设为首页收藏本站官方微博
开启辅助访问 切换到窄版

飘云阁

 找回密码
 加入我们

QQ登录

只需一步，快速开始

[x86]PYG官方Dll优雅破解补丁制作工具[x64]PYG官方DLL优雅破解补丁制作工具[x86]PYG官方Exe优雅破解补丁制作工具[x86/x64]Baymax Patch Tools飘云阁工具包(已更新第4季)
返回列表 发新帖
查看: 3028|回复: 4

[已解决] 12章小程序格式分析WeChat版本问题,-目前贴出6.9到7.9的C伪代码-得到老板肯定继续分析

[复制链接]
ningkong

该用户从未签到
发表于 2023-1-7 11:20:35 | 显示全部楼层 |阅读模式
本帖最后由 ningkong 于 2023-1-7 15:43 编辑

IDA pro 7.0 反编译的 WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib 函数和书上的为何不一致呢？ 分析不然没法跟上，主要看飘哥的分析步骤。
所以 将书本2019.12月 7.0到 7.10的所有旧版本微信全部下载了一遍，脱壳后没有书中的代码 IDA pro  F5  一致的代码， 飘哥没有贴出targe在光盘， 不然分析起来可以还原。

Wechat 6.7
[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x23
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x22
  __int64 v8; // x1
  __int64 v9; // x21
  void *v10; // x0
  __int64 v11; // x25
  void *v12; // x25
  void *v13; // x26
  void *v14; // x0
  bool v15; // w24
  __int64 v16; // x0
  char v18; // [xsp+10h] [xbp-60h]
  __int64 v19; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
    &OBJC_CLASS___iConsole,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    103LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v19 = 0LL;
  v6 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v19);
  v7 = (void *)objc_retainAutoreleasedReturnValue(v6);
  v9 = objc_retain(v19, v8);
  if ( v9 )
  {
    +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
      &OBJC_CLASS___iConsole,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      109LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v9);
  }
  else if ( objc_msgSend(v7, "length") )
  {
    goto LABEL_5;
  }
  v10 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v11 = objc_retainAutoreleasedReturnValue(v10);
  objc_release(v7);
  v7 = (void *)v11;
LABEL_5:
  if ( objc_msgSend(v7, "length") )
  {
    sub_1030E8470(&v18);
    v12 = (void *)objc_retainAutorelease(v7);
    v13 = objc_msgSend(v12, "bytes");
    v14 = objc_msgSend(v12, "length");
    sub_1030E85E0(&v18, v13, v14);
    v15 = 1;
    v16 = sub_1005A4DEC(v4, &v18, 1LL);
    if ( (_DWORD)v16 )
    {
      +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
        &OBJC_CLASS___iConsole,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        126LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v16);
      v15 = 0;
    }
    sub_1030E8520(&v18);
  }
  else
  {
    +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
      &OBJC_CLASS___iConsole,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      117LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v15 = 0;
  }
  objc_release(v7);
  objc_release(v9);
  objc_release(v5);
  return v15;
}



wechat 7.0
[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x23
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x22
  __int64 v8; // x1
  __int64 v9; // x21
  void *v10; // x0
  __int64 v11; // x25
  void *v12; // x25
  void *v13; // x26
  void *v14; // x0
  bool v15; // w24
  __int64 v16; // x0
  char v18; // [xsp+10h] [xbp-60h]
  __int64 v19; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
    &OBJC_CLASS___iConsole,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    103LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v19 = 0LL;
  v6 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v19);
  v7 = (void *)objc_retainAutoreleasedReturnValue(v6);
  v9 = objc_retain(v19, v8);
  if ( v9 )
  {
    +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
      &OBJC_CLASS___iConsole,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      109LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v9);
  }
  else if ( objc_msgSend(v7, "length") )
  {
    goto LABEL_5;
  }
  v10 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v11 = objc_retainAutoreleasedReturnValue(v10);
  objc_release(v7);
  v7 = (void *)v11;
LABEL_5:
  if ( objc_msgSend(v7, "length") )
  {
    sub_103346574(&v18);
    v12 = (void *)objc_retainAutorelease(v7);
    v13 = objc_msgSend(v12, "bytes");
    v14 = objc_msgSend(v12, "length");
    sub_1033466E4(&v18, v13, v14);
    v15 = 1;
    v16 = sub_1005E9CC0(v4, &v18, 1LL);
    if ( (_DWORD)v16 )
    {
      +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
        &OBJC_CLASS___iConsole,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        126LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v16);
      v15 = 0;
    }
    sub_103346624(&v18);
  }
  else
  {
    +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
      &OBJC_CLASS___iConsole,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      117LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v15 = 0;
  }
  objc_release(v7);
  objc_release(v9);
  objc_release(v5);
  return v15;
}



