README
¶
wxkey
wxkey is the companion CLI used by wx-mcp
to initialize local WeChat 4.x WCDB keys on macOS.
It reads the local WeChat process memory, finds candidate WCDB key material, and
verifies candidates against local DB page-1 SQLCipher HMACs. It writes the
resulting per-DB key map to ~/.config/wxcli/config.json, where wx-mcp can read
it later.
Install
go install github.com/r266-tech/wxkey/cmd/wxkey@latest
Usage
wxkey bootstrap
wxkey doctor
wxkey setup
wxkey scan --quiet
wxkey resign-wechat
Recommended first-run path:
wxkey bootstrap
bootstrap checks existing config, applies the no-SIP ad-hoc signing route for
WeChat.app when needed, asks for the Mac admin password once, stores that
password in the user's macOS Keychain, then runs setup and prints only a
summary. It does not print raw key material.
SIP
SIP should stay enabled. First-time key extraction uses one supported path:
ad-hoc-signing the user's local WeChat.app and running wxkey with administrator
privileges. The admin password is stored in Keychain by wxkey bootstrap so
later wxkey setup runs can refresh missing DB keys unattended. Disabling SIP is
not a supported setup step.
Security
Do not paste raw ~/.config/wxcli/config.json, DB keys, WeChat DBs, or message
contents into public issues.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
wxkey
command
wxkey extracts WeChat 4.x WCDB master keys from the live WeChat process on macOS.
|
wxkey extracts WeChat 4.x WCDB master keys from the live WeChat process on macOS. |
|
wxkey-grep-pwd
command
Diagnostic: search WeChat process memory for the literal known master password string in any of these forms:
|
Diagnostic: search WeChat process memory for the literal known master password string in any of these forms: |
|
internal
|
|
|
dbfiles
Package dbfiles walks a WeChat 4.x xwechat_files account directory and collects every encrypted .db it finds, along with the file's first page (needed for SQLCipher salt + HMAC verification).
|
Package dbfiles walks a WeChat 4.x xwechat_files account directory and collects every encrypted .db it finds, along with the file's first page (needed for SQLCipher salt + HMAC verification). |
|
machvm
Package machvm wraps the Mach VM syscalls used to enumerate and read another process's memory on macOS.
|
Package machvm wraps the Mach VM syscalls used to enumerate and read another process's memory on macOS. |
|
scan
Package scan finds WeChat database master keys by walking the WeChat process's RW memory regions, looking for the SQL literal pattern `x'<hex>'` that WCDB uses when it forwards keys to sqlite3_key_v2, and verifying each candidate against page 1 of every collected DB.
|
Package scan finds WeChat database master keys by walking the WeChat process's RW memory regions, looking for the SQL literal pattern `x'<hex>'` that WCDB uses when it forwards keys to sqlite3_key_v2, and verifying each candidate against page 1 of every collected DB. |
|
verify
Package verify implements WCDB-flavor SQLCipher 4 page-1 HMAC verification.
|
Package verify implements WCDB-flavor SQLCipher 4 page-1 HMAC verification. |