init

app/decrypt/decrypt.py

@@ -0,0 +1,208 @@
+# -*- coding: utf-8 -*-#
+# -------------------------------------------------------------------------------
+# Name:         getwxinfo.py
+# Description:
+# Author:       xaoyaoo
+# Date:         2023/08/21
+# License:      https://github.com/xaoyaoo/PyWxDump/blob/3b794bcb47b0457d1245ce5b4cfec61b74524073/LICENSE MIT
+# 微信数据库采用的加密算法是256位的AES-CBC。数据库的默认的页大小是4096字节即4KB，其中每一个页都是被单独加解密的。
+# 加密文件的每一个页都有一个随机的初始化向量，它被保存在每一页的末尾。
+# 加密文件的每一页都存有着消息认证码，算法使用的是HMAC-SHA1（安卓数据库使用的是SHA512）。它也被保存在每一页的末尾。
+# 每一个数据库文件的开头16字节都保存了一段唯一且随机的盐值，作为HMAC的验证和数据的解密。
+# 用来计算HMAC的key与解密的key是不同的，解密用的密钥是主密钥和之前提到的16字节的盐值通过PKCS5_PBKF2_HMAC1密钥扩展算法迭代64000次计算得到的。而计算HMAC的密钥是刚提到的解密密钥和16字节盐值异或0x3a的值通过PKCS5_PBKF2_HMAC1密钥扩展算法迭代2次计算得到的。
+# 为了保证数据部分长度是16字节即AES块大小的整倍数，每一页的末尾将填充一段空字节，使得保留字段的长度为48字节。
+# 综上，加密文件结构为第一页4KB数据前16字节为盐值，紧接着4032字节数据，再加上16字节IV和20字节HMAC以及12字节空字节；而后的页均是4048字节长度的加密数据段和48字节的保留段。
+# -------------------------------------------------------------------------------
+import argparse
+import hmac
+import hashlib
+import os
+from typing import Union, List
+from Cryptodome.Cipher import AES
+
+# from Crypto.Cipher import AES # 如果上面的导入失败，可以尝试使用这个
+
+SQLITE_FILE_HEADER = "SQLite format 3\x00"  # SQLite文件头
+
+KEY_SIZE = 32
+DEFAULT_PAGESIZE = 4096
+DEFAULT_ITER = 64000
+
+
+# 通过密钥解密数据库
+def decrypt(key: str, db_path, out_path):
+    """
+    通过密钥解密数据库
+    :param key: 密钥 64位16进制字符串
+    :param db_path:  待解密的数据库路径(必须是文件)
+    :param out_path:  解密后的数据库输出路径(必须是文件)
+    :return:
+    """
+    if not os.path.exists(db_path) or not os.path.isfile(db_path):
+        return False, f"[-] db_path:'{db_path}' File not found!"
+    if not os.path.exists(os.path.dirname(out_path)):
+        return False, f"[-] out_path:'{out_path}' File not found!"
+
+    if len(key) != 64:
+        return False, f"[-] key:'{key}' Len Error!"
+
+    password = bytes.fromhex(key.strip())
+    with open(db_path, "rb") as file:
+        blist = file.read()
+
+    salt = blist[:16]
+    byteKey = hashlib.pbkdf2_hmac("sha1", password, salt, DEFAULT_ITER, KEY_SIZE)
+    first = blist[16:DEFAULT_PAGESIZE]
+    if len(salt) != 16:
+        return False, f"[-] db_path:'{db_path}' File Error!"
+
+    mac_salt = bytes([(salt[i] ^ 58) for i in range(16)])
+    mac_key = hashlib.pbkdf2_hmac("sha1", byteKey, mac_salt, 2, KEY_SIZE)
+    hash_mac = hmac.new(mac_key, first[:-32], hashlib.sha1)
+    hash_mac.update(b'\x01\x00\x00\x00')
+
+    if hash_mac.digest() != first[-32:-12]:
+        return False, f"[-] Key Error! (key:'{key}'; db_path:'{db_path}'; out_path:'{out_path}' )"
+
+    newblist = [blist[i:i + DEFAULT_PAGESIZE] for i in range(DEFAULT_PAGESIZE, len(blist), DEFAULT_PAGESIZE)]
+
+    with open(out_path, "wb") as deFile:
+        deFile.write(SQLITE_FILE_HEADER.encode())
+        t = AES.new(byteKey, AES.MODE_CBC, first[-48:-32])
+        decrypted = t.decrypt(first[:-48])
+        deFile.write(decrypted)
+        deFile.write(first[-48:])
+
+        for i in newblist:
+            t = AES.new(byteKey, AES.MODE_CBC, i[-48:-32])
+            decrypted = t.decrypt(i[:-48])
+            deFile.write(decrypted)
+            deFile.write(i[-48:])
+    return True, [db_path, out_path, key]
+
+
+def batch_decrypt(key: str, db_path: Union[str, List[str]], out_path: str, is_logging: bool = False):
+    if not isinstance(key, str) or not isinstance(out_path, str) or not os.path.exists(out_path) or len(key) != 64:
+        error = f"[-] (key:'{key}' or out_path:'{out_path}') Error!"