WeChat 7.1

[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x23
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x22
  __int64 v8; // x1
  __int64 v9; // x21
  void *v10; // x0
  __int64 v11; // x25
  void *v12; // x25
  void *v13; // x26
  void *v14; // x0
  bool v15; // w24
  __int64 v16; // x0
  char v18; // [xsp+10h] [xbp-60h]
  __int64 v19; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
    &OBJC_CLASS___iConsole,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    103LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v19 = 0LL;
  v6 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v19);
  v7 = (void *)objc_retainAutoreleasedReturnValue(v6);
  v9 = objc_retain(v19, v8);
  if ( v9 )
  {
    +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
      &OBJC_CLASS___iConsole,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      109LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v9);
  }
  else if ( objc_msgSend(v7, "length") )
  {
    goto LABEL_5;
  }
  v10 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v11 = objc_retainAutoreleasedReturnValue(v10);
  objc_release(v7);
  v7 = (void *)v11;
LABEL_5:
  if ( objc_msgSend(v7, "length") )
  {
    sub_103346754(&v18);
    v12 = (void *)objc_retainAutorelease(v7);
    v13 = objc_msgSend(v12, "bytes");
    v14 = objc_msgSend(v12, "length");
    sub_1033468C4(&v18, v13, v14);
    v15 = 1;
    v16 = sub_1005E9CC0(v4, &v18, 1LL);
    if ( (_DWORD)v16 )
    {
      +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
        &OBJC_CLASS___iConsole,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        126LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v16);
      v15 = 0;
    }
    sub_103346804(&v18);
  }
  else
  {
    +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
      &OBJC_CLASS___iConsole,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      117LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v15 = 0;
  }
  objc_release(v7);
  objc_release(v9);
  objc_release(v5);
  return v15;
}



WeChat 7.2

[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x23
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x22
  __int64 v8; // x1
  __int64 v9; // x21
  void *v10; // x0
  __int64 v11; // x25
  void *v12; // x25
  void *v13; // x26
  void *v14; // x0
  bool v15; // w24
  __int64 v16; // x0
  char v18; // [xsp+10h] [xbp-60h]
  __int64 v19; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
    &OBJC_CLASS___iConsole,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    103LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v19 = 0LL;
  v6 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v19);
  v7 = (void *)objc_retainAutoreleasedReturnValue(v6);
  v9 = objc_retain(v19, v8);
  if ( v9 )
  {
    +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
      &OBJC_CLASS___iConsole,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      109LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v9);
  }
  else if ( objc_msgSend(v7, "length") )
  {
    goto LABEL_5;
  }
  v10 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v11 = objc_retainAutoreleasedReturnValue(v10);
  objc_release(v7);
  v7 = (void *)v11;
LABEL_5:
  if ( objc_msgSend(v7, "length") )
  {
    sub_10334E908(&v18);
    v12 = (void *)objc_retainAutorelease(v7);
    v13 = objc_msgSend(v12, "bytes");
    v14 = objc_msgSend(v12, "length");
    sub_10334EA78(&v18, v13, v14);
    v15 = 1;
    v16 = sub_1005E9CC0(v4, &v18, 1LL);
    if ( (_DWORD)v16 )
    {
      +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
        &OBJC_CLASS___iConsole,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        126LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v16);
      v15 = 0;
    }
    sub_10334E9B8(&v18);
  }
  else
  {
    +[iConsole logWithLevel:module:errorCode:file:line:func:format:](
      &OBJC_CLASS___iConsole,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      117LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v15 = 0;
  }
  objc_release(v7);
  objc_release(v9);
  objc_release(v5);
  return v15;
}



