fix(macos): recover runtime SQLCipher codec keys

[RPGboy2023]

Summary

• add an arm64 Mach-O instruction-pattern locator for newer macOS WeChat builds that no longer expose every key as x'<key><salt>'
• capture transient SQLCipher derived AES/HMAC key pairs through LLDB and independently verify both keys against encrypted page 1 before accepting them
• re-verify and preserve existing keys, isolate legacy scanner output, and atomically replace all_keys.json only when at least one valid key remains
• decrypt main/WAL pages with HMAC verification for derived-key entries
• discover both message_N.db and biz_message_N.db shards

Safety properties

• no fixed WeChat version offset, account path, database shard number, or key material
• the hook must match exactly one arm64 instruction sequence or the fallback fails closed
• capture output is created with mode 0600; key bytes are never printed by the fallback
• failed or empty scans do not erase previously verified keys
• an outer LLDB timeout sends SIGCONT so WeChat is not left suspended

Verification

• python3 -m unittest discover -s tests -v (6 tests pass)
• Python 3.12 compileall passes
• CLI --help smoke test passes
• wheel builds with Python 3.12 and includes the LLDB helper while excluding tests/build artifacts
• the locator uniquely resolves the installed WeChat arm64 dylib to the same hook previously found by manual analysis
• a real derived-key entry decrypts the corresponding message database through DBCache; SQLite PRAGMA quick_check returns ok
• full extraction regression on a temporary copy: the legacy scanner returned zero candidates, while all 28 previously saved keys were re-verified and preserved

Runtime note

The codec fallback observes live page processing. If the target database is idle during the bounded capture window it reports a timeout and leaves the key file unchanged; opening/using the relevant chat while init runs provides the required page activity.

[JackieGLQ]

你好，系统为windows 10 教育版22H2 微信版本为4.1.11.55：提示如下：
开始提取密钥...

提取所有微信数据库密钥

找到 17 个数据库, 17 个不同的salt
salt a60147460d07db8619da49bd99531be7: bizchat\bizchat.db
salt 056fa0172cd06b53fcb033caf9cb99b4: contact\contact.db
salt f788a955d9b0e601713cdb724a314da5: contact\contact_fts.db
salt 7e4356fbd4f46c5945d913cfa0a50e74: emoticon\emoticon.db
salt 0c5415385a607e9ff1fd9bdb1522f1bf: favorite\favorite.db
salt 0323f1eae8f8869958daae5bf97df0ee: favorite\favorite_fts.db
salt 6323ac5c9f18e182d86157f09b9890d7: general\general.db
salt 0a3232313dfc33d8423740ffc2543b09: hardlink\hardlink.db
salt eebd1a0c7dcc70a4dc256db2ba7fc65c: head_image\head_image.db
salt eaa73300f89ae3bbb14e71f600f6380c: message\biz_message_0.db
salt 9a4b8bc11e76d54a1928fa193c61b6e0: message\message_0.db
salt ead6d65d602a3c09e503a43bd0289d9c: message\message_fts.db
salt 678a58dbb2646a5e990e71fa7b116897: message\message_resource.db
salt 71c2fe7c337204bb25b64522f1c8eb63: message\weclaw.db
salt cf10cab00bf0e8b2cca9e34201a1ffa1: session\session.db
salt 0f30e2197b7f58d026ee72417f8f237d: sns\sns.db
salt a7b693c6d4f68f5e425e9271e5a0b591: solitaire\solitaire.db
[+] Weixin.exe PID=19692 (604MB)
[+] Weixin.exe PID=10088 (170MB)
[+] Weixin.exe PID=14016 (134MB)
[+] Weixin.exe PID=16100 (130MB)
[+] Weixin.exe PID=7776 (90MB)
[+] Weixin.exe PID=14516 (65MB)

