本文共 2682 字，大约阅读时间需要 8 分钟。

目录

程序运行

运行程序：

点击确定：

本人微信对应的版本如下：

微信版本如下：

代码与实例

这里直接用CE，然后用二分法去找基址就可以。最后发现是在

WeChatWin.dll加上0x13972DC的偏移上，这里给出其他信息的偏移：

关键代码如下：

注入器：

#include 
   
    #include 
    
     #include 
     
      #include 
      
       #include 
       
        #include 
        
         using namespace std;bool Inject(LPCTSTR DLLPath, DWORD ProcessID){ HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID); if(!hProcess){ cout << "OpenProcess failed!" << endl; return false; } SIZE_T pathSize = (_tcslen(DLLPath) + 1) * sizeof(TCHAR); LPVOID startAddress = VirtualAllocEx(hProcess, NULL, pathSize, MEM_COMMIT, PAGE_READWRITE); if(!startAddress){ cout << "VirtualAllocEx failed" << endl; return false; } if(!WriteProcessMemory(hProcess, startAddress, DLLPath, pathSize, NULL)){ cout << "WriteProcessMemory failed" << endl; return false; } PTHREAD_START_ROUTINE pfnStartAddress = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(_T("kernel32.dll")), "LoadLibraryW"); if(!pfnStartAddress){ cout << "GetProcAddress failed" << endl; return false; } HANDLE hThread = CreateRemoteThreadEx(hProcess, NULL, NULL, pfnStartAddress, startAddress, NULL, NULL, NULL); if(!hThread){ cout << "CreateRemoteThreadEx failed" << endl; return false; } WaitForSingleObject(hThread, INFINITE); CloseHandle(hThread); CloseHandle(hProcess); return true;}int main(int argc, int *argv[]){ HANDLE hProcess = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); if(!hProcess){ cout << "CreateToolhelp32Snapshot failed!" << endl; getchar(); return 0; } PROCESSENTRY32 info; info.dwSize = sizeof(PROCESSENTRY32); if(!Process32First(hProcess, &info)){ cout << "Process32First failed!" << endl; getchar(); return 0; } DWORD wxPid; while(true){ USES_CONVERSION; if(strcmp("WeChat.exe", W2A(info.szExeFile)) == 0){ wxPid = info.th32ProcessID; break; } if(!Process32Next(hProcess, &info)){ wxPid = 0; break; } } if(wxPid == 0){ cout << "Process32Next over! unfind pid!" << endl; getchar(); return 0; } //开始注入 if(Inject(L"E:\\vs2012\\hackWechat\\Debug\\hackDll.dll", wxPid)){ cout << "inject successfully!" << endl; } getchar(); return 0;}
        
       
      
     
    
   

注入的dll关键代码：

#include "stdafx.h"#include "My.h"#include 
   
    #include 
    
     void getAllInfo(){	MessageBoxA(NULL, "开始解析", "报告首长", NULL);	//WeChatWin.dll的基址	DWORD weChatWinAddr = (DWORD)GetModuleHandle(L"WeChatWin.dll");	char wxID[0x1000] = {0};	DWORD weIDDW = weChatWinAddr + 0x13972DC;		//wxID[0] = (char)(*(DWORD*)weIDDW);	for(int i = 0; i < 40; i++){		wxID[i] = (char)(*(DWORD*)weIDDW);		if(wxID[i] == '0'){					break;		}		weIDDW += 0x1;	}		MessageBoxA(NULL, wxID, "报告首长", NULL);}
    
   

这里要注意，这个版本的微信，使用sprinf_s和memcpy会有问题，会被拦截，大家可以试试，只有用这种一个字节，一个字节的读，不会出现问题！

源码打包下载

转载地址：https://it1995.blog.csdn.net/article/details/103357756 如侵犯您的版权，请留言回复原文章的地址，我们会给您删除此文章，给您带来不便请您谅解！