TitanEngine is a Windows-native C/C++ library for reverse engineering, debugging, and unpacking PE executables. It provides a large exported C API covering process debugging (create/attach/detach, breakpoints, stepping), memory and register manipulation, PE file parsing and modification (sections, imports, exports, relocations, TLS), hooking (code redirection, IAT patching), import reconstruction (IAT scanning, dump fixing via integrated Scylla wrapper), anti-debugging evasion, and static file analysis (hashes, decompression). The codebase is primarily a monolithic DLL with hundreds of functions, tightly coupled to the Windows NT API and undocumented structures. It is the core engine behind the x64dbg debugger's unpacking and import-repair capabilities. While the library is functionally complete and has been battle-tested, it exhibits significant technical debt: heavy use of global mutable state, non-reentrant functions, manual memory management, hardcoded OS-specific offsets, and monolithic functions (e.g., DebugLoop). Some subsystems—such as the breakpoint handler, memory I/O with breakpoint bypass, file mapping utilities, and the self-contained ntdll.h header—demonstrate high craftsmanship and are reusable in other projects. The integration of scylla_wrapper and distorm adds well-engineered components for import scanning and disassembly, but overall the codebase requires careful use due to thread-safety and maintenance concerns.
This repository provides a command-line tool for decrypting and unpacking WeChat mini-program package files (.wxapkg). The tool takes a .wxapkg file as input, extracts the wxid from the file path, decrypts the file if necessary using a hardcoded IV and salt with PBKDF2-derived AES-CBC keys, and then unpacks the decrypted file into a directory containing the original mini-program source files. The architecture is a simple monolithic Go application with two internal packages: `decrypter` for handling the decryption process and `unpacker` for parsing the wxapkg binary format and extracting files. The main function in `main.go` orchestrates the flow: argument parsing, decryption (if needed), and unpacking. The decrypter package demonstrates competent use of Go's crypto libraries for AES-CBC decryption and PBKDF2 key derivation, though it is tightly coupled to the WeChat-specific file format (fixed IV, salt, and XOR step). The unpacker package provides a clean, self-contained implementation for reading the wxapkg index structure and extracting embedded files, relying only on the Go standard library. However, the repository is marked as archived by the maintainer due to the inability to keep up with WeChat's frequent updates, indicating that the tool may not work with newer versions of the wxapkg format.