tangandxue/wcdb-key-tool

wcdb-key-tool is a Python utility that extracts the encryption keys from WeChat's local message databases on Linux, allowing you to open and read those databases yourself. WeChat stores its chat history in encrypted database files using a format called WCDB (a database library built on SQLCipher). Without the correct key, you cannot open or inspect the database file, even though it is stored on your own computer. The tool was created to address a change introduced in WeChat 4.1+. Earlier versions stored the raw encryption key directly in process memory in a predictable pattern, so existing open-source tools could find it by scanning memory. The newer version switched to storing a passphrase instead, which must be transformed through a key-stretching algorithm called PBKDF2-SHA512 (run 256,000 times) to produce the actual encryption key. This broke every previous tool. The solution uses three steps. First, ELF static analysis: the tool inspects the WeChat binary file itself to automatically locate the address of the function that handles key writing, so it does not need manual reverse engineering each time WeChat updates. Second, GDB (a debugger) attaches briefly during WeChat login, intercepts that function, and reads the 32-byte passphrase directly from a CPU register. This takes less than two seconds and then detaches. Third, the tool applies PBKDF2-SHA512 to derive the per-database encryption key and verifies it before saving. The tool is a single Python file with one dependency (gdb). It works on Linux x86_64 and covers WeChat versions 4.0.x through 4.1.x. It is intended for users extracting keys from their own WeChat account on their own device.