weflow-cli 1.5.0 → 1.6.1

package/scripts/wechat_emoji.py

@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+"""Render WeChat face codes like [害羞] for HTML export.
+
+WeChat stores faces in message text as bracketed names. Two renderers:
+
+* Faces we ship the original artwork for (resources/emoji/*.png, MIT, from the
+  `wechat-emojis` package) become a <span> whose CSS class carries the image.
+  The image is base64-embedded once per page, not once per occurrence.
+* Everything else falls back to the closest standard emoji. WeChat's faces are
+  its own artwork, so these are approximations - only used where we have no
+  original.
+
+Unrecognised codes (including the placeholders this project generates itself,
+such as [图片]) are left untouched.
+"""
+import base64
+import hashlib
+import json
+import re
+from pathlib import Path
+
+_HERE = Path(__file__).resolve().parent
+_DATA_FILE = _HERE / 'data' / 'wechat_emoji.json'
+EMOJI_DIR = _HERE.parent / 'resources' / 'wechat-emoji'
+
+# Keys starting with "_" are documentation, not faces.
+_FACES = {}
+try:
+    with open(_DATA_FILE, encoding='utf-8') as fh:
+        _FACES = {k: v for k, v in json.load(fh).items() if not k.startswith('_')}
+except (OSError, ValueError):
+    _FACES = {}
+
+
+def _load_image_faces():
+    """{face name: png path} for every face we have original artwork for."""
+    if not EMOJI_DIR.is_dir():
+        return {}
+    return {p.stem: p for p in EMOJI_DIR.glob('*.png')}
+
+
+IMAGE_FACES = _load_image_faces()
+ALL_NAMES = set(_FACES) | set(IMAGE_FACES)
+
+# Longest name first so [左哼哼] can never be shadowed by a shorter prefix.
+_ALL_RE = None
+if ALL_NAMES:
+    _alternation = '|'.join(re.escape(n) for n in sorted(ALL_NAMES, key=len, reverse=True))
+    _ALL_RE = re.compile(r'\[(' + _alternation + r')\]')
+
+
+def face_class(name):
+    """Stable CSS class for a face with original artwork."""
+    return 'wxf-' + hashlib.md5(name.encode()).hexdigest()[:10]
+
+
+def convert_faces(text):
+    """Replace known [表情] codes with emoji. Unknown codes pass through."""
+    if not text or _ALL_RE is None:
+        return text
+    return _ALL_RE.sub(lambda m: _FACES.get(m.group(1), m.group(0)), text)
+
+
+def render_faces(text):
+    """Like convert_faces, but faces with original artwork become a <span>.
+
+    The returned string is HTML and must NOT be escaped again.
+    """
+    if not text or _ALL_RE is None:
+        return text
+
+    def repl(m):
+        name = m.group(1)
+        if name in IMAGE_FACES:
+            return f'<span class="wxface {face_class(name)}"></span>'
+        return _FACES.get(name, m.group(0))
+
+    return _ALL_RE.sub(repl, text)
+
+
+def find_face(text):
+    """First WeChat face code in `text` as "[名字]", or None.
+
+    A single regex scan; callers used to loop the whole table doing
+    `label in text`, which got expensive once the table grew to ~120.
+    """
+    if not text or _ALL_RE is None:
+        return None
+    m = _ALL_RE.search(text)
+    return f"[{m.group(1)}]" if m else None
+
+
+def has_face(text):
+    """True if `text` contains any known face code."""
+    if not text or _ALL_RE is None:
+        return False
+    return _ALL_RE.search(text) is not None
+
+
+def faces_used_in(html):
+    """CSS classes referenced by an HTML fragment."""
+    return set(re.findall(r'wxface (wxf-[0-9a-f]{10})', html))
+
+
+def face_css(html, indent='  '):
+    """CSS defining just the faces this page actually uses.
+
+    Embedding only what a page needs keeps paginated exports small - a full
+    sprite would add ~1MB to every page.
+    """
+    used = faces_used_in(html)
+    if not used:
+        return ''
+    rules = []
+    for name, path in sorted(IMAGE_FACES.items()):
+        cls = face_class(name)
+        if cls not in used:
+            continue
+        try:
+            b64 = base64.b64encode(path.read_bytes()).decode()
+        except OSError:
+            continue
+        rules.append(f'.{cls} {{ background-image: url(data:image/png;base64,{b64}); }}')
+    if not rules:
+        return ''
+    return indent + ('\n' + indent).join(rules)
+
+
+if __name__ == '__main__':
+    import sys
+    for line in sys.stdin:
+        sys.stdout.write(convert_faces(line))

