微信发送自定义小程序

发送微信小程序卡片有两种类型，一种是在小程序中点击分享，另一种是在聊天界面点“转发”。在8.0.49版本，这两种类型的消息分别是:com.tencent.mm.pluginsdk.model.app.e3 和 com.tencent.mm.pluginsdk.model.app.c3，可使用关键词/cgi-bin/micromsg-bin/sendappmsg定位关键代码。

逆向分析

com.tencent.mm.pluginsdk.model.app.e3

package com.tencent.mm.pluginsdk.model.app;

public class e3 extends k1 implements j0, f {
    public final m d;
    public s0 e;
    public final long f;
    public final String g;
    public final oj.f h;
    public final d i;
    public k9 j;
    public final boolean n;
    public final int o;
    public final a p;
    public WebviewReportPublisherIdEvent q;
    public AppBrandOuterMenuClickReportEvent r;
    public final d3 s;

    public e3(long v, boolean z, oj.f f0, d3 d30, String s, d d0) {
        this.f = 0L;
        this.h = null;
        this.i = null;
        this.j = null;
        this.n = false;
        this.o = 0;
        this.s = null;
        this.f = v;
        this.g = s;
        this.h = f0;
        this.s = d30;
        this.n = z;
        this.i = d0;
        j j0 = new j();
        j0.a = new y25();
        j0.b = new z25();
        j0.c = "/cgi-bin/micromsg-bin/sendappmsg";
        j0.d = 0xDE;
        j0.e = 107;
        j0.f = 1000000107;
        this.d = j0.a();
        k2.j("MicroMsg.NetSceneSendAppMsgForCdn", "summerbig NetSceneSendAppMsgForCdn msgId[%d], sceneResult[%s], sessionId[%s], attachInfo[%s]. stack[%s]", new Object[]{v, f0, s, d0, new x3()});
        Map map0 = q4.V6().e;
        Object object0 = new Object();
        ((ConcurrentHashMap)map0).put(Integer.valueOf(this.hashCode()), object0);
    }

    public e3(long v, boolean z, oj.f f0, d3 d30, String s, d d0, int v1, a a0) {
        this(v, ((boolean)(((int)z))), f0, d30, s, d0);
        this.o = v1;
        this.p = a0;
    }

    @Override  // com.tencent.mm.modelbase.k1
    public int doScene(q q0, s0 s00) {
        int v3;
        int v2;
        String s1;
        e3 e30 = this;
        e30.e = s00;
        m9 m90 = (m9)h8.b().z();
        long msgid = e30.f;
        k9 k90 = m90.y3(msgid);
        e30.j = k90;
        d3 d30 = e30.s;
        if(Long.compare(k90.getMsgId(), msgid) != 0) {
            k2.e("MicroMsg.NetSceneSendAppMsgForCdn", "summerbig cdntra doscene msginfo null id:%d", new Object[]{msgid});
            d30.a(3, -1);
            return -1;
        }

        pe0.q q1 = pe0.q.u(e30.j.getContent());  // xml
        if(q1 == null) {
            k2.e("MicroMsg.NetSceneSendAppMsgForCdn", "summerbig cdntra doscene AppMessage.Content.parse null id:%d", new Object[]{msgid});
            d30.a(3, -1);
        }

        if(q1 != null && q1.i == 6 && e30.j.getType() == 10000) {
            k2.e("MicroMsg.NetSceneSendAppMsgForCdn", "stop send revoke msg(%s)", new Object[]{((long)e30.j.getMsgId())});
            return -1;
        }

        Class class0 = to2.d3.class;
        if(q1 != null && q1.i == 6 && (e30.j.u0() <= 0L || e30.j.x0() != 2)) {
            b b0 = (b)q1.x(b.class);
            if(b0 != null && (b0.b != 0L || !a8.F0(b0.c))) {
                b0.b = 0L;
                b0.c = "";
                e30.j.J0(pe0.q.t(q1, null, null));
                ((b1)(((to2.d3)u70.k1.s(class0)))).l7().W8(e30.j.getMsgId(), e30.j);
            }
        }

        m m0 = e30.d;
        y25 y250 = (y25)m0.a.a;
        x6 x60 = new x6();
        x60.e = q1.d;
        x60.n = e30.j.y0() + e30.j.getMsgId() + "T" + e30.j.getCreateTime();
        x60.j = (int)a8.d1();
        x60.g = e30.j.y0();
        x60.d = b2.r();
        x60.h = q1.i;
        x60.f = q1.e;
        x60.p = q1.r;
        String s = ((d1)ok.a.a).a(e30.j);
        x60.r = a8.F0(s) ? tj0.m9.a(e30.j.G) : s;
        x60.s = q1.E1;
        x60.t = q1.F1;
        x60.u = q1.G1;
        a a0 = e30.p;
        if(a0 != null) {
            x60.v = a0.a;
            x60.w = a0.b;
        }

        y250.q = e30.o;
        l2 l20 = w.a(e30.g);
        if(l20 != null) {
            WebviewReportPublisherIdEvent webviewReportPublisherIdEvent0 = new WebviewReportPublisherIdEvent();
            e30.q = webviewReportPublisherIdEvent0;
            webviewReportPublisherIdEvent0.g.e = q1.j;
            webviewReportPublisherIdEvent0.g.a = l20.f("prePublishId", "");
            k00 k000 = e30.q.g;
            k000.c = l20.f("preUsername", "");
            k00 k001 = e30.q.g;
            k001.d = l20.f("preChatName", "");
            k00 k002 = e30.q.g;
            k002.f = l20.e("preMsgIndex", 0);
            k00 k003 = e30.q.g;
            k003.j = l20.e("sendAppMsgScene", 0);
            k00 k004 = e30.q.g;
            k004.k = l20.e("getA8KeyScene", 0);
            k00 k005 = e30.q.g;
            k005.l = l20.f("referUrl", null);
            k00 k006 = e30.q.g;
            k006.m = l20.f("adExtStr", null);
            e30.q.g.g = e30.j.y0();
            e30.q.g.n = q1.f;
            e30.q.g.o = q1.g;
            if(((t4)h8.b().u()).n(e30.j.y0(), true) != null) {
                e30.q.g.h = "";
            }

            k00 k007 = e30.q.g;
            k007.i = ((nq.a)(((e)n0.c(e.class)))).N6(e30.j.y0());
            if(q1.U1 == null) {
                goto label_294;
            }
            else {
                rf5 rf50 = new rf5();
                byte[] arr_b = Base64.decode(q1.U1, 0);
                try {
                    rf50.parseFrom(arr_b);
                    pf5 pf50 = rf50.f;
                    if(pf50 == null) {
                        goto label_294;
                    }

                    s1 = pf50.d;
                }
                catch(Exception unused_ex) {
                label_294:
                    s1 = "";
                }
            }

            y250.j = String.format(Locale.US, "prePublishId=%s&preUserName=%s&preChatName=%s&preChatType=%d&getA8KeyScene=%d&sourceAppId=%s", e30.q.g.a, e30.q.g.c, e30.q.g.d, ((int)h2.b(e30.q.g.c, e30.q.g.d)), ((int)e30.q.g.k), s1);
        }

        if(l20 != null && q1.i == 33) {
            e30.r = new AppBrandOuterMenuClickReportEvent();
            int v1 = l20.e("fromScene", 1);
            e30.r.g.d = v1;
            l20.e("appservicetype", 0);
            e30.r.g.getClass();
            String s2 = l20.f("preChatName", "");
            e30.r.g.f = 2 == v1 ? s2 + ":" + l20.f("preUsername", "") : s2;
            String s3 = e30.j.y0();
            boolean z = l20.d("moreRetrAction", false);
            if(s3.endsWith("@chatroom")) {
                e30.r.g.h = z ? 5 : 2;
            }
            else {
                e30.r.g.h = z ? 4 : 1;
            }

            wi.w w0 = e30.r.g;
            w0.e = q1.v2 + 1;
            w0.g = q1.e2;
            w0.a = q1.f2;
            w0.b = q1.g2;
            w0.c = q1.w2;
            w0.j = a8.d1();
            e30.r.g.k = 1;
            e30.r.g.l = q1.j2;
        }

        if(a8.F0(e30.j.m0())) {
        label_438:
            v3 = 0;
            v2 = 0;
        }
        else {
            ((i)(((f0)n0.c(f0.class)))).getClass();
            BitmapFactory.Options bitmapFactory$Options0 = x.e0(l3.X6().V3(e30.j.m0()));
            if(bitmapFactory$Options0 == null) {
                goto label_438;
            }

