feat: add macOS C memory key scanner

Scans WeChat process memory for SQLCipher encryption keys using
Mach VM API. Outputs all_keys.json compatible with decrypt_db.py.

Build: cc -O2 -o find_all_keys_macos find_all_keys_macos.c -framework Foundation
Usage: sudo ./find_all_keys_macos [pid]
This commit is contained in:
bbingz
2026-03-05 21:49:00 +08:00
parent 24ae180669
commit 1f9ca3792a
2 changed files with 294 additions and 0 deletions

View File

@@ -162,6 +162,7 @@ python find_image_key.py
| `find_image_key.py` | 从微信进程内存提取图片 AES 密钥 |
| `find_image_key_monitor.py` | 持续监控版密钥提取(推荐) |
| `latency_test.py` | 延迟测量诊断工具 |
| `find_all_keys_macos.c` | macOS 版内存密钥扫描器 (C, Mach VM API) |
## 技术细节