2026-03-03 05:22:29 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文分享了针对微信小程序的jsrpc注入技巧，提供了适配小程序WebSocketAPI的完整代码实现，涵盖连接建立、消息处理及客户端注册流程。文章重点指出小程序注入需在appcontext下进行，并解决了反编译目录与运行时打包文件路径不一致导致的hook失效问题，对小程序安全测试具有较高的参考价值。 综合评分： 72 文章分类： 安全工具,渗透测试,逆向分析

cover_image

凌曦安全：jsrpc小程序注入tips

原创

Syst1m Syst1m

凌曦安全

2026年2月26日 10:02 广东

本推文提供的信息、技术和方法仅用于教育目的。文中讨论的所有案例和技术均旨在帮助读者更好地理解相关安全问题，并采取适当的防护措施来保护自身系统免受攻击。

严禁将本文中的任何信息用于非法目的或对任何未经许可的系统进行测试。未经授权尝试访问计算机系统或数据是违法行为，可能会导致法律后果。

作者不对因阅读本文后采取的任何行动所造成的任何形式的损害负责，包括但不限于直接、间接、特殊、附带或后果性的损害。用户应自行承担使用这些信息的风险。我们鼓励所有读者遵守法律法规，负责任地使用技术知识，共同维护网络空间的安全与和谐。

2026新版体系课程直达链接：凌曦安全：2026新版课程正式上线（早鸟价时刻）

课程介绍：https://www.yuque.com/syst1m-/blog/lc3k6elv0zqhdal3

原版会有一些问题，结合这位师傅的代码，做了一些修改和完善

https://mp.weixin.qq.com/s/SyQXNkUDqaRnyH6gwmNJfQ

// 1. 微信小程序环境适配const&nbsp;isWechatMiniProgram =&nbsp;typeof&nbsp;wx !==&nbsp;'undefined'&nbsp;&& wx.connectSocket;
// 全局变量直接挂载到globalThisglobalThis.rpc_client_id&nbsp;= wx && wx.getStorageSync&nbsp;? wx.getStorageSync('rpc_client_id') ||&nbsp;''&nbsp;:&nbsp;'';
// 2. 构造函数 - 适配小程序APIglobalThis.Hlclient&nbsp;=&nbsp;function&nbsp;(wsURL) {&nbsp; &nbsp;&nbsp;if&nbsp;(!wsURL)&nbsp;throw&nbsp;new&nbsp;Error('wsURL can not be empty!!');
&nbsp; &nbsp;&nbsp;this.wsURL&nbsp;= wsURL;&nbsp; &nbsp;&nbsp;this.handlers&nbsp;= {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;_execjs:&nbsp;function&nbsp;(resolve, param) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;res =&nbsp;eval(param);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;resolve(res ||&nbsp;"没有返回值");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;resolve(`执行错误:&nbsp;${e.message}`);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; };&nbsp; &nbsp;&nbsp;this.socket&nbsp;=&nbsp;null;&nbsp; &nbsp;&nbsp;this.isWechat&nbsp;= isWechatMiniProgram;&nbsp; &nbsp;&nbsp;this.connected&nbsp;=&nbsp;false;
&nbsp; &nbsp;&nbsp;// 小程序环境初始化&nbsp; &nbsp;&nbsp;if&nbsp;(this.isWechat) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.initWechatEvents();&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;this.connect();};
// 3. 小程序专用事件初始化globalThis.Hlclient.prototype.initWechatEvents&nbsp;=&nbsp;function() {&nbsp; &nbsp;&nbsp;let&nbsp;_this =&nbsp;this;
&nbsp; &nbsp;&nbsp;// 监听WebSocket打开&nbsp; &nbsp; wx.onSocketOpen(function(res) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log('微信WebSocket连接已打开');&nbsp; &nbsp; &nbsp; &nbsp; _this.connected&nbsp;=&nbsp;true;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 发送注册消息&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(globalThis.rpc_client_id) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.send(JSON.stringify({&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;action:&nbsp;'register',&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;clientId: globalThis.rpc_client_id&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }));&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; });
&nbsp; &nbsp;&nbsp;// 监听消息&nbsp; &nbsp; wx.onSocketMessage(function(res) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log('收到微信WebSocket消息:', res.data);&nbsp; &nbsp; &nbsp; &nbsp; _this.handlerRequest(res.data);&nbsp; &nbsp; });
&nbsp; &nbsp;&nbsp;// 监听错误&nbsp; &nbsp; wx.onSocketError(function(err) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.error('微信WebSocket错误:', err);&nbsp; &nbsp; &nbsp; &nbsp; _this.connected&nbsp;=&nbsp;false;&nbsp; &nbsp; &nbsp; &nbsp; _this.reconnect();&nbsp; &nbsp; });
&nbsp; &nbsp;&nbsp;// 监听关闭&nbsp; &nbsp; wx.onSocketClose(function(res) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log('微信WebSocket连接关闭');&nbsp; &nbsp; &nbsp; &nbsp; _this.connected&nbsp;=&nbsp;false;&nbsp; &nbsp; &nbsp; &nbsp; _this.reconnect();&nbsp; &nbsp; });};
// 4. 连接方法 - 小程序适配globalThis.Hlclient.prototype.connect&nbsp;=&nbsp;function&nbsp;() {&nbsp; &nbsp;&nbsp;let&nbsp;_this =&nbsp;this;
&nbsp; &nbsp;&nbsp;// 处理URL，添加clientId&nbsp; &nbsp;&nbsp;let&nbsp;connectURL =&nbsp;this.wsURL;&nbsp; &nbsp;&nbsp;if&nbsp;(connectURL.indexOf("clientId=") === -1&nbsp;&& globalThis.rpc_client_id) {&nbsp; &nbsp; &nbsp; &nbsp; connectURL += (connectURL.indexOf('?') === -1&nbsp;?&nbsp;'?'&nbsp;:&nbsp;'&') +&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"clientId="&nbsp;+&nbsp;encodeURIComponent(globalThis.rpc_client_id);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;console.log('开始连接到:', connectURL);
&nbsp; &nbsp;&nbsp;if&nbsp;(this.isWechat) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 微信小程序环境&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(this.socket) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; wx.closeSocket();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) {}&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; wx.connectSocket({&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;url: connectURL,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;success:&nbsp;function() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log('微信WebSocket连接请求已发送');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;fail:&nbsp;function(err) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.error('微信WebSocket连接失败:', err);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;setTimeout(function() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.reconnect();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp;3000);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; });
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.socket&nbsp;=&nbsp;true;&nbsp;// 微信环境下，socket是一个状态标识
&nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 浏览器环境&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.socket&nbsp;=&nbsp;new&nbsp;WebSocket(connectURL);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.socket.onopen&nbsp;=&nbsp;function() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log("WebSocket连接成功");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.connected&nbsp;=&nbsp;true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.socket.onmessage&nbsp;=&nbsp;function(e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.handlerRequest(e.data);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.socket.onclose&nbsp;=&nbsp;function() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log('WebSocket连接关闭');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.connected&nbsp;=&nbsp;false;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.reconnect();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.socket.onerror&nbsp;=&nbsp;function(err) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.error('WebSocket错误:', err);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.connected&nbsp;=&nbsp;false;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.error("连接失败:", e);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.reconnect();&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }};
// 5. 重连方法globalThis.Hlclient.prototype.reconnect&nbsp;=&nbsp;function&nbsp;() {&nbsp; &nbsp;&nbsp;let&nbsp;_this =&nbsp;this;&nbsp; &nbsp;&nbsp;console.log("5秒后尝试重连...");&nbsp; &nbsp;&nbsp;setTimeout(function() {&nbsp; &nbsp; &nbsp; &nbsp; _this.connect();&nbsp; &nbsp; },&nbsp;5000);};
