mirror of
https://wget.la/https://github.com/Wxw-Gu/WechatExplorer
synced 2026-08-17 19:47:08 +08:00
feat: 支持图片密钥配置与内存扫描
This commit is contained in:
电摇小子
+57
-4
@@ -47,6 +47,24 @@ const BUILD_MARK = 'wechat4-local-http-api-2026-07-03'
|
||||
const TRAY_MODE =
|
||||
process.argv.includes('--tray') || (process.env['WXE_TRAY'] || '').toString() === '1'
|
||||
|
||||
function normalizeImageXorKey(value: unknown): string {
|
||||
const raw = String(value ?? '').trim()
|
||||
if (!raw) return ''
|
||||
const parsed = raw.toLowerCase().startsWith('0x')
|
||||
? Number.parseInt(raw.slice(2), 16)
|
||||
: Number.parseInt(raw, 10)
|
||||
if (!Number.isFinite(parsed)) return raw
|
||||
return `0x${Math.max(0, parsed & 0xff).toString(16).toUpperCase().padStart(2, '0')}`
|
||||
}
|
||||
|
||||
function getConfiguredImageKeys(): { xorKey: string; aesKey: string } {
|
||||
const settings = loadSettings()
|
||||
return {
|
||||
xorKey: settings.imageXorKey || import.meta.env.VITE_IMAGE_XOR_KEY || '0x40',
|
||||
aesKey: settings.imageAesKey || import.meta.env.VITE_IMAGE_AES_KEY || ''
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
function createWindow(): void {
|
||||
// 创建浏览器窗口
|
||||
@@ -180,6 +198,36 @@ app.whenReady().then(async () => {
|
||||
}
|
||||
})
|
||||
|
||||
ipcMain.handle('key:autoGetImageKey', async (event) => {
|
||||
const settings = loadSettings()
|
||||
const self = chat.getSelfAccountInfo()
|
||||
const accountRoot = settings.imageKeyRoot || self?.accountRoot || settings.dbRoot
|
||||
const wxid = self?.wxid
|
||||
const onStatus = (message: string): void => {
|
||||
if (!event.sender.isDestroyed()) event.sender.send('key:imageKeyStatus', { message })
|
||||
}
|
||||
const result =
|
||||
process.platform === 'win32'
|
||||
? await keyServiceWin.autoGetImageKeyByMemoryScan(accountRoot, onStatus)
|
||||
: await keyServiceMac.autoGetImageKey(accountRoot, onStatus, wxid)
|
||||
|
||||
if (!result.success || !result.aesKey) return result
|
||||
|
||||
const imageXorKey = normalizeImageXorKey(result.xorKey)
|
||||
const nextSettings = saveSettings({
|
||||
...settings,
|
||||
imageXorKey,
|
||||
imageAesKey: result.aesKey
|
||||
})
|
||||
imageDecryptService = null
|
||||
return {
|
||||
...result,
|
||||
imageXorKey,
|
||||
imageAesKey: result.aesKey,
|
||||
settings: nextSettings
|
||||
}
|
||||
})
|
||||
|
||||
ipcMain.handle('db:getContacts', (_, filter?: string) => chat.listContacts(filter))
|
||||
|
||||
ipcMain.handle('db:getContactAvatars', (_, usernames: string[]) =>
|
||||
@@ -275,9 +323,7 @@ app.whenReady().then(async () => {
|
||||
async (_, imageMd5?: string, imageDatNameOrThumb?: string | boolean, _sessionId?: string) => {
|
||||
void _sessionId
|
||||
if (!imageDecryptService) {
|
||||
// 从环境变量获取密钥
|
||||
const xorKey = import.meta.env.VITE_IMAGE_XOR_KEY || '0x40'
|
||||
const aesKey = import.meta.env.VITE_IMAGE_AES_KEY || ''
|
||||
const { xorKey, aesKey } = getConfiguredImageKeys()
|
||||
if (!aesKey) {
|
||||
return { success: false, error: '未配置图片解密密钥' }
|
||||
}
|
||||
@@ -314,7 +360,14 @@ app.whenReady().then(async () => {
|
||||
}))
|
||||
|
||||
ipcMain.handle('settings:set', (_, patch: Partial<AppSettings>) => {
|
||||
const merged = saveSettings({ ...loadSettings(), ...patch })
|
||||
const before = loadSettings()
|
||||
const merged = saveSettings({ ...before, ...patch })
|
||||
if (
|
||||
before.imageXorKey !== merged.imageXorKey ||
|
||||
before.imageAesKey !== merged.imageAesKey
|
||||
) {
|
||||
imageDecryptService = null
|
||||
}
