Update README.md

Added a recommendation for WxDatDecrypt project and updated DbkeyHookCMD section.

DbkeyHook.sln

@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.35931.194
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DbkeyHook", "DbkeyHook.vcxproj", "{B8305ABB-1F1B-4FD5-AF77-A1F7C9CB67FD}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{B8305ABB-1F1B-4FD5-AF77-A1F7C9CB67FD}.Debug|x64.ActiveCfg = Debug|x64
+		{B8305ABB-1F1B-4FD5-AF77-A1F7C9CB67FD}.Debug|x64.Build.0 = Debug|x64
+		{B8305ABB-1F1B-4FD5-AF77-A1F7C9CB67FD}.Debug|x86.ActiveCfg = Debug|Win32
+		{B8305ABB-1F1B-4FD5-AF77-A1F7C9CB67FD}.Debug|x86.Build.0 = Debug|Win32
+		{B8305ABB-1F1B-4FD5-AF77-A1F7C9CB67FD}.Release|x64.ActiveCfg = Release|x64
+		{B8305ABB-1F1B-4FD5-AF77-A1F7C9CB67FD}.Release|x64.Build.0 = Release|x64
+		{B8305ABB-1F1B-4FD5-AF77-A1F7C9CB67FD}.Release|x86.ActiveCfg = Release|Win32
+		{B8305ABB-1F1B-4FD5-AF77-A1F7C9CB67FD}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {8CABB8D3-3F51-4D43-A140-C354CCCC4C28}
+	EndGlobalSection
+EndGlobal

DbkeyHook.vcxproj

@@ -0,0 +1,178 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{b8305abb-1f1b-4fd5-af77-a1f7c9cb67fd}</ProjectGuid>
+    <RootNamespace>DbkeyHook</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+    <ProjectName>mmmojo_64</ProjectName>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+    <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;DBKEYHOOK_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;DBKEYHOOK_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;DBKEYHOOK_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;DBKEYHOOK_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClInclude Include="framework.h" />
+    <ClInclude Include="pch.h" />
+    <ClInclude Include="wrapper.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.cpp" />
+    <ClCompile Include="pch.cpp">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <MASM Include="wrapper.asm">
+      <FileType>Document</FileType>
+    </MASM>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+    <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
+  </ImportGroup>
+</Project>

DbkeyHook.vcxproj.filters

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="源文件">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="头文件">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="资源文件">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="framework.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="pch.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="wrapper.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="dllmain.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="pch.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <MASM Include="wrapper.asm">
+      <Filter>源文件</Filter>
+    </MASM>
+  </ItemGroup>
+</Project>

DbkeyHook.vcxproj.user

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>

README.md

@@ -1,6 +1,25 @@
 # DbkeyHook
 PC微信4.0.3.39以后版本HOOK获取dbkey
 
+推荐另外一个大家可能需要的项目：
+解密与查看微信 4.1 的图片，将微信缓存的 dat 文件解密为原始图片格式
+https://github.com/recarto404/WxDatDecrypt  
+
+
+## DbkeyHookCMD
+>2025年7月1日新增，理论上支持所有微信4.0以上版本   
+>获取方式更简单、更安全，不修改、不注入dll文件   
+>exe下载：https://github.com/gzygood/DbkeyHook/releases
+>
+![cmd](https://github.com/user-attachments/assets/b16fbdaf-55e3-4ade-adca-758d466c04a6)
+
+## DbkeyHookUI
+>2025年6月12日新增，理论上支持所有微信4.0以上版本   
+>获取方式更简单、更安全，不修改、不注入dll文件   
+>exe下载：https://github.com/gzygood/DbkeyHook/releases
+>
+![image](https://github.com/user-attachments/assets/9bf427f8-9a5b-4d7f-94e6-7e6f86610fee)  
+
 ## 感谢
 文章: [微信4.0防撤回+提醒 (符号恢复+字符串解密)](https://bbs.kanxue.com/thread-286611.htm)  
 C++代码来源：https://github.com/EEEEhex/RevokeHook
@@ -9,12 +28,13 @@ C++代码来源：https://github.com/EEEEhex/RevokeHook
 >微信4.0.3.39以后dbkey使用后内存就会释放，以往的搜索等方法不再能够找到dbkey.  
 >本项目使用的方法是hook初始化数据库获取.  
 >支持4.0.3.43 和 4.0.5.7.  
+>提示：获取dbkey后，记得把dll文件恢复，可能会被检测到修改了DLL！https://github.com/EEEEhex/RevokeHook/issues/7
 
