WxEcho

macOS Native Chat History Export Tool

English · 中文

⚠️ DISCLAIMER: This tool is intended for personal backup and educational purposes only. Using it may violate the Terms of Service of the messaging platform in question. The author is not responsible for any account suspension, data loss, or legal consequences resulting from the use of this software. Use at your own risk.

| Feature | Description | |---------|-------------| | 🔑 Key Extraction | Extract encryption keys directly from running process memory | | 🔓 Database Decryption | Decrypt SQLCipher 4 (AES-256-CBC) encrypted databases | | 📤 Multi-format Export | Export to TXT / CSV / JSON formats | | 🔍 Fuzzy Search | Search contacts by nickname or remarks | | 💬 Group Chat Support | Full support for group conversations | | 🍎 Native macOS | Built with Mach VM API, runs natively on Apple Silicon |

Prerequisites

macOS 11+ on Apple Silicon (M1/M2/M3/M4...) Desktop app 4.x (logged in, chat history synced) Xcode Command Line Tools: xcode-select --install

Installation

npm install -g @walkerch/wxecho

Or manually:

git clone https://github.com/chang-xinhai/WxEcho.git
cd WxEcho
npm install && npm run build

Usage

# Step 1: Re-sign the app
sudo codesign --force --deep --sign - /Applications/WeChat.app

# Re-open and log in

Alternative: Disable SIP (csrutil disable in Recovery Mode) — no re-signing needed, but affects system-wide security.

# Step 2: Extract Keys
wxecho keys

# Step 3: Decrypt Databases
wxecho decrypt

# Step 4: Export Chat History
wxecho export -l                    # List all conversations
wxecho export -n "John Doe"        # Export by name

| WeChat Version | Status | |----------------|--------| | 4.x (latest tested: 4.1.5.240) | ✅ Tested |

npm package last updated: 2026-04-04 (v1.0.6)

Running App Process ──key extraction──▶ keys.json ──decrypt──▶ plaintext SQLite ──export──▶ TXT/CSV/JSON
   (SQLCipher 4)                          (AES-256-CBC)        (.db files)           (chat history)

The app uses WCDB (based on SQLCipher 4) with per-database AES-256 keys cached in process memory, stored as x'<64hex_key><32hex_salt>'.

| Command | Description | |---------|-------------| | wxecho keys | Extract database keys from running process | | wxecho decrypt | Decrypt local databases | | wxecho export [options] | Export chat history | | wxecho doctor | Check environment dependencies |

export Options

| Option | Description | |--------|-------------| | -l, --list | List all conversations | | -n, --name <name> | Search contacts by nickname or remark | | -u, --username <wxid> | Match by exact username | | -o, --output <dir> | Specify output directory | | --top <n> | List top N conversations (default: 20) | | --my-wxid <wxid> | Your own user ID (auto-detected if omitted) |

Decrypted databases in py/decrypted/:

decrypted/
├── contact/contact.db          # Contacts
├── session/session.db          # Conversation list
├── message/message_0.db        # Chat messages (sharded)
├── message/message_fts.db     # Full-text search
├── message/media_0.db         # Voice messages
├── sns/sns.db                  # Moments
├── favorite/favorite.db        # Favorites
└── ...

Messages for each contact/group are stored in tables named Msg_<md5(username)>.

A: Make sure: (1) the app has been re-signed with ad-hoc signature; (2) the app is running and logged in.

A: Updates restore the original code signature. Re-run the re-sign step.

A: Some messages use zstd compression. Most text messages are unaffected.

A: This tool exports text records only. Media files are in xwechat_files/.../Message/, correlate via message_resource.db.

A: Yes. Export works the same way. Messages show sender's actual nickname/remark.

| Project | Description | |---------|-------------| | ydotdog/wechat-export-macos | Reference project | | L1en2407/wechat-decrypt | C memory scanner | | Thearas/wechat-db-decrypt-macos | lldb key extraction | | ylytdeng/wechat-decrypt | Original memory search |

MIT License