SkillPkg Logo
如需下载，请在电脑端打开本页操作。
SKILL.md
---
name: wechat-exportor
description: This skill should be used when exporting, backing up, or archiving WeChat PC 4.x chat history (text + images + files + videos) into a queryable format. Covers the complete pipeline: extracting WeChat database keys (wx_key.dll DLL-injection Hook), decrypting databases (PBKDF2-HMAC-SHA512 + SQLCipher4), decrypting wxgf images (AES-128-ECB + XOR), MD5-deduplicated media archiving, message extraction (per-session Msg_ tables + zstd), SQLite+FTS5 full-text indexing, and green/portable packaging. Triggers include requests like "导出微信聊天记录", "备份微信聊天记录", "微信记录归档", "提取微信密钥", "解密微信数据库", or incremental backup of WeChat chat data.
agent_created: true
version: 1.0.0
---

WeChat Exportor

Overview

This skill enables the complete export and archival of WeChat PC 4.x chat records — text messages, images, files, and videos — into a locally-queryable form (SQLite + FTS5 full-text index + browsable HTML). It works on Windows, targets WeChat 4.x (verified on 4.1.12.55), and produces an incremental, deduplicated backup suitable for off-site storage.

When to Use

Use this skill when the user wants to:

  • Export / back up / archive WeChat chat history
  • Extract WeChat database or image keys
  • Decrypt WeChat databases
  • Build an incremental backup that can survive deleting WeChat records
  • Package the tooling as a portable (green) app

Core Pipeline

The end-to-end workflow, in order:

  1. Extract database key — scripts/extract_hook.mjs uses wx_key.dll (DLL-injection + Hook on sqlcipher_codec_ctx_set_cipher) to intercept the 32-byte passphrase. Requires the user to log out and re-login WeChat to trigger database opening.
  2. Extract image key — scripts/extract_image_key.mjs scans WeChat process memory for the 32-byte ASCII AES key. Requires the user to open a few chat images (full view) to make the key appear in memory.
  3. Decrypt databases — scripts/decrypt_all.mjs derives each database's raw key via PBKDF2-HMAC-SHA512(passphrase, salt, 256000, dklen=32) and decrypts with SQLCipher4 (AES-256-CBC, page size 4096). Salt = first 16 bytes of each .db file.
  4. Archive media — scripts/archive_media.mjs copies files + videos (plaintext), scripts/archive_images.mjs decrypts images (AES-128-ECB + XOR) to JPG. Both deduplicate by content MD5.
  5. Extract messages — scripts/extract_export.mjs walks the per-session Msg_<md5(username)> tables, decompresses zstd content, and associates media by imageMd5/videoMd5/filename.
  6. Import to SQLite — scripts/merge.py inserts into data/wechat.db with FTS5 (trigram tokenizer for Chinese), deduplicating by message hash.
  7. Build viewer — scripts/build_viewer.py generates browsable HTML with images/files/videos rendered inline.

To package everything as a portable app (bundled Node + Python runtimes), run scripts/build_portable.py.

Key Scripts

All scripts live in scripts/. They are portable — paths.mjs provides APP_ROOT (relative to the script location) and detectWechatRoot() (auto-detects the WeChat data directory, with multi-path fallback for admin-elevation cases).

  • extract_hook.mjs — database key extraction (Hook). Needs admin rights.
  • extract_image_key.mjs — image key extraction (memory scan). Needs admin rights.
  • decrypt_all.mjs — decrypt all databases in db_storage/.
  • archive_media.mjs — archive files (msg/file) + videos (msg/video), MD5 dedup.
  • archive_images.mjs — decrypt + archive images (msg/attach _t.dat), MD5 dedup.
  • extract_export.mjs — extract messages + media association to inbox/wechat_export.json.
  • merge.py — incremental import to SQLite + FTS5.
  • query.py — command-line query (search / contact / recent / count / list / range).
  • build_viewer.py — generate HTML viewer.
  • build_portable.py — green packaging (bundles Node + Python runtimes).
  • wx_key.dll — core Hook DLL (dependency of extract_hook.mjs).

Dependencies

The .mjs scripts require Node.js >= 18 with koffi and zstd-codec installed (npm install koffi zstd-codec), plus node:sqlite (built-in in Node 22). The .py scripts require Python >= 3.10 (stdlib only). wx_key.dll is bundled.

Version Management

This skill follows semantic versioning (MAJOR.MINOR.PATCH):

  • MAJOR — incompatible changes (WeChat major upgrade breaks the Hook signatures, architecture rewrite).
  • MINOR — new capability (e.g. media archiving, incremental backup, portable packaging).
  • PATCH — bug fixes and documentation updates.

Version is recorded in three places: the version field in this frontmatter, the VERSION file, and CHANGELOG.md. Tag each release in git (v1.0.0, v1.1.0, ...).

Resources

references/

  • wechat-4x-internals.md — WeChat 4.x database schema, key system, and image format internals.
  • key-extraction.md — the two key-extraction approaches (Hook vs memory scan) and their trigger conditions.
  • pitfalls.md — known traps and troubleshooting (passive scan is dead on 4.1.x, BLOB type handling, admin-elevation homedir, etc.).

Load the relevant reference file when detailed internals or troubleshooting is needed.