zWorkFlow

zikai/zWorkFlow

Fork 0

Commit Graph

Author	SHA1	Message	Date
bbingz	03582dd82c	fix: narrow Method 2 scan to hex charset [0-9a-f] Previous range [a-z0-9] was too broad, matching non-hex characters g-z which wastes CPU on false candidates. WeChat image keys are lowercase hex strings.	2026-03-07 21:35:00 +08:00
bbingz	0576151b67	feat: add macOS image key scanner and batch decryptor (C) - find_image_key.c: scans WeChat process memory for V2 image AES keys using Mach VM API + CommonCrypto batch decryption - decrypt_images.c: batch decrypts V2 .dat image files using keys from image_keys.json, handles AES-ECB + XOR + raw_data segments Build: cc -O3 -o find_image_key find_image_key.c -framework Security cc -O3 -o decrypt_images decrypt_images.c -framework Security	2026-03-07 21:35:00 +08:00

Author

SHA1

Message

Date

bbingz

03582dd82c

fix: narrow Method 2 scan to hex charset [0-9a-f]

Previous range [a-z0-9] was too broad, matching non-hex characters
g-z which wastes CPU on false candidates. WeChat image keys are
lowercase hex strings.

2026-03-07 21:35:00 +08:00

bbingz

0576151b67

feat: add macOS image key scanner and batch decryptor (C)

- find_image_key.c: scans WeChat process memory for V2 image AES keys
  using Mach VM API + CommonCrypto batch decryption
- decrypt_images.c: batch decrypts V2 .dat image files using keys
  from image_keys.json, handles AES-ECB + XOR + raw_data segments

Build: cc -O3 -o find_image_key find_image_key.c -framework Security
       cc -O3 -o decrypt_images decrypt_images.c -framework Security

2026-03-07 21:35:00 +08:00

2 Commits