freanocank/wechat-decrypt

[Credential-related source omitted]

[![tests](https://github.com/tzwkb/wechat-decrypt/actions/workflows/tests.yml/badge.svg)](https://github.com/tzwkb/wechat-decrypt/actions/workflows/tests.yml)

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)

[![Python](https://img.shields.io/badge/Python-3.10%2B-blue.svg)](https://www.python.org/)

A local-first [Codex Skill](https://developers.openai.com/codex/skills) for reading, searching, summarizing, exporting, and transcribing WeChat 4.x history on macOS and Windows. The command-line core also works without MCP; the bundled serv

sudo codesign --force --deep --sign - /Applications/WeChat.app

Thanks to all [code contributors](https://github.com/tzwkb/wechat-decrypt/graphs/contributors) and everyone who helps through issue reports and design proposals. Contributions include:

- [@Allen-CDA](https://github.com/Allen-CDA) diagnosed the Windows WeChat 4.1.12.55 key-extraction failure and provided multi-entry SHA-512 hook and process-detection improvement suggestions ([#1](https://github.com/tzwkb/wechat-decrypt/iss

- [@Lee-Juntong](https://github.com/Lee-Juntong) contributed complete-text preservation, query validation and streaming, chat-list pagination, relocated Windows data and attachment paths, SQLCipher page authentication, and committed-WAL sna

- [@ShiTan-677](https://github.com/ShiTan-677) contributed per-shard sender resolution, unambiguous contact selection, and collision-safe attachment export ([#3](https://github.com/tzwkb/wechat-decrypt/pull/3), [#4](https://github.com/tzwkb

[![tests](https://github.com/tzwkb/wechat-decrypt/actions/workflows/tests.yml/badge.svg)](https://github.com/tzwkb/wechat-decrypt/actions/workflows/tests.yml)

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)

[![Python](https://img.shields.io/badge/Python-3.10%2B-blue.svg)](https://www.python.org/)

一个本地优先的 [Codex Skill](https://developers.openai.com/codex/skills)：在 macOS 和 Windows 上读取、搜索、总结、导出并转写 WeChat 4.x 聊天记录。命令行核心不依赖 MCP；随附服务提供可选的 [Codex MCP](https://developers.openai.com/codex/mcp) 门面。

sudo codesign --force --deep --sign - /Applications/WeChat.app

感谢所有[代码贡献者](https://github.com/tzwkb/wechat-decrypt/graphs/contributors)，也感谢通过问题报告和方案建议帮助改进项目的贡献者。具体贡献包括：

- [@Allen-CDA](https://github.com/Allen-CDA)：诊断 Windows 微信 4.1.12.55 密钥提取失败问题，并提供多 SHA-512 入口挂钩与进程检测优化建议（[#1](https://github.com/tzwkb/wechat-decrypt/issues/1)）。

- [@Lee-Juntong](https://github.com/Lee-Juntong)：贡献完整文本保留、查询参数校验与流式读取、会话列表分页、Windows 自定义数据目录与附件定位、SQLCipher 逐页认证及已提交 WAL 快照支持（[#7](https://github.com/tzwkb/wechat-decrypt/pull/7)、[#8](https://github.com/tzwkb/wechat-decrypt/pull/8)、[#9](htt

- [@ShiTan-677](https://github.com/ShiTan-677)：贡献按数据库分片解析发送者、联系人唯一匹配与附件导出防覆盖修复（[#3](https://github.com/tzwkb/wechat-decrypt/pull/3)、[#4](https://github.com/tzwkb/wechat-decrypt/pull/4)、[#5](https://github.com/tzwkb/wechat-decrypt/pull/5)），并

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

Executable file

[Credential-related source omitted]

- **frida spawn 在 ARM 模拟 x64 进程不兼容**(微信卡死 1 进程);**attach 可**。 - **frida 17 API 大变**: `Module.findGlobalExportByName(name)`、`frida.get_local_device().enumerate_processes()`(旧 `Module.findExportByName`/`frida.enumerate_processes` 已删)。 - 装 fri

- **frida 17 API 大变**: `Module.findGlobalExportByName(name)`、`frida.get_local_device().enumerate_processes()`(旧 `Module.findExportByName`/`frida.enumerate_processes` 已删)。 - 装 frida 用清华镜像(PyPI 直连 ConnectionReset): `pip install -i https://pyp

- 装 frida 用清华镜像(PyPI 直连 ConnectionReset): `pip install -i https://pypi.tuna.tsinghua.edu.cn/simple frida-tools`。

if (-not (Test-Path $DUMP)) {     Write-Error "缺少 $DUMP —— 从 https://github.com/0xlane/wechat-dump-rs/releases 下载放此处"

Write-Error "缺少 $DUMP —— 从 https://github.com/0xlane/wechat-dump-rs/releases 下载放此处"