wechat 7.3

[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x24
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x0
  void *v8; // x22
  __int64 v9; // x1
  __int64 v10; // x21
  void *v11; // x0
  void *v12; // x0
  __int64 v13; // x26
  void *v14; // x26
  void *v15; // x27
  void *v16; // x0
  bool v17; // w25
  __int64 v18; // x24
  void *v19; // x0
  void *v20; // x0
  char v22; // [xsp+10h] [xbp-60h]
  __int64 v23; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  v6 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
  objc_msgSend(
    v6,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    103LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v23 = 0LL;
  v7 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v23);
  v8 = (void *)objc_retainAutoreleasedReturnValue(v7);
  v10 = objc_retain(v23, v9);
  if ( v10 )
  {
    v11 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v11,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      109LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v10);
  }
  else if ( objc_msgSend(v8, "length") )
  {
    goto LABEL_5;
  }
  v12 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v13 = objc_retainAutoreleasedReturnValue(v12);
  objc_release(v8);
  v8 = (void *)v13;
LABEL_5:
  if ( objc_msgSend(v8, "length") )
  {
    sub_10354B138(&v22);
    v14 = (void *)objc_retainAutorelease(v8);
    v15 = objc_msgSend(v14, "bytes");
    v16 = objc_msgSend(v14, "length");
    sub_10354B2A8(&v22, v15, v16);
    v17 = 1;
    v18 = sub_100735844(v4, &v22, 1LL);
    if ( (_DWORD)v18 )
    {
      v19 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
      objc_msgSend(
        v19,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        126LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v18);
      v17 = 0;
    }
    sub_10354B1E8(&v22);
  }
  else
  {
    v20 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v20,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      117LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v17 = 0;
  }
  objc_release(v8);
  objc_release(v10);
  objc_release(v5);
  return v17;
}


wechat 7.4

[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](
        WAPackageInfoCacheLogic *self,
        SEL a2,
        id a3,
        WXAPkg *a4)
{
  id v5; // x19
  objc_class *v6; // x0
  NSData *v7; // x0
  NSData *v8; // x22
  id v9; // x21
  objc_class *v10; // x0
  NSData *v11; // x0
  NSData *v12; // x26
  NSData *v13; // x26
  id v14; // x27
  id v15; // x0
  bool v16; // w25
  __int64 v17; // x24
  objc_class *v18; // x0
  objc_class *v19; // x0
  char v21[8]; // [xsp+10h] [xbp-60h] BYREF
  id v22; // [xsp+18h] [xbp-58h] BYREF

  v5 = objc_retain(a3);
  v6 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
  objc_msgSend(
    v6,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    103LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v22 = 0LL;
  v7 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v22);
  v8 = objc_retainAutoreleasedReturnValue(v7);
  v9 = objc_retain(v22);
  if ( v9 )
  {
    v10 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v10,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      109LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v9);
  }
  else if ( objc_msgSend(v8, "length") )
  {
    goto LABEL_5;
  }
  v11 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v12 = objc_retainAutoreleasedReturnValue(v11);
  objc_release(v8);
  v8 = v12;
LABEL_5:
  if ( objc_msgSend(v8, "length") )
  {
    sub_104116C4C(v21);
    v13 = objc_retainAutorelease(v8);
    v14 = objc_msgSend(v13, "bytes");
    v15 = objc_msgSend(v13, "length");
    sub_104116DBC(v21, v14, v15);
    v16 = 1;
    v17 = sub_10108BE84(a4, v21, 1LL);
    if ( (_DWORD)v17 )
    {
      v18 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
      objc_msgSend(
        v18,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        126LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v17);
      v16 = 0;
    }
    sub_104116CFC(v21);
  }
  else
  {
    v19 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v19,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      117LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v16 = 0;
  }
  objc_release(v8);
  objc_release(v9);
  objc_release(v5);
  return v16;
}