+        if is_logging: print(error)
+        return False, error
+
+    process_list = []
+
+    if isinstance(db_path, str):
+        if not os.path.exists(db_path):
+            error = f"[-] db_path:'{db_path}' not found!"
+            if is_logging: print(error)
+            return False, error
+
+        if os.path.isfile(db_path):
+            inpath = db_path
+            outpath = os.path.join(out_path, 'de_' + os.path.basename(db_path))
+            process_list.append([key, inpath, outpath])
+
+        elif os.path.isdir(db_path):
+            for root, dirs, files in os.walk(db_path):
+                for file in files:
+                    inpath = os.path.join(root, file)
+                    rel = os.path.relpath(root, db_path)
+                    outpath = os.path.join(out_path, rel, 'de_' + file)
+
+                    if not os.path.exists(os.path.dirname(outpath)):
+                        os.makedirs(os.path.dirname(outpath))
+                    process_list.append([key, inpath, outpath])
+        else:
+            error = f"[-] db_path:'{db_path}' Error "
+            if is_logging: print(error)
+            return False, error
+
+    elif isinstance(db_path, list):
+        rt_path = os.path.commonprefix(db_path)
+        if not os.path.exists(rt_path):
+            rt_path = os.path.dirname(rt_path)
+
+        for inpath in db_path:
+            if not os.path.exists(inpath):
+                erreor = f"[-] db_path:'{db_path}' not found!"
+                if is_logging: print(erreor)
+                return False, erreor
+
+            inpath = os.path.normpath(inpath)
+            rel = os.path.relpath(os.path.dirname(inpath), rt_path)
+            outpath = os.path.join(out_path, rel, 'de_' + os.path.basename(inpath))
+            if not os.path.exists(os.path.dirname(outpath)):
+                os.makedirs(os.path.dirname(outpath))
+            process_list.append([key, inpath, outpath])
+    else:
+        error = f"[-] db_path:'{db_path}' Error "
+        if is_logging: print(error)
+        return False, error
+
+    result = []
+    for i in process_list:
+        result.append(decrypt(*i))  # 解密
+
+    # 删除空文件夹
+    for root, dirs, files in os.walk(out_path, topdown=False):
+        for dir in dirs:
+            if not os.listdir(os.path.join(root, dir)):
+                os.rmdir(os.path.join(root, dir))
+
+    if is_logging:
+        print("=" * 32)
+        success_count = 0
+        fail_count = 0
+        for code, ret in result:
+            if code == False:
+                print(ret)
+                fail_count += 1
+            else:
+                print(f'[+] "{ret[0]}" -> "{ret[1]}"')
+                success_count += 1
+        print("-" * 32)
+        print(f"[+] 共 {len(result)} 个文件, 成功 {success_count} 个, 失败 {fail_count} 个")
+        print("=" * 32)
+    return True, result
+
+
+def encrypt(key: str, db_path, out_path):
+    """
+    通过密钥加密数据库
+    :param key: 密钥 64位16进制字符串
+    :param db_path:  待加密的数据库路径(必须是文件)
+    :param out_path:  加密后的数据库输出路径(必须是文件)
+    :return:
+    """
+    if not os.path.exists(db_path) or not os.path.isfile(db_path):
+        return False, f"[-] db_path:'{db_path}' File not found!"
+    if not os.path.exists(os.path.dirname(out_path)):
+        return False, f"[-] out_path:'{out_path}' File not found!"
+
+    if len(key) != 64:
+        return False, f"[-] key:'{key}' Len Error!"