[Credential-related source omitted]

if (-not (Test-Path $DUMP)) {     Write-Host "[2/4] 缺少 wechat-dump-rs.exe"     Write-Host "  下载: https://github.com/0xlane/wechat-dump-rs/releases -> 放到 $DUMP"

Write-Host "[2/4] 缺少 wechat-dump-rs.exe"     Write-Host "  下载: https://github.com/0xlane/wechat-dump-rs/releases -> 放到 $DUMP" } else {

Write-Host "  下载: https://github.com/0xlane/wechat-dump-rs/releases -> 放到 $DUMP"

[Credential-related source omitted]

Implemented for [issue #6](https://github.com/tzwkb/wechat-decrypt/issues/6).

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

Executable file

_ZSTD_MAGIC = b"\x28\xb5\x2f\xfd"

sudo codesign --force --deep --sign - /Applications/WeChat.app

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

def fetch(table, db_paths, since_dt, until_dt):

# Determine speaker label (is_me + sender_wxid resolved per-DB in fetch())

all_rows = fetch(table, db_paths, start_dt, end_dt)

#!/usr/bin/env python3

Executable file

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

if len(wal) < 32 or wal[:4] != b"\x37\x7f\x06\x82":

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

for table in msg_tables:         wxid = name2id.get(table, table)         rows = ec.fetch(table, [src], since, until)

wxid = name2id.get(table, table)         rows = ec.fetch(table, [src], since, until)         if not rows:

rows = ec.fetch(table, [src], since, until)

#!/usr/bin/env python3

Executable file

Executable file

#!/usr/bin/env python3

Executable file

Executable file

The page payload is opaque: this works before SQLCipher page decryption. Format reference: https://www.sqlite.org/fileformat2.html#wal_file_format

Format reference: https://www.sqlite.org/fileformat2.html#wal_file_format

Executable file

if (-not (Test-Path $DUMP)) {     Write-Error "缺少 $DUMP —— 从 https://github.com/0xlane/wechat-dump-rs/releases 下载放此处"

Write-Error "缺少 $DUMP —— 从 https://github.com/0xlane/wechat-dump-rs/releases 下载放此处"

Executable file

Executable file

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

Executable file

#!/usr/bin/env swift

#!/bin/bash

trap "rm -rf $WORK_DIR" EXIT

#!/usr/bin/env python3

#!/bin/bash

rm -f "$FRIDA_OUT"

[Credential-related source omitted]

echo "  1. sudo codesign --force --deep --sign - /Applications/WeChat.app"

[Credential-related source omitted]

Executable file

#!/usr/bin/env python3

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

Executable file

Executable file

#!/bin/bash

rm "$USER_SKILL_DIR"

echo "  1. sudo codesign --force --deep --sign - /Applications/WeChat.app"

Executable file

Executable file

Executable file

"<des>周杰伦 &amp; 乐队</des>"         "<sourcedisplayname>QQ音乐</sourcedisplayname>"         "<dataurl>https://example.com/song?a=1&amp;b=2</dataurl>"

"<sourcedisplayname>QQ音乐</sourcedisplayname>"         "<dataurl>https://example.com/song?a=1&amp;b=2</dataurl>"         "<songalbumurl>https://example.com/cover.jpg</songalbumurl>",

"<dataurl>https://example.com/song?a=1&amp;b=2</dataurl>"

"<songalbumurl>https://example.com/cover.jpg</songalbumurl>",

assert parsed["artist"] == "周杰伦 & 乐队"     assert parsed["source"] == "QQ音乐"     assert parsed["url"] == "https://example.com/song?a=1&b=2"

assert parsed["source"] == "QQ音乐"     assert parsed["url"] == "https://example.com/song?a=1&b=2"     assert "夜曲 & Live" in parsed["summary"]

assert parsed["url"] == "https://example.com/song?a=1&b=2"

"<title><![CDATA[演示视频]]></title>"         "<des><![CDATA[两分钟介绍]]></des>"         "<url><![CDATA[https://example.com/video]]></url>",

"<des><![CDATA[两分钟介绍]]></des>"         "<url><![CDATA[https://example.com/video]]></url>",     )

"<url><![CDATA[https://example.com/video]]></url>",

malformed = (         "<msg><appmsg><type>4</type><title><![CDATA[仍可读取]]></title>"         "<url>https://example.com/video?x=1&y=2</url></appmsg></msg>"

"<msg><appmsg><type>4</type><title><![CDATA[仍可读取]]></title>"         "<url>https://example.com/video?x=1&y=2</url></appmsg></msg>"     )

"<url>https://example.com/video?x=1&y=2</url></appmsg></msg>"

fallback = appmsg.parse_app_message(malformed, _local_type(4))     assert fallback["title"] == "仍可读取"     assert fallback["url"] == "https://example.com/video?x=1&y=2"

assert fallback["url"] == "https://example.com/video?x=1&y=2"

