{
  "added_at": "2026-11-06",
  "category": "reconstruction-cases",
  "description_en": "An investigation of WeChat 4.1.10 for macOS reports recovering per-database SQLCipher keys by breaking on CommonCrypto encryption calls in LLDB. It compares that approach with memory scanning and sqlite3_key breakpoints, and describes an offline check against a decrypted SQLite page.",
  "description_zh": "这项研究针对 macOS 版 WeChat 4.1.10，作者报告通过 LLDB 在 CommonCrypto 加密调用处设置断点，提取各数据库的 SQLCipher 密钥。文档比较内存扫描与 sqlite3_key 断点，并说明如何用 SQLite 页面离线核对密钥。",
  "entry_url": "https://awesomerea.org/resources/wechat-4-1-10-macos-key-case/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/wechat-4-1-10-macos-key-case/",
  "evidence_url": "https://github.com/Evanyuan-builder/wechat-4.1.10-macos-key/blob/14acb2ea420197e493c579914fe138960246310a/README.md",
  "group": "cases",
  "id": "wechat-4-1-10-macos-key-case",
  "json_url": "https://awesomerea.org/resources/wechat-4-1-10-macos-key-case/record.json",
  "kind": "case-study",
  "markdown_url": "https://awesomerea.org/resources/wechat-4-1-10-macos-key-case/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/wechat-4-1-10-macos-key-case/index.md",
  "name": "WeChat: recovering SQLCipher keys through CommonCrypto hooks",
  "name_zh": "WeChat：通过 CommonCrypto 钩子提取 SQLCipher 密钥",
  "record_type": "resource",
  "relationship": "independent-reconstruction",
  "requirement_facets": [
    "prerequisites",
    "testing",
    "license"
  ],
  "requirements": [
    "WeChat 4.1.10 on Apple Silicon macOS, with LLDB and access to the user's own app data.",
    "The author reports testing on one machine running macOS 26.5.1.",
    "No licence file in the repository."
  ],
  "requirements_zh": [
    "需要在 Apple Silicon macOS 上使用 WeChat 4.1.10、LLDB，并能访问自己的应用数据。",
    "作者报告仅在一台运行 macOS 26.5.1 的机器上测试。",
    "仓库中没有许可证文件。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/Evanyuan-builder/wechat-4.1.10-macos-key",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}