yichen-wechat-local-vault

The code is a local WeChat database key-extraction tool rather than ordinary application functionality. It instruments WeChat, captures cryptographic material, tests it against encrypted databases, and stores recovered keys locally. No direct exfiltration or destructive malware behavior is evident in the supplied fragment, but extracting and persisting encryption keys is a high-impact privacy and security action. The absent FRIDA_JS/FRIDA_HOST definitions prevent complete assessment, and the fragment is syntactically incomplete. Use only with explicit authorization and review the missing Frida payloads before execution.

The code appears to be a local WeChat database decryption utility, not malware. It has a concrete path traversal vulnerability in key_name_to_rel(): arbitrary slash-containing .db names can escape the configured source and output directories. The explicit recursive deletion option also creates destructive-use risk when given an unsafe path. No network exfiltration, reverse shell, cryptomining, obfuscated payload, or credential theft behavior is present. The shown fragment also has an incomplete final main() invocation and would not run exactly as pasted.

未提供实际源代码，仅提供项目说明文档。文档描述了本机微信密钥提取、数据库解密和大规模隐私导出功能，属于高敏感、双用途工具，但没有证据表明存在网络外传、后门、破坏行为或故意恶意代码。应进一步审查 extract_keys.py、decrypt_all_dbs.py、vault_cli.py、export_chat.py 及其依赖，重点验证密钥访问范围、文件权限、路径遍历防护、网络调用和明文数据保护。