            v2 = bitmapFactory$Options0.outWidth;
            v3 = bitmapFactory$Options0.outHeight;
        }

        oj.f f0 = e30.h;
        if(f0.b()) {
            k2.j("MicroMsg.NetSceneSendAppMsgForCdn", "summersafecdn app sceneResult crc[%d], safecdn[%b], hitcachetype[%d], aeskey[%s]", new Object[]{((int)f0.field_filecrc), Boolean.valueOf(f0.field_upload_by_safecdn), ((int)f0.field_UploadHitCacheType), f0.field_aesKey});
            f0.field_aesKey = "";
            y250.n = 1;
        }

        y250.o = f0.field_filecrc;
        x60.i = pe0.q.s(q1, (e30.n ? "@cdn_" + f0.field_fileId + "_" + f0.field_aesKey + "_1" : null), f0, v2, v3);
        y250.d = x60;
        d d0 = e30.i;
        if(d0 != null && (q1.t != 0 || q1.l > 0x1900000)) {
            y250.i = d0.field_signature;
            y250.h = 7;
        }

        y250.g = q1.s;
        if(a8.F0(f0.field_filemd5)) {
            k2.j("MicroMsg.NetSceneSendAppMsgForCdn", "summerbig sceneResult filemd5 is null use content.filemd5[%s]", new Object[]{q1.s});
        }
        else {
            y250.g = f0.field_filemd5;
        }

        if(((PluginMessengerFoundation)(((to2.l3)n0.c(to2.l3.class)))).S6(e30.j.y0())) {
            y250.r = ((b1)(((to2.d3)u70.k1.s(class0)))).Q6().Y(e30.j.y0());
        }

        k2.j("MicroMsg.NetSceneSendAppMsgForCdn", "summerbig file md5[%s], HitMd5[%d], signature[%s], type[%d], sceneResult[%s], fromScene[%s]", new Object[]{y250.g, ((int)y250.n), a8.B1(y250.i), ((int)y250.h), f0, y250.j});
        k2.j("MicroMsg.NetSceneSendAppMsgForCdn", "Req MsgSource %s", new Object[]{y250.d.r});
        return e30.dispatch(q0, m0, e30);
    }

    @Override  // com.tencent.mm.modelbase.k1
    public int getDispatchInterceptRet(q q0, t0 t00, j0 j00) {
        return a1.a(this.f, this) ? 0xFFFFFF82 : super.getDispatchInterceptRet(q0, t00, j00);
    }

    @Override  // qo.f
    public long getMsgId() {
        return this.f;
    }

    @Override  // com.tencent.mm.modelbase.k1
    public int getType() {
        return 0xDE;
    }

    @Override  // com.tencent.mm.network.j0
    public void onGYNetEnd(int v, int v1, int v2, String s, t0 t00, byte[] arr_b) {
        k9 k91;
        m m0 = (m)t00;
        k2.j("MicroMsg.NetSceneSendAppMsgForCdn", "summerbig cdntra onGYNetEnd [%d,%d,%s] msgId:%d, oldContent[%s], newContent[%s]", new Object[]{v1, v2, s, ((long)this.f), a8.B1(this.j.getContent()), ((y25)m0.a.a).d.i});
        z25 z250 = (z25)m0.b.a;
        if(z250 != null && (v1 == 4 || v1 == 0 && v2 == 0)) {
            ((PluginMessengerFoundation)(((to2.l3)n0.c(to2.l3.class)))).T6(z250.q);
        }

        k9 k90 = ((m9)h8.b().z()).y3(this.j.getMsgId());
        d3 d30 = this.s;
        if(v1 == 0 && v2 == 0) {
            k2.j("MicroMsg.NetSceneSendAppMsgForCdn", "summersafecdn svrid[%d]. aeskey[%s], old content[%s]", new Object[]{((long)z250.n), z250.o, a8.B1(k90.getContent())});
            if(this.h == null || !this.h.b()) {
                k91 = k90;
            }
            else if(a8.F0(z250.o)) {
                k91 = k90;
                k2.q("MicroMsg.NetSceneSendAppMsgForCdn", "summersafecdn need aeskey but ret null", null);
            }
            else {
                pe0.q q0 = pe0.q.u(k90.getContent());
                q0.R = z250.o;
                k91 = k90;
                k91.J0(pe0.q.t(q0, null, null));
                if(q0.i == 5 && q0.H == 0) {
                    k91.J0(x0.a(0, k91.y0(), ((boolean)(k91.o0() == 1 ? 1 : 0)), k91.getContent()));
                }

                k2.j("MicroMsg.NetSceneSendAppMsgForCdn", "summersafecdn aeskey[%s], new content[%s]", new Object[]{z250.o, a8.B1(k91.getContent())});
            }

            k91.h1(2);
            k91.a1(z250.n);
            tj0.m9.M(k91, z250.p, false);
            ((m9)h8.b().z()).W8(k91.getMsgId(), k91);
            ((m1)(((uy.i)n0.c(uy.i.class)))).Q6(k91.getMsgId());
            int v3 = u.a(k91);
            h.f.e(k91, v3);
            this.e.onSceneEnd(v1, v2, s, this);
            d30.a(v1, v2);
            if(this.q != null && !a8.F0(this.q.g.e)) {
                this.q.g.b = "msg_" + Long.toString(z250.n);
                this.q.d();
            }

            AppBrandOuterMenuClickReportEvent appBrandOuterMenuClickReportEvent0 = this.r;
            if(appBrandOuterMenuClickReportEvent0 != null) {
                appBrandOuterMenuClickReportEvent0.g.i = "msg_" + k91.u0();
                this.r.d();
            }

            pe0.q q1 = pe0.q.u(k91.getContent());
            if(q1 != null) {
                if(k4.K3(k91.y0())) {
                    pe0.a a0 = (pe0.a)q1.x(pe0.a.class);
                    if(a0 != null && (a0.I)) {
                        uj.j0.a(k91, q1);
                    }

                    ((xj.j)(((xj.i)n0.c(xj.i.class)))).e7(k91);
                }

                if(q1.i == 6) {
                    ((xo4.t0)xo4.t0.d).g(new e7(q1, k91, 6));
                }
            }

            return;
        }

        k9 k92 = k90;
        if(v1 == 4 && v2 == 102) {
            k2.q("MicroMsg.NetSceneSendAppMsgForCdn", "summersafecdn MM_ERR_GET_AESKEY_FAILED", null);
            this.e.onSceneEnd(v1, v2, s, this);
            d30.a(v1, v2);
            return;
        }

        k92.h1(5);
        zo2.b.e(k92.getMsgId(), zo2.b.c(v2, v1, s, 0xDE));
        ((m9)h8.b().z()).W8(k92.getMsgId(), k92);
        k2.e("MicroMsg.NetSceneSendAppMsgForCdn", "summerbig send app msg failed, err=" + v1 + "," + v2, null);
        this.e.onSceneEnd(v1, v2, s, this);
        d30.a(v1, v2);
    }

    @Override  // com.tencent.mm.modelbase.k1
    public com.tencent.mm.modelbase.m1 securityVerificationChecked(t0 t00) {
        return com.tencent.mm.modelbase.m1.e;
    }
}

com.tencent.mm.pluginsdk.model.app.c3

package com.tencent.mm.pluginsdk.model.app;


public class c3 extends k1 implements j0, f {
    public final m d;
    public s0 e;
    public k9 f;
    public final long g;
    public final String h;
    public final String i;
    public final int j;
    public final a n;
    public long o;
    public String p;
    public WebviewReportPublisherIdEvent q;
    public WebviewReportTmplTransferEvent r;
    public AppBrandOuterMenuClickReportEvent s;
    public long t;
    public final i u;

    public c3(long v, String s, String s1) {
        this.f = null;
        this.g = 0L;
        this.j = 0;
        this.o = 0L;
        this.p = "";
        this.t = 0L;
        this.u = new b3(this);
        this.g = v;
        this.h = s;
        this.i = s1;
        j j0 = new j();
        j0.a = new y25();
        j0.b = new z25();
        j0.c = "/cgi-bin/micromsg-bin/sendappmsg";
        j0.d = 0xDE;
        j0.e = 107;
        j0.f = 1000000107;
        this.d = j0.a();
        k2.j("MicroMsg.NetSceneSendAppMsg", "summersafecdn NetSceneSendAppMsg msgid[%d], sessionid[%s], signature[%s], stack[%s]", new Object[]{v, s, a8.B1(s1), new x3()});
        Map map0 = q4.V6().e;
        Object object0 = new Object();
        ((ConcurrentHashMap)map0).put(Integer.valueOf(this.hashCode()), object0);
    }

    public c3(long v, String s, String s1, int v1, a a0) {
        this(v, s, s1);
        this.j = v1;
        this.n = a0;
        k2.j("MicroMsg.NetSceneSendAppMsg", "NetSceneSendAppMsg directShare[%d]", new Object[]{v1});
        if(a0 != null) {
            k2.j("MicroMsg.NetSceneSendAppMsg", "NetSceneSendAppMsg tokenValid[%d], pkgName[%s]", new Object[]{((int)a0.a), a0.b});
        }
    }

