Wechathacker: Studying the Process Memory of an Old WeChat Build (Archived)
A pretty evil dive into old WeChat memory: the wild ideas, the crude tooling, and the second thoughts all live here.
Wechathacker is a study of the process memory of an old WeChat client, an archived project. Back then I was messing around with process memory on Windows and happened to have an old WeChat client on hand, so I just went and read what it laid out in memory while running. “Memory research” here really just means grabbing a debugger and a small memory-reading tool and rummaging through the memory of a running program. The old client had almost no hardening, so it went smoothly, and the deeper I got the more hooked I was.
The details aren’t spelled out. The tools and notes are all stuffed into Wechathacker.zip (a little over 1.3 MB), and the repo is left with just this archive, a SECURITY note, and GPL v3. There’s no build script, no dependency manifest; clone it, unzip it, and that’s everything:
git clone https://github.com/dwgx/Wechathacker.git
cd Wechathacker
unzip Wechathacker.zip -d ./_reviewThe toolchain is a pile of small scripts thrown together in Python (.gitignore still carries traces of a Python template to this day), crude stuff that just barely runs, purely to test out an idea in my head, nowhere near engineering.
I’m keeping it as a record of growth. Digging through the memory of someone else’s messaging app is the kind of thing where being able to do it doesn’t mean you should, and once I’d thought that through, that was enough. This is where it stops: archived, no more updates.