spensercai / gowxdump Goto Github PK

View Code? Open in Web Editor NEW

1.3K 22.0 164.0 57.92 MB

SharpWxDump的Go语言版。微信客户端取证，获取信息(微信号、手机号、昵称)，微信聊天记录分析(Top N聊天的人、统计聊天最频繁的好友排行、关键词列表搜索等)

License: GNU General Public License v3.0

Go 99.73% Batchfile 0.27%

gowxdump's People

Contributors

Stargazers

Watchers

Forkers

qiuyanjs arcns2 huxuang karosown emily6688 qincrm plag-it-hub gitai123 blackface111 ixc123 kkbdv fj-oms zhanghao5683934 klinklinklin test1213145 j-w-ca lildragonz zhanglei handsomed123 aichatd sec-fork nyx2022 sec-fork hactf tellmewhy1122 redwifiteam douglas88 cmjlove1 xiaojiang3106 crackercat ajatars evi1hack sesyi xc1ym 1337g re13orn wyf2008 showsmall imjdl foreverluck bingpo auxiliarya y1idjfe fossabot skw123321 jenxp e027 joyboy8848 wnhot istoliving fgsagsa wlr19982cc errorecho honeypothoneypot codechina888 amjiyu helow123 happyallha geeks6666 zzhsec nanaao printf172 x-tfrk yuxiaopan cykenjay gaophei qmxz wongxun ypmuxue muai77 dzxindex niuniugougou sanggao gishare wolong001 jsionr wenjiaran hellowzsg secloop naist4869 somnuszzg flypig5211 fishing001 a3sroot 4ra1n n1ko61 sycdtk augusitine-x li1055107552 mseaspring jianson009 patrickstarwow larpx meng19871219 garyreload9527 lchjczw mssky9527 dbb-pro q629988171 xixiaobo

gowxdump's Issues

同时登录2个微信，只能解密其中一个

交互式的默认是解密其中的一个，加上-spy参数，即使选择了另外一个微信，也显示password error。
有没有办法可以手工选择其中一个微信解密，谢谢

版本3.9.6.19报错

报错信息：GetWeChatWinModule error: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

按照msdn的说法,
https://learn.microsoft.com/zh-cn/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot?redirectedfrom=MSDN
CreateToolhelp32Snapshot函数在遍历进程模块的时候, 如果指定的进程是 64 位进程，并且调用方是 32 位进程，则此函数将失败，最后一个错误代码 ERROR_PARTIAL_COPY ( 299) 。这个错误也就是 Only part of a ReadProcessMemory or WriteProcessMemory request was complete

wechat现在升级成了64位应用, 所以GetWeChatWinModule调用CreateToolhelp32Snapshot时报错误
GetWeChatWinModule error: Only part of a ReadProcessMemory or WriteProcessMemory request was complete

修改build.bat, set GOARCH=amd64, 同时升级gcc lib 64位, 如TDM-GCC-64或mingw64, 后编译,
不过此时因为没有版本信息, OffSetMap的数组越界, 不过64位的versionlist offset可能需要重新分析一边了