Commit Graph

2 Commits (d38d7ebf9c9f8543c9f1dc835a598de69bd653a7)

Author SHA1 Message Date
bbingz d38d7ebf9c fix: replace glob() with nftw() and add chunk overlap
- glob() does not support ** recursive matching on macOS (POSIX).
  Replace with nftw() + opendir to recursively walk db_storage/.
- Add overlap between memory chunks to catch x'...' patterns
  spanning chunk boundaries.
2026-03-05 22:02:49 +08:00
bbingz 1f9ca3792a feat: add macOS C memory key scanner
Scans WeChat process memory for SQLCipher encryption keys using
Mach VM API. Outputs all_keys.json compatible with decrypt_db.py.

Build: cc -O2 -o find_all_keys_macos find_all_keys_macos.c -framework Foundation
Usage: sudo ./find_all_keys_macos [pid]
2026-03-05 21:49:00 +08:00