Final guide: 5 steps to the windows revokemsgpatcher

Final guide: 5 steps to the windows revokemsgpatcher

Revokemsgpatcher: trallface: a hex editor for wechat/qq/tim - pc version of micro-mail/qq/tim withdrawal patches (i see, it's useless to withdraw)

Project address: https://gitcode. Com/github trending/re/revokemsgpatcher

Have you ever been anxious to miss the emergency notice of the leadership withdrawal? Is there nothing to do with the withdrawal of critical information by important clients? At a time when digital communication is becoming increasingly important, the information withdrawal function, which was created to correct errors, is often the "black hole" where information is lost. Revokemsgpatcher, an open source withdrawal patch designed for the windows platform, was created to address this pain. It allows you, through precise reverse engineering analysis, to permanently say goodbye to the "message has been withdrawn" in mainstream communication software, such as twitter, qqqq, tim, and to provide practical micro-credits that are open-minded and complete work-life separation。

I. Purpose: why is there a need for a withdrawal-proof function? 1. 1 information preservation needs in the work scene

In the on-the-job communication, we believe that we have become an indispensable tool for collaboration. However, the information withdrawal function of these platforms may pose a serious risk of information loss. Imagine these real scenes: the leadership's important work assignments published in the twitter community were erroneously withdrawn, key demand files sent by clients on qqqs disappeared as a result of operational errors, project information shared by colleagues in tim was automatically withdrawn because of web problems... These conditions not only affect the efficiency of the work, but may also lead to project delays and even financial losses。

1. 2 integrity of information in individual communications

In personal social scenes, interesting links shared by friends, important reminders sent by family members, true feelings expressed by lovers may be missed once withdrawn. Traditional solutions are either limited or complex, while revokemsgpatcher makes information preservation simple and efficient by a single-key operation。

Technical disclosure: art and science for reverse engineering 2. 1 reverse engineering reality: key code for positioning withdrawal function

The core of the anti-revocation patch lies in the precision modification of the dll document of the target software. Revokemsgpatcher uses reverse engineering to find key functions to process the withdrawal of messages by analysing the binary files of micro-intelligence, qqq, tim。

As shown in the figure above, the developers first search for strings associated with "revokemsg" in the wechatwin. Dll file of micro-intelligence using the x32dbg debug tool. This is the first step of the reverse project - to locate key function points by string. In windows pe files, a string is usually an important thread for a function to call and can quickly guide developers to the location of the target function。

2. 2 bytes modification: jump from condition to unconditional jump

When the relevant string is found, the next step is to analyse the corresponding compilation code. The graph shows the location of the code containing the "revokemsg" string, which is the core logic of micro-processing messages. In a compilation of x86, the conditions jump commands jemp if equal and jne control the process。

The principle of protection against withdrawal is quite clever. The developer changes the original condition jump command to an unconditional jump by modifying a specific byte code. Specifically, the jp (eb) directive was changed to jmp (74) directive. The logic of this change is to replace the original logic of "execut withdrawal if conditions are met" with "no withdrawal shall be executed in any event"。

2. 3 patch applications: permanently modify dll files

The figure above shows the process of applying patches to the xx32dbg for the xxhatwin. Dll file. The tool automatically identifies the location that needs to be modified and writes the correct byte code to the target file. Such modifications are permanent and remain valid even if the software or system is restarted。

Project architecture: smart modular design 3. 1 core module resolution

Revokemsgpatcher uses a highly modular architecture design consisting mainly of the following core components:

Modifier module (at revokemsgpatcher/modifier/ catalogue):

Matcher module:

Data model module (reversemsgpatcher/model/):

3. 2 patch data management

The patch data of the project is stored in revokemsgpatcher. Assistant/data/ directory and is stored in json format. Each version corresponds to a profile and contains all patch information supported by that version. For example, the patch configuration contains the following key information:

Other organiser
"name": "wechatwin. Dll",
version: "3. 3. 5. 25",
"sha1 before": "3e 94753ccc 2799d98f3c741377e99bdae33b4cf",
"sha1after": "ab98f83fc16674ac49113802c79c3ca4c2fd71",
"changes"...
"position": 3413977, "content": [235],
"position": 12159591, "content": [235]

♪ i'm sorry ♪

This design makes version management clearer and allows communities to contribute new patches。

Iv. Operational guidelines: 5-step command of withdrawal protection 4. 1 preparatory work and environmental requirements

System requirements:

Software readiness:

Download the latest version of revokemsgpatcher to ensure that the target software (webmail/qq/tim) is installed to shut down all target software processes 4. 2 5 steps

Step 1: access to software

Now, let's see what we can do about it

Or download directly the compiled implementable documents。

Step 2: run as administrator right-click revokemsgpatcher. Exe, choose "run as administrator". This is a critical step, as the process requires modification of the system file and requires administrator privileges to complete the operation。

Step 3: automatic routing software will automatically detect the micro-intelligence, qqq, tim paths you installed on your computer. For green version software, manual selection of installation directories may be required。

Step 4: functional selection

Step 5: install patch click on the "equip patch" button and wait for operation to be completed. It is normal that the interface may be short-lived. Once completed, the corresponding communications software can be restarted。

4. 3 version compatibility self-checklists the software platform supports major document modifications to the scope of the version

Wesson

2. 6. 6. 28 - 3. 3. 5. 25

Wechatwin. Dll

Support for withdrawal and multiplication

Qqueen

9. 0. 4. 23786 - 9. 4. 7. Xx

Im. Dll

Supporting withdrawal only

Tim

2. 3. 21173 and above

Im. Dll

Supporting withdrawal only

Qq-q-q-x-x-x-x

7. 9. 1430. 0 and above

Im. Dll

Supporting withdrawal only

Security risk assessment and preparedness 5. 1 security analysis

Open source transparency advantage:

Document completeness verification:

5. 2 risk precautions

Toxicicide software misprocessing: owing to the modification of system files, some poisoning software may be misreported. Solutions:

The temporary closure of real-time protection downloads from official channels to ensure the security of documents pending the addition of revokemsgpatcher to the white list of poisoning software

Backup and recovery mechanisms:

Progressive play: custom patch development 6. 1 reverse engineering base

For senior users, reverse engineering basics can be learned and self-defined development patches can be developed. The chart above shows the debugging process of the qqq protection against withdrawal, which is similar to, but not specific to, the dll document。

Basic tool chain:

6. 2 patch development process

Objective analysis:

2. Model matching:

3. Patching:

Test certification:

Vii. Use of scenario matrix: selected functional combinations as required

Professionals

Work information preservation

We believe it's back

Prioritize the integrity of working communication