 ## 使用方法
 1.下载或自编译mmmojo_64.dll文件.  
-2.将微信安装目录下的mmmojo_64.dll文件重命名为mmmojo_64_true.dll.  
+2.将微信安装目录下的mmmojo_64.dll文件重命名为mmmojo_64_true.dll  
 3.复制下载的mmmojo_64.dll文件到微信安装目录下.  
-4.打开微信登录即可，生成的dbkey在微信目录dbkey.txt文件中.  
+4.打开微信登录即可，获取到的dbkey在微信目录dbkey.txt文件中.  
 
 
 

dllmain.cpp

@@ -0,0 +1,253 @@
+// dllmain.cpp : 定义 DLL 应用程序的入口点。
+#include "pch.h"
+#include <wincrypt.h>
+
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <iomanip>
+#include <tchar.h>
+#include <cstdint>
+#include <string>
+#include <vector>
+#include <chrono>  
+#include <random>
+#include <algorithm>
+
+//x64汇编
+#include "wrapper.h"
+
+
+// 劫持mmmojo_64.dll -> mmmojo_64_true.dll
+#pragma comment(linker, "/EXPORT:AppendMMSubProcessSwitchNative=mmmojo_64_true.AppendMMSubProcessSwitchNative,@1")
+#pragma comment(linker, "/EXPORT:CreateMMMojoEnvironment=mmmojo_64_true.CreateMMMojoEnvironment,@2")
+#pragma comment(linker, "/EXPORT:CreateMMMojoWriteInfo=mmmojo_64_true.CreateMMMojoWriteInfo,@3")
+#pragma comment(linker, "/EXPORT:GetHandleVerifier=mmmojo_64_true.GetHandleVerifier,@4")
+#pragma comment(linker, "/EXPORT:GetMMMojoReadInfoAttach=mmmojo_64_true.GetMMMojoReadInfoAttach,@5")
+#pragma comment(linker, "/EXPORT:GetMMMojoReadInfoMethod=mmmojo_64_true.GetMMMojoReadInfoMethod,@6")
+#pragma comment(linker, "/EXPORT:GetMMMojoReadInfoRequest=mmmojo_64_true.GetMMMojoReadInfoRequest,@7")
+#pragma comment(linker, "/EXPORT:GetMMMojoReadInfoSync=mmmojo_64_true.GetMMMojoReadInfoSync,@8")
+#pragma comment(linker, "/EXPORT:GetMMMojoWriteInfoAttach=mmmojo_64_true.GetMMMojoWriteInfoAttach,@9")
+#pragma comment(linker, "/EXPORT:GetMMMojoWriteInfoRequest=mmmojo_64_true.GetMMMojoWriteInfoRequest,@10")
+#pragma comment(linker, "/EXPORT:InitializeMMMojo=mmmojo_64_true.InitializeMMMojo,@11")
+#pragma comment(linker, "/EXPORT:IsSandboxedProcess=mmmojo_64_true.IsSandboxedProcess,@12")
+#pragma comment(linker, "/EXPORT:RemoveMMMojoEnvironment=mmmojo_64_true.RemoveMMMojoEnvironment,@13")
+#pragma comment(linker, "/EXPORT:RemoveMMMojoReadInfo=mmmojo_64_true.RemoveMMMojoReadInfo,@14")
+#pragma comment(linker, "/EXPORT:RemoveMMMojoWriteInfo=mmmojo_64_true.RemoveMMMojoWriteInfo,@15")
+#pragma comment(linker, "/EXPORT:SendMMMojoWriteInfo=mmmojo_64_true.SendMMMojoWriteInfo,@16")
+#pragma comment(linker, "/EXPORT:SetMMMojoConfiguration=mmmojo_64_true.SetMMMojoConfiguration,@17")
+#pragma comment(linker, "/EXPORT:SetMMMojoEnvironmentCallbacks=mmmojo_64_true.SetMMMojoEnvironmentCallbacks,@18")
+#pragma comment(linker, "/EXPORT:SetMMMojoEnvironmentInitParams=mmmojo_64_true.SetMMMojoEnvironmentInitParams,@19")
