Wx Favorites Report Skill for Claude

# 复制微信到桌面并去掉 Hardened Runtime
cp -R /Applications/WeChat.app ~/Desktop/WeChat.app
codesign --force --deep --sign - ~/Desktop/WeChat.app

pip3 install frida frida-tools

# 关闭原版微信，从桌面副本启动
killall WeChat 2>/dev/null; sleep 2

# 用 frida spawn 模式启动微信并 hook PBKDF2
PYTHONPATH=$(python3 -c "import site; print(site.getusersitepackages())") python3 << 'PYEOF'
import frida, time

JS_CODE = """
function buf2hex(buffer) {
    var a = new Uint8Array(buffer); var h = '';
    for (var i = 0; i < a.length; i++) h += ('0' + a[i].toString(16)).slice(-2);
    return h;
}
var found = false;
Process.enumerateModules().forEach(function(m) {
    if (found) return;
    m.enumerateExports().forEach(function(exp) {
        if (found) return;
        if (exp.name === "CCKeyDerivationPBKDF") {
            found = true;
            send("[*] Hook installed on " + m.name);
            Interceptor.attach(exp.address, {
                onEnter: function(args) {
                    this.pwLen = args[2].toInt32();
                    this.saltLen = args[4].toInt32();
                    this.rounds = args[6].toInt32();
                    this.pw = args[1]; this.salt = args[3];
                    this.dk = args[7]; this.dkLen = args[8].toInt32();
                },
                onLeave: function(retval) {
                    if (this.pwLen < 4 || this.pwLen > 256) return;
                    if (this.saltLen < 4 || this.saltLen > 64) return;
                    var saltHex = buf2hex(this.salt.readByteArray(this.saltLen));
                    var dkHex = buf2hex(this.dk.readByteArray(this.dkLen));
                    var pwHex = buf2hex(this.pw.readByteArray(this.pwLen));
                    send("[PBKDF2] r=" + this.rounds + " salt=" + saltHex);
                    var f = new File("/tmp/wechat_frida_keys.log", "a");
                    f.write("rounds=" + this.rounds + "\\npw=" + pwHex + "\\nsalt=" + saltHex + "\\ndk=" + dkHex + "\\n\\n");
                    f.flush(); f.close();
                }
            });
        }
    });
});
if (!found) send("[!] CCKeyDerivationPBKDF not found");
"""

device = frida.get_local_device()
pid = device.spawn(["/Users/" + __import__('os').getenv('USER') + "/Desktop/WeChat.app/Contents/MacOS/WeChat"])
session = device.attach(pid)
script = session.create_script(JS_CODE)
script.on("message", lambda msg, data: print(msg.get("payload", msg)))
script.load()
device.resume(pid)
print("WeChat running. Login → open Favorites → wait 60s...")
time.sleep(120)
session.detach()
print("Done. Check /tmp/wechat_frida_keys.log")
PYEOF

# 核心解密逻辑（内置在 parse_favorites.py 的上游）
import hashlib, hmac, struct
from Crypto.Cipher import AES

# enc_key = 从 frida 日志中 256000 轮 PBKDF2 输出匹配 DB salt 的 dk
# 逐页 AES-256-CBC 解密，HMAC-SHA512 校验

python3 ~/.claude/skills/wechat-favorites-viz/scripts/parse_favorites.py \
  --input "<解密后的 favorite.db 路径>" \
  --output "<输出目录>/data.json"

python3 ~/.claude/skills/wechat-favorites-viz/scripts/generate_report.py \
  --input "<输出目录>/data.json" \
  --output "<输出目录>/report.html"

# 推荐用 http server（file:// 下部分交互可能受限）
cd <输出目录> && python3 -m http.server 8765 &
open http://localhost:8765/report.html

<输出目录>/
├── data.json      # 解析后的结构化数据
└── report.html    # 单文件可视化报告（可直接分享）