|
||||
return { settings: merged, settingsPath: getSettingsPath() }
|
||||
})
|
||||
|
||||
|
||||
@@ -4,6 +4,7 @@ import fs from 'fs-extra'
|
||||
import path from 'path'
|
||||
import { promisify } from 'util'
|
||||
import { isValidDatabaseKey } from './database-key-store'
|
||||
import crypto from 'crypto'
|
||||
|
||||
const execFileAsync = promisify(execFile)
|
||||
|
||||
@@ -14,6 +15,14 @@ export interface DatabaseKeyResult {
|
||||
code?: string
|
||||
}
|
||||
|
||||
export interface ImageKeyResult {
|
||||
success: boolean
|
||||
xorKey?: number
|
||||
aesKey?: string
|
||||
verified?: boolean
|
||||
error?: string
|
||||
}
|
||||
|
||||
export class KeyServiceMac {
|
||||
private getHelperPath(): string {
|
||||
// 多 candidate fallback:覆盖 extraResources、asarUnpack、dev 三种场景
|
||||
@@ -175,4 +184,259 @@ export class KeyServiceMac {
|
||||
return { success: false, error: error instanceof Error ? error.message : String(error) }
|
||||
}
|
||||
}
|
||||
|
||||
async autoGetImageKey(
|
||||
accountPath?: string,
|
||||
onStatus?: (message: string) => void,
|
||||
wxid?: string
|
||||
): Promise<ImageKeyResult> {
|
||||
try {
|
||||
onStatus?.('正在从缓存目录扫描图片密钥...')
|
||||
const codes = this.collectKvcommCodes(accountPath)
|
||||
if (codes.length === 0) {
|
||||
return { success: false, error: '未找到有效的密钥码（kvcomm 缓存为空）' }
|
||||
}
|
||||
|
||||
const wxidCandidates = this.collectWxidCandidates(accountPath, wxid)
|
||||
const accountPathCandidates = this.collectAccountPathCandidates(accountPath)
|
||||
|
||||
for (const candidateAccountPath of accountPathCandidates) {
|
||||
if (!fs.existsSync(candidateAccountPath)) continue
|
||||
const template = this.findTemplateData(candidateAccountPath, 32)
|
||||
if (!template.ciphertext) continue
|
||||
|
||||
const orderedWxids: string[] = []
|
||||
this.pushAccountIdCandidates(orderedWxids, path.basename(candidateAccountPath))
|
||||
for (const candidate of wxidCandidates) this.pushAccountIdCandidates(orderedWxids, candidate)
|
||||
|
||||
onStatus?.(`正在校验候选 wxid（${orderedWxids.length} 个）...`)
|
||||
for (const candidateWxid of orderedWxids) {
|
||||
for (const code of codes) {
|
||||
const { xorKey, aesKey } = this.deriveImageKeys(code, candidateWxid)
|
||||
if (!this.verifyDerivedAesKey(aesKey, template.ciphertext)) continue
|
||||
onStatus?.(`图片密钥获取成功 (wxid: ${candidateWxid})`)
|
||||
return { success: true, xorKey, aesKey, verified: true }
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const fallbackWxid = wxidCandidates[0]
|
||||
const fallbackCode = codes[0]
|
||||
const { xorKey, aesKey } = this.deriveImageKeys(fallbackCode, fallbackWxid)
|
||||
onStatus?.(`图片密钥已计算 (wxid: ${fallbackWxid})`)
|
||||
return { success: true, xorKey, aesKey, verified: false }
|
||||
} catch (error) {
|
||||
return {
|
||||
success: false,
|
||||
error: error instanceof Error ? error.message : String(error)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private collectKvcommCodes(accountPath?: string): number[] {
|
||||
const codeSet = new Set<number>()
|
||||
const pattern = /^key_(\d+)_.+\.statistic$/i
|
||||
for (const kvcommDir of this.getKvcommCandidates(accountPath)) {
|
||||
if (!fs.existsSync(kvcommDir)) continue
|
||||
try {
|
||||
for (const file of fs.readdirSync(kvcommDir)) {
|
||||
const match = file.match(pattern)
|
||||
if (!match) continue
|
||||
const code = Number(match[1])
|
||||
if (Number.isFinite(code) && code > 0 && code <= 0xffffffff) codeSet.add(code)
|
||||
}
|
||||
} catch {
|
||||
// Try the next candidate.
|
||||
}
|
||||
}
|
||||
return Array.from(codeSet)
|
||||
}
|
||||
|
||||
private getKvcommCandidates(accountPath?: string): string[] {
|
||||
const home = app.getPath('home')
|
||||
const candidates = new Set<string>([
|
||||
path.join(home, 'Library/Containers/com.tencent.xinWeChat/Data/Documents/app_data/net/kvcomm'),
|
||||
path.join(home, 'Library/Containers/com.tencent.xinWeChat/Data/Library/Application Support/com.tencent.xinWeChat/xwechat/net/kvcomm'),
|
||||
path.join(home, 'Library/Containers/com.tencent.xinWeChat/Data/Library/Application Support/com.tencent.xinWeChat/net/kvcomm'),
|
||||
path.join(home, 'Library/Containers/com.tencent.xinWeChat/Data/Documents/xwechat/net/kvcomm')
|
||||
])
|
||||
|
||||
const normalized = String(accountPath || '').replace(/\\/g, '/').replace(/\/+$/, '')
|
||||
const marker = '/xwechat_files'
|
||||
const markerIndex = normalized.indexOf(marker)
|
||||
if (markerIndex >= 0) {
|
||||
candidates.add(`${normalized.slice(0, markerIndex)}/app_data/net/kvcomm`)
|
||||
}
|
||||
|
||||
const newPathMatch = normalized.match(/^(.*\/com\.tencent\.xinWeChat\/(?:\d+\.\d+b\d+\.\d+|\d+\.\d+\.\d+))/)
|
||||
if (newPathMatch) {
|
||||
candidates.add(`${newPathMatch[1]}/net/kvcomm`)
|
||||
candidates.add(`${newPathMatch[1]}/xwechat/net/kvcomm`)
|
||||
}
|
||||
|
||||
return Array.from(candidates)
|
||||
}
|
||||
|
||||
private collectWxidCandidates(accountPath?: string, wxidParam?: string): string[] {
|
||||
const candidates: string[] = []
|
||||
this.pushAccountIdCandidates(candidates, wxidParam)
|
||||
|
||||
const normalized = String(accountPath || '').replace(/\\/g, '/').replace(/\/+$/, '')
|
||||
if (normalized) {
|
||||
this.pushAccountIdCandidates(candidates, path.basename(normalized))
|
||||
const root = this.resolveXwechatRootFromPath(normalized)
|
||||
if (root && fs.existsSync(root)) {
|
||||
try {
|
||||
for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
|
||||
if (!entry.isDirectory()) continue
|
||||
const entryPath = path.join(root, entry.name)
|
||||
if (this.isAccountDirPath(entryPath)) this.pushAccountIdCandidates(candidates, entry.name)
|
||||
}
|
||||
} catch {
|
||||
// Ignore unreadable directories.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (candidates.length === 0) candidates.push('unknown')
|
||||
return candidates
|
||||
}
|
||||
|
||||
private collectAccountPathCandidates(accountPath?: string): string[] {
|
||||
const candidates: string[] = []
|
||||
const push = (value?: string): void => {
|
||||
const normalized = String(value || '').trim()
|
||||
if (normalized && !candidates.includes(normalized)) candidates.push(normalized)
|
||||
}
|
||||
|
||||
push(accountPath)
|
||||
const root = this.resolveXwechatRootFromPath(accountPath)
|
||||
if (root && fs.existsSync(root)) {
|
||||
try {
|
||||
for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
|
||||
if (!entry.isDirectory()) continue
|
||||
const entryPath = path.join(root, entry.name)
|
||||
if (this.isAccountDirPath(entryPath) && this.isReasonableAccountId(entry.name)) push(entryPath)
|
||||
}
|
||||
} catch {
|
||||
// Ignore unreadable directories.