+
+    password = bytes.fromhex(key.strip())
+    with open(db_path, "rb") as file:
+        blist = file.read()
+
+    salt = os.urandom(16)  # 生成随机盐值
+    byteKey = hashlib.pbkdf2_hmac("sha1", password, salt, DEFAULT_ITER, KEY_SIZE)
+
+    # 计算消息认证码
+    mac_salt = bytes([(salt[i] ^ 58) for i in range(16)])
+    mac_key = hashlib.pbkdf2_hmac("sha1", byteKey, mac_salt, 2, KEY_SIZE)
+    hash_mac = hmac.new(mac_key, blist[:-32], hashlib.sha1)
+    hash_mac.update(b'\x01\x00\x00\x00')
+    mac_digest = hash_mac.digest()
+
+    newblist = [blist[i:i + DEFAULT_PAGESIZE] for i in range(DEFAULT_PAGESIZE, len(blist), DEFAULT_PAGESIZE)]
+
+    with open(out_path, "wb") as enFile:
+        enFile.write(salt)  # 写入盐值
+        enFile.write(mac_digest)  # 写入消息认证码
+
+        for i in newblist:
+            t = AES.new(byteKey, AES.MODE_CBC, os.urandom(16))  # 生成随机的初始向量
+            encrypted = t.encrypt(i)  # 加密数据块
+            enFile.write(encrypted)
+
+    return True, [db_path, out_path, key]

app/decrypt/get_bias_addr.py

@@ -0,0 +1,259 @@
+# -*- coding: utf-8 -*-#
+# -------------------------------------------------------------------------------
+# Name:         get_base_addr.py
+# Description:
+# Author:       xaoyaoo
+# Date:         2023/08/22
+# License:      https://github.com/xaoyaoo/PyWxDump/blob/3b794bcb47b0457d1245ce5b4cfec61b74524073/LICENSE MIT
+# -------------------------------------------------------------------------------
+import argparse
+import ctypes
+import hashlib
+import json
+import multiprocessing
+import os
+import re
+import sys
+
+import psutil
+from win32com.client import Dispatch
+from pymem import Pymem
+import pymem
+import hmac
+
+ReadProcessMemory = ctypes.windll.kernel32.ReadProcessMemory
+void_p = ctypes.c_void_p
+KEY_SIZE = 32
+DEFAULT_PAGESIZE = 4096
+DEFAULT_ITER = 64000
+
+
+def validate_key(key, salt, first, mac_salt):
+    byteKey = hashlib.pbkdf2_hmac("sha1", key, salt, DEFAULT_ITER, KEY_SIZE)
+    mac_key = hashlib.pbkdf2_hmac("sha1", byteKey, mac_salt, 2, KEY_SIZE)
+    hash_mac = hmac.new(mac_key, first[:-32], hashlib.sha1)
+    hash_mac.update(b'\x01\x00\x00\x00')
+
+    if hash_mac.digest() == first[-32:-12]:
+        return True
+    else:
+        return False
+
+
+def get_exe_bit(file_path):
+    """
+    获取 PE 文件的位数: 32 位或 64 位
+    :param file_path:  PE 文件路径(可执行文件)
+    :return: 如果遇到错误则返回 64
+    """
+    try:
+        with open(file_path, 'rb') as f:
+            dos_header = f.read(2)
+            if dos_header != b'MZ':
+                print('get exe bit error: Invalid PE file')
+                return 64
+            # Seek to the offset of the PE signature
+            f.seek(60)
+            pe_offset_bytes = f.read(4)
+            pe_offset = int.from_bytes(pe_offset_bytes, byteorder='little')
+
+            # Seek to the Machine field in the PE header
+            f.seek(pe_offset + 4)
+            machine_bytes = f.read(2)
+            machine = int.from_bytes(machine_bytes, byteorder='little')
+
+            if machine == 0x14c:
+                return 32
+            elif machine == 0x8664:
+                return 64
+            else:
