrapper class for the message, containing all the attributes of the message. In this case, the field of interest is the receiver field_talker. As long as you know where the Ed method is called to hook off, you can do whatever you want. However, there are many places to call this through AS lookup, and it is impossible to determine where the specific message is called and how to do. Xposed analysis with the help of com.0700.mm.g.c.c. Ed () method, which is to set the receiver field_talker method, as long as the hook method, and then print out the call stack to see where exactly is the callback.

val clz = XposedHelpers.findClass("com.tencent.mm.g.c.cg", WechatGlobal.wxLoader) XposedHelpers.findAndHookMethod(clz, "ed", String::class.java, object : XC_MethodHook() { override fun beforeHookedMethod(param: MethodHookParam?) {log("set field_talker start") logutil.logstacktraces () // print stack log("set field_talker end")}})Copy the code

Print result:

image.png

com.tencent.mm.modelmulti.i.<init>

public i(String str, String str2, int i, int i2, Object obj) { w.d("MicroMsg.NetSceneSendMsg", "dktext :%s", new Object[]{bh.cjG()}); if (! bh.oB(str)) { cg azVar = new az(); azVar.eV(1); azVar.ed(str); azVar.av(bd.in(str)); azVar.eW(1); azVar.setContent(str2); azVar.setType(i); String a = a(((o) g.l(o.class)).s(azVar), obj, i2); if (! bh.oB(a)) { azVar.ej(a); w.d("MicroMsg.NetSceneSendMsg", "NetSceneSendMsg:MsgSource:%s", new Object[]{azVar.fnF}); // omit a lot of code}Copy the code

You can see that the constructor of this class instantiates CG azVar = new az(); And calls the Ed () method. Str2 is the text content, the last few do not know, I guess this class is to send a message, from the source code is difficult to analyze, hook off to see. Hook com. Tencent. Mm. Modelmulti i. constructor printing parameters, see whether and sending a message. I won’t post the code and screenshots here, the conclusion is relevant. Hook the constructor of this class to send a message.

The problem with hook is that when you hook the second API, you don’t know who the receiver of the message is, so it’s not easy to set up.

Source code here, key places are annotated, interested can star