From c4c3b7279634f24761a66ced22534df1fa8918d2 Mon Sep 17 00:00:00 2001 From: jakevin Date: Thu, 14 May 2026 17:20:07 +0800 Subject: [PATCH] =?UTF-8?q?docs(readme):=20mention=20Windows=20VirtualQuer?= =?UTF-8?q?yEx=20+=20ReadProcessMemory=20in=20=E5=8E=9F=E7=90=86=20section?= =?UTF-8?q?=20(#55)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 原理 section previously listed only macOS Mach VM API and Linux /proc//mem, omitting the Windows scanner path that has existed in src/scanner/windows.rs since the Rust rewrite. Add the Windows API pair and the required process access rights so the section accurately reflects all three platforms supported in CI/builds. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index de816d1..8a8e23b 100644 --- a/README.md +++ b/README.md @@ -294,7 +294,7 @@ daemon 首次解密后将数据库和 mtime 持久化到 `~/.wx-cli/cache/`。 微信 4.x 使用 SQLCipher 4 加密本地数据库（AES-256-CBC + HMAC-SHA512，PBKDF2 256,000 次迭代）。WCDB 在进程内存中缓存派生后的 raw key，格式为 `x'<64hex_key><32hex_salt>'`。 -wx-cli 通过 macOS Mach VM API（`mach_vm_region` + `mach_vm_read`）或 Linux `/proc//mem` 扫描微信进程内存，匹配该模式提取密钥，daemon 按需解密并缓存。 +wx-cli 通过 macOS Mach VM API（`mach_vm_region` + `mach_vm_read`）、Linux `/proc//mem` 或 Windows `VirtualQueryEx` + `ReadProcessMemory`（需要 `PROCESS_VM_READ | PROCESS_QUERY_INFORMATION` 权限）扫描微信进程内存，匹配该模式提取密钥，daemon 按需解密并缓存。 ---