WeChat Chat Export Skill

Export the user's WeChat chat records (text only, no media) for AI analysis.

When to Use

• User asks to export, backup, or analyze their WeChat chat history
• User wants their Agent to "understand" them through their WeChat conversations
• User wants to preserve WeChat chat data in a readable format

Requirements

• Windows 10/11 x64
• WeChat PC 4.x (Weixin.exe) must be running and logged in
• Python 3.10+ with deps: pip install pywin32 psutil pymem pycryptodome yara-python lz4 pillow openpyxl lxml requests
• Dependencies on MemoTrace project (clone from GitHub if wxManager/ not present)
• Administrator rights (for key extraction step)

How It Works

Architecture

wx_key.dll (Hook injection) -> captures 32-byte DB key
       ↓
PBKDF2+SHA512 (256K rounds) -> derives AES-256 key
       ↓
AES-256-CBC -> decrypts WeChat .db files
       ↓
SQLite -> reads text messages (type=1)
       ↓
JSON -> exports to E:\myself\chat_records\

WeChat 4.x encrypts local SQLite databases with AES-256-CBC. The encryption key is generated at login and stored in process memory. Instead of scanning memory patterns (fragile across versions), we use wx_key.dll (from ycccccccy/wx_key) which injects a Shellcode Hook into the WeChat process to intercept the key when WeChat reads its database.

Key Extraction Detail

The DLL approach is critical because:

• Old approach (MemoTrace): yara pattern matching in memory — broken for WeChat 4.1.2.17+
• Our approach: DLL Hook injection — works for all WeChat 4.x versions

The Hook must be installed BEFORE WeChat login (the key is only loaded once at startup).

Directory Structure

wechat-export/
├── SKILL.md              ← this file
├── scripts/
│   ├── export_wx.py      ← main entry: full pipeline (find process -> get key -> decrypt -> export)
│   ├── capture_key.py    ← capture DB key via wx_key.dll Hook (needs admin + WeChat restart)
│   └── just_export.py    ← export text messages from already-decrypted database
└── assets/
    └── wx_key.dll        ← key extraction DLL (v2.1.8 from ycccccccy/wx_key)

Usage Flow

Option A: One-Click (admin available)

cd scripts
python export_wx.py

Automatically: finds WeChat process → searches memory for data dir → extracts key via DLL → decrypts all .db files → exports text messages as JSON

Option B: Two-Step (manual WeChat restart)

When the DLL Hook doesn't capture the key immediately (WeChat was already logged in):

Step 1: Close WeChat, then run:

python capture_key.py

Script waits for WeChat to close → loads DLL → waits for WeChat to restart → hooks key → saves to wx_db_key.txt

Step 2:

python export_wx.py

(The script will skip key extraction if wx_db_key.txt exists)

File Modifications

One file in MemoTrace was modified:

wxManager/decrypt/decrypt_v4.py — changed from ProcessPoolExecutor (multi-process) to sequential single-process decryption. The multi-process version crashes on Windows when running from scripts without freeze_support() in __main__. This change is in line 136-137.

Export Format

Each contact/group → one JSON file in E:\myself\chat_records\:

[
  {
    "time": "2026-05-25 10:30:00",
    "is_send": true,
    "sender": "My Name",
    "content": "Hello! Are you free this weekend?"
  }
]

• is_send: true = sent by user; false = received from contact
• Text-only: no images, videos, audio, files
• Also generates E:\myself\contacts_summary.json with all 610+ contacts

Troubleshooting

| Symptom | Cause | Fix | |---------|-------|-----| | key = None | Hook not triggered | Close WeChat first, run capture_key.py, then reopen WeChat | | key = None (with admin) | WeChat version mismatch | Check wx_key.dll supports current version | | ModuleNotFoundError: wxManager | MemoTrace not in path | Clone https://github.com/LC044/WeChatMsg and adjust sys.path | | database disk image is malformed | Some contacts use separate DBs | Normal; ~400+ contacts export successfully | | Process pool crash | Multi-process spawn issue | decrypt_v4.py must use sequential mode | | crypto / Crypto import conflict | Package name collision on Windows | Uninstall crypto pkg, keep only pycryptodome |

Dependencies Map

| Component | Source | License | |-----------|--------|---------| | wx_key.dll | ycccccccy/wx_key v2.1.8 | MIT | | wxManager/ | LC044/WeChatMsg (MemoTrace) | MIT | | exporter/ | LC044/WeChatMsg | MIT | | scripts/*.py | This project | MIT |