wechat 7.5
[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x24
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x0
  void *v8; // x22
  __int64 v9; // x1
  __int64 v10; // x21
  void *v11; // x0
  void *v12; // x0
  __int64 v13; // x26
  void *v14; // x26
  void *v15; // x27
  void *v16; // x0
  bool v17; // w25
  __int64 v18; // x24
  void *v19; // x0
  void *v20; // x0
  char v22; // [xsp+10h] [xbp-60h]
  __int64 v23; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  v6 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
  objc_msgSend(
    v6,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    103LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v23 = 0LL;
  v7 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v23);
  v8 = (void *)objc_retainAutoreleasedReturnValue(v7);
  v10 = objc_retain(v23, v9);
  if ( v10 )
  {
    v11 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v11,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      109LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v10);
  }
  else if ( objc_msgSend(v8, "length") )
  {
    goto LABEL_5;
  }
  v12 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v13 = objc_retainAutoreleasedReturnValue(v12);
  objc_release(v8);
  v8 = (void *)v13;
LABEL_5:
  if ( objc_msgSend(v8, "length") )
  {
    sub_104FB59E4(&v22);
    v14 = (void *)objc_retainAutorelease(v8);
    v15 = objc_msgSend(v14, "bytes");
    v16 = objc_msgSend(v14, "length");
    sub_104FB5B54(&v22, v15, v16);
    v17 = 1;
    v18 = sub_100FC1930(v4, &v22, 1LL);
    if ( (_DWORD)v18 )
    {
      v19 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
      objc_msgSend(
        v19,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        126LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v18);
      v17 = 0;
    }
    sub_104FB5A94(&v22);
  }
  else
  {
    v20 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v20,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      117LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v17 = 0;
  }
  objc_release(v8);
  objc_release(v10);
  objc_release(v5);
  return v17;
}


wechat 7.7

[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x24
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x0
  void *v8; // x22
  __int64 v9; // x1
  __int64 v10; // x21
  void *v11; // x0
  void *v12; // x0
  __int64 v13; // x26
  void *v14; // x26
  void *v15; // x27
  void *v16; // x0
  bool v17; // w25
  __int64 v18; // x24
  void *v19; // x0
  void *v20; // x0
  char v22; // [xsp+10h] [xbp-60h]
  __int64 v23; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  v6 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
  objc_msgSend(
    v6,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    102LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v23 = 0LL;
  v7 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v23);
  v8 = (void *)objc_retainAutoreleasedReturnValue(v7);
  v10 = objc_retain(v23, v9);
  if ( v10 )
  {
    v11 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v11,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      108LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v10);
  }
  else if ( objc_msgSend(v8, "length") )
  {
    goto LABEL_5;
  }
  v12 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v13 = objc_retainAutoreleasedReturnValue(v12);
  objc_release(v8);
  v8 = (void *)v13;
LABEL_5:
  if ( objc_msgSend(v8, "length") )
  {
    sub_104E0FE70(&v22);
    v14 = (void *)objc_retainAutorelease(v8);
    v15 = objc_msgSend(v14, "bytes");
    v16 = objc_msgSend(v14, "length");
    sub_100034E18(&v22, v15, v16);
    v17 = 1;
    v18 = sub_1000E1A88(v4, &v22, 1LL);
    if ( (_DWORD)v18 )
    {
      v19 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
      objc_msgSend(
        v19,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        125LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v18);
      v17 = 0;
    }
    sub_104E0FEA4(&v22);
  }
  else
  {
    v20 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v20,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      116LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v17 = 0;
  }
  objc_release(v8);
  objc_release(v10);
  objc_release(v5);
  return v17;
}


