Agent skill · data analytics · aradotso
wx-favorites-report
End-to-end pipeline to extract, decrypt, and visualize WeChat Mac favorites from encrypted SQLite DB into an interactive HTML report.
Why this skill is useful
Adds a complete end-to-end pipeline with executable scripts for extracting and visualizing WeChat favorites that the AI cannot generate on its own.
What it needs
Requires frida, frida-tools, pycryptodome installed locally. About 6k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
wx-favorites-report Skill by ara.so — Daily 2026 Skills collection. End-to-end pipeline that hooks into the WeChat Mac client via Frida, extracts PBKDF2-derived encryption keys, decrypts the favorite.db SQLCipher database, parses XML-encoded favorites, and renders a single-file interactive HTML report with charts, word cloud, and filterable card browser. --- Prerequisites macOS (Apple Silicon or Intel) WeChat Mac 4.x installed and logged in Python 3.9+ Frida 17.x --- Project Layout --- Full Pipeline (Step-by-Step) Step 1 — Strip Hardened Runtime from WeChat The App Store build blocks Frida injection. Copy and re-sign without entitlements: Never run with sudo — doing so changes the data directory to /var/root/… and breaks DB path resolution. Step 2 — Hook PBKDF2 with Frida Save as hookwechat.js: Run the hook: Key insight: favorite.db is only opened when the user navigates to the Favorites tab. If you hook before opening Favorites, the key won't appear. Step 3 — Match Key to favorite.db Step 4 — Decrypt the Database Step 5 — Parse Favorites WeChat 4.x uses a single table favdbitem with XML content (not the 3.x FavItems/FavDataItem split): Step 6 — Generate HTML Report Serve locally (required — file:// breaks ECharts event delegation): --- Key Configuration Reference Parameter Value Notes ----------- ------- ------- SQLCipher version 4 WeChat 4.x Cipher AES-256-CBC — HMAC HMAC-SHA512 — KDF iterations 256 000 PBKDF2 Page size 4 096 bytes — Reserve per page 80 bytes 64 HMAC + 16 IV Salt location bytes 0–15 of file — Table name (4.x) favdbitem 3.x used FavItems Article title field <pagetitle> Not <title> --- Common Issues & Fixes "Key not found in log" 1. Confirm you opened the 收藏 tab while Frida was attached. 2. Check log for any entries: wc -l /tmp/wechatfridakeys.log 3. Salt mismatch — re-read salt: xxd ~/…/favorite.db head -2 (bytes 16–31 after the ASCII header). "database disk image is malformed" Decryption parameters are wrong. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/wx-favorites-report