+                print('get exe bit error: Unknown architecture: %s' % hex(machine))
+                return 64
+    except IOError:
+        print('get exe bit error: File not found or cannot be opened')
+        return 64
+
+
+def get_exe_version(file_path):
+    """
+    获取 PE 文件的版本号
+    :param file_path:  PE 文件路径(可执行文件)
+    :return: 如果遇到错误则返回
+    """
+    file_version = Dispatch("Scripting.FileSystemObject").GetFileVersion(file_path)
+    return file_version
+
+
+def find_all(c: bytes, string: bytes, base_addr=0):
+    """
+    查找字符串中所有子串的位置
+    :param c: 子串 b'123'
+    :param string: 字符串 b'123456789123'
+    :return:
+    """
+    return [base_addr + m.start() for m in re.finditer(re.escape(c), string)]
+
+
+class BiasAddr:
+    def __init__(self, account, mobile, name, key, db_path):
+        self.account = account.encode("utf-8")
+        self.mobile = mobile.encode("utf-8")
+        self.name = name.encode("utf-8")
+        self.key = bytes.fromhex(key) if key else b""
+        self.db_path = db_path if db_path and os.path.exists(db_path) else ""
+
+        self.process_name = "WeChat.exe"
+        self.module_name = "WeChatWin.dll"
+
+        self.pm = None  # Pymem 对象
+        self.is_WoW64 = None  # True: 32位进程运行在64位系统上 False: 64位进程运行在64位系统上
+        self.process_handle = None  # 进程句柄
+        self.pid = None  # 进程ID
+        self.version = None  # 微信版本号
+        self.process = None  # 进程对象
+        self.exe_path = None  # 微信路径
+        self.address_len = None  # 4 if self.bits == 32 else 8  # 4字节或8字节
+        self.bits = 64 if sys.maxsize > 2 ** 32 else 32  # 系统：32位或64位
+
+    def get_process_handle(self):
+        try:
+            self.pm = Pymem(self.process_name)
+            self.pm.check_wow64()
+            self.is_WoW64 = self.pm.is_WoW64
+            self.process_handle = self.pm.process_handle
+            self.pid = self.pm.process_id
+            self.process = psutil.Process(self.pid)
+            self.exe_path = self.process.exe()
+            self.version = get_exe_version(self.exe_path)
+
+            version_nums = list(map(int, self.version.split(".")))  # 将版本号拆分为数字列表
+            if version_nums[0] <= 3 and version_nums[1] <= 9 and version_nums[2] <= 2:
+                self.address_len = 4
+            else:
+                self.address_len = 8
+            return True, ""
+        except pymem.exception.ProcessNotFound:
+            return False, "[-] WeChat No Run"
+
+    def search_memory_value(self, value: bytes, module_name="WeChatWin.dll"):
+        # 创建 Pymem 对象
+        module = pymem.process.module_from_name(self.pm.process_handle, module_name)
+        ret = self.pm.pattern_scan_module(value, module, return_multiple=True)
+        ret = ret[-1] - module.lpBaseOfDll if len(ret) > 0 else 0
+        return ret
+
+    def get_key_bias1(self):
+        try:
+            byteLen = self.address_len  # 4 if self.bits == 32 else 8  # 4字节或8字节
+
+            keyLenOffset = 0x8c if self.bits == 32 else 0xd0
+            keyWindllOffset = 0x90 if self.bits == 32 else 0xd8
+
+            module = pymem.process.module_from_name(self.process_handle, self.module_name)
+            keyBytes = b'-----BEGIN PUBLIC KEY-----\n...'
