import frida, sys, time

script_code = """
var found = false;

// 查找所有模块中的 sqlite3_key
Process.enumerateModules().forEach(function(m) {
    var exp = m.findExportByName('sqlite3_key');
    if (exp) {
        found = true;
        send('[+] sqlite3_key in: ' + m.name + ' @ ' + exp);
        Interceptor.attach(exp, {
            onEnter: function(args) {
                var len = args[2].toInt32();
                if (len > 0 && len < 256) {
                    var key = Memory.readByteArray(args[1], len);
                    send('[KEY] ' + Array.from(new Uint8Array(key)).map(b=>b.toString(16).padStart(2,'0')).join(''));
                }
            }
        });
    }
});

// 同时 hook sqlite3_exec 抓 PRAGMA key
var sqlite3exec = Module.findExportByName(null, 'sqlite3_exec');
if (sqlite3exec) {
    Interceptor.attach(sqlite3exec, {
        onEnter: function(args) {
            try {
                var sql = args[1].readCString();
                if (sql && (sql.toLowerCase().includes('pragma key') || sql.toLowerCase().includes('key='))) {
                    send('[PRAGMA] ' + sql);
                }
            } catch(e) {}
        }
    });
    send('[+] Hooked sqlite3_exec');
}

// WeChat 内部 cipher 字符串位置
var wechat = Process.findModuleByName('WeChat');
send('[*] WeChat module: ' + wechat.base + ' size=' + wechat.size);

if (!found) {
    send('[-] sqlite3_key not in exports (statically linked)');
}
"""

def on_message(msg, data):
    if msg['type'] == 'send':
        print(msg['payload'])
    elif msg['type'] == 'error':
        print('[ERR]', msg['stack'][:200])

session = frida.attach(93592)
script = session.create_script(script_code)
script.on('message', on_message)
script.load()
print('[*] Hooked, waiting 10s for key calls...')
time.sleep(10)
session.detach()
print('[*] Done')