Merge branch 'v4' into no-phone

Author: 0xlane

Cargo.toml

@@ -1,7 +1,8 @@
 [package]
 name = "wechat-dump-rs"
-version = "1.0.25-no-phone"
+version = "1.0.29-no-phone"
 edition = "2021"
+repository = "https://github.com/0xlane/wechat-dump-rs"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -12,31 +13,5 @@ lto = true
 codegen-units = 1
 
 [dependencies]
-aes = "0.8.3"
-anyhow = "1.0.75"
-cbc = "0.1.2"
 clap = "4.4.3"
-hex = "0.4.3"
-hmac = "0.12.1"
-pbkdf2 = { version = "0.12.2", features = ["sha1", "sha2"] }
-sha1 = "0.10.5"
-windows = { version = "0.58.0", features = [
-    "implement", 
-    "Win32_Security", 
-    "Win32_System_WindowsProgramming", 
-    "Win32_System_Com", 
-    "Win32_System_Memory", 
-    "Win32_System_Threading", 
-    "Win32_Foundation", 
-    "Win32_System_ProcessStatus", 
-    "Win32_System_Diagnostics_Debug",
-    "Win32_System_Diagnostics_ToolHelp",
-    "Wdk_System_Threading",
-    "Win32_System_Kernel",
-    "Win32_Storage_FileSystem"
-] }
-yara = { version = "0.29.0", features = ["yara-static", "vendored"] }
-rayon = "1.10"
-sha2 = "0.10.8"
-regex = "1.11.1"
-indicatif = { version = "0.17.9", features = ["rayon"] }
+wxdump= { path = "./wxdump/" }

README.md

@@ -69,6 +69,8 @@ wechat-dump-rs.exe -k xxxxxxxxxxxxxxxxx -f c:\users\xxxx\xxxx\contact.db -r --vv
 1. ~~微信登录设备类型基本只有 iphone、android，在内存中先搜到设备类型所在内存，key 就在它的前面，向前搜就行~~
 2. ~~key 的内存地址和登录设备类型据我观察是 16 字节对齐的，所以每次向前 16 字节~~
 
+> **微信 4.0 的 key 借助了用户绑定的国内手机号定位，未绑定手机号的参考 [#41](https://github.com/0xlane/wechat-dump-rs/issues/41)，绑定国外手机号的参考 [#29](https://github.com/0xlane/wechat-dump-rs/issues/29)。**
+
 还有其它一些小细节，直接看一下代码吧。
 
 ## 已测试版本列表
@@ -90,11 +92,16 @@ wechat-dump-rs.exe -k xxxxxxxxxxxxxxxxx -f c:\users\xxxx\xxxx\contact.db -r --vv
 - 4.0.0.35
 - 4.0.1.11
 - 4.0.1.13
+- 4.0.1.17
+- 4.0.1.21
+- 4.0.2.17
 
 ## 库表结构
 
 - [4.0.0.26](docs/wechat_4_0_0_26_table_struct.md)
 
+> 4.0 聊天记录内容解析参考示例 [导出聊天记录到TXT](./sample_scripts/导出聊天记录到TXT/)。
+
 ## 微信分析记录
 
 - [微信3.9手动寻找偏移](docs/wechat_3_9_analysis.md)

docs/wechat_4_0_0_26_table_struct.md

@@ -4,15 +4,21 @@
 
 ## login
 
+用户登录相关
+
 ### key_info.db
 
+用户认证信息相关
+
 ```sql
 CREATE TABLE LoginKeyInfoTable(user_name_md5 TEXT, key_md5 TEXT, key_info_md5 TEXT, key_info_data BLOB)
 CREATE UNIQUE INDEX LoginKeyInfoTable_USER_KEYINFO ON LoginKeyInfoTable(user_name_md5, key_info_md5)
 ```
 
 ## biz
 
+公众号相关
+
 ### biz.db
 
 ```sql
@@ -21,8 +27,12 @@ CREATE TABLE biz_pay_status(url_id TEXT, is_charge_appmsg INTEGER, is_paid INTEG
 
 ## contact
 
+联系人相关
+
 ### contact.db
 
+联系人数据库，包括在微信里你能看到的各种群、群成员、通讯录、公众号的信息。
+
 ```sql
 CREATE TABLE biz_info(id INTEGER PRIMARY KEY, username TEXT, type INTEGER, accept_type INTEGER, child_type INTEGER, version INTEGER, external_info TEXT, brand_info TEXT, brand_icon_url TEXT, brand_list TEXT, brand_flag INTEGER, belong TEXT, ext_buffer BLOB)
 CREATE TABLE biz_profile(username TEXT, service_type INTEGER, article_count INTEGER, friend_sub_count INTEGER, is_subscribe INTEGER, offset TEXT, time_stamp INTEGER, is_end INTEGER, resp_buffer BLOB)
@@ -94,6 +104,8 @@ CREATE INDEX wacontact_APPID ON wacontact(app_id)
 