[*] 扫描 PID=19692 (601MB, 1851 区域)
[2.5%] 0/17 salts matched, 0 hex patterns, 0.0s
[24.9%] 0/17 salts matched, 0 hex patterns, 0.2s
[29.5%] 0/17 salts matched, 0 hex patterns, 0.2s
[62.4%] 0/17 salts matched, 0 hex patterns, 0.4s
[63.3%] 0/17 salts matched, 0 hex patterns, 0.4s
[75.2%] 0/17 salts matched, 0 hex patterns, 0.4s
[85.2%] 0/17 salts matched, 0 hex patterns, 0.5s
[93.2%] 0/17 salts matched, 0 hex patterns, 0.6s
[98.4%] 0/17 salts matched, 0 hex patterns, 0.6s

[*] 扫描 PID=10088 (171MB, 530 区域)
[26.7%] 0/17 salts matched, 0 hex patterns, 0.6s
[80.6%] 0/17 salts matched, 0 hex patterns, 0.7s

[*] 扫描 PID=14016 (134MB, 1251 区域)
[50.1%] 0/17 salts matched, 0 hex patterns, 0.8s
[61.8%] 0/17 salts matched, 0 hex patterns, 0.9s
[64.1%] 0/17 salts matched, 0 hex patterns, 0.9s
[65.4%] 0/17 salts matched, 0 hex patterns, 0.9s
[68.3%] 0/17 salts matched, 0 hex patterns, 0.9s
[93.0%] 0/17 salts matched, 0 hex patterns, 0.9s

[*] 扫描 PID=16100 (130MB, 750 区域)
[21.0%] 0/17 salts matched, 0 hex patterns, 0.9s
[35.6%] 0/17 salts matched, 0 hex patterns, 1.0s
[72.1%] 0/17 salts matched, 0 hex patterns, 1.0s

[*] 扫描 PID=7776 (91MB, 340 区域)
[68.2%] 0/17 salts matched, 0 hex patterns, 1.1s

[*] 扫描 PID=14516 (65MB, 344 区域)
[53.3%] 0/17 salts matched, 0 hex patterns, 1.2s

扫描完成: 1.2s, 6 个进程, 0 hex模式

============================================================
结果: 0/17 salts 找到密钥
MISSING: bizchat\bizchat.db (salt=a60147460d07db8619da49bd99531be7)
MISSING: contact\contact.db (salt=056fa0172cd06b53fcb033caf9cb99b4)
MISSING: contact\contact_fts.db (salt=f788a955d9b0e601713cdb724a314da5)
MISSING: emoticon\emoticon.db (salt=7e4356fbd4f46c5945d913cfa0a50e74)
MISSING: favorite\favorite.db (salt=0c5415385a607e9ff1fd9bdb1522f1bf)
MISSING: favorite\favorite_fts.db (salt=0323f1eae8f8869958daae5bf97df0ee)
MISSING: general\general.db (salt=6323ac5c9f18e182d86157f09b9890d7)
MISSING: hardlink\hardlink.db (salt=0a3232313dfc33d8423740ffc2543b09)
MISSING: head_image\head_image.db (salt=eebd1a0c7dcc70a4dc256db2ba7fc65c)
MISSING: message\biz_message_0.db (salt=eaa73300f89ae3bbb14e71f600f6380c)
MISSING: message\message_0.db (salt=9a4b8bc11e76d54a1928fa193c61b6e0)
MISSING: message\message_fts.db (salt=ead6d65d602a3c09e503a43bd0289d9c)
MISSING: message\message_resource.db (salt=678a58dbb2646a5e990e71fa7b116897)
MISSING: message\weclaw.db (salt=71c2fe7c337204bb25b64522f1c8eb63)
MISSING: session\session.db (salt=cf10cab00bf0e8b2cca9e34201a1ffa1)
MISSING: sns\sns.db (salt=0f30e2197b7f58d026ee72417f8f237d)
MISSING: solitaire\solitaire.db (salt=a7b693c6d4f68f5e425e9271e5a0b591)

[!] 未提取到任何密钥

[!] 密钥提取失败: 未能从任何微信进程中提取到密钥
提示: macOS/Linux 可能需要 sudo 权限 请问需要如何解决呢？