    @Override  // com.tencent.mm.modelbase.k1
    public int doScene(q q0, s0 s00) {
        int v7;
        m m1;
        String s8;
        String s5;
        int v2;
        String s1;
        c3 c30 = this;
        c30.e = s00;
        if(c30.o == 0L) {
            c30.o = System.currentTimeMillis();
        }

        m9 m90 = (m9)h8.b().z();
        long v = c30.g;
        k9 k90 = m90.y3(v);
        c30.f = k90;
        if(Long.compare(k90.getMsgId(), v) != 0) {
            return -1;
        }

        pe0.q q1 = pe0.q.u(c30.f.getContent());
        Class class0 = d3.class;
        if(q1 == null) {
            h5 h50 = new h5(c30.f.getContent());
            if(a8.F0(h50.f)) {
                q1 = new pe0.q();
                q1.p = h50.d;
                q1.i = 8;
                k2.j("MicroMsg.NetSceneSendAppMsg", "create new content. loss appid", null);
            }
            else {
                q1 = pe0.q.u(h50.f);
            }
        }
        else if(q1.i == 6 && (c30.f.u0() <= 0L || c30.f.x0() != 2)) {
            b b0 = (b)q1.x(b.class);
            if(b0 != null && (b0.b != 0L || !a8.F0(b0.c))) {
                b0.b = 0L;
                b0.c = "";
                c30.f.J0(pe0.q.t(q1, null, null));
                ((b1)(((d3)u70.k1.s(class0)))).l7().W8(c30.f.getMsgId(), c30.f);
            }
        }

        Assert.assertTrue("content != null [[" + c30.f.getContent() + "]]", ((boolean)(q1 == null ? 0 : 1)));
        if(q1 == null) {
            c30.f = null;
            return -1;
        }

        if(c30.f.k2()) {
            u0 u00 = (u0)n0.c(u0.class);
            String s = c30.f.m0();
            ((v0)u00).getClass();
            t2 t20 = zl0.b3.i(s);
            s1 = t20 == null ? "" : t20.D.i;
        }
        else if(a8.F0(c30.f.m0())) {
            s1 = "";
        }
        else {
            ((av.i)(((f0)n0.c(f0.class)))).getClass();
            s1 = l3.X6().V3(c30.f.m0());
        }

        int v1 = q1.i;
        if(v1 == 8 || v1 == 9) {
            k2.j("MicroMsg.NetSceneSendAppMsg", "cdntra cdn not support Emoji or voiceremind now type:%d", new Object[]{v1});
            v2 = 0;
        }
        else if(a8.F0(s1)) {
            k2.j("MicroMsg.NetSceneSendAppMsg", "cdntra cdn not support no thumb msg type:%d", new Object[]{((int)q1.i)});
            v2 = 0;
        }
        else {
            long v3 = v;
            long v4 = (long)(((int)p6.l(s1)));
            c30.t = v4;
            int v5 = q1.i;
            int v6 = v5 == 33 || v5 == 36 || v5 == 46 || v5 == 44 || v5 == 0x30 || v5 == 101 ? 1 : 0;
            if(v6 == 0 && v4 >= 0x40000L) {
                k2.q("MicroMsg.NetSceneSendAppMsg", "cdntra thumb[%s][%d] Too Big Not Use CDN TRANS", new Object[]{s1, v4});
                v2 = 0;
            }
            else {
                k2.j("MicroMsg.NetSceneSendAppMsg", "cdntra content.type:%d  thumbPath:%s,  thumbLength:%d ", new Object[]{v5, s1, ((long)c30.t)});
                if(a8.F0(q1.o)) {
                    Class class1 = jq.f0.class;
                    if(v6 == 0 && !((k)(((jq.f0)n0.c(class1)))).W6(4)) {
                        k2.q("MicroMsg.NetSceneSendAppMsg", "cdntra not use cdn flag:%b ", new Object[]{Boolean.valueOf(((k)(((jq.f0)n0.c(class1)))).W6(4))});
                        v2 = 0;
                    }
                    else {
                        String s2 = p1.b("upappmsg", c30.f.getCreateTime(), c30.f.y0(), "" + c30.f.getMsgId());
                        c30.p = s2;
                        if(a8.F0(s2)) {
                            k2.q("MicroMsg.NetSceneSendAppMsg", "cdntra genClientId failed not use cdn msgid:%d", new Object[]{((long)c30.f.getMsgId())});
                            v2 = 0;
                        }
                        else {
                            oj.k k0 = new oj.k();
                            k0.d = "task_AppMessage";
                            k0.field_fullpath = "";
                            k0.field_fileType = 3;
                            k0.field_priority = 2;
                            k0.field_needStorage = false;
                            k0.field_isStreamMedia = false;
                            k0.field_force_aeskeycdn = true;
                            k0.field_trysafecdn = false;
                            for(Object object0: q1.B2.entrySet()) {
                                h h0 = (h)((Map.Entry)object0).getValue();
                                if(h0 == null) {
                                    continue;
                                }

                                h0.b(k0, q1);
                            }

                            k0.f = c30.u;
                            k0.field_mediaId = c30.p;
                            k0.field_thumbpath = s1;
                            k0.field_talker = c30.f.y0();
                            k2.j("MicroMsg.NetSceneSendAppMsg", "summersafecdn cdntra checkUseCdn content.type[%d], thumb[%s], useCdnTransClientId[%s], fileType[%d], enable_hitcheck[%b], onlycheckexist[%b], force_aeskeycdn[%b], trysafecdn[%b]", new Object[]{((int)q1.i), s1, c30.p, ((int)k0.field_fileType), Boolean.valueOf(k0.field_enable_hitcheck), Boolean.valueOf(k0.field_onlycheckexist), Boolean.valueOf(k0.field_force_aeskeycdn), Boolean.valueOf(k0.field_trysafecdn)});
                            if(((k)(((jq.f0)n0.c(class1)))).S6(k0)) {
                                v2 = 1;
                            }
                            else {
                                k2.e("MicroMsg.NetSceneSendAppMsg", "cdntra addSendTask failed.", null);
                                c30.p = "";
                                v2 = 0;
                            }
                        }
                    }
                }
                else {
                    k2.q("MicroMsg.NetSceneSendAppMsg", "cdntra attach has been upload by cdn msgid:%d", new Object[]{v3});
                    v2 = 0;
                }
            }
        }

        if(v2 != 0) {
            return 0;
        }

        l2 l20 = w.a(c30.h);
        if(l20 != null && (l20.a("_tmpl_webview_transfer_scene"))) {
            WebviewReportTmplTransferEvent webviewReportTmplTransferEvent0 = new WebviewReportTmplTransferEvent();
            c30.r = webviewReportTmplTransferEvent0;
            webviewReportTmplTransferEvent0.g.a = l20.e("_tmpl_webview_transfer_scene", -1);
        }

        m m0 = c30.d;
        y25 y250 = (y25)m0.a.a;
        x6 x60 = new x6();
        x60.e = q1.d;
        String s3 = s1;
        x60.n = c30.f.y0() + c30.f.getMsgId() + "T" + c30.f.getCreateTime();
        if(q1.i != 19 && q1.i != 24) {
            String s4 = c30.f.getContent();
            if(d.f().b(new RepairerConfigUrlXmlTrim()) == 1 && (q1.i == 5 && q1.H == 0 && s4 != null)) {
                try {
                    s5 = s74.b.a(s4, "appmsg");
                }
                catch(Exception unused_ex) {
                    s5 = null;
                }
            }
            else {
                s5 = null;
            }

            if(a8.F0(s5)) {
                s5 = pe0.q.s(q1, null, null, 0, 0);
            }

            x60.i = s5;
        }
        else {
            try {
                x60.i = s74.b.a(c30.f.getContent(), "appmsg");
            }
            catch(Exception unused_ex) {
                x60.i = pe0.q.s(q1, null, null, 0, 0);
            }
        }

