652 ·GitHub
What is this?
A single-purpose Python tool that pulls the encryption keys out of WeChat's local WCDB/SQLCipher4 chat databases on Linux, macOS and Windows, so you can decrypt your own chat history.
A single-purpose Python tool that pulls the encryption keys out of WeChat's local WCDB/SQLCipher4 chat databases on Linux, macOS and Windows, so you can decrypt your own chat history.Is this a GUI app or a command-line script?Command-line only: three separate Python scripts, one per platform — wcdbkeytool.py for Linux, wcdbkeytoolmacos.py and wcdbkeytoolwindows.py.
Command-line only: three separate Python scripts, one per platform — wcdbkeytool.py for Linux, wcdbkeytoolmacos.py and wcdbkeytoolwindows.py.How do I get it running?Grab the script for your OS and run it with Python 3 — there is no install step and nothing to pip install.
Grab the script for your OS and run it with Python 3 — there is no install step and nothing to pip install.Do I need to install anything besides Python?No third-party libraries: the scripts call the crypto that ships with each OS — OpenSSL on Linux, CommonCrypto on macOS, CNG on Windows.
No third-party libraries: the scripts call the crypto that ships with each OS — OpenSSL on Linux, CommonCrypto on macOS, CNG on Windows.Does it work with the latest WeChat versions, or is that the catch?It handles both old and new WeChat, but 4.1+ needs a one-time logout and re-login so the debugger can catch the passphrase being derived, plus sudo on Linux/macOS for ptrace access.
It handles both old and new WeChat, but 4.1+ needs a one-time logout and re-login so the debugger can catch the passphrase being derived, plus sudo on Linux/macOS for ptrace access.Which platforms are supported?Linux, macOS and Windows. Each has a WeChat 4.0.x path (memory scanning) and a 4.1+ path (GDB, LLDB or runtime scan plus PBKDF2), all marked as verified on real machines.
Linux, macOS and Windows. Each has a WeChat 4.0.x path (memory scanning) and a 4.1+ path (GDB, LLDB or runtime scan plus PBKDF2), all marked as verified on real machines.Will it keep working after WeChat updates?That is the headline feature: on Linux it re-locates the key function via ELF static analysis of the binary, macOS breakpoints on Apple's own CCKeyDerivationPBKDF so it is independent of WeChat's version, and Windows falls back to legacy memory scanning — though after a macOS upgrade the app may need re-signing.
That is the headline feature: on Linux it re-locates the key function via ELF static analysis of the binary, macOS breakpoints on Apple's own CCKeyDerivationPBKDF so it is independent of WeChat's version, and Windows falls back to legacy memory scanning — though after a macOS upgrade the app may need re-signing.What does it actually do with the passphrase once captured?For each database it runs PBKDF2-HMAC-SHA512 with 256,000 iterations over the file's own 16-byte salt to get a 32-byte AES-256 key, validates it with an HMAC check against the first page, then decrypts AES-256-CBC page-by-page into a standard SQLite file.
For each database it runs PBKDF2-HMAC-SHA512 with 256,000 iterations over the file's own 16-byte salt to get a 32-byte AES-256 key, validates it with an HMAC check against the first page, then decrypts AES-256-CBC page-by-page into a standard SQLite file.Why does the Linux path need ELF static analysis?The Linux WeChat binary exposes no usable symbols, so the tool searches .rodata for WCDB marker strings like com.Tencent.WCDB.Config.Cipher and follows cross-references to the key-handling function, then plants a GDB breakpoint there.
The Linux WeChat binary exposes no usable symbols, so the tool searches .rodata for WCDB marker strings like com.Tencent.WCDB.Config.Cipher and follows cross-references to the key-handling function, then plants a GDB breakpoint there.Why did older WeChat key tools stop working?WeChat 4.1+ stopped caching the raw key in process memory — only a passphrase remains, so the classic memory pattern scans found nothing. This tool instead catches the passphrase at the moment of derivation and derives the real key with PBKDF2.
WeChat 4.1+ stopped caching the raw key in process memory — only a passphrase remains, so the classic memory pattern scans found nothing. This tool instead catches the passphrase at the moment of derivation and derives the real key with PBKDF2.What are similar projects?awesome-reverse-engineering, reverse-engineering, ghidra-mcp, pwndbg, vol-rs, ablation, Detect-It-Easy, binwalk
awesome-reverse-engineering, reverse-engineering, ghidra-mcp, pwndbg, vol-rs, ablation, Detect-It-Easy, binwalkWhich topics is it in?forensics, data-extraction, binary-analysis, cryptography, low-level, messaging, wechat, debugging, static-analysis, reverse-engineering, encryption, security-tools
forensics, data-extraction, binary-analysis, cryptography, low-level, messaging, wechat, debugging, static-analysis, reverse-engineering, encryption, security-tools