 ## emoticon
 
+表情包相关
+
 ### emoticon.db
 
 ```sql
@@ -115,6 +127,8 @@ CREATE UNIQUE INDEX kStoreEmoticonPackageTable_PID ON kStoreEmoticonPackageTable
 
 ## favorite
 
+收藏
+
 ### favorite.db
 
 ```sql
@@ -179,6 +193,8 @@ CREATE INDEX video_hardlink_info_v3_MODIFY_TIME ON video_hardlink_info_v3(modify
 
 ## head_image
 
+用户头像相关
+
 ### head_image.db
 
 ```sql
@@ -195,8 +211,36 @@ CREATE TABLE ilink_voip(wx_chatroom_ TEXT PRIMARY KEY, millsecond_ INTEGER, grou
 
 ## message
 
+存储聊天记录相关。聊天消息内容存储在 `message_[0-9].db` 数据库的 `Msg_md5(username)` 表的 `message_content` 字段，`username` 在 `contact` 表根据 `nickname` 查询。
+
+`local_type` 和 `message_content` 对照关系：
+
+|`local_type`|消息类型|`message_content`格式|
+|---|----|-----|
+|1|文本消息|plain|
+|3|图片消息|zstd_compress(xml)|
+|34|语音消息|zstd_compress|
+|42|名片消息|zstd_compress|
+|43|视频消息|zstd_compress|
+|47|动画表情|zstd_compress(xml)|
+|48|位置消息|zstd_compress|
+|244813135921|引用消息|zstd_compress(xml)|
+|17179869233|卡片式链接（带描述）|zstd_compress(xml)|
+|21474836529|卡片式链接/图文消息|zstd_compress(xml)|
+|154618822705|小程序分享|zstd_compress(xml)|
+|12884901937|音乐卡片|zstd_compress|
+|8594229559345|红包卡片|zstd_compress|
+|81604378673|聊天记录合并转发消息|zstd_compress|
+|266287972401|拍一拍消息|zstd_compress|
+|8589934592049|转账卡片|zstd_compress|
+|270582939697|视频号直播卡片|zstd_compress|
+|25769803825|文件消息|zstd_compress|
+|10000|系统消息（撤回、加入群聊、群管理、群语音通话等）|plain or zstd_compress(xml)|
+
 ### biz_message_0.db
 
+公众号消息记录
+
 ```sql
 CREATE TABLE DeleteInfo(chat_name_id INTEGER, delete_table_name TEXT, CONSTRAINT UNIQUE_CHAT_DELETE UNIQUE(chat_name_id, delete_table_name))
 CREATE TABLE DeleteResInfo(local_id INTEGER PRIMARY KEY AUTOINCREMENT, session_name_id INTEGER, msg_create_time INTEGER, msg_local_id INTEGER, res_path TEXT)
@@ -216,6 +260,8 @@ CREATE INDEX Msg_02628fb4b062917ee2a9d4d7bde609ad_TYPE_SEQ ON Msg_02628fb4b06291
 
 ### media_0.db
 
+语音消息内容
+
 ```sql
 CREATE TABLE Name2Id(user_name TEXT PRIMARY KEY)
 CREATE TABLE TimeStamp(timestamp INTEGER)
@@ -226,6 +272,8 @@ CREATE UNIQUE INDEX VoiceInfo_UNIQUE_INDEX ON VoiceInfo(chat_name_id, create_tim
 
 ### message_0.db
 
+聊天记录
+
 ```sql
 CREATE TABLE DeleteInfo(chat_name_id INTEGER, delete_table_name TEXT, CONSTRAINT UNIQUE_CHAT_DELETE UNIQUE(chat_name_id, delete_table_name))
 CREATE TABLE DeleteResInfo(local_id INTEGER PRIMARY KEY AUTOINCREMENT, session_name_id INTEGER, msg_create_time INTEGER, msg_local_id INTEGER, res_path TEXT)
@@ -265,6 +313,8 @@ CREATE TABLE table_info(Key TEXT PRIMARY KEY, ValueInt64 INTEGER, ValueDouble RE
 
 ### message_revoke.db
 
+该数据库只存储本人撤回的消息，不存其他人撤回的消息
+
 ```sql
 CREATE TABLE revokemessage(to_user_name TEXT, svr_id INTEGER, message_type INTEGER, revoke_time INTEGER, content TEXT, at_user_list TEXT)
 CREATE INDEX revokemessage_revoke_time ON revokemessage(revoke_time)
@@ -281,6 +331,8 @@ CREATE TABLE new_tips(unique_id TEXT PRIMARY KEY, disable INTEGER, new_tips_cont
 
 ## session
 
+窗口会话
+
 ### session.db
 
 ```sql
@@ -292,6 +344,8 @@ CREATE INDEX SessionTable_TYPE ON SessionTable(type)
 
 ## sns
 
+朋友圈相关
+
 ### sns.db
 
 ```sql

sample_scripts/readme.md

@@ -0,0 +1,3 @@
+# 示例脚本
+
+脚本只做示例参考使用，如需扩展请 fork 后自行修改。