        x60.j = (int)a8.d1();
        x60.g = c30.f.y0();
        x60.d = b2.r();
        x60.h = q1.i;
        x60.f = q1.e;
        x60.p = q1.r;
        String s6 = ((d1)ok.a.a).a(c30.f);
        x60.r = a8.F0(s6) ? tj0.m9.a(c30.f.G) : s6;
        x60.s = q1.E1;
        x60.t = q1.F1;
        x60.u = q1.G1;
        a a0 = c30.n;
        if(a0 != null) {
            x60.v = a0.a;
            x60.w = a0.b;
        }

        if(l20 == null) {
            m1 = m0;
            v7 = 5;
        }
        else {
            WebviewReportPublisherIdEvent webviewReportPublisherIdEvent0 = new WebviewReportPublisherIdEvent();
            c30.q = webviewReportPublisherIdEvent0;
            webviewReportPublisherIdEvent0.g.e = q1.j;
            webviewReportPublisherIdEvent0.g.a = l20.f("prePublishId", "");
            k00 k000 = c30.q.g;
            k000.c = l20.f("preUsername", "");
            k00 k001 = c30.q.g;
            k001.d = l20.f("preChatName", "");
            k00 k002 = c30.q.g;
            k002.f = l20.e("preMsgIndex", 0);
            k00 k003 = c30.q.g;
            k003.j = l20.e("sendAppMsgScene", 0);
            k00 k004 = c30.q.g;
            k004.k = l20.e("getA8KeyScene", 0);
            k00 k005 = c30.q.g;
            k005.l = l20.f("referUrl", null);
            k00 k006 = c30.q.g;
            k006.m = l20.f("adExtStr", null);
            c30.q.g.g = c30.f.y0();
            c30.q.g.n = q1.f;
            c30.q.g.o = q1.g;
            if(((t4)h8.b().u()).n(c30.f.y0(), true) != null) {
                c30.q.g.h = "";
            }

            k00 k007 = c30.q.g;
            k007.i = ((nq.a)(((e)n0.c(e.class)))).N6(c30.f.y0());
            if(q1.U1 == null) {
                goto label_661;
            }
            else {
                rf5 rf50 = new rf5();
                byte[] arr_b = Base64.decode(q1.U1, 0);
                try {
                    rf50.parseFrom(arr_b);
                    pf5 pf50 = rf50.f;
                    if(pf50 == null) {
                        goto label_661;
                    }

                    String s7 = pf50.d;
                    s8 = s7;
                }
                catch(Exception unused_ex) {
                label_661:
                    s8 = "";
                }
            }

            Locale locale0 = Locale.US;
            Object[] arr_object = new Object[6];
            m1 = m0;
            arr_object[0] = c30.q.g.a;
            arr_object[1] = c30.q.g.c;
            arr_object[2] = c30.q.g.d;
            arr_object[3] = (int)h2.b(c30.q.g.c, c30.q.g.d);
            arr_object[4] = (int)c30.q.g.k;
            v7 = 5;
            arr_object[5] = s8;
            y250.j = String.format(locale0, "prePublishId=%s&preUserName=%s&preChatName=%s&preChatType=%d&getA8KeyScene=%d&sourceAppId=%s", arr_object);
        }

        if(l20 != null && q1.i == 33) {
            c30.s = new AppBrandOuterMenuClickReportEvent();
            int v8 = l20.e("fromScene", 1);
            c30.s.g.d = v8;
            l20.e("appservicetype", 0);
            c30.s.g.getClass();
            String s9 = l20.f("preChatName", "");
            c30.s.g.f = 2 == v8 ? s9 + ":" + l20.f("preUsername", "") : s9;
            String s10 = c30.f.y0();
            boolean z = l20.d("moreRetrAction", false);
            if(s10.endsWith("@chatroom")) {
                wi.w w0 = c30.s.g;
                if(!z) {
                    v7 = 2;
                }

                w0.h = v7;
            }
            else {
                c30.s.g.h = z ? 4 : 1;
            }

            wi.w w1 = c30.s.g;
            w1.e = q1.v2 + 1;
            w1.g = q1.e2;
            w1.a = q1.f2;
            w1.b = q1.g2;
            w1.c = q1.w2;
            w1.j = a8.d1();
            c30.s.g.k = 1;
            c30.s.g.l = q1.j2;
        }

        if(!a8.F0(s3)) {
            byte[] arr_b1 = p6.N(s3, 0, -1);
            if(!a8.H0(arr_b1)) {
                oy4 oy40 = new oy4();
                oy40.c(arr_b1);
                x60.o = oy40;
            }
        }

        y250.d = x60;
        if(q1.t != 0 || q1.l > 0x1900000) {
            y250.h = 7;
        }

        y250.g = q1.s;
        y250.i = c30.i;
        y250.q = c30.j;
        if(((PluginMessengerFoundation)(((to2.l3)n0.c(to2.l3.class)))).S6(c30.f.y0())) {
            y250.r = ((b1)(((d3)u70.k1.s(class0)))).Q6().Y(c30.f.y0());
        }

        k2.j("MicroMsg.NetSceneSendAppMsg", "summersafecdn file md5[%s], signature[%s], type[%d], fromScene[%s]", new Object[]{y250.g, a8.B1(y250.i), ((int)y250.h), y250.j});
        k2.j("MicroMsg.NetSceneSendAppMsg", "Req MsgSource %s", new Object[]{y250.d.r});
        return c30.dispatch(q0, m1, c30);
    }

    @Override  // com.tencent.mm.modelbase.k1
    public int getDispatchInterceptRet(q q0, t0 t00, j0 j00) {
        return a1.a(this.g, this) ? 0xFFFFFF82 : super.getDispatchInterceptRet(q0, t00, j00);
    }

    @Override  // qo.f
    public long getMsgId() {
        return this.g;
    }

    @Override  // com.tencent.mm.modelbase.k1
    public int getType() {
        return 0xDE;
    }

    @Override  // com.tencent.mm.network.j0
    public void onGYNetEnd(int v, int v1, int v2, String s, t0 t00, byte[] arr_b) {
        k9 k91;
        k9 k93;
        mq2.b b0;
        String s2;
        c3 c30 = this;
        int v3 = v1;
        int v4 = v2;
        String s1 = s;
        k2.j("MicroMsg.NetSceneSendAppMsg", "summersafecdn cdntra onGYNetEnd [%d,%d,%s] msgId:%d, oldContent[%s]", new Object[]{v1, v2, s1, ((long)c30.g), a8.B1(c30.f.getContent())});
        m m0 = (m)t00;
        z25 z250 = (z25)m0.b.a;
        y25 y250 = (y25)m0.a.a;
        if(z250 != null && (v3 == 4 || v3 == 0 && v4 == 0)) {
            ((PluginMessengerFoundation)(((to2.l3)n0.c(to2.l3.class)))).T6(z250.q);
        }

        if(v3 == 3 && v4 == -1 && !a8.F0(c30.p)) {
            k2.q("MicroMsg.NetSceneSendAppMsg", "cdntra using cdn trans,  wait cdn service callback! clientid:%s", new Object[]{c30.p});
            return;
        }

        k9 k90 = ((m9)h8.b().z()).y3(c30.f.getMsgId());
        if(v3 == 0 && v4 == 0) {
            k90.h1(2);
            k90.a1(z250.n);
            tj0.m9.M(k90, z250.p, false);
            ((m9)h8.b().z()).W8(k90.getMsgId(), k90);
            ((m1)(((uy.i)n0.c(uy.i.class)))).Q6(k90.getMsgId());
            int v5 = u.a(k90);
            com.tencent.mm.modelstat.h.f.e(k90, v5);
            if(c30.q != null && !a8.F0(c30.q.g.e)) {
                c30.q.g.b = "msg_" + Long.toString(z250.n);
                c30.q.d();
            }

            WebviewReportTmplTransferEvent webviewReportTmplTransferEvent0 = c30.r;
            if(webviewReportTmplTransferEvent0 != null && webviewReportTmplTransferEvent0.g.a != -1) {
                webviewReportTmplTransferEvent0.d();
            }

            pe0.q q0 = pe0.q.u(k90.getContent());
            if(q0 != null && ("wx4310bbd51be7d979".equals(q0.d))) {
                int v6 = (a8.F0(k90.y0())) || !k4.O3(k90.y0()) ? 0 : 1;
                try {
                    s2 = URLEncoder.encode(q0.g, "UTF-8");
                }
                catch(UnsupportedEncodingException unsupportedEncodingException0) {
                    k2.n("MicroMsg.NetSceneSendAppMsg", unsupportedEncodingException0, "", new Object[0]);
                    s2 = "";
                }