"<objectId>12345</objectId>"         "<objectNonceId>nonce-1</objectNonceId>"         "<mediaList><media><url>https://example.com/finder.mp4</url>"

"<objectNonceId>nonce-1</objectNonceId>"         "<mediaList><media><url>https://example.com/finder.mp4</url>"         "<coverUrl>https://example.com/finder.jpg</coverUrl></media></mediaList>"

"<mediaList><media><url>https://example.com/finder.mp4</url>"

"<coverUrl>https://example.com/finder.jpg</coverUrl></media></mediaList>"

assert parsed["object_id"] == "12345"     assert parsed["object_nonce_id"] == "nonce-1"     assert parsed["url"] == "https://example.com/finder.mp4"

assert parsed["object_nonce_id"] == "nonce-1"     assert parsed["url"] == "https://example.com/finder.mp4"     assert parsed["thumb_url"] == "https://example.com/finder.jpg"

assert parsed["url"] == "https://example.com/finder.mp4"

assert parsed["thumb_url"] == "https://example.com/finder.jpg"

"<finderLive><nickname>直播间</nickname><desc>新品发布</desc>"             "<finderUsername>host</finderUsername><liveId>888</liveId>"             "<coverUrl>https://example.com/live.jpg</coverUrl></finderLive>",

"<finderUsername>host</finderUsername><liveId>888</liveId>"             "<coverUrl>https://example.com/live.jpg</coverUrl></finderLive>",         ),

"<coverUrl>https://example.com/live.jpg</coverUrl></finderLive>",

"<weappinfo><username>gh_demo@app</username><appid>wx123</appid>"             "<pagepath>pages/menu</pagepath>"             "<weappiconurl>https://example.com/icon.png</weappiconurl></weappinfo>",

"<pagepath>pages/menu</pagepath>"             "<weappiconurl>https://example.com/icon.png</weappiconurl></weappinfo>",         ),

"<weappiconurl>https://example.com/icon.png</weappiconurl></weappinfo>",

999,             "<title>新型卡片</title><des>未来格式</des>"             "<url>https://example.com/future</url>",

"<title>新型卡片</title><des>未来格式</des>"             "<url>https://example.com/future</url>",         ),

"<url>https://example.com/future</url>",

assert unknown["label"] == "分享卡片"     assert "新型卡片" in unknown["summary"]     assert "https://example.com/future" in unknown["summary"]

assert "https://example.com/future" in unknown["summary"]

3,         "<title><![CDATA[测试歌曲]]></title><des>测试歌手</des>"         "<dataurl>https://example.com/song</dataurl>",

"<title><![CDATA[测试歌曲]]></title><des>测试歌手</des>"         "<dataurl>https://example.com/song</dataurl>",     )

"<dataurl>https://example.com/song</dataurl>",

assert "[音乐分享] 测试歌曲" in exported     assert "测试歌手" in exported     assert "https://example.com/song" in exported

assert "https://example.com/song" in exported

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

PNG = base64.b64decode('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aK1sAAAAASUVORK5CYII=')

return b'\x12\x22\x0a\x20' + identifier.encode()

return {'_db': str(storage / 'message' / shard), 'local_id': local_id,                     'server_id': server_id, 'create_time': stamp, 'local_type': 3,                     'msg_hex': ('<msg><img md5="' + 'f'*32 + '" aeskey="SECRET" cdnurl

'msg_hex': ('<msg><img md5="' + 'f'*32 + '" aeskey="SECRET" cdnurl="https://example.invalid/private"/></msg>').encode().hex()}, location

def test_html_and_markdown_do_not_interpret_message_markup():     import transcript_render     line='<script>alert(1)</script> ![remote](https://example.invalid/pixel)'

import transcript_render     line='<script>alert(1)</script> ![remote](https://example.invalid/pixel)'     html=''.join(transcript_render.render('<header>',[(line,None)],'html'))

line='<script>alert(1)</script> ![remote](https://example.invalid/pixel)'

Executable file

Executable file

Executable file

Executable file

blob = b"\x28\xb5\x2f\xfd" + b"\x00" * 24

blob = b"\x28\xb5\x2f\xfd" + b"\x00" * 8

Executable file

Executable file

(b'\x28\xb5\x2f\xfd' + b'\x00' * 8,))

Executable file

Executable file

Executable file

blob = b"\x28\xb5\x2f\xfd" + b"\x00" * 6 + content.encode() + b"\x01\x00tail"

blob = b"\x28\xb5\x2f\xfd" + b"\x00" * 6 + content.encode() + b"\x01\x00tail"

pat_blob = b"\x28\xb5\x2f\xfd" + b"\x00" * 6 + pat_content.encode() + b"\x01\x00"

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file