add wx 3.9.12.15

pywxdump/WX_OFFS.json

@@ -411,5 +411,12 @@
     93700888,
     0,
     93702352
+  ],
+  "3.9.12.15": [
+    93813544,
+    93814880,
+    93813352,
+    0,
+    93814816
   ]
 }

pywxdump/api/local_server.py

@@ -259,7 +259,7 @@ def get_biasaddr(request: BiasAddrRequest):
     mobile = request.mobile
     name = request.name
     account = request.account
-    key = request.json.key
+    key = request.key
     wxdbPath = request.wxdbPath
     if not mobile or not name or not account:
         return ReJson(1002)

pywxdump/wx_core/__init__.py

@@ -8,4 +8,4 @@
 from .wx_info import get_wx_info, get_wx_db, get_core_db
 from .get_bias_addr import BiasAddr
 from .decryption import batch_decrypt, decrypt
-from .merge_db import  merge_db, decrypt_merge, merge_real_time_db,  all_merge_real_time_db
+from .merge_db import merge_db, decrypt_merge, merge_real_time_db, all_merge_real_time_db

pywxdump/wx_core/get_bias_addr.py

@@ -10,14 +10,31 @@
 import os
 import re
 import sys
+from ctypes import wintypes
+
 import psutil
 import pymem
 
 from .utils import get_exe_version, get_exe_bit, verify_key
+from .utils import get_process_list, get_memory_maps, get_process_exe_path, get_file_version_info
+from .utils import search_memory
 
 ReadProcessMemory = ctypes.windll.kernel32.ReadProcessMemory if sys.platform == "win32" else None
 void_p = ctypes.c_void_p
 
+# 定义常量
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_VM_READ = 0x0010
+
+kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
+OpenProcess = kernel32.OpenProcess
+OpenProcess.restype = wintypes.HANDLE
+OpenProcess.argtypes = [wintypes.DWORD, wintypes.BOOL, wintypes.DWORD]
+
+CloseHandle = kernel32.CloseHandle
+CloseHandle.restype = wintypes.BOOL
+CloseHandle.argtypes = [wintypes.HANDLE]
+
 
 class BiasAddr:
     def __init__(self, account, mobile, name, key, db_path):
@@ -61,10 +78,25 @@ def get_process_handle(self):
             return False, "[-] WeChat No Run"
 
     def search_memory_value(self, value: bytes, module_name="WeChatWin.dll"):
-        # 创建 Pymem 对象
-        module = pymem.process.module_from_name(self.pm.process_handle, module_name)
-        ret = self.pm.pattern_scan_module(value, module, return_multiple=True)
-        ret = ret[-1] - module.lpBaseOfDll if len(ret) > 0 else 0
+        start_adress = 0x7FFFFFFFFFFFFFFF
+        end_adress = 0
+
+        memory_maps = get_memory_maps(self.pid)
+        for module in memory_maps:
+            if module.FileName and module_name in module.FileName:
+                s = module.BaseAddress
+                e = module.BaseAddress + module.RegionSize
+                start_adress = s if s < start_adress else start_adress
+                end_adress = e if e > end_adress else end_adress
+        hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, False, self.pid)
+        ret = search_memory(hProcess, value, max_num=3, start_address=start_adress,
+                                    end_address=end_adress)
+        ret = ret[-1] - start_adress if len(ret) > 0 else 0
+
+        # # 创建 Pymem 对象
+        # module = pymem.process.module_from_name(self.pm.process_handle, module_name)
+        # ret = self.pm.pattern_scan_module(value, module, return_multiple=True)
+        # ret = ret[-1] - module.lpBaseOfDll if len(ret) > 0 else 0
         return ret
 
     def get_key_bias1(self):
@@ -81,7 +113,6 @@ def get_key_bias1(self):
             module = pymem.process.module_from_name(self.process_handle, self.module_name)
             keyBytes = b'-----BEGIN PUBLIC KEY-----\n...'
             publicKeyList = pymem.pattern.pattern_scan_all(self.process_handle, keyBytes, return_multiple=True)
-
             keyaddrs = []
             for addr in publicKeyList:
                 keyBytes = addr.to_bytes(byteLen, byteorder="little", signed=True)  # 低位在前