wechat-dump icon indicating copy to clipboard operation
wechat-dump copied to clipboard

Negative uin

Open gregoiregentil opened this issue 4 years ago • 4 comments

I have run everything and I get:

[10:24:53 [email protected]:wechat] found uin=-157... in system_config_prefs.xml [10:24:53 [email protected]:wechat] found uin=272... in com.tencent.mm_preferences.xml [10:24:53 [email protected]:wechat] found uin=-157... in auth_info_key_prefs.xml [10:24:53 [email protected]:wechat] found uin=-157... in systemInfo.cfg [10:24:53 [email protected]:wechat] Possible uin: [-157..., 272...] [10:24:53 [email protected]:wechat] found imei=353... from iphonesubinfo [10:24:53 [email protected]:wechat] found imei=1234567890ABCDEF in CompatibleInfo.cfg [10:24:53 [email protected]:wechat] Possible imei: ['353...', '1234567890ABCDEF', '1234567890ABCDEF'] Traceback (most recent call last): File "/tmp/wechat-dump/decrypt-db.py", line 175, in key = get_key(imei, uin) File "/tmp/wechat-dump/decrypt-db.py", line 132, in get_key a = md5(imei + uin) TypeError: can't concat int to bytes

I have tried to force the positive uin (272...) in the command line but it doesn't decrypt. Can you please look into this? Is this possible to have a negative uin?

gregoiregentil avatar Nov 27 '20 18:11 gregoiregentil

According to this old article https://www.forensicfocus.com/articles/decrypt-wechat-enmicromsgdb-database/ negative UIN should be concated as string directly. i.e. you can try "-157". Does this work?

ppwwyyxx avatar Nov 27 '20 23:11 ppwwyyxx

No. If I login to the website, my uin cookie is 272... But even if I force this number for UIN and I use my IMEI from my phone, I still can't decrypt the database. Am I doing something wrong?

gregoiregentil avatar Nov 28 '20 00:11 gregoiregentil

Also if I subtract my two potential UIN (272...) and (-157...), I get 0xFFFFFFFF

gregoiregentil avatar Nov 28 '20 00:11 gregoiregentil

I have WeChat version 7.0.17 and I don't think it can work. I have calculated the MD5 as explained in the referenced article.

gregoiregentil avatar Nov 28 '20 00:11 gregoiregentil