wechat 7.8
[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x24
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x0
  void *v8; // x22
  __int64 v9; // x1
  __int64 v10; // x21
  void *v11; // x0
  void *v12; // x0
  __int64 v13; // x26
  void *v14; // x26
  void *v15; // x27
  void *v16; // x0
  bool v17; // w25
  __int64 v18; // x24
  void *v19; // x0
  void *v20; // x0
  char v22; // [xsp+10h] [xbp-60h]
  __int64 v23; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  v6 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
  objc_msgSend(
    v6,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    102LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v23 = 0LL;
  v7 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v23);
  v8 = (void *)objc_retainAutoreleasedReturnValue(v7);
  v10 = objc_retain(v23, v9);
  if ( v10 )
  {
    v11 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v11,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      108LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v10);
  }
  else if ( objc_msgSend(v8, "length") )
  {
    goto LABEL_5;
  }
  v12 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v13 = objc_retainAutoreleasedReturnValue(v12);
  objc_release(v8);
  v8 = (void *)v13;
LABEL_5:
  if ( objc_msgSend(v8, "length") )
  {
    sub_104E11E50(&v22);
    v14 = (void *)objc_retainAutorelease(v8);
    v15 = objc_msgSend(v14, "bytes");
    v16 = objc_msgSend(v14, "length");
    sub_100034E78(&v22, v15, v16);
    v17 = 1;
    v18 = sub_1000E1CF4(v4, &v22, 1LL);
    if ( (_DWORD)v18 )
    {
      v19 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
      objc_msgSend(
        v19,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        125LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v18);
      v17 = 0;
    }
    sub_104E11E84(&v22);
  }
  else
  {
    v20 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v20,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      116LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v17 = 0;
  }
  objc_release(v8);
  objc_release(v10);
  objc_release(v5);
  return v17;
}


wechat 7.9
[C] 纯文本查看 复制代码
bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x24
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x0
  void *v8; // x22
  __int64 v9; // x1
  __int64 v10; // x21
  void *v11; // x0
  void *v12; // x0
  __int64 v13; // x26
  void *v14; // x26
  void *v15; // x27
  void *v16; // x0
  bool v17; // w25
  __int64 v18; // x0
  __int64 v19; // x24
  void *v20; // x0
  void *v21; // x0
  char v23; // [xsp+10h] [xbp-60h]
  __int64 v24; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  v6 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
  objc_msgSend(
    v6,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    102LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v24 = 0LL;
  v7 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v24);
  v8 = (void *)objc_retainAutoreleasedReturnValue(v7);
  v10 = objc_retain(v24, v9);
  if ( v10 )
  {
    v11 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v11,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      108LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v10);
  }
  else if ( objc_msgSend(v8, "length") )
  {
    goto LABEL_5;
  }
  v12 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v13 = objc_retainAutoreleasedReturnValue(v12);
  objc_release(v8);
  v8 = (void *)v13;
LABEL_5:
  if ( objc_msgSend(v8, "length") )
  {
    sub_10524DE88(&v23);
    v14 = (void *)objc_retainAutorelease(v8);
    v15 = objc_msgSend(v14, "bytes");
    v16 = objc_msgSend(v14, "length");
    sub_100034214(&v23, v15, v16);
    v17 = 1;
    v18 = sub_1000DA800(v4, &v23, 1LL);
    if ( (_DWORD)v18 )
    {
      v19 = v18;
      v20 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
      objc_msgSend(
        v20,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        125LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v19);
      v17 = 0;
    }
    sub_10524DEBC(&v23);
  }
  else
  {
    v21 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v21,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      116LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v17 = 0;
  }
  objc_release(v8);
  objc_release(v10);
  objc_release(v5);
  return v17;
}


PYG19周年生日快乐！
回复

使用道具 举报

飘云
  • TA的每日心情
    开心
    2024-12-1 11:04

    • 签到天数: 12 天

    [LV.3]偶尔看看II
    发表于 2023-1-7 13:18:20 | 显示全部楼层
    F5出来的代码有时候也会有差异，找到相同的特征然后对照分析你已经做到这一步了，说明动手能力非常OK了
    PYG19周年生日快乐！
    回复 支持 反对

    使用道具 举报

    ningkong

    该用户从未签到
     楼主| 发表于 2023-1-7 14:39:59 | 显示全部楼层
    能够得到，飘哥的赞扬，非常感动。 坚定了把逆向学到底的目标， 人生没有多少时光可以选择。

    看雪， 出品的一本 软件加密与解密内幕，新版中，看到您的 格言，  在逆向路上失败过，沮丧过，但从未放弃过！
    PYG19周年生日快乐！
    回复 支持 反对