|
||||
}
|
||||
}
|
||||
return candidates
|
||||
}
|
||||
|
||||
private resolveXwechatRootFromPath(accountPath?: string): string | null {
|
||||
const normalized = String(accountPath || '').replace(/\\/g, '/').replace(/\/+$/, '')
|
||||
if (!normalized) return null
|
||||
const marker = '/xwechat_files'
|
||||
const markerIndex = normalized.indexOf(marker)
|
||||
if (markerIndex >= 0) return normalized.slice(0, markerIndex + marker.length)
|
||||
const newPathMatch = normalized.match(/^(.*\/com\.tencent\.xinWeChat\/(?:\d+\.\d+b\d+\.\d+|\d+\.\d+\.\d+))(\/|$)/)
|
||||
return newPathMatch ? newPathMatch[1] : null
|
||||
}
|
||||
|
||||
private isAccountDirPath(entryPath: string): boolean {
|
||||
return (
|
||||
fs.existsSync(path.join(entryPath, 'db_storage')) ||
|
||||
fs.existsSync(path.join(entryPath, 'msg')) ||
|
||||
fs.existsSync(path.join(entryPath, 'FileStorage', 'Image')) ||
|
||||
fs.existsSync(path.join(entryPath, 'FileStorage', 'Image2'))
|
||||
)
|
||||
}
|
||||
|
||||
private pushAccountIdCandidates(candidates: string[], value?: string): void {
|
||||
const raw = String(value || '').trim()
|
||||
if (!this.isReasonableAccountId(raw)) return
|
||||
for (const candidate of [raw, this.normalizeAccountId(raw)]) {
|
||||
if (candidate && !candidates.includes(candidate) && this.isReasonableAccountId(candidate)) {
|
||||
candidates.push(candidate)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private normalizeAccountId(value: string): string {
|
||||
const trimmed = String(value || '').trim()
|
||||
if (!trimmed) return ''
|
||||
if (trimmed.toLowerCase().startsWith('wxid_')) {
|
||||
const match = trimmed.match(/^(wxid_[^_]+)/i)
|
||||
return match?.[1] || trimmed
|
||||
}
|
||||
const suffixMatch = trimmed.match(/^(.+)_([a-zA-Z0-9]{4})$/)
|
||||
return suffixMatch ? suffixMatch[1] : trimmed
|
||||
}
|
||||
|
||||
private isReasonableAccountId(value: string): boolean {
|
||||
const lowered = String(value || '').trim().toLowerCase()
|
||||
if (!lowered || lowered.includes('/') || lowered.includes('\\')) return false
|
||||
return !['xwechat_files', 'all_users', 'backup', 'wmpf', 'app_data'].includes(lowered)
|
||||
}
|
||||
|
||||
private deriveImageKeys(code: number, wxid: string): { xorKey: number; aesKey: string } {
|
||||
const xorKey = code & 0xff
|
||||
const aesKey = crypto
|
||||
.createHash('md5')
|
||||
.update(`${code}${this.normalizeAccountId(wxid)}`)
|
||||
.digest('hex')
|
||||
.substring(0, 16)
|
||||
return { xorKey, aesKey }
|
||||
}
|
||||
|
||||
private findTemplateData(userDir: string, limit = 32): { ciphertext: Buffer | null } {
|
||||
const magic = Buffer.from([0x07, 0x08, 0x56, 0x32, 0x08, 0x07])
|
||||
const files: string[] = []
|
||||
const collect = (dir: string): void => {
|
||||
if (files.length >= limit) return
|
||||
try {
|
||||
for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
|
||||
if (files.length >= limit) break
|
||||
const full = path.join(dir, entry.name)
|
||||
if (entry.isDirectory()) collect(full)
|
||||
else if (entry.isFile() && entry.name.endsWith('_t.dat')) files.push(full)
|
||||
}
|
||||
} catch {
|
||||
// Ignore unreadable directories.
|
||||
}
|
||||
}
|
||||
collect(userDir)
|
||||
files.sort((a, b) => {
|
||||
try {
|
||||
return fs.statSync(b).mtimeMs - fs.statSync(a).mtimeMs
|
||||
} catch {
|
||||
return 0
|
||||
}
|
||||
})
|
||||
|
||||
for (const file of files) {
|
||||
try {
|
||||
const data = fs.readFileSync(file)
|
||||
if (data.length >= 0x1f && data.subarray(0, 6).equals(magic)) {
|
||||
return { ciphertext: data.subarray(0x0f, 0x1f) }
|
||||
}
|
||||
} catch {
|
||||
// Try the next file.
|
||||
}
|
||||
}
|
||||
return { ciphertext: null }
|
||||
}
|
||||
|
||||
private verifyDerivedAesKey(aesKey: string, ciphertext: Buffer): boolean {
|
||||
try {
|
||||
if (!aesKey || aesKey.length < 16 || ciphertext.length !== 16) return false
|
||||
const decipher = crypto.createDecipheriv(
|
||||
'aes-128-ecb',
|
||||
Buffer.from(aesKey, 'ascii').subarray(0, 16),
|
||||
null
|
||||
)
|
||||
decipher.setAutoPadding(false)
|
||||
const dec = Buffer.concat([decipher.update(ciphertext), decipher.final()])
|
||||
if (dec[0] === 0xff && dec[1] === 0xd8 && dec[2] === 0xff) return true
|
||||
if (dec[0] === 0x89 && dec[1] === 0x50 && dec[2] === 0x4e && dec[3] === 0x47) return true
|
||||
if (dec[0] === 0x52 && dec[1] === 0x49 && dec[2] === 0x46 && dec[3] === 0x46) return true
|
||||
if (dec[0] === 0x77 && dec[1] === 0x78 && dec[2] === 0x67 && dec[3] === 0x66) return true
|
||||
if (dec[0] === 0x47 && dec[1] === 0x49 && dec[2] === 0x46) return true
|
||||
return false
|
||||
} catch {
|
||||
return false
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -922,64 +922,8 @@ export class KeyService {
|
||||
onProgress?: (message: string) => void,
|
||||
wxidParam?: string
|
||||
): Promise<ImageKeyResult> {
|
||||
if (!this.ensureWin32()) return { success: false, error: '仅支持 Windows' }
|
||||
if (!this.ensureLoaded()) return { success: false, error: this.getLoadError() }
|
||||
|
||||
onProgress?.('正在从缓存目录扫描图片密钥...')
|
||||
|
||||
const resultBuffer = Buffer.alloc(8192)
|
||||
const ok = this.getImageKeyDll(resultBuffer, resultBuffer.length)
|
||||
|
||||
if (!ok) {
|
||||
const errMsg = this.getLastErrorMsg ? this.decodeCString(this.getLastErrorMsg()) : '获取图片密钥失败'
|
||||
return { success: false, error: errMsg }
|
||||
}
|
||||
|
||||
const jsonStr = this.decodeUtf8(resultBuffer)
|
||||
let parsed: any
|
||||
try {
|
||||
parsed = JSON.parse(jsonStr)
|
||||
} catch {
|
||||
return { success: false, error: '解析密钥数据失败' }
|
||||
}
|
||||
|
||||
// 从任意账号提取 code 列表（code 来自 kvcomm，与 wxid 无关，所有账号都一样）
|
||||
const accounts: any[] = parsed.accounts ?? []
|
||||
if (!accounts.length || !accounts[0]?.keys?.length) {
|
||||
return { success: false, error: '未找到有效的密钥码（kvcomm 缓存为空）' }
|
||||
}
|
||||
|
||||
const codes: number[] = accounts[0].keys.map((k: any) => k.code)
|
||||
console.log('[ImageKey] codes:', codes, 'DLL wxids:', accounts.map((a: any) => a.wxid))
