Skip to content

WeChat v4.1.1.4 Linux Flatpak: "file is not a database #86

@hupeipei125

Description

@hupeipei125

WeChat v4.1.1.4 Linux Flatpak: wx sessions returns "file is not a database"

Environment

Item Value
WeChat version 4.1.1.4 (Flatpak, com.tencent.WeChat)
OS Debian 12 (LXD container)
wx-cli version 0.3.0
Install method npm install -g @jackwener/wx-cli

Steps to reproduce

  1. Install WeChat via Flatpak on Linux
  2. Launch WeChat with QT_SCALE_FACTOR=1.5 (otherwise QR code renders split on Xvfb)
  3. Scan QR code to log in
  4. WeChat data directory structure (WeChat v4 uses db_storage/ instead of Msg/):
xwechat_files/
├── wxid_xxx_4433/
│   ├── db_storage/
│   │   ├── message/
│   │   │   ├── message_0.db       (26 MB)
│   │   │   ├── message_fts.db     (52 MB)
│   │   │   └── message_resource.db
│   │   ├── session/
│   │   │   └── session.db         (69 KB)
│   │   ├── contact/
│   │   │   └── contact.db         (2 MB)
│   │   └── ...
  1. Create symlinks to match expected structure:
ln -sfn db_storage/message message
ln -sfn db_storage/session session
ln -sfn db_storage/contact contact
  1. Keys extracted from /proc/<pid>/mem using x'<64hex><32hex>' pattern — 15 keys found, salts match all database files correctly.

  2. all_keys.json created with matched enc_key + salt pairs.

Expected behavior

wx sessions should list recent chat sessions.

Actual behavior

$ HOME=/home/agent wx sessions
启动 wx-daemon...
错误: file is not a database

Daemon log shows:

[daemon] DB_DIR: .../wxid_xxx_4433
[daemon] 密钥数量: 2
[cache] 全量解密 session/session.db (0ms)
[daemon] 预热完成,联系人 0 个

The cached "decrypted" DB has correct SQLite magic header (SQLite format 3\0) but bytes 16+ are garbage (invalid page size 6806, etc.).

Manual verification

  • AES-256-CBC decryption of session.db page 1 with extracted key produces valid SQLite format 3\0 magic but garbage after byte 16 — confirming key extraction is correct but decryption parameters may differ for v4 Flatpak.
  • Same issue with message_0.db (26 MB).
  • sqlcipher CLI with PRAGMA key = "x'<key>'" also returns "file is not a database".

Additional context

Workaround attempted

  • Manual Python decryption with cryptography library (AES-256-CBC, matching wx-cli's decrypt_page logic)
  • sqlcipher CLI with various PRAGMA settings
  • All produce same result: correct magic header, garbage data

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions