---

name: wx-backup-decrypt description: "Decrypt and extract WeChat backup database (.xb files) from NAS/Android backups. Handles XOR-encrypted content fields, friend/group metadata, and exports all messages. | 解密和提取微信备份数据库（.xb文件），处理加密内容字段，导出全部消息。" argument-hint: "[database-path] [--imei IMEI] [--output OUTPUT_DIR] [--exclude-keywords KW1 KW2]" version: "1.1.0" user-invocable: true allowed-tools: Read, Write, Edit, Bash

Language / 语言: Detect user's language from first message, respond in same language throughout.

WeChat Backup Database Decryptor

Trigger

Activate when user:

• Runs /wx-backup-decrypt
• Mentions: 解密微信备份数据, decrypt wechat backup, 微信聊天记录解密
• Points to a .xb file or WeChat backup directory

Flow

1. Locate database

find {path} -name "*.xb" -type f 2>/dev/null

If directory provided, also check for .xb files directly inside it.

2. Decrypt using the tool

Run the bundled Python script:

python3 .claude/skills/wx-backup-decrypt/tools/decrypt.py \
  --db {db_path} \
  --output {output_dir} \
  [--wxid {wxid}] \
  [--imei {imei}] [--uin {uin}] \
  [--exclude-keywords {kw1} {kw2}]

Parameters: | Param | Required | Description | |-------|----------|-------------| | --db | Yes | Path to .xb database | | --output | No | Output directory (default: ./wx_decrypted) | | --wxid | No | User's WeChat ID (auto-detected if omitted) | | --imei | No | Phone IMEI (fallback key derivation) | | --uin | No | WeChat UIN (paired with IMEI) | | --exclude-keywords | No | Group name keywords to exclude |

3. Validate results

After decryption, check decrypt_stats.json for:

• Valid decryption rate (should be near 100%)
• Message counts
• Excluded sessions

If rate < 90%, suggest user provide IMEI/UIN for alternative key derivation.

4. Present findings

Show user:

• Total messages decrypted
• Friend/group counts
• Output file list
• Any warnings (low validation rate, excluded groups)

Key Technical Notes

Encryption in NAS WeChat backups

• wx_chat.content: XOR-encrypted (hex-encoded ciphertext)
• wx_friend.nickname, wx_group.nickName: May be plaintext — script auto-detects
• wx_backup_history.display: Usually plaintext — used for known-plaintext attack

Key discovery (handled automatically by decrypt.py)

1. Known-plaintext attack (primary): Match wx_backup_history.display (plaintext) to wx_chat.content (ciphertext) at same timestamp/session → derive XOR key
2. IMEI derivation (fallback): MD5(IMEI + UIN)[:7]
3. Brute-force (last resort): Try all 256 single-byte XOR keys

Field encryption auto-detection

The script detects if a field is encrypted by checking: hex-only characters + even length + length ≥ 4. If all conditions met, attempts decryption; otherwise treats as plaintext.

Output Files

| File | Content | |------|---------| | user_messages.json | User's text messages (filtered) | | user_messages.txt | Plain text: [timestamp] message | | all_user_messages.json | User's all-type messages (filtered) | | all_text_messages.json | Everyone's text messages (filtered) | | friends.json | Friend list | | groups.json | Group list | | decrypt_stats.json | Statistics & metadata |

Troubleshooting

| Problem | Solution | |---------|----------| | Garbled output | Field may be plaintext, not encrypted. Script auto-detects. | | No plaintext-ciphertext pairs | backup_history.display may be empty. Provide --imei + --uin. | | Low validation rate | Wrong key. Try different IMEI/UIN combinations. | | pywxdump won't install | Linux doesn't support pywxdump (requires pywin32). Use this tool instead. |

Persona Building

Exported data feeds directly into create-yourself skill:

• Message patterns → speech style, catchphrases, emoji usage
• Timestamps → active hours, daily rhythms
• Session analysis → relationship mapping, communication style per group
• Content themes → values, interests, life events