feat(desktop-wake): add WeCom UIA warm-tree and ship n2-wake in 1.2.3
All checks were successful
Publish Python Package to Gitea / publish (push) Successful in 29s

Expose ensure_ui_ready via DuiLib GetAccessible inject path; package x86 native helpers for host/skill consumers.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
2026-08-02 08:42:38 +08:00
parent 3dc46b0555
commit 71091e38a9
29 changed files with 3088 additions and 3 deletions

View File

@@ -0,0 +1,39 @@
# N2 — 企微进程内硬唤醒 PoC
## 现状
- 目标进程:`WXWork.exe`(常见为 **Win32/x86**,安装在 `Program Files (x86)`)
- 产物:`native/wecom_wake.dll` + `native/desktop-wake.exe`(**均须 x86**)
- 手段:
1. `CreateRemoteThread` + `LoadLibraryW`(写 `%TEMP%\jiangchang_desktop_wake_loaded.txt`)
2. `SetWindowsHookEx(WH_CALLWNDPROC)` 在 UI 线程子类化,拦 `WM_GETOBJECT`
## 编译
在 kit 根或本目录:
```powershell
powershell -File ..\build.ps1
# 即:native_src\build.ps1
```
## 手动试
```powershell
# 先 probe 拿 hwnd
python -m jiangchang_desktop_wake probe --profile wecom
.\..\..\native\desktop-wake.exe wecom <hwnd_hex> --mode n2
```
## 标记文件(%TEMP%)
| 文件 | 含义 |
|---|---|
| `jiangchang_desktop_wake_target.txt` | injector 写入的目标 hwnd |
| `jiangchang_desktop_wake_loaded.txt` | DLL 已进目标进程 |
| `jiangchang_desktop_wake_hook.txt` | CALLWNDPROC 钩子触发 |
| `jiangchang_desktop_wake_subclass.txt` | 子类化已安装 |
## 限制
子类化 + `CreateStdAccessibleObject` **不一定**能暖开企微 DirectUI;本阶段先证明注入通道。若 `loaded_marker=True` 而树仍冷,下一步要做更深层 Provider 补丁。