+            publicKeyList = pymem.pattern.pattern_scan_all(self.process_handle, keyBytes, return_multiple=True)
+
+            keyaddrs = []
+            for addr in publicKeyList:
+                keyBytes = addr.to_bytes(byteLen, byteorder="little", signed=True)  # 低位在前
+                may_addrs = pymem.pattern.pattern_scan_module(self.process_handle, module, keyBytes,
+                                                              return_multiple=True)
+                if may_addrs != 0 and len(may_addrs) > 0:
+                    for addr in may_addrs:
+                        keyLen = self.pm.read_uchar(addr - keyLenOffset)
+                        if keyLen != 32:
+                            continue
+                        keyaddrs.append(addr - keyWindllOffset)
+
+            return keyaddrs[-1] - module.lpBaseOfDll if len(keyaddrs) > 0 else 0
+        except:
+            return 0
+
+    def search_key(self, key: bytes):
+        key = re.escape(key)  # 转义特殊字符
+        key_addr = self.pm.pattern_scan_all(key, return_multiple=False)
+        key = key_addr.to_bytes(self.address_len, byteorder='little', signed=True)
+        result = self.search_memory_value(key, self.module_name)
+        return result
+
+    def get_key_bias2(self, wx_db_path):
+
+        addr_len = get_exe_bit(self.exe_path) // 8
+        db_path = wx_db_path
+
+        def read_key_bytes(h_process, address, address_len=8):
+            array = ctypes.create_string_buffer(address_len)
+            if ReadProcessMemory(h_process, void_p(address), array, address_len, 0) == 0: return "None"
+            address = int.from_bytes(array, byteorder='little')  # 逆序转换为int地址（key地址）
+            key = ctypes.create_string_buffer(32)
+            if ReadProcessMemory(h_process, void_p(address), key, 32, 0) == 0: return "None"
+            key_bytes = bytes(key)
+            return key_bytes
+
+        def verify_key(key, wx_db_path):
+            KEY_SIZE = 32
+            DEFAULT_PAGESIZE = 4096
+            DEFAULT_ITER = 64000
+            with open(wx_db_path, "rb") as file:
+                blist = file.read(5000)
+            salt = blist[:16]
+            byteKey = hashlib.pbkdf2_hmac("sha1", key, salt, DEFAULT_ITER, KEY_SIZE)
+            first = blist[16:DEFAULT_PAGESIZE]
+
+            mac_salt = bytes([(salt[i] ^ 58) for i in range(16)])
+            mac_key = hashlib.pbkdf2_hmac("sha1", byteKey, mac_salt, 2, KEY_SIZE)
+            hash_mac = hmac.new(mac_key, first[:-32], hashlib.sha1)
+            hash_mac.update(b'\x01\x00\x00\x00')
+
+            if hash_mac.digest() != first[-32:-12]:
+                return False
+            return True
+
+        phone_type1 = "iphone\x00"
+        phone_type2 = "android\x00"
+        phone_type3 = "ipad\x00"
+
+        pm = pymem.Pymem("WeChat.exe")
+        module_name = "WeChatWin.dll"
+
+        MicroMsg_path = os.path.join(db_path, "MSG", "MicroMsg.db")
+
+        module = pymem.process.module_from_name(pm.process_handle, module_name)
+
+        type1_addrs = pm.pattern_scan_module(phone_type1.encode(), module, return_multiple=True)
+        type2_addrs = pm.pattern_scan_module(phone_type2.encode(), module, return_multiple=True)
+        type3_addrs = pm.pattern_scan_module(phone_type3.encode(), module, return_multiple=True)
+        type_addrs = type1_addrs if len(type1_addrs) >= 2 else type2_addrs if len(
+            type2_addrs) >= 2 else type3_addrs if len(type3_addrs) >= 2 else "None"
+        if type_addrs == "None":
+            return 0
+        for i in type_addrs[::-1]:
+            for j in range(i, i - 2000, -addr_len):
+                key_bytes = read_key_bytes(pm.process_handle, j, addr_len)
+                if key_bytes == "None":
+                    continue
+                if verify_key(key_bytes, MicroMsg_path):
+                    return j - module.lpBaseOfDll
+        return 0
+
+    def run(self, logging_path=False, version_list_path=None):
+        if not self.get_process_handle()[0]:
+            return {}
+        mobile_bias = self.search_memory_value(self.mobile, self.module_name)
+        name_bias = self.search_memory_value(self.name, self.module_name)
+        account_bias = self.search_memory_value(self.account, self.module_name)
+        key_bias = 0
+        key_bias = self.get_key_bias1()
+        key_bias = self.search_key(self.key) if key_bias <= 0 and self.key else key_bias
+        key_bias = self.get_key_bias2(self.db_path) if key_bias <= 0 and self.db_path else key_bias
+
+        rdata = {self.version: [name_bias, account_bias, mobile_bias, 0, key_bias]}
+        return rdata
+
+
+def get_info_without_key(h_process, address, n_size=64):
+    array = ctypes.create_string_buffer(n_size)
+    if ReadProcessMemory(h_process, void_p(address), array, n_size, 0) == 0: return "None"
+    array = bytes(array).split(b"\x00")[0] if b"\x00" in array else bytes(array)
+    text = array.decode('utf-8', errors='ignore')
+    return text.strip() if text.strip() != "" else "None"

app/decrypt/get_wx_info.py

@@ -0,0 +1,468 @@
+# -*- coding: utf-8 -*-#
+# -------------------------------------------------------------------------------
+# Name:         getwxinfo.py
+# Description:
+# Author:       xaoyaoo
+# Date:         2023/08/21
+# -------------------------------------------------------------------------------
+import hmac
+import hashlib
+import ctypes
+import winreg
+import pymem
+from win32com.client import Dispatch
+import psutil
+
+ReadProcessMemory = ctypes.windll.kernel32.ReadProcessMemory
+void_p = ctypes.c_void_p
+
+import binascii
+import pymem.process
+from pymem import Pymem
+from win32api import GetFileVersionInfo, HIWORD, LOWORD
+
+"""
+class Wechat来源：https://github.com/SnowMeteors/GetWeChatKey
+"""
+
+
+class Wechat:
+    def __init__(self, pm):
+        module = pymem.process.module_from_name(pm.process_handle, "WeChatWin.dll")
+        self.pm = pm
+        self.dllBase = module.lpBaseOfDll
+        self.sizeOfImage = module.SizeOfImage
+        self.bits = self.GetPEBits()
+
+    # 通过解析PE来获取位数
+    def GetPEBits(self):
+        address = self.dllBase + self.pm.read_int(self.dllBase + 60) + 4 + 16
+        SizeOfOptionalHeader = self.pm.read_short(address)
+
+        # 0XF0 64bit
+        if SizeOfOptionalHeader == 0xF0:
+            return 64
+
+        return 32
+
+    def GetInfo(self):
+        version = self.GetVersion()
+        if not version:
+            print("Get WeChatWin.dll Failed")
+            return
+
+        print(f"WeChat Version：{version}")
+        print(f"WeChat Bits: {self.bits}")
+
+        keyBytes = b'-----BEGIN PUBLIC KEY-----\n...'
+
+        # 从内存中查找 BEGIN PUBLIC KEY 的地址
+        publicKeyList = pymem.pattern.pattern_scan_all(self.pm.process_handle, keyBytes, return_multiple=True)
+        if len(publicKeyList) == 0:
+            print("Failed to find PUBLIC KEY")
+            return
+
+        keyAddr = self.GetKeyAddr(publicKeyList)
+        if keyAddr is None:
+            print("Failed to find key")
+            return
+
+        keyLenOffset = 0x8c if self.bits == 32 else 0xd0
+
+        for addr in keyAddr:
+            try:
+                keyLen = self.pm.read_uchar(addr - keyLenOffset)
+                if self.bits == 32:
+                    key = self.pm.read_bytes(self.pm.read_int(addr - 0x90), keyLen)
+                else:
+                    key = self.pm.read_bytes(self.pm.read_longlong(addr - 0xd8), keyLen)
+
+                key = binascii.b2a_hex(key).decode()
+                if self.CheckKey(key):
+                    print(f"key is {key}")
+                    return key
+            except:
+                pass
+
+        print("Find the end of the key")
+
+    @staticmethod
+    def CheckKey(key):
+        # 目前key位数是32位
+        if key is None or len(key) != 64:
+            return False
+
+        return True
+
+    # 内存搜索特征码
+    @staticmethod
+    def SearchMemory(parent, child):
+        offset = []
+        index = -1
+
+        while True:
+            index = parent.find(child, index + 1)
+            if index == -1:
+                break
+            offset.append(index)
+
+        return offset
+
+    # 获取key的地址
+    def GetKeyAddr(self, publicKeyList):
+        # 存放真正的key地址
+        keyAddr = []
+
+        # 读取整个 WeChatWin.dll 的内容
+        buffer = self.pm.read_bytes(self.dllBase, self.sizeOfImage)
+
+        byteLen = 4 if self.bits == 32 else 8
+        for publicKeyAddr in publicKeyList:
+            keyBytes = publicKeyAddr.to_bytes(byteLen, byteorder="little", signed=True)
+            offset = self.SearchMemory(buffer, keyBytes)
+
+            if not offset or len(offset) == 0:
+                continue
+
+            offset[:] = [x + self.dllBase for x in offset]
+            keyAddr += offset
+
+        if len(keyAddr) == 0:
+            return None
+
+        return keyAddr
+
+    # 获取微信版本
+    def GetVersion(self):
+        WeChatWindll_path = ""
+        for m in list(self.pm.list_modules()):
+            path = m.filename
+            if path.endswith("WeChatWin.dll"):
+                WeChatWindll_path = path
+                break
+
+        if not WeChatWindll_path:
+            return False
+
+        version = GetFileVersionInfo(WeChatWindll_path, "\\")
+
+        msv = version['FileVersionMS']
+        lsv = version['FileVersionLS']
+        version = f"{str(HIWORD(msv))}.{str(LOWORD(msv))}.{str(HIWORD(lsv))}.{str(LOWORD(lsv))}"
+
+        return version
+
+
+# 获取exe文件的位数
+def get_exe_bit(file_path):
+    """
+    获取 PE 文件的位数: 32 位或 64 位
+    :param file_path:  PE 文件路径(可执行文件)
+    :return: 如果遇到错误则返回 64
+    """
+    try:
+        with open(file_path, 'rb') as f:
+            dos_header = f.read(2)
+            if dos_header != b'MZ':
+                print('get exe bit error: Invalid PE file')
+                return 64
+            # Seek to the offset of the PE signature
+            f.seek(60)
+            pe_offset_bytes = f.read(4)
+            pe_offset = int.from_bytes(pe_offset_bytes, byteorder='little')
+
+            # Seek to the Machine field in the PE header
+            f.seek(pe_offset + 4)
+            machine_bytes = f.read(2)
+            machine = int.from_bytes(machine_bytes, byteorder='little')
+
+            if machine == 0x14c:
+                return 32
+            elif machine == 0x8664:
+                return 64
+            else:
+                print('get exe bit error: Unknown architecture: %s' % hex(machine))
+                return 64
+    except IOError:
+        print('get exe bit error: File not found or cannot be opened')
+        return 64
+
+
+# 读取内存中的字符串(非key部分)
+def get_info_without_key(h_process, address, n_size=64):
+    array = ctypes.create_string_buffer(n_size)
+    if ReadProcessMemory(h_process, void_p(address), array, n_size, 0) == 0: return "None"
+    array = bytes(array).split(b"\x00")[0] if b"\x00" in array else bytes(array)
+    text = array.decode('utf-8', errors='ignore')
+    return text.strip() if text.strip() != "" else "None"
+
+
+def pattern_scan_all(handle, pattern, *, return_multiple=False, find_num=100):
+    next_region = 0
+    found = []
+    user_space_limit = 0x7FFFFFFF0000 if sys.maxsize > 2 ** 32 else 0x7fff0000
+    while next_region < user_space_limit:
+        try:
+            next_region, page_found = pymem.pattern.scan_pattern_page(
+                handle,
+                next_region,
+                pattern,
+                return_multiple=return_multiple
+            )
+        except Exception as e:
+            print(e)
+            break
+        if not return_multiple and page_found:
+            return page_found
+        if page_found:
+            found += page_found
+        if len(found) > find_num:
+            break
+    return found
+
+
+def get_info_wxid(h_process):
+    find_num = 100
+    addrs = pattern_scan_all(h_process, br'\\Msg\\FTSContact', return_multiple=True, find_num=find_num)
+    wxids = []
+    for addr in addrs:
+        array = ctypes.create_string_buffer(80)
+        if ReadProcessMemory(h_process, void_p(addr - 30), array, 80, 0) == 0: return "None"
+        array = bytes(array)  # .split(b"\\")[0]
+        array = array.split(b"\\Msg")[0]
+        array = array.split(b"\\")[-1]
+        wxids.append(array.decode('utf-8', errors='ignore'))
+    wxid = max(wxids, key=wxids.count) if wxids else "None"
+    return wxid
+
+
+def get_info_filePath(wxid="all"):
+    if not wxid:
+        return "None"
+    w_dir = "MyDocument:"
+    is_w_dir = False
+
+    try:
+        key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, r"Software\Tencent\WeChat", 0, winreg.KEY_READ)
+        value, _ = winreg.QueryValueEx(key, "FileSavePath")
+        winreg.CloseKey(key)
+        w_dir = value
+        is_w_dir = True
+    except Exception as e:
+        w_dir = "MyDocument:"
+
+    if not is_w_dir:
+        try:
+            user_profile = os.environ.get("USERPROFILE")
+            path_3ebffe94 = os.path.join(user_profile, "AppData", "Roaming", "Tencent", "WeChat", "All Users", "config",
+                                         "3ebffe94.ini")
+            with open(path_3ebffe94, "r", encoding="utf-8") as f:
+                w_dir = f.read()
+            is_w_dir = True
+        except Exception as e:
+            w_dir = "MyDocument:"
+
+    if w_dir == "MyDocument:":
+        try:
+            # 打开注册表路径
+            key = winreg.OpenKey(winreg.HKEY_CURRENT_USER,
+                                 r"Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders")
+            documents_path = winreg.QueryValueEx(key, "Personal")[0]  # 读取文档实际目录路径
+            winreg.CloseKey(key)  # 关闭注册表
+            documents_paths = os.path.split(documents_path)
+            if "%" in documents_paths[0]:
+                w_dir = os.environ.get(documents_paths[0].replace("%", ""))
+                w_dir = os.path.join(w_dir, os.path.join(*documents_paths[1:]))
+                # print(1, w_dir)
+            else:
+                w_dir = documents_path
+        except Exception as e:
+            profile = os.environ.get("USERPROFILE")
+            w_dir = os.path.join(profile, "Documents")
+
+    msg_dir = os.path.join(w_dir, "WeChat Files")
+
+    if wxid == "all" and os.path.exists(msg_dir):
+        return msg_dir
+
+    filePath = os.path.join(msg_dir, wxid)
+    return filePath if os.path.exists(filePath) else "None"
+
+
+def get_key(db_path, addr_len):
+    def read_key_bytes(h_process, address, address_len=8):
+        array = ctypes.create_string_buffer(address_len)
+        if ReadProcessMemory(h_process, void_p(address), array, address_len, 0) == 0: return "None"
+        address = int.from_bytes(array, byteorder='little')  # 逆序转换为int地址（key地址）
+        key = ctypes.create_string_buffer(32)
+        if ReadProcessMemory(h_process, void_p(address), key, 32, 0) == 0: return "None"
+        key_bytes = bytes(key)
+        return key_bytes
+
+    def verify_key(key, wx_db_path):
+        if not wx_db_path or wx_db_path.lower() == "none":
+            return True
+        KEY_SIZE = 32
+        DEFAULT_PAGESIZE = 4096
+        DEFAULT_ITER = 64000
+        with open(wx_db_path, "rb") as file:
+            blist = file.read(5000)
+        salt = blist[:16]
+        byteKey = hashlib.pbkdf2_hmac("sha1", key, salt, DEFAULT_ITER, KEY_SIZE)
+        first = blist[16:DEFAULT_PAGESIZE]
+
+        mac_salt = bytes([(salt[i] ^ 58) for i in range(16)])
+        mac_key = hashlib.pbkdf2_hmac("sha1", byteKey, mac_salt, 2, KEY_SIZE)
+        hash_mac = hmac.new(mac_key, first[:-32], hashlib.sha1)
+        hash_mac.update(b'\x01\x00\x00\x00')
+
+        if hash_mac.digest() != first[-32:-12]:
+            return False
+        return True
+
+    phone_type1 = "iphone\x00"
+    phone_type2 = "android\x00"
+    phone_type3 = "ipad\x00"
+
+    pm = pymem.Pymem("WeChat.exe")
+    module_name = "WeChatWin.dll"
+
+    MicroMsg_path = os.path.join(db_path, "MSG", "MicroMsg.db")
+
+    type1_addrs = pm.pattern_scan_module(phone_type1.encode(), module_name, return_multiple=True)
+    type2_addrs = pm.pattern_scan_module(phone_type2.encode(), module_name, return_multiple=True)
+    type3_addrs = pm.pattern_scan_module(phone_type3.encode(), module_name, return_multiple=True)
+    type_addrs = type1_addrs if len(type1_addrs) >= 2 else type2_addrs if len(type2_addrs) >= 2 else type3_addrs if len(
+        type3_addrs) >= 2 else "None"