package/scripts/wechat_emoticon.py

@@ -0,0 +1,433 @@
+#!/usr/bin/env python3
+"""Decrypt WeChat custom stickers (表情包) from the local cache.
+
+WeChat 4.x keeps stickers in `cache/YYYY-MM/Emoticon/<md5[:2]>/<md5>` and
+`business/emoticon/{Persist,Thumb,...}`. Each file is AES-128-CBC with the key
+also used as the IV, where
+
+    key = md5(f"{seed}{wxid}EMOTICON")[:16]
+
+`seed` is a per-account constant held in WeChat's process memory (see
+find_seed). Once known it is stable, so it only has to be scanned for once.
+
+Most cached stickers are WeChat's own `wxgf` container - a small header
+followed by a raw H.265 stream - which needs ffmpeg to turn into an image.
+Decoded results are cached on disk because that is the expensive step.
+
+Reference: CN-Grace/Wechat-Emoticon-Parser (v4.0-plus branch).
+"""
+import glob
+import hashlib
+import os
+import subprocess
+import tempfile
+
+try:
+    from cryptography.hazmat.primitives import padding
+    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+    _HAVE_CRYPTO = True
+except ImportError:
+    _HAVE_CRYPTO = False
+
+try:
+    import zstandard
+    _HAVE_ZSTD = True
+except ImportError:
+    _HAVE_ZSTD = False
+
+IMAGE_MAGICS = (
+    (b'\x89PNG', 'image/png', '.png'),
+    (b'\xff\xd8\xff', 'image/jpeg', '.jpg'),
+    (b'GIF8', 'image/gif', '.gif'),
+    (b'RIFF', 'image/webp', '.webp'),
+    (b'wxgf', 'image/hevc', '.hevc'),
+)
+
+
+def derive_key(seed, wxid):
+    """Cache key for an account. Returns 16 bytes."""
+    return hashlib.md5(f'{seed}{wxid}EMOTICON'.encode()).digest()[:16]
+
+
+def account_wxid(account_dir_name):
+    """`wxid_mgnjdl8034eh22_4c8e` -> `wxid_mgnjdl8034eh22`."""
+    parts = account_dir_name.rsplit('_', 1)
+    return parts[0] if len(parts) == 2 and len(parts[1]) == 4 else account_dir_name
+
+
+def decrypt(raw, key):
+    """AES-128-CBC(key=IV) with PKCS7. Returns plaintext (best effort)."""
+    if not _HAVE_CRYPTO or not raw or len(raw) < 32:
+        return b''
+    body = raw[:len(raw) // 16 * 16]
+    dec = Cipher(algorithms.AES(key), modes.CBC(key)).decryptor()
+    out = dec.update(body) + dec.finalize()
+    try:
+        unp = padding.PKCS7(128).unpadder()
+        return unp.update(out) + unp.finalize()
+    except Exception:
+        return out
+
+
+def sniff(data):
+    """(mime, extension) for decrypted bytes, or (None, None)."""
+    for magic, mime, ext in IMAGE_MAGICS:
+        if data.startswith(magic):
+            return mime, ext
+    return None, None
+
+
+def find_seed_candidates():
+    """Decimal strings scraped from WeChat's process memory (seed candidates)."""
+    try:
+        import ctypes
+        from ctypes import (byref, c_size_t, c_void_p, create_string_buffer,
+                            sizeof, wintypes)
+        import pymem
+        import re as _re
+    except ImportError:
+        return []
+
+    class MBI(ctypes.Structure):
+        _fields_ = [
+            ('BaseAddress', ctypes.c_void_p), ('AllocationBase', ctypes.c_void_p),
+            ('AllocationProtect', wintypes.DWORD), ('PartitionId', wintypes.WORD),
+            ('RegionSize', ctypes.c_size_t), ('State', wintypes.DWORD),
+            ('Protect', wintypes.DWORD), ('Type', wintypes.DWORD),
+        ]
+
+    k32 = ctypes.windll.kernel32
+    rpm = k32.ReadProcessMemory
+    rpm.argtypes = [wintypes.HANDLE, wintypes.LPