wechat-key-macoslisted

# wechat-key-macos Extract per-database SQLCipher keys from a **running WeChat for Mac 4.x** and use them to decrypt/query the local databases. This is agent-agnostic: any coding agent (or a human) can follow it. ## When to use Use this skill when, on macOS, the user wants to read/query/export **their own** local WeChat data and a key-extraction step fails on a modern WeChat build — symptoms: `提取到 0 个密钥` / "extracted 0 keys", `无法解密 session.db` / "cannot decrypt", or a memory scan that finds no `x'...'` pattern. Those tools assume WeChat ≤ 4.1.8; this skill handles 4.x (verified on **4.1.13**). Only operate on the machine's own logged-in account, at the user's request. ## Why the old method fails on 4.x (one paragraph) WeChat ≤ 4.1.8 left the SQLCipher raw key in memory as an ASCII PRAGMA string `x'<64 hex key><32 hex salt>'`, so tools scanned for it. WeChat 4.x no longer keeps that string resident, and the derived keys are not reliably recoverable as aligned raw bytes either. **Each database now has its own key** `enc_key_i = PBKDF2-HMAC-SHA512(password, salt_i, 256000, 32)` (salt = first 16 bytes of each file; the account `password` is shared across all DBs). The reliable, version-robust way to obtain the keys is to hook the system crypto functions WeChat calls at runtime — see `reference/method.md`. ## Method (what the script does) Hook macOS **CommonCrypto** with Frida on the live WeChat process: - `CCCrypt`, `CCCryptorCreate`, `CCCryptorCreateWithMode` — SQLCiphe