reference-wechat-android-re.md 2.74 KB

Edit Raw Blame History



name: wechat-android-reverse-engineering
description: "Research notes on WeChat Android reverse engineering, hooking frameworks, and message interception projects"
metadata: 
  node_type: memory
  type: reference
  originSessionId: a0bf5811-73e6-4c69-beeb-9a2867ab56bf
Context: User is interested in reverse engineering WeChat Android to hook/intercept message send/receive interfaces.

Core Challenge: WeChat Android has strong obfuscation (class/method names), signature verification, and version checks. Static decompilation is nearly unreadable; dynamic hooking is the current standard approach.
Android Projects


Project
Framework
Target
Status
Link


Hook_WeChat_FaaS
Frida
Android WeChat cloud functions
Active (218⭐)
GitHub


frida_wechat_hook
Frida
receive_message interception
Archived (Gitee)
Gitee


XposedHookWeichat
Xposed
GPS hook demo
Outdated
GitHub


PC Projects (reference architecture)


Project
Approach
Features
Link


WeChatFerry
DLL injection + RPC
Send/receive, groups, SQL, decrypt
GitHub


千寻框架
HTTP API wrapper
Text, @mentions, emoji
Gitee


wechat_hook
Docker + WebSocket
WebSocket listen + HTTP send
GitHub


PyWxDump
Protocol reverse
Message dump framework
CSDN


Technical Resources

Hooking WeChat using Xposed — Stack Overflow
微信 smali 反编译查看撤回消息 — CSDN
微信安卓协议分析笔记 — CSDN
LLMs + Frida automated WeChat RE — Wechaty

Recommended Approach for Android

Frida dynamic hook (no root needed for some setups)


frida -U -f com.tencent.mm
Hook message functions via symbol/bytecode signatures
Scripts need updating per WeChat version

Xposed/LSPosed (requires root)


More stable hooks but harder to maintain across versions
Reference: findAndHookMethod pattern


Warning: WeChat updates frequently break hooks. Expect high maintenance. All projects are for educational/research purposes only.