+#pragma comment(linker, "/EXPORT:SetMMMojoWriteInfoMessagePipe=mmmojo_64_true.SetMMMojoWriteInfoMessagePipe,@20")
+#pragma comment(linker, "/EXPORT:SetMMMojoWriteInfoResponseSync=mmmojo_64_true.SetMMMojoWriteInfoResponseSync,@21")
+#pragma comment(linker, "/EXPORT:ShutdownMMMojo=mmmojo_64_true.ShutdownMMMojo,@22")
+#pragma comment(linker, "/EXPORT:StartMMMojoEnvironment=mmmojo_64_true.StartMMMojoEnvironment,@23")
+#pragma comment(linker, "/EXPORT:StopMMMojoEnvironment=mmmojo_64_true.StopMMMojoEnvironment,@24")
+#pragma comment(linker, "/EXPORT:SwapMMMojoWriteInfoCallback=mmmojo_64_true.SwapMMMojoWriteInfoCallback,@25")
+#pragma comment(linker, "/EXPORT:SwapMMMojoWriteInfoMessage=mmmojo_64_true.SwapMMMojoWriteInfoMessage,@26")
+
+extern "C" uint64_t HijackLogic(uint64_t key_class);    //劫持逻辑
+extern "C" uint64_t g_imgbase = 0;                      //Weixin.dll的基址
+extern "C" uint64_t g_hook_offset = 0;                  //要hook的偏移
+extern "C" uint8_t * g_transfer_zone = 0;                //中转指令内存
+
+struct OrgInfo
+{
+    uint64_t     addr;              //地址
+    size_t      org_size;           //原始机器码长度
+    uint8_t     org_opcodes[256];   //被HOOK之前原始的机器码
+};
+std::vector<OrgInfo> g_org_info;
+
+void OutputDebugPrintf(const char* strOutputString, ...)
+{
+#define OUT_DEBUG_BUF_LEN   512
+    char strBuffer[OUT_DEBUG_BUF_LEN] = { 0 };
+    va_list vlArgs;
+    va_start(vlArgs, strOutputString);
+    _vsnprintf_s(strBuffer, sizeof(strBuffer) - 1, strOutputString, vlArgs);  //_vsnprintf_s  _vsnprintf
+    va_end(vlArgs);
+    OutputDebugStringA(strBuffer);  //OutputDebugString    // OutputDebugStringW
+}
+
+
+std::string toHexString(const uint8_t* data, size_t size) {
+    std::stringstream ss;
+    ss << std::hex << std::setfill('0');
+    for (size_t i = 0; i < size; ++i) {
+        ss << std::setw(2) << static_cast<int>(data[i]);
+    }
+    return ss.str();
+}
+
+/**
+ * @brief 恢复HOOK写入的字节.
+ */
+void HookEnd(uint8_t type)
+{
+    //写入原机器码
+    if (g_org_info.size() != 0) {
+        for (auto& org_info : g_org_info)
+        {
+            if (org_info.addr == 0) {
+                OutputDebugString(TEXT("[DbkeyHook] Hook Addr is 0"));
+                continue;
+            }
+            BOOL bRet = WriteProcessMemory(GetCurrentProcess(), (LPVOID)org_info.addr, org_info.org_opcodes, org_info.org_size, NULL);
+            if (bRet == NULL)
+                OutputDebugPrintf("[DbkeyHook] Write Hook Org Bytes Failed! [%d]", GetLastError());
+        }
+    }
+    if (type == 2) {
+        if (g_transfer_zone) {
