$ show aixed/WeChat-Hook
This repository implements a Windows DLL (version.dll) that uses DLL proxy injection to hook into the WeChat desktop client (x64, version 4.1.x). Once injected, it launches a local HTTP server on port 30001 that exposes a REST API for automating WeChat operations: sending text/image/XML messages, forwarding messages, decoding encrypted image caches, querying the user's profile, and executing arbitrary SQL on WeChat's internal SQLite databases (e.g., MicroMsg.db). The architecture is a monolithic DLL with several layers: a proxy DLL loader (version_proxy.cpp), a custom x64 hooking framework (Hook_Method.cpp) using MinHook and assembly trampolines, a set of WeChat interface implementations (wx_send.cpp, wx_send_xml.cpp, etc.) that construct internal WeChat objects using known memory offsets, and an HTTP server (http_server.cpp) built on the vendored cpp-httplib library. The project also includes a database access module (xdb/db_mgr.cpp) that scans WeChat's memory for SQLite3 API routines and executes queries directly, bypassing the need for external database drivers. External dependencies include MinHook (bundled), cpp-httplib (vendored), LZ4 compression library, and nlohmann/json. The code is heavily tied to specific WeChat version offsets and memory layouts, making it fragile across WeChat updates, but the project's update log shows active adaptation to new versions.
The LLM identified 4 files worth highlighting for reuse:
Implements a custom x64 hooking framework that supports both call hooks (redirecting function calls) and inline hooks (patching function prologues). It assembles trampolines with proper register saving/restoring, allocates executable memory near the target, and provides a clean interface for installing and removing hooks. The pattern is self-contained (depends only on MinHook and basic Windows APIs) and could be extracted for use in other reverse engineering or instrumentation projects.
Implements a DatabaseMgr singleton that scans the host process memory for SQLite3 API routines (using SundaySearch pattern matching) and uses them to execute arbitrary SQL on encrypted databases. It retrieves database keys from memory and provides a query interface that returns JSON results. This pattern of leveraging an application's internal SQLite3 routines is reusable for any project that needs to access encrypted or proprietary databases without external drivers.
Provides a comprehensive set of utility functions including string/Unicode conversions, base64 encoding/decoding, URL encoding, UUID generation (using CPU ID and MAC address), MD5 hashing, file I/O, hex conversion, and time formatting. These functions are self-contained and could be extracted as a standalone utility library for Windows C++ projects.
A drop-in replacement for nlohmann/json that preserves key insertion order (FIFO) by using a custom ordered map. This is useful when JSON key order matters for API compatibility or human readability. The implementation is minimal and can be easily integrated into any project using nlohmann/json.