                String s3 = "1," + (v6 == 0 ? 1 : 2) + ",," + s2;
                k2.j("MicroMsg.NetSceneSendAppMsg", "androidSystemShareFixed(13717) %s", new Object[]{s3});
                g0.r.kvStat(0x3595, s3);
            }

            if(q0 == null) {
                k91 = k90;
            }
            else {
                int v7 = q0.i;
                if(v7 == 6) {
                    k91 = k90;
                    ((xo4.t0)xo4.t0.d).g(new e7(q0, k91, 6));
                }
                else {
                    switch(v7) {
                        case 53: {
                            k9 k92 = k90;
                            Class class0 = eh2.e.class;
                            p p0 = ((eh2.e)n0.c(class0)).Q6();
                            p0.getClass();
                            if(k92.u0() <= 0L) {
                                k91 = k92;
                            }
                            else {
                                k91 = k92;
                                ((xo4.t0)xo4.t0.d).h(new ih2.k(p0, k91), "GroupSolitaireReport");
                            }

                            p p1 = ((eh2.e)n0.c(class0)).Q6();
                            p1.getClass();
                            if(k91.u0() > 0L) {
                                ((xo4.t0)xo4.t0.d).g(new ih2.m(p1, k91));
                            }

                            break;
                        }
                        case 57: {
                            Class class1 = jq2.i.class;
                            jq2.i i0 = (jq2.i)n0.c(class1);
                            long v8 = k90.getMsgId();
                            long v9 = k90.u0();
                            ((jq2.j)i0).getClass();
                            mq2.a a0 = ((jq2.j)(((jq2.i)n0.c(class1)))).N6();
                            if(v8 <= 0L) {
                                a0.getClass();
                                k2.e("MicroMsg.msgquote.MsgQuoteStorage", "getMsgQuteByMsgId:%s", new Object[]{v8});
                                b0 = null;
                            }
                            else {
                                Cursor cursor0 = a0.d.l("MsgQuote", mq2.b.v.c, "msgId=?", new String[]{v8 + ""}, null, null, null);
                                if(cursor0 == null) {
                                    b0 = null;
                                }
                                else {
                                    ArrayList arrayList0 = new ArrayList();
                                    while(cursor0.moveToNext()) {
                                        mq2.b b1 = new mq2.b();
                                        b1.convertFrom(cursor0);
                                        arrayList0.add(b1);
                                    }

                                    b0 = arrayList0.size() == 0 ? null : ((mq2.b)arrayList0.get(0));
                                }
                            }

                            if(b0 == null) {
                                k93 = k90;
                                k2.e("MicroMsg.msgquote.PluginMsgQuote", "handleQuoteMsgSendResuld() msgId:%s msgSvrId:%s, msgQuote is null", new Object[]{v8, v9});
                            }
                            else {
                                b0.field_msgSvrId = v9;
                                mq2.a a1 = ((jq2.j)(((jq2.i)n0.c(class1)))).N6();
                                a1.getClass();
                                k93 = k90;
                                boolean z = a1.update(b0.systemRowid, b0);
                                k9 k94 = ((b1)(((d3)u70.k1.s(d3.class)))).l7().y3(b0.field_quotedMsgId);
                                switch(k94.getType()) {
                                    case 49: 
                                    case 0x100031: 
                                    case 0x19000031: 
                                    case 0x1A000031: 
                                    case 0x2D000031: 
                                    case 0x2E000031: 
                                    case 0x30000031: 
                                    case 0x31000031: 
                                    case 0x33000031: 
                                    case 0x38000031: 
                                    case 0x3A000031: 
                                    case 0x3A200031: 
                                    case 0x3E000031: 
                                    case 0x41000031: 
                                    case 0x45000031: 
                                    case 0x46000031: {
                                        pe0.q q1 = pe0.q.u(k94.getContent());
                                        if(q1 == null) {
                                            k2.e("MicroMsg.msgquote.PluginMsgQuote", "appMsgContent is null", null);
                                        }
                                        else {
                                            g.a(2L, b0.field_quotedMsgSvrId, 49L, q1.i);
                                        }

                                        break;
                                    }
                                    default: {
                                        g.a(2L, b0.field_quotedMsgSvrId, k94.getType(), 0L);
                                    }
                                }

                                k2.j("MicroMsg.msgquote.PluginMsgQuote", "handleQuoteMsgSendResuld() msgId:%s msgSvrId:%s result:%s", new Object[]{v8, v9, Boolean.valueOf(((boolean)(((int)z))))});
                            }

                            k91 = k93;
                            break;
                        }
                        default: {
                            k91 = k90;
                        }
                    }
                }
            }

            if(q0 != null && (k4.K3(k91.y0()))) {
                pe0.a a2 = (pe0.a)q0.x(pe0.a.class);
                if(a2 != null && (a2.I)) {
                    uj.j0.a(k91, q0);
                }

                ((xj.j)(((xj.i)n0.c(xj.i.class)))).e7(k91);
            }

            AppBrandOuterMenuClickReportEvent appBrandOuterMenuClickReportEvent0 = c30.s;
            if(appBrandOuterMenuClickReportEvent0 != null) {
                appBrandOuterMenuClickReportEvent0.g.i = "msg_" + k91.u0();
                c30.s.d();
            }

            c30.e.onSceneEnd(v3, v4, s1, c30);
            return;
        }

        k90.h1(5);
        zo2.b.e(k90.getMsgId(), zo2.b.c(v4, v3, s1, 0xDE));
        x43.f.e.idkeyStat(0x6FL, 34L, 1L, true);
        ((m9)h8.b().z()).W8(k90.getMsgId(), k90);
        k2.e("MicroMsg.NetSceneSendAppMsg", "send app msg failed, err=" + v3 + "," + v4 + ", msgId " + k90.getMsgId(), null);
        d80.u.L("AndroidSendMsgFailReport", new n(k90.getMsgId(), new o(v1, v2, s1)));
        c30.e.onSceneEnd(v3, v4, s1, c30);
    }

    @Override  // com.tencent.mm.modelbase.k1
    public com.tencent.mm.modelbase.m1 securityVerificationChecked(t0 t00) {
        return com.tencent.mm.modelbase.m1.e;
    }
}

尝试hook这两个类的构造方法，发现在发送小程序时，并没有小程序xml参数出现在构造方法中。

打印c3的构造方法参数，并打印堆栈:

c3->$init (argType: long): 916071
c3->$init (argType: java.lang.String): SessionId@2012095376183828835#28699318305714
c3->$init (argType: java.lang.String):
java.lang.Exception
        at com.tencent.mm.pluginsdk.model.app.c3.<init>(Native Method)
        at com.tencent.mm.pluginsdk.model.app.u0.G(Unknown Source:1515) //<-------------
        at com.tencent.mm.ui.transmit.MsgRetransmitUI.C6(Unknown Source:375)
        at ig4.a1.run(Unknown Source:59)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:462)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at jp4.l.run(Unknown Source:242)
        at kp4.v.run(Unknown Source:8)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at cp4.c.run(Unknown Source:2)
        at java.lang.Thread.run(Thread.java:919)

com.tencent.mm.pluginsdk.model.app.u0.G这个函数比较大，只贴关键代码：

long v14 = ((m9)h8.b().z()).D8(k92);  // insert into message...
if(q2.i == 53) {
    NotifyGroupSolitatireEvent notifyGroupSolitatireEvent0 = new NotifyGroupSolitatireEvent();
    notifyGroupSolitatireEvent0.g.a = 0;
    notifyGroupSolitatireEvent0.g.c = k92.U;
    notifyGroupSolitatireEvent0.g.b = k92.y0();
    notifyGroupSolitatireEvent0.h.a = v14;
    notifyGroupSolitatireEvent0.d();
}

new String("G(null:-1)");
if(v14 < 0L) {
    k2.e("MicroMsg.AppMsgLogic", "G(null:-1)insert msg failed :" + v14, null);
    return new Pair(((int)(-k.a())), v14);
}

k2.j("MicroMsg.AppMsgLogic", k.a() + " new msg inserted to db , local id = " + v14, null);
k92.setMsgId(v14);
t t0 = new t();
t0.field_xml = k92.getContent();
t0.field_appId = s;
t0.field_title = q2.f;
t0.field_type = q2.i;
t0.field_description = q2.g;
t0.field_msgId = v14;
t0.field_source = s1;
q4.W6().insert(t0);  // insert into AppMessage...
k2.j("MicroMsg.AppMsgLogic", "summerbig sendAppMsg attInfo is null[%b]", new Object[]{Boolean.valueOf(((boolean)(d3 == null ? 1 : 0)))});
if(d3 != null) {
    d3.field_msgInfoId = v14;
    d3.field_status = 101L;
    q4.N6().u1(d3, new String[0]);
    if(q2.i == 2 || !a8.F0(s4)) {
        q4.V6().d.put(Long.valueOf(v14), s4);
    }

    u0.K(k92, d3);
    return new Pair(integer2, v14);
}

String s18 = s4;
if(q2.t == 0 && q2.l <= 0x1900000) {
    q4.V6().getClass();
    c3 c30 = new c3(v14, s18, s5);  // new com.tencent.mm.pluginsdk.model.app.c3()
    h8.e().f(c30);  // send...
    return new Pair(integer2, v14);
}