+            if (!VirtualFree(g_transfer_zone, 0, MEM_RELEASE)) {
+                OutputDebugPrintf("[DbkeyHook] Free Transfer Mem Failed! [%d]", GetLastError());
+                return;
+            }
+        }
+    }
+}
+
+
+uint64_t HijackLogic(uint64_t a4/*r9*/)
+{
+
+    uint64_t key_class = a4;
+    uint64_t DbkeyLength_addr = key_class + 0x18, DbkeyLength = 0;
+    uint64_t Dbkey_addr_offet = key_class + 0x8, DbkeyAddr = 0;
+
+
+    ReadProcessMemory(GetCurrentProcess(), (LPCVOID)DbkeyLength_addr, &DbkeyLength, 4, NULL); //
+    ReadProcessMemory(GetCurrentProcess(), (LPCVOID)Dbkey_addr_offet, &DbkeyAddr, 8, NULL); //
+
+    OutputDebugPrintf("[DbkeyHook] DbkeyLength = [%d],DbkeyAddr = 0x%llX", DbkeyLength, DbkeyAddr);
+
+    if (!DbkeyAddr || DbkeyLength != 32) {
+        return 0;
+    }
+
+    uint8_t db_key[32];
+
+    BOOL bRet = ReadProcessMemory(GetCurrentProcess(), (LPCVOID)DbkeyAddr, db_key, 32, NULL);
+    if (!bRet)
+    {
+        OutputDebugPrintf("[DbkeyHook] Read db_key Bytes Failed! [%d]", GetLastError());
+        return 0;
+    }
+
+    std::string db_key_Str = toHexString(db_key, sizeof(db_key));
+    OutputDebugPrintf("[DbkeyHook] GET DBkey String [%s]", db_key_Str.c_str());
+
+    std::ofstream file("dbkey.txt"); // 默认覆盖模式
+    if (file.is_open()) {
+        file << db_key_Str;    // 写入文本
+        file.close();                 // 显式关闭文件（可选，析构时会自动关闭）
+        //获取到dbkey就取消hook
+        HookEnd(1);
+        OutputDebugPrintf("[DbkeyHook] Write dbkey to dbkey.txt");
+    }
+    else {
+
+        OutputDebugPrintf("[DbkeyHook] Write dbkey.txt Failed! [%d]", GetLastError());
+    }
+
+
+    return 0;
+
+}
+
+
+void HookStart(HMODULE hModule)
+{
+    HMODULE weixin_dll_base = GetModuleHandle(_T("Weixin.dll"));
+    if (weixin_dll_base == NULL)
+    {
+        OutputDebugPrintf("[DbkeyHook] Get Weixin.dll's ImgBase Failed! [%d]", GetLastError());
+        return;
+    }
+    g_imgbase = (uint64_t)weixin_dll_base;
+    g_hook_offset = 0x0C0A9A6;// 这个是4.0.5.7的        4.0.3.43 = 0x0BC91A6    4.0.5.13=0xC0CC76   4.0.6.17=0xCF1F16
+
+    //读取Hook点原机器码
+    uint64_t hook_addr = g_imgbase + g_hook_offset;
+    uint8_t hook_opcode[] = {/*mov rax, 地址*/0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /*jmp rax*/0xFF, 0xE0 };
+    size_t hook_size = sizeof(hook_opcode); //12个字节
+
+    OrgInfo hook_org_info;// 记录原始字节信息
+    hook_org_info.addr = hook_addr;         //记录地址
+    hook_org_info.org_size = hook_size;     //记录要写多少个字节
+    BOOL bRet = ReadProcessMemory(GetCurrentProcess(), (LPCVOID)hook_addr, hook_org_info.org_opcodes, hook_size, NULL);
