WeChat applet capture and reverse + WeChat applet decompilation tutorial + unpacking tutorial + unpacking tool

disclaimer

The original intention of making videos is to learn and communicate, and to let myself learn more things in the sharing process.
The videos, environments, software, scripts, articles, materials, etc. I publish are only used to learn and communicate security technologies. Please do not For any illegal purpose, otherwise the consequences will be paid by yourself.
Part of the technology comes from the technology website: www.baipaizhong.com

This is an order I received. A college student wants to build a library reservation system for their own learning. Don't want to get up early and want to grab a seat.

Stud analysis first. After all, make an appointment, then you must analyze the package. When you start to capture the package, you will silently read a lot of I**your big**,
because the previous package capture tools can’t capture it. Record it Time 2022-11-11. Then what should I do, the list is accepted, and I can't give up.

Solve the problem of not being able to catch the package.

Because WeChat seems to use the cloud now, so the general means should not be able to catch it, it was recently updated.

Two WeChat mini-program methods I know

1. Hook is very familiar with this in the reverse engineering of his PC. They seem to do the same with the ipad protocol, they just simply understand it without studying it. this is a
2. It is through decompilation, which is also introduced in this article. Decompile it with a decompiler tool. Then import it into the WeChat applet developer for debugging, which is equivalent to getting the code, and then you will have everything you want later. It's not a problem to capture packets like this.
   When this step is reached, packet capture is not simple
   .
   

Implement the second packet capture method

1. Tool preparation (Baidu is free, find my knowledge and pay)

1. decryption tool
   
2. The reverse tool
   currently used is: wxappxxxxcker
   , which was developed by a great master. It could be downloaded from github before, but as of today, the master has closed the download. The specific reason... you know. However, open source is a trend, just like the world will not stop being open, so we still have many channels to get it, and you can get it through your own channels

2. Decryption applet

There are many tutorials on the Internet, which use a rooted mobile phone to extract small program packages. In fact, it is not so troublesome, just use the WeChat PC client directly.

1. It is recommended to modify the default small program package location on the PC side of WeChat

The default is on the C drive, which takes up too much memory, it is recommended to modify

2. Open a small program

A method is recommended,
open here and you set the path folder (as shown in the figure below), exit WeChat, and delete the left and right contents under this folder

Then open a small program on the PC side, click on all the pages as much as possible, and let the local automatically generate a local package. In the folder just set up (as shown above), the content is as follows: the entry arrow points to the folder, but

inside What is encrypted is the file: APP .wxapkg needs to use our previous decryption software.
3. Decrypt the small program package

The software looks like this:

Select the encrypted small program package

and decrypt successfully in 0.1 seconds:
the file name after decryption is:

1 wx4f11048xxxxxxx66.wxapkg

It will be stored in the wxpack folder:

3. Reverse applet

Officially used [wxappxxxxker] developed by the master. The following operations are all performed in the cmd command window. What needs to be emphasized is that it must be in the wxapxxxxker path. The simple method is to directly enter cmd in the address bar of the [wxapxxxer] folder.

If you put it on the desktop like me, it will come out like this:

1. Check nodejs Enter node -v to check whether nodejs is installed.

If nodejs is not installed, please install it first. Download address: https://nodejs.org/en/ Install nodejs and keep clicking Next to install.
2. Installation dependencies

Enter the following 7 npm installs in turn, and install them one by one

1. npm install esprima
2. npm install css-tree
3. npm install cssbeautify
4. npm install vm2
5. npm install uglify-es
6. npm install js-beautify
   3. Formal reverse engineering

Input:
bingo.bat Main package path (can be directly dragged in)

The compiled file is saved in the same folder as [wx4f11xxxxxxxc766.wxapkg] and is automatically named wxxxxxx3xxxx766.

Compilation is complete, then open it directly with the WeChat development tool, and you can learn from the front-end design of the predecessors, Sao Nian.

4. Possible errors

①, if the time is reported when executing the compile command

this package is a subPackage which should be unpacked with -s=.

Explain that this is a subpackage. When opening the applet, two .wxapkg files are generated. Just compile another file. The commands for compiling the subpackage and the main package are different:

node ./wuWxapkg.js subpackage path -s=main package path

②. If the generated file does not contain the app.json file,
it means that the applet you are looking for was developed by the master, and decompilation security measures have been taken, so the decryption failed. This is also the purpose of my posting this article.
But this kind of great god is still relatively rare, will you become that one in the future? Come on, Sao Nian, Oli!
Effect screenshot

This is exactly the same as the browser capture package. You can capture the package as much as you like.

4. Conclusion

Well, the WeChat applet decompilation tutorial + unpacking tutorial + the use of unpacking tools and packet capture analysis have been completed, and have been shared for everyone;