WeChat搶紅包Tweak3

前言

使用如下代碼實現隱藏本身的頭像和暱稱

重點研究WCRedEnvelopesReceiveHomeViewOpenRedEnvelopes

CContactMgr *contactManager = [[%c(MMServiceCenter) defaultCenter] getService:[%c(CContactMgr) class]];
CContact *selfContact = [contactManager getSelfContact];

[args setObject:[selfContact getContactDisplayName] forKey:@"nickName"];
[args setObject:[selfContact m_nsHeadImgUrl] forKey:@"headImg"];

如下方法爲拆紅包的方法。

void -[WCRedEnvelopesLogicMgr ReceiverQueryRedEnvelopesRequest:](void * self, void * _cmd, void * arg2) {
    loc_e0b79c(self, @selector(GetHongbaoBusinessRequest:CMDID:OutputType:), arg2, 0x3, 0x1, r7, lr);
    return;
}

void -[WCRedEnvelopesLogicMgr OpenRedEnvelopesRequest:](void * self, void * _cmd, void * arg2) {
    loc_e0b79c(self, @selector(GetHongbaoBusinessRequest:CMDID:OutputType:), arg2, 0x4, 0x1, r7, lr);
    return;
}

loc_1c0d080(stack[2023], stack[2012], r5, @"sessionUserName");

sessionUserName大概是會話名稱，也就是羣名稱

[args setObject:nativeUrl forKey:@"nativeUrl"];
[args setObject:xxx forKey:@"sessionUserName"];

下來這一段仍是用mmservicecenter來獲取WCRedLogicMgr對象，而後調用WCRedLogicMgr的open方法來拆紅包，能夠想象open方法的參數就是上面咱們辛苦組裝的字典

loc_1c0d0f4();
    loc_1c0d080(@class(MMServiceCenter), @selector(defaultCenter));
    r4 = loc_1c0d08c();
    loc_1c0d080(r4, @selector(getService:), loc_1c0d080(@class(WCPayLogicMgr), @selector(class)));
    r0 = loc_1c0d08c();
    loc_1c0d080(r0, @selector(setRealnameReportScene:), 0x3eb);
    loc_1c0d090(r0);
    loc_1c0d090(r4);
    loc_1c0d080(@class(MMServiceCenter), @selector(defaultCenter));
    r4 = loc_1c0d08c();
    loc_1c0d080(r4, @selector(getService:), loc_1c0d080(@class(WCPayLogicMgr), @selector(class)));
    loc_1c0d08c();
    loc_1c0d080(*(stack[2024] + stack[2022]), @selector(m_structDicRedEnvelopesBaseInfo));
    loc_1c0d08c();
    loc_1c0d080();
    r4 = loc_1c0d08c();
    r5 = stack[2024];
    asm { strd       fp, r0, [sp, #0x8c + var_30] };
    loc_1c0d094(stack[2023]);
    r8 = loc_1c0d094(r5);
    r5 = sp + 0x38;
    asm { stm.w      r0, {r6, sl, fp} };
    loc_1c0d0f0();
    loc_1c0d094(r8);
    loc_1c0d080(stack[2020], @selector(checkHongbaoOpenLicense:acceptCallback:denyCallback:), r4, sp + 0x54, r5);
    loc_1c0d090(r4);
    loc_1c0d090(stack[2022]);

[[[%c(MMServiceCenter) defaultCenter] getService:[%c(WCRedEnvelopesLogicMgr) class]] OpenRedEnvelopesRequest:args];

領紅包邏輯

到這裏，咱們再總結一下咱們上面分析的過程……

獲得m_oWCPayInfoItem屬性
解析m_oWCPayInfoItem的m_c2cNativeUrl屬性
獲得selfcontact
組裝相關參數
調用OpenRedEnvelopesRequest:領取紅包

最終的搶紅包代碼合併起來以下：

#import "WxMsgPreview.h"

%hook CMessageMgr

-(void)AsyncOnAddMsg:(id)message MsgWrap:(CMessageWrap* )msgWrap {
    %log;
    %orig;
    if(msgWrap.m_uiMessageType == 49){
        CContactMgr *contactManager = [[%c(MMServiceCenter) defaultCenter] getService:[%c(CContactMgr) class]];
        CContact *selfContact = [contactManager getSelfContact];

        if ([msgWrap.m_nsContent rangeOfString:@"wxpay://c2cbizmessagehandler/hongbao/receivehongbao"].location != NSNotFound) { // 紅包

            NSString *nativeUrl = [[msgWrap m_oWCPayInfoItem] m_c2cNativeUrl];
            nativeUrl = [nativeUrl substringFromIndex:[@"wxpay://c2cbizmessagehandler/hongbao/receivehongbao?" length]];

            NSDictionary *nativeUrlDict = [%c(WCBizUtil) dictionaryWithDecodedComponets:nativeUrl separator:@"&"];

            NSMutableDictionary *args = [[%c(NSMutableDictionary) alloc] init];
            [args setObject:nativeUrlDict[@"msgtype"] forKey:@"msgType"];
            [args setObject:nativeUrlDict[@"sendid"] forKey:@"sendId"];
            [args setObject:nativeUrlDict[@"channelid"] forKey:@"channelId"];
            [args setObject:[selfContact getContactDisplayName] forKey:@"nickName"];
            [args setObject:[selfContact m_nsHeadImgUrl] forKey:@"headImg"];
            [args setObject:nativeUrl forKey:@"nativeUrl"];
            [args setObject:msgWrap.m_nsFromUsr forKey:@"sessionUserName"];

            [[[%c(MMServiceCenter) defaultCenter] getService:[%c(WCRedEnvelopesLogicMgr) class]] OpenRedEnvelopesRequest:args];
        }
    }
}

%end