// 6. 发送消息方法globalThis.Hlclient.prototype.send&nbsp;=&nbsp;function&nbsp;(msg) {&nbsp; &nbsp;&nbsp;if&nbsp;(this.isWechat) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(this.connected) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; wx.sendSocketMessage({&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;data: msg,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;success:&nbsp;function() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log('消息发送成功');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;fail:&nbsp;function(err) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.error('消息发送失败:', err);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; });&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.warn('连接未就绪，无法发送消息');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;setTimeout(() =>&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.send(msg);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp;1000);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(this.socket&nbsp;&&&nbsp;this.socket.readyState&nbsp;===&nbsp;WebSocket.OPEN) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.socket.send(msg);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }};
// 7. 其他方法保持不变，但需要适配globalThis.rpc_client_idglobalThis.Hlclient.prototype.regAction&nbsp;=&nbsp;function&nbsp;(func_name, func) {&nbsp; &nbsp;&nbsp;if&nbsp;(typeof&nbsp;func_name !==&nbsp;'string')&nbsp;throw&nbsp;new&nbsp;Error("func_name must be string");&nbsp; &nbsp;&nbsp;if&nbsp;(typeof&nbsp;func !==&nbsp;'function')&nbsp;throw&nbsp;new&nbsp;Error("must be function");&nbsp; &nbsp;&nbsp;console.log("注册函数:", func_name);&nbsp; &nbsp;&nbsp;this.handlers[func_name] = func;&nbsp; &nbsp;&nbsp;return&nbsp;true;};
globalThis.Hlclient.prototype.handlerRequest&nbsp;=&nbsp;function&nbsp;(requestJson) {&nbsp; &nbsp;&nbsp;let&nbsp;_this =&nbsp;this;&nbsp; &nbsp;&nbsp;let&nbsp;result =&nbsp;null;&nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log('处理请求:', requestJson);&nbsp; &nbsp; &nbsp; &nbsp; result =&nbsp;JSON.parse(requestJson);
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 处理注册ID&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(result["registerId"] || result["clientId"]) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; globalThis.rpc_client_id&nbsp;= result["registerId"] || result["clientId"];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log('收到clientId:', globalThis.rpc_client_id);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 小程序环境保存到storage&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(this.isWechat&nbsp;&& wx.setStorageSync) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; wx.setStorageSync('rpc_client_id', globalThis.rpc_client_id);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 发送确认消息&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.send(JSON.stringify({&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;action:&nbsp;'register_ack',&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;clientId: globalThis.rpc_client_id,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;status:&nbsp;'success'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return;&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 处理常规请求&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!result['action'] || !result["message_id"]) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.warn('无效的请求:', result);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return;&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;action = result["action"],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; message_id = result["message_id"],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; param = result["param"];
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(typeof&nbsp;param ===&nbsp;'string') {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; param =&nbsp;JSON.parse(param);&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) { }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;handler =&nbsp;this.handlers[action];&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!handler) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.warn('未找到处理函数:', action);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.sendResult(action, message_id,&nbsp;'Action not found');&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 执行处理函数&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;handler(function&nbsp;(response) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.sendResult(action, message_id, response);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }, param);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.error('执行处理函数出错:', e);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _this.sendResult(action, message_id,&nbsp;`执行错误:&nbsp;${e.message}`);&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }&nbsp;catch&nbsp;(error) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.error("处理请求出错:", error);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(result && result.message_id) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.sendResult(result.action&nbsp;||&nbsp;'', result.message_id, error.message);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }};
globalThis.Hlclient.prototype.sendResult&nbsp;=&nbsp;function&nbsp;(action, message_id, data) {&nbsp; &nbsp;&nbsp;let&nbsp;response;&nbsp; &nbsp;&nbsp;if&nbsp;(typeof&nbsp;data ===&nbsp;'object') {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; response =&nbsp;JSON.stringify(data);&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) {&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; response =&nbsp;String(data);&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; response =&nbsp;String(data);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;let&nbsp;resultMsg =&nbsp;JSON.stringify({&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;action: action,&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;message_id: message_id,&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;response_data: response&nbsp; &nbsp; });
&nbsp; &nbsp;&nbsp;console.log('发送响应:', resultMsg);&nbsp; &nbsp;&nbsp;this.send(resultMsg);};globalThis.socket&nbsp;=&nbsp;new&nbsp;Hlclient("ws://127.0.0.1:12080/ws?group=two");
globalThis.one&nbsp;=&nbsp;this.sm2Encode;&nbsp;// globalThis.【第一次无需变化】 = 要注入的方法名globalThis.socket.regAction("two",&nbsp;function&nbsp;(resolve, param) {try&nbsp;{let&nbsp;result = globalThis.one(param['data']);&nbsp;// param 部分 填参数&nbsp;&nbsp;resolve(result);&nbsp;}&nbsp;catch&nbsp;(e) {&nbsp;&nbsp;resolve(`调用失败:&nbsp;${e.message}`);&nbsp;}});
// 第一次注册可以使用上述代码直接复制粘贴, 第二次往后需要单独注册globalThis.two&nbsp;=&nbsp;this.tempKey;&nbsp;// globalThis.【需要变化】 = 要注入的方法名globalThis.socket.regAction("one",&nbsp;function&nbsp;(resolve, param) {&nbsp;// 注册的第一个参数名称不能与之前相同.try&nbsp;{let&nbsp;result = globalThis.two();&nbsp;// globalThis.two 与之前注册的一样, param 部分 填参数&nbsp;&nbsp;resolve(result);&nbsp;}&nbsp;catch&nbsp;(e) {&nbsp;&nbsp;resolve(`调用失败:&nbsp;${e.message}`);&nbsp;}});

小程序需要在 appcontext 下注入

注意事项：

使用wedecode反编译出来是完整的js文件以及目录

如图：

但是强开f12调试的目录，则会变为，全部打包进appContext下的app-server.js文件中，所以在进行hook需要加载外部模块的时候，需要使用app-server.js文件中的路径，反编译的目录是不生效的。

一些细节

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：凌曦安全 Syst1m Syst1m《凌曦安全：jsrpc小程序注入tips》