    使用道具 举报

    ningkong

    该用户从未签到
     楼主| 发表于 2023-1-7 14:51:42 | 显示全部楼层

    继续的分析记录

    本帖最后由 ningkong 于 2023-1-7 15:12 编辑

    目前分析基于 WeChat 7.0.3， 对比


    [C] 纯文本查看 复制代码
    bool __cdecl -[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:](WAPackageInfoCacheLogic *self, SEL a2, id a3, WXAPkg *a4)
{
  WXAPkg *v4; // x24
  __int64 v5; // x19
  void *v6; // x0
  void *v7; // x0
  void *v8; // x22
  __int64 v9; // x1
  __int64 v10; // x21
  void *v11; // x0
  void *v12; // x0
  __int64 v13; // x26
  void *v14; // x26
  void *v15; // x27
  void *v16; // x0
  bool v17; // w25
  __int64 v18; // x24
  void *v19; // x0
  void *v20; // x0
  char v22; // [xsp+10h] [xbp-60h]
  __int64 v23; // [xsp+18h] [xbp-58h]

  v4 = a4;
  v5 = objc_retain(a3, a2);
  v6 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
  objc_msgSend(
    v6,
    "logWithLevel:module:errorCode:file:line:func:format:",
    2LL,
    "WeApp",
    0LL,
    "WAPackageInfoCacheLogic.mm",
    103LL,
    "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
    CFSTR("unpack pkg, path=%@"),
    v5);
  v23 = 0LL;
  v7 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:options:error:", v5, 3LL, &v23);
  v8 = (void *)objc_retainAutoreleasedReturnValue(v7);
  v10 = objc_retain(v23, v9);
  if ( v10 )
  {
    v11 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v11,
      "logWithLevel:module:errorCode:file:line:func:format:",
      3LL,
      "WeApp",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      109LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("unpackPkgWithFilePath(NSDataReadingMappedIfSafe | NSDataReadingUncached) error: %@"),
      v10);
  }
  else if ( objc_msgSend(v8, "length") )
  {
    goto LABEL_5;
  }
  v12 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithContentsOfFile:", v5);
  v13 = objc_retainAutoreleasedReturnValue(v12);
  objc_release(v8);
  v8 = (void *)v13;
LABEL_5:
  if ( objc_msgSend(v8, "length") )
  {
    sub_10354B138(&v22);
    v14 = (void *)objc_retainAutorelease(v8);
    v15 = objc_msgSend(v14, "bytes");
    v16 = objc_msgSend(v14, "length");
    sub_10354B2A8(&v22, v15, v16);
    v17 = 1;
    v18 = sub_100735844(v4, &v22, 1LL);
    if ( (_DWORD)v18 )
    {
      v19 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
      objc_msgSend(
        v19,
        "logWithLevel:module:errorCode:file:line:func:format:",
        4LL,
        "WeAppError",
        0LL,
        "WAPackageInfoCacheLogic.mm",
        126LL,
        "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
        CFSTR("unpack error:%d"),
        v18);
      v17 = 0;
    }
    sub_10354B1E8(&v22);
  }
  else
  {
    v20 = +[WCLogger externalIMP](&OBJC_CLASS___WCLogger, "externalIMP");
    objc_msgSend(
      v20,
      "logWithLevel:module:errorCode:file:line:func:format:",
      4LL,
      "WeAppError",
      0LL,
      "WAPackageInfoCacheLogic.mm",
      117LL,
      "-[WAPackageInfoCacheLogic unpackPkgWithFilePath:unpackLib:]",
      CFSTR("pkgData is empty"));
    v17 = 0;
  }
  objc_release(v8);
  objc_release(v10);
  objc_release(v5);
  return v17;
}

    本帖子中包含更多资源

    您需要 登录 才可以下载或查看，没有账号？加入我们

    x
    PYG19周年生日快乐！
    回复 支持 反对

    使用道具 举报

    飞天梦
  • TA的每日心情
    无聊
    昨天 09:43

    • 签到天数: 694 天

    [LV.9]以坛为家II
    发表于 2023-1-7 23:52:31 | 显示全部楼层
    谢谢楼主的分享
    PYG19周年生日快乐！
    回复 支持 反对

    使用道具 举报

    返回列表 发新帖
    高级模式
    B Color Image Link Quote Code Smilies
    您需要登录后才可以回帖 登录 | 加入我们

    本版积分规则

    快速回复 返回顶部 返回列表