主要流程就是将要转发的小程序链接存入数据库，创建com.tencent.mm.pluginsdk.model.app.c3对象时，只需要传入数据库中的msgId，后续发送过程中就会从数据库中读取这条消息的数据并上传到服务器。

通过hook数据库的insert方法，可以清晰的看到这个流程。

(frida_env) ➜  wechat git:(master) ✗ python wechat.py hook_send_8.0.49.js
start...
insertWithOnConflict tablename: message
Key: isSend, Value: 1
Key: status, Value: 1
Key: talker, Value: filehelper
Key: talkerId, Value: 1
Key: lvbuffer, Value: [B@d879ee7
Key: type, Value: 49
Key: msgId, Value: 916071
Key: bizChatId, Value: -1
Key: content, Value: <msg><appmsg appid="" sdkver="0"><title>这里有微信支付提现免费券可以领！</title><des></des><username></username><action>view</action><type>33</type><showtype>0</showtype><content></content><url>https://mp.weixin.qq.com/mp/waerrpage?appid=wxe73c2db202c7eebf&type=upgrade&upgradetype=3#wechat_redirect</url><lowurl></lowurl><forwardflag>0</forwardflag><dataurl></dataurl><lowdataurl></lowdataurl><contentattr>0</contentattr><streamvideo><streamvideourl></streamvideourl><streamvideototaltime>0</streamvideototaltime><streamvideotitle></streamvideotitle><streamvideowording></streamvideowording><streamvideoweburl></streamvideoweburl><streamvideothumburl></streamvideothumburl><streamvideoaduxinfo></streamvideoaduxinfo><streamvideopublishid></streamvideopublishid></streamvideo><canvasPageItem><canvasPageXml><![CDATA[]]></canvasPageXml></canvasPageItem><appattach><totallen>0</totallen><attachid></attachid><cdnattachurl></cdnattachurl><emoticonmd5></emoticonmd5><aeskey></aeskey><fileext></fileext><islargefilemsg>0</islargefilemsg></appattach><extinfo></extinfo><androidsource>3</androidsource><sourceusername>gh_b82ea3acb70b@app</sourceusername><sourcedisplayname>微信支付有优惠</sourcedisplayname><commenturl></commenturl><thumburl></thumburl><mediatagname></mediatagname><messageaction><![CDATA[]]></messageaction><messageext><![CDATA[]]></messageext><emoticongift><packageflag>0</packageflag><packageid></packageid></emoticongift><emoticonshared><packageflag>0</packageflag><packageid></packageid></emoticonshared><designershared><designeruin>0</designeruin><designername>null</designername><designerrediretcturl><![CDATA[null]]></designerrediretcturl></designershared><emotionpageshared><tid>0</tid><title>null</title><desc>null</desc><iconUrl><![CDATA[null]]></iconUrl><secondUrl>null</secondUrl><pageType>0</pageType><setKey>null</setKey></emotionpageshared><webviewshared><shareUrlOriginal></shareUrlOriginal><shareUrlOpen></shareUrlOpen><jsAppId></jsAppId><publisherId>wxapp_wxe73c2db202c7eebfpages/home/home.html?shareid=3&openid=osd2L5f8A1Y0sLCNHl6wrTEIMMbE</publisherId><publisherReqId></publisherReqId></webviewshared><template_id></template_id><md5></md5><websearch><rec_category>0</rec_category><channelId>0</channelId></websearch><weappinfo><pagepath><![CDATA[pages/home/home.html?shareid=3&openid=osd2L5f8A1Y0sLCNHl6wrTEIMMbE]]></pagepath><username>gh_b82ea3acb70b@app</username><appid>wxe73c2db202c7eebf</appid><version>711</version><type>2</type><weappiconurl><![CDATA[http://wx.qlogo.cn/mmhead/Q3auHgzwzM4tFJj0ibs5Hul64eKTWbXvKBFWibeemX6WqIEojFKzSmBw/96]]></weappiconurl><weapppagethumbrawurl><![CDATA[https://gtimg.wechatpay.cn/resource/xres/img/202303/f82cea40972086206ff109cb244d479a_1000x800.jpg]]></weapppagethumbrawurl><shareId><![CDATA[1_wxe73c2db202c7eebf_5dbdd2781198f0e8f4cad8365766a9f1_1718089477_5]]></shareId><appservicetype>0</appservicetype><secflagforsinglepagemode>0</secflagforsinglepagemode><videopageinfo><thumbwidth>0</thumbwidth><thumbheight>0</thumbheight><fromopensdk>0</fromopensdk></videopageinfo></weappinfo><statextstr></statextstr><musicShareItem><musicDuration>0</musicDuration></musicShareItem><finderLiveProductShare><finderLiveID><![CDATA[]]></finderLiveID><finderUsername><![CDATA[]]></finderUsername><finderObjectID><![CDATA[]]></finderObjectID><finderNonceID><![CDATA[]]></finderNonceID><liveStatus><![CDATA[]]></liveStatus><appId><![CDATA[]]></appId><pagePath><![CDATA[]]></pagePath><productId><![CDATA[]]></productId><coverUrl><![CDATA[]]></coverUrl><productTitle><![CDATA[]]></productTitle><marketPrice><![CDATA[0]]></marketPrice><sellingPrice><![CDATA[0]]></sellingPrice><platformHeadImg><![CDATA[]]></platformHeadImg><platformName><![CDATA[]]></platformName><shopWindowId><![CDATA[]]></shopWindowId><flashSalePrice><![CDATA[0]]></flashSalePrice><flashSaleEndTime><![CDATA[0]]></flashSaleEndTime><ecSource><![CDATA[]]></ecSource><sellingPriceWording><![CDATA[]]></sellingPriceWording><platformIconURL><![CDATA[]]></platformIconURL><firstProductTagURL><![CDATA[]]></firstProductTagURL><firstProductTagAspectRatioString><![CDATA[0.0]]></firstProductTagAspectRatioString><secondProductTagURL><![CDATA[]]></secondProductTagURL><secondProductTagAspectRatioString><![CDATA[0.0]]></secondProductTagAspectRatioString><firstGuaranteeWording><![CDATA[]]></firstGuaranteeWording><secondGuaranteeWording><![CDATA[]]></secondGuaranteeWording><thirdGuaranteeWording><![CDATA[]]></thirdGuaranteeWording><isPriceBeginShow>false</isPriceBeginShow><lastGMsgID><![CDATA[]]></lastGMsgID><promoterKey><![CDATA[]]></promoterKey><discountWording><![CDATA[]]></discountWording><priceSuffixDescription><![CDATA[]]></priceSuffixDescription><showBoxItemStringList></showBoxItemStringList></finderLiveProductShare><finderOrder><appID><![CDATA[]]></appID><orderID><![CDATA[]]></orderID><path><![CDATA[]]></path><priceWording><![CDATA[]]></priceWording><stateWording><![CDATA[]]></stateWording><productImageURL><![CDATA[]]></productImageURL><products><![CDATA[]]></products><productsCount><![CDATA[0]]></productsCount></finderOrder><finderShopWindowShare><finderUsername><![CDATA[]]></finderUsername><avatar><![CDATA[]]></avatar><nickname><![CDATA[]]></nickname><commodityInStockCount><![CDATA[]]></commodityInStockCount><appId><![CDATA[]]></appId><path><![CDATA[]]></path><appUsername><![CDATA[]]></appUsername><query><![CDATA[]]></query><liteAppId><![CDATA[]]></liteAppId><liteAppPath><![CDATA[]]></liteAppPath><liteAppQuery><![CDATA[]]></liteAppQuery><platformTagURL><![CDATA[]]></platformTagURL><saleWording><![CDATA[]]></saleWording><lastGMsgID><![CDATA[]]></lastGMsgID><profileTypeWording><![CDATA[]]></profileTypeWording><reputationInfo><hasReputationInfo>0</hasReputationInfo><reputationScore>0</reputationScore><reputationWording></reputationWording><reputationTextColor></reputationTextColor><reputationLevelWording></reputationLevelWording><reputationBackgroundColor></reputationBackgroundColor></reputationInfo><productImageURLList></productImageURLList></finderShopWindowShare><findernamecard><username></username><avatar><![CDATA[]]></avatar><nickname></nickname><auth_job></auth_job><auth_icon>0</auth_icon><auth_icon_url></auth_icon_url><ecSource><![CDATA[]]></ecSource><lastGMsgID><![CDATA[]]></lastGMsgID></findernamecard><finderGuarantee><scene><![CDATA[0]]></scene></finderGuarantee><directshare>0</directshare><gamecenter><namecard><iconUrl></iconUrl><name></name><desc></desc><tail></tail><jumpUrl></jumpUrl></namecard></gamecenter><patMsg><chatUser></chatUser><records><recordNum>0</recordNum></records></patMsg><secretmsg><issecretmsg>0</issecretmsg></secretmsg><referfromscene>0</referfromscene><gameshare><liteappext><liteappbizdata></liteappbizdata><priority>0</priority></liteappext><appbrandext><litegameinfo></litegameinfo><priority>-1</priority></appbrandext><gameshareid></gameshareid><sharedata></sharedata><isvideo>0</isvideo><duration>-1</duration><isexposed>0</isexposed><readtext></readtext></gameshare><mpsharetrace><hasfinderelement>0</hasfinderelement><lastgmsgid></lastgmsgid></mpsharetrace><wxgamecard><framesetname></framesetname><mbcarddata></mbcarddata><minpkgversion></minpkgversion><mbcardheight>0</mbcardheight><isoldversion>0</isoldversion></wxgamecard><liteapp><id>null</id><path></path><query></query></liteapp></appmsg></msg>
Key: createTime, Value: 1718091419880
Key: imgPath, Value: THUMBNAIL_DIRPATH://th_e163fefa7deb9b3f9a808d1fa1b7f66b
java.lang.Exception
        at com.tencent.wcdb.database.SQLiteDatabase.insertWithOnConflict(Native Method)
        at com.tencent.wcdb.database.SQLiteDatabase.insert(Unknown Source:1)
        at o94.z$$e.a(Unknown Source:34)
        at o94.z.z(Unknown Source:40)
        at com.tencent.mm.storage.m9.G8(Unknown Source:314)
        at com.tencent.mm.storage.m9.D8(Unknown Source:2)
        at com.tencent.mm.pluginsdk.model.app.u0.G(Unknown Source:1257)
        at com.tencent.mm.ui.transmit.MsgRetransmitUI.C6(Unknown Source:375)
        at ig4.a1.run(Unknown Source:59)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:462)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at jp4.l.run(Unknown Source:242)
        at kp4.v.run(Unknown Source:8)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at cp4.c.run(Unknown Source:2)
        at java.lang.Thread.run(Thread.java:919)


