WeChat 4.0 Miniapp Reverse Engineering: Unpacking, Decompiling, Deobfuscating

WeChat 4.0 Mini Program Reverse Engineering

The main changes are that the new version of WeChat uses a different storage layout, with some differences in encryption and other details.

We still use this project.

Unpack → decompile → deobfuscate

https://github.com/strengthen/AppletReverseTool

The specific package:

C:\Users\bx336\AppData\Roaming\Tencent\xwechat\radium\Applet\packages

Alternatively, if you have tools such as Everthing, search for wxapkg.

Find the one matching the time sequence.

For decompilation, use the script in this project as well; it is based on Node.

npm install

The main thing is to determine whether it is a main package alone or includes subpackages.

./bingo.bat testpkg/master-xxx.wxapkg

To unpack subpackages, you need this:

./bingo.bat testpkg/sub-1-xxx.wxapkg -s=../master-xxx

For deobfuscation, apply it to the main files.

Use a large language model to decode it.

I’ll make a Dify workflow later.