+    # print(type_addrs)
+    if type_addrs == "None":
+        return "None"
+    for i in type_addrs[::-1]:
+        for j in range(i, i - 2000, -addr_len):
+            key_bytes = read_key_bytes(pm.process_handle, j, addr_len)
+            if key_bytes == "None":
+                continue
+            if db_path != "None" and verify_key(key_bytes, MicroMsg_path):
+                return key_bytes.hex()
+    return "None"
+
+
+# 读取微信信息(account,mobile,name,mail,wxid,key)
+def read_info(version_list, is_logging=False):
+    wechat_process = []
+    result = []
+    error = ""
+    for process in psutil.process_iter(['name', 'exe', 'pid']):
+        if process.name() == 'WeChat.exe':
+            wechat_process.append(process)
+
+    if len(wechat_process) == 0:
+        error = "[-] WeChat No Run"
+        if is_logging: print(error)
+        return -1
+
+    for process in wechat_process:
+        tmp_rd = {}
+
+        tmp_rd['pid'] = process.pid
+        tmp_rd['version'] = Dispatch("Scripting.FileSystemObject").GetFileVersion(process.exe())
+
+        wechat_base_address = 0
+        for module in process.memory_maps(grouped=False):
+            if module.path and 'WeChatWin.dll' in module.path:
+                wechat_base_address = int(module.addr, 16)
+                break
+        if wechat_base_address == 0:
+            error = f"[-] WeChat WeChatWin.dll Not Found"
+            if is_logging: print(error)
+            return -1
+
+        Handle = ctypes.windll.kernel32.OpenProcess(0x1F0FFF, False, process.pid)
+
+        bias_list = version_list.get(tmp_rd['version'], None)
+        if not isinstance(bias_list, list) or len(bias_list) <= 4:
+            error = f"[-] WeChat Current Version Is Not Supported(maybe not get account,mobile,name,mail)"
+            if is_logging: print(error)
+            tmp_rd['account'] = "None"
+            tmp_rd['mobile'] = "None"
+            tmp_rd['name'] = "None"
+            tmp_rd['mail'] = "None"
+            return tmp_rd['version']
+        else:
+            name_baseaddr = wechat_base_address + bias_list[0]
+            account__baseaddr = wechat_base_address + bias_list[1]
+            mobile_baseaddr = wechat_base_address + bias_list[2]
+            mail_baseaddr = wechat_base_address + bias_list[3]
+            # key_baseaddr = wechat_base_address + bias_list[4]
+
+            tmp_rd['account'] = get_info_without_key(Handle, account__baseaddr, 32) if bias_list[1] != 0 else "None"
+            tmp_rd['mobile'] = get_info_without_key(Handle, mobile_baseaddr, 64) if bias_list[2] != 0 else "None"
+            tmp_rd['name'] = get_info_without_key(Handle, name_baseaddr, 64) if bias_list[0] != 0 else "None"
+            tmp_rd['mail'] = get_info_without_key(Handle, mail_baseaddr, 64) if bias_list[3] != 0 else "None"
+
+        addrLen = get_exe_bit(process.exe()) // 8
+
+        tmp_rd['wxid'] = get_info_wxid(Handle)
+        tmp_rd['filePath'] = get_info_filePath(tmp_rd['wxid']) if tmp_rd['wxid'] != "None" else "None"
+        tmp_rd['key'] = "None"
+        tmp_rd['key'] = get_key(tmp_rd['filePath'], addrLen)
+        if tmp_rd['key'] == 'None':
+            wechat = Pymem("WeChat.exe")
+            key = Wechat(wechat).GetInfo()
+            if key:
+                tmp_rd['key'] = key
+        result.append(tmp_rd)
+
+    if is_logging:
+        print("=" * 32)
+        if isinstance(result, str):  # 输出报错
+            print(result)
+        else:  # 输出结果
+            for i, rlt in enumerate(result):
+                for k, v in rlt.items():
+                    print(f"[+] {k:>8}: {v}")
+                print(end="-" * 32 + "\n" if i != len(result) - 1 else "")
+        print("=" * 32)
+
+    return result
+
+
+import os
+import sys
+
+
+def resource_path(relative_path):
+    """ Get absolute path to resource, works for dev and for PyInstaller """
+    base_path = getattr(sys, '_MEIPASS', os.path.dirname(os.path.abspath(__file__)))
+    return os.path.join(base_path, relative_path)
+
+
+def get_info(VERSION_LIST):
+    result = read_info(VERSION_LIST, True)  # 读取微信信息
+    return result
+
+
+if __name__ == "__main__":
+    import argparse
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--vlfile", type=str, help="手机号", required=False)
+    parser.add_argument("--vldict", type=str, help="微信昵称", required=False)
+
+    args = parser.parse_args()
+
+    # 读取微信各版本偏移
+    if args.vlfile:
+        VERSION_LIST_PATH = args.vlfile
+        with open(VERSION_LIST_PATH, "r", encoding="utf-8") as f:
+            VERSION_LIST = json.load(f)
+    if args.vldict:
+        VERSION_LIST = json.loads(args.vldict)
+
+    if not args.vlfile and not args.vldict:
+        VERSION_LIST_PATH = "../version_list.json"
+
+        with open(VERSION_LIST_PATH, "r", encoding="utf-8") as f:
+            VERSION_LIST = json.load(f)
+
+    result = read_info(VERSION_LIST, True)  # 读取微信信息