insertWithOnConflict tablename: AppMessage
Key: description, Value:
Key: source, Value: null
Key: xml, Value: <msg><appmsg appid="" sdkver="0"><title>这里有微信支付提现免费券可以领！</title><des></des><username></username><action>view</action><type>33</type><showtype>0</showtype><content></content><url>https://mp.weixin.qq.com/mp/waerrpage?appid=wxe73c2db202c7eebf&type=upgrade&upgradetype=3#wechat_redirect</url><lowurl></lowurl><forwardflag>0</forwardflag><dataurl></dataurl><lowdataurl></lowdataurl><contentattr>0</contentattr><streamvideo><streamvideourl></streamvideourl><streamvideototaltime>0</streamvideototaltime><streamvideotitle></streamvideotitle><streamvideowording></streamvideowording><streamvideoweburl></streamvideoweburl><streamvideothumburl></streamvideothumburl><streamvideoaduxinfo></streamvideoaduxinfo><streamvideopublishid></streamvideopublishid></streamvideo><canvasPageItem><canvasPageXml><![CDATA[]]></canvasPageXml></canvasPageItem><appattach><totallen>0</totallen><attachid></attachid><cdnattachurl></cdnattachurl><emoticonmd5></emoticonmd5><aeskey></aeskey><fileext></fileext><islargefilemsg>0</islargefilemsg></appattach><extinfo></extinfo><androidsource>3</androidsource><sourceusername>gh_b82ea3acb70b@app</sourceusername><sourcedisplayname>微信支付有优惠</sourcedisplayname><commenturl></commenturl><thumburl></thumburl><mediatagname></mediatagname><messageaction><![CDATA[]]></messageaction><messageext><![CDATA[]]></messageext><emoticongift><packageflag>0</packageflag><packageid></packageid></emoticongift><emoticonshared><packageflag>0</packageflag><packageid></packageid></emoticonshared><designershared><designeruin>0</designeruin><designername>null</designername><designerrediretcturl><![CDATA[null]]></designerrediretcturl></designershared><emotionpageshared><tid>0</tid><title>null</title><desc>null</desc><iconUrl><![CDATA[null]]></iconUrl><secondUrl>null</secondUrl><pageType>0</pageType><setKey>null</setKey></emotionpageshared><webviewshared><shareUrlOriginal></shareUrlOriginal><shareUrlOpen></shareUrlOpen><jsAppId></jsAppId><publisherId>wxapp_wxe73c2db202c7eebfpages/home/home.html?shareid=3&openid=osd2L5f8A1Y0sLCNHl6wrTEIMMbE</publisherId><publisherReqId></publisherReqId></webviewshared><template_id></template_id><md5></md5><websearch><rec_category>0</rec_category><channelId>0</channelId></websearch><weappinfo><pagepath><![CDATA[pages/home/home.html?shareid=3&openid=osd2L5f8A1Y0sLCNHl6wrTEIMMbE]]></pagepath><username>gh_b82ea3acb70b@app</username><appid>wxe73c2db202c7eebf</appid><version>711</version><type>2</type><weappiconurl><![CDATA[http://wx.qlogo.cn/mmhead/Q3auHgzwzM4tFJj0ibs5Hul64eKTWbXvKBFWibeemX6WqIEojFKzSmBw/96]]></weappiconurl><weapppagethumbrawurl><![CDATA[https://gtimg.wechatpay.cn/resource/xres/img/202303/f82cea40972086206ff109cb244d479a_1000x800.jpg]]></weapppagethumbrawurl><shareId><![CDATA[1_wxe73c2db202c7eebf_5dbdd2781198f0e8f4cad8365766a9f1_1718089477_5]]></shareId><appservicetype>0</appservicetype><secflagforsinglepagemode>0</secflagforsinglepagemode><videopageinfo><thumbwidth>0</thumbwidth><thumbheight>0</thumbheight><fromopensdk>0</fromopensdk></videopageinfo></weappinfo><statextstr></statextstr><musicShareItem><musicDuration>0</musicDuration></musicShareItem><finderLiveProductShare><finderLiveID><![CDATA[]]></finderLiveID><finderUsername><![CDATA[]]></finderUsername><finderObjectID><![CDATA[]]></finderObjectID><finderNonceID><![CDATA[]]></finderNonceID><liveStatus><![CDATA[]]></liveStatus><appId><![CDATA[]]></appId><pagePath><![CDATA[]]></pagePath><productId><![CDATA[]]></productId><coverUrl><![CDATA[]]></coverUrl><productTitle><![CDATA[]]></productTitle><marketPrice><![CDATA[0]]></marketPrice><sellingPrice><![CDATA[0]]></sellingPrice><platformHeadImg><![CDATA[]]></platformHeadImg><platformName><![CDATA[]]></platformName><shopWindowId><![CDATA[]]></shopWindowId><flashSalePrice><![CDATA[0]]></flashSalePrice><flashSaleEndTime><![CDATA[0]]></flashSaleEndTime><ecSource><![CDATA[]]></ecSource><sellingPriceWording><![CDATA[]]></sellingPriceWording><platformIconURL><![CDATA[]]></platformIconURL><firstProductTagURL><![CDATA[]]></firstProductTagURL><firstProductTagAspectRatioString><![CDATA[0.0]]></firstProductTagAspectRatioString><secondProductTagURL><![CDATA[]]></secondProductTagURL><secondProductTagAspectRatioString><![CDATA[0.0]]></secondProductTagAspectRatioString><firstGuaranteeWording><![CDATA[]]></firstGuaranteeWording><secondGuaranteeWording><![CDATA[]]></secondGuaranteeWording><thirdGuaranteeWording><![CDATA[]]></thirdGuaranteeWording><isPriceBeginShow>false</isPriceBeginShow><lastGMsgID><![CDATA[]]></lastGMsgID><promoterKey><![CDATA[]]></promoterKey><discountWording><![CDATA[]]></discountWording><priceSuffixDescription><![CDATA[]]></priceSuffixDescription><showBoxItemStringList></showBoxItemStringList></finderLiveProductShare><finderOrder><appID><![CDATA[]]></appID><orderID><![CDATA[]]></orderID><path><![CDATA[]]></path><priceWording><![CDATA[]]></priceWording><stateWording><![CDATA[]]></stateWording><productImageURL><![CDATA[]]></productImageURL><products><![CDATA[]]></products><productsCount><![CDATA[0]]></productsCount></finderOrder><finderShopWindowShare><finderUsername><![CDATA[]]></finderUsername><avatar><![CDATA[]]></avatar><nickname><![CDATA[]]></nickname><commodityInStockCount><![CDATA[]]></commodityInStockCount><appId><![CDATA[]]></appId><path><![CDATA[]]></path><appUsername><![CDATA[]]></appUsername><query><![CDATA[]]></query><liteAppId><![CDATA[]]></liteAppId><liteAppPath><![CDATA[]]></liteAppPath><liteAppQuery><![CDATA[]]></liteAppQuery><platformTagURL><![CDATA[]]></platformTagURL><saleWording><![CDATA[]]></saleWording><lastGMsgID><![CDATA[]]></lastGMsgID><profileTypeWording><![CDATA[]]></profileTypeWording><reputationInfo><hasReputationInfo>0</hasReputationInfo><reputationScore>0</reputationScore><reputationWording></reputationWording><reputationTextColor></reputationTextColor><reputationLevelWording></reputationLevelWording><reputationBackgroundColor></reputationBackgroundColor></reputationInfo><productImageURLList></productImageURLList></finderShopWindowShare><findernamecard><username></username><avatar><![CDATA[]]></avatar><nickname></nickname><auth_job></auth_job><auth_icon>0</auth_icon><auth_icon_url></auth_icon_url><ecSource><![CDATA[]]></ecSource><lastGMsgID><![CDATA[]]></lastGMsgID></findernamecard><finderGuarantee><scene><![CDATA[0]]></scene></finderGuarantee><directshare>0</directshare><gamecenter><namecard><iconUrl></iconUrl><name></name><desc></desc><tail></tail><jumpUrl></jumpUrl></namecard></gamecenter><patMsg><chatUser></chatUser><records><recordNum>0</recordNum></records></patMsg><secretmsg><issecretmsg>0</issecretmsg></secretmsg><referfromscene>0</referfromscene><gameshare><liteappext><liteappbizdata></liteappbizdata><priority>0</priority></liteappext><appbrandext><litegameinfo></litegameinfo><priority>-1</priority></appbrandext><gameshareid></gameshareid><sharedata></sharedata><isvideo>0</isvideo><duration>-1</duration><isexposed>0</isexposed><readtext></readtext></gameshare><mpsharetrace><hasfinderelement>0</hasfinderelement><lastgmsgid></lastgmsgid></mpsharetrace><wxgamecard><framesetname></framesetname><mbcarddata></mbcarddata><minpkgversion></minpkgversion><mbcardheight>0</mbcardheight><isoldversion>0</isoldversion></wxgamecard><liteapp><id>null</id><path></path><query></query></liteapp></appmsg></msg>
Key: type, Value: 33
Key: appId, Value:
Key: msgId, Value: 916071
Key: title, Value: 这里有微信支付提现免费券可以领！
java.lang.Exception
        at com.tencent.wcdb.database.SQLiteDatabase.insertWithOnConflict(Native Method)
        at com.tencent.wcdb.database.SQLiteDatabase.insert(Unknown Source:1)
        at o94.z$$e.a(Unknown Source:34)
        at o94.z.z(Unknown Source:40)
        at o94.z.c(Unknown Source:1)
        at z74.l0.insertNotify(Unknown Source:24)
        at com.tencent.mm.pluginsdk.model.app.h0.o1(Unknown Source:15)
        at com.tencent.mm.pluginsdk.model.app.h0.insertNotify(Unknown Source:2)
        at z74.l0.insert(Unknown Source:1)
        at com.tencent.mm.pluginsdk.model.app.u0.G(Unknown Source:1420)
        at com.tencent.mm.ui.transmit.MsgRetransmitUI.C6(Unknown Source:375)
        at ig4.a1.run(Unknown Source:59)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:462)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at jp4.l.run(Unknown Source:242)
        at kp4.v.run(Unknown Source:8)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at cp4.c.run(Unknown Source:2)
        at java.lang.Thread.run(Thread.java:919)