|
||||
|
||||
const wxidCandidates = await this.collectWxidCandidates(manualDir, wxidParam)
|
||||
let verifyCiphertext: Buffer | null = null
|
||||
if (manualDir && existsSync(manualDir)) {
|
||||
const template = await this._findTemplateData(manualDir, 32)
|
||||
verifyCiphertext = template.ciphertext
|
||||
}
|
||||
|
||||
if (verifyCiphertext) {
|
||||
onProgress?.(`正在校验候选 wxid（${wxidCandidates.length} 个）...`)
|
||||
for (const candidateWxid of wxidCandidates) {
|
||||
for (const code of codes) {
|
||||
const { xorKey, aesKey } = this.deriveImageKeys(code, candidateWxid)
|
||||
if (!this.verifyDerivedAesKey(aesKey, verifyCiphertext)) continue
|
||||
onProgress?.(`密钥获取成功 (wxid: ${candidateWxid}, code: ${code})`)
|
||||
console.log('[ImageKey] 校验命中: wxid=', candidateWxid, 'code=', code)
|
||||
return { success: true, xorKey, aesKey, verified: true }
|
||||
}
|
||||
}
|
||||
return { success: false, error: '缓存 code 与当前账号 wxid 未匹配，请确认账号目录后重试，或使用内存扫描' }
|
||||
}
|
||||
|
||||
// 无模板密文可验真时回退旧策略
|
||||
const fallbackWxid = wxidCandidates[0] || accounts[0].wxid || 'unknown'
|
||||
const fallbackCode = codes[0]
|
||||
const { xorKey, aesKey } = this.deriveImageKeys(fallbackCode, fallbackWxid)
|
||||
onProgress?.(`密钥获取成功 (wxid: ${fallbackWxid}, code: ${fallbackCode})`)
|
||||
console.log('[ImageKey] 回退计算: wxid=', fallbackWxid, 'code=', fallbackCode)
|
||||
return { success: true, xorKey, aesKey, verified: false }
|
||||
void wxidParam
|
||||
return this.autoGetImageKeyByMemoryScan(manualDir || '', onProgress)
|
||||
}
|
||||
|
||||
// --- 内存扫描备选方案（融合 Dart+Python 优点）---
|
||||
|
||||
@@ -8,6 +8,9 @@ export interface AppSettings {
|
||||
apiEnabled: boolean
|
||||
apiHost: string
|
||||
apiPort: number
|
||||
imageKeyRoot: string
|
||||
imageXorKey: string
|
||||
imageAesKey: string
|
||||
}
|
||||
|
||||
function getDefaultDbRoot(): string {
|
||||
@@ -102,11 +105,16 @@ function isUsableDbRoot(candidate?: string): boolean {
|
||||
}
|
||||
}
|
||||
|
||||
const defaultDbRoot = getDefaultDbRoot()
|
||||
|
||||
const DEFAULT_SETTINGS: AppSettings = {
|
||||
dbRoot: getDefaultDbRoot(),
|
||||
dbRoot: defaultDbRoot,
|
||||
apiEnabled: true,
|
||||
apiHost: '127.0.0.1',
|
||||
apiPort: 6131
|
||||
apiPort: 6131,
|
||||
imageKeyRoot: defaultDbRoot,
|
||||
imageXorKey: process.env.VITE_IMAGE_XOR_KEY || '',
|
||||
imageAesKey: process.env.VITE_IMAGE_AES_KEY || ''
|
||||
}
|
||||
|
||||
const SETTINGS_FILE = path.join(
|
||||
@@ -129,6 +137,9 @@ export function loadSettings(): AppSettings {
|
||||
if (process.platform === 'win32' && !isUsableDbRoot(cache.dbRoot)) {
|
||||
cache.dbRoot = getDefaultDbRoot()
|
||||
}
|
||||
if (!cache.imageKeyRoot) {
|
||||
cache.imageKeyRoot = cache.dbRoot
|
||||
}
|
||||
return cache
|
||||
}
|
||||
} catch (error) {
|
||||
|
||||
Reference in New Issue
Block a user