+    if (!bRet)
+    {
+        OutputDebugPrintf("[DbkeyHook] Read Hook Org Bytes Failed! [%d]", GetLastError());
+        return;
+    }
+    g_org_info.push_back(hook_org_info); //记录
+
+  
+
+    //构造中转区机器码 原指令 + jmp far
+    size_t org_insns_len = hook_size;  //暂时先写死
+    g_transfer_zone = (uint8_t*)VirtualAlloc(NULL, 64, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
+    if (!g_transfer_zone) {
+        OutputDebugPrintf("[DbkeyHook] Alloc Transfer Mem Failed! [%d]", GetLastError());
+        return;
+    }
+
+    bRet = ReadProcessMemory(GetCurrentProcess(), (LPCVOID)hook_addr, g_transfer_zone, org_insns_len, NULL);
+    if (!bRet)
+    {
+        OutputDebugPrintf("[DbkeyHook] Read Transfer Zone Org Bytes Failed! [%d]", GetLastError());
+        return;
+    }
+
+    uint8_t jmp_org_opcode[] = { 0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE0 };
+    uint64_t next_insn_addr = hook_addr + org_insns_len;
+    for (size_t i = 0; i < sizeof(uint64_t); i++) //跳回去
+        jmp_org_opcode[i + 2] = *((uint8_t*)(&next_insn_addr) + i);
+    memcpy(g_transfer_zone + org_insns_len, jmp_org_opcode, sizeof(jmp_org_opcode));
+    OutputDebugPrintf("[DbkeyHook] g_transfer_zone Addr: 0x%llX", g_transfer_zone);
+
+
+
+    //写入劫持机器码 跳转到HijackLogicWarpper函数处
+    uint64_t hijacklogic_addr = (uint64_t)(&HijackLogicWarpper);
+    for (size_t i = 0; i < sizeof(uint64_t); i++)
+    {
+        hook_opcode[i + 2] = *((uint8_t*)(&hijacklogic_addr) + i);
+    }
+    bRet = WriteProcessMemory(GetCurrentProcess(), (LPVOID)hook_addr, hook_opcode, hook_size, NULL);
+    if (bRet == NULL)
+    {
+        OutputDebugPrintf("[DbkeyHook] Write Hook Bytes Failed! [%d]", GetLastError());
+        return;
+    }
+
+
+}
+
+
+BOOL APIENTRY DllMain( HMODULE hModule,
+                       DWORD  ul_reason_for_call,
+                       LPVOID lpReserved
+                     )
+{
+    switch (ul_reason_for_call)
+    {
+    case DLL_PROCESS_ATTACH:
+        DisableThreadLibraryCalls(hModule); //防止多次调用
+        //不知道为什么不会自动加载mmmojo_64_true.dll 直接手动加载
+        OutputDebugPrintf("[DbkeyHook] Load mmmojo_64_true.dll: 0x%llX", LoadLibrary(TEXT("mmmojo_64_true.dll")));
+        OutputDebugString(TEXT("[DbkeyHook] Begin Hook and Hijack!"));
+        HookStart(hModule);
+        break;
+    case DLL_THREAD_ATTACH:
+    case DLL_THREAD_DETACH:
+    case DLL_PROCESS_DETACH:
+        OutputDebugString(TEXT("[DbkeyHook] Restore Hook Bytes!"));
+        HookEnd(2);
+        break;
+    }
+    return TRUE;
+}
+

framework.h

@@ -0,0 +1,5 @@
+#pragma once
+
+#define WIN32_LEAN_AND_MEAN             // 从 Windows 头文件中排除极少使用的内容
+// Windows 头文件
+#include <windows.h>

pch.cpp

@@ -0,0 +1,5 @@
+// pch.cpp: 与预编译标头对应的源文件
+
+#include "pch.h"
+
+// 当使用预编译的头时，需要使用此源文件，编译才能成功。

pch.h

@@ -0,0 +1,13 @@
+// pch.h: 这是预编译标头文件。
+// 下方列出的文件仅编译一次，提高了将来生成的生成性能。
+// 这还将影响 IntelliSense 性能，包括代码完成和许多代码浏览功能。
+// 但是，如果此处列出的文件中的任何一个在生成之间有更新，它们全部都将被重新编译。
+// 请勿在此处添加要频繁更新的文件，这将使得性能优势无效。
+
+#ifndef PCH_H
+#define PCH_H
+
+// 添加要在此处预编译的标头
+#include "framework.h"
+
+#endif //PCH_H

wrapper.asm

@@ -0,0 +1,50 @@
+EXTERN HijackLogic: PROC		; <20><><EFBFBD><EFBFBD><EFBFBD>ⲿ<EFBFBD><E2B2BF><EFBFBD><EFBFBD>
+
+EXTERN g_transfer_zone: QWORD	; <20><><EFBFBD><EFBFBD><EFBFBD>ⲿ<EFBFBD><E2B2BF><EFBFBD><EFBFBD>
+
+.CODE
+
+; ջ<><D5BB><EFBFBD>룺<EFBFBD><EBA3BA> 64 λģʽ<C4A3>£<EFBFBD><C2A3><EFBFBD><EFBFBD>ú<EFBFBD><C3BA><EFBFBD>ʱջ<CAB1><D5BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 16 <20>ֽڶ<D6BD><DAB6><EFBFBD><EFBFBD><EFBFBD>
+HijackLogicWarpper PROC
+    push rbx                                ; ѹ<><D1B9>ͨ<EFBFBD>üĴ<C3BC><C4B4><EFBFBD>
+    push rcx
+    push rdx
+    push rsi
+    push rdi
+    push rbp
+    push r8
+    push r9
+    push r10
+    push r11
+    push r12
+    push r13
+    push r14
+    push r15
+    pushfq                                  ; ѹ<><D1B9>eflags
+
+	sub rsp, 28h							; ջ<><D5BB><EFBFBD><EFBFBD>
+    mov rcx, r9                             ; <20><><EFBFBD><EFBFBD> <20><><EFBFBD><EFBFBD>Ϊ<EFBFBD><CEAA><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>arg4
+	call HijackLogic						; <20><><EFBFBD><EFBFBD>HijackLogic <20>޸<EFBFBD>KeyClass<73>ڴ<EFBFBD>
+    add rsp, 28h							; <20>ָ<EFBFBD>ջ
+	
+    popfq                                   ; <20>ָ<EFBFBD>eflags
+    pop r15
+    pop r14
+    pop r13
+    pop r12
+    pop r11
+    pop r10
+    pop r9
+    pop r8
+    pop rbp  
+    pop rdi
+    pop rsi
+    pop rdx
+    pop rcx
+    pop rbx                                 ; <20>ָ<EFBFBD>ͨ<EFBFBD>üĴ<C3BC><C4B4><EFBFBD>   
+
+    mov rax, qword ptr [g_transfer_zone]	; rax<61><78>ֵg_transfer_zone
+    jmp rax                                 ; <20><>ת<EFBFBD><D7AA>ת<EFBFBD>ڴ<EFBFBD>ִ<EFBFBD><D6B4>ԭָ<D4AD><D6B8>
+HijackLogicWarpper ENDP
+ 
+END

wrapper.h

@@ -0,0 +1,4 @@
+#pragma once
+#include <cstdint>
+
+extern "C" uint64_t HijackLogicWarpper(uint64_t PixCloudInstance);