hook ProtoBuf序列化的方法，可以查看调用堆栈。

var a = Java.use("com.tencent.mm.protobuf.a");
a.toByteArray.overload().implementation = function() {
    var retval = this.toByteArray()
    console.log(Base64.encodeToString(retval, 2))
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()))
    return retval;
}

var k = Java.use("com.tencent.mm.modelbase.k");
k.toProtoBuf.overload().implementation = function () {
    var retval = this.toProtoBuf()
    var cmdId = this.getCmdId()
    var funcId = this.getFuncId()
    // console.log('cmdId:', cmdId)
    // console.log('funcId:', funcId)
    if (funcId === 222) {
        console.log("k->toProtoBuf (retType: [B): " + retval)
        console.log(Base64.encodeToString(retval, 2))
        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()))
    }

    return retval;
}

使用frida发送小程序消息

如何使用frida发送一条小程序消息？

1. 将消息数据insert到数据库中
2. 创建com.tencent.mm.pluginsdk.model.app.c3对象并发送这个消息对象

最终代码

Java.perform(function () {

    console.log('start...')

    var String = Java.use('java.lang.String')
    var System = Java.use('java.lang.System')
    var Long = Java.use('java.lang.Long')
    var Integer = Java.use('java.lang.Integer')
    var Base64 = Java.use('android.util.Base64')
    var SQLiteDatabase = Java.use("com.tencent.wcdb.database.SQLiteDatabase");
    var ContentValues = Java.use('android.content.ContentValues');

    var instance_SQLiteDatabase = undefined
    SQLiteDatabase.insertWithOnConflict.overload('java.lang.String', 'java.lang.String', 'android.content.ContentValues', 'int').implementation = function (tablename, arg2, arg3, arg4) {
        if(tablename.indexOf('message') > -1){
            // 保存SQLiteDatabase实例
            instance_SQLiteDatabase = Java.retain(this);
        }
        var ret = this.insertWithOnConflict.overload('java.lang.String', 'java.lang.String', 'android.content.ContentValues', 'int').call(this, tablename, arg2, arg3, arg4);
        console.log('insertWithOnConflict', 'tablename: ' + tablename);
        var cv = Java.cast(arg3, ContentValues);
        return ret;
    };


    setTimeout(function () {
        var xml = '<msg>....................</msg>'
        var cv = ContentValues.$new()
        cv.put('isSend', Integer.valueOf(1))
        cv.put('status', Integer.valueOf(1))
        cv.put('talker', 'filehelper')
        // cv.put('talkerId', Integer.valueOf(1))
        cv.put('type', Integer.valueOf(49))
        cv.put('bizChatId', Integer.valueOf(-1))
        cv.put('content', xml)
        cv.put('createTime', Long.valueOf(System.currentTimeMillis()))
        // cv.put('imgPath', 'THUMBNAIL_DIRPATH://th_e163fefa7deb9b3f9a808d1fa1b7f66b')

        var msgid = instance_SQLiteDatabase.insertWithOnConflict('message', "msgId", cv, 0)
        console.log('msgid:', msgid)


        var h8 = Java.use('tj0.h8')
        var c3 = Java.use("com.tencent.mm.pluginsdk.model.app.c3");
        var instance_c3 = c3.$new(msgid, '', '')
        send(h8.e())
        h8.e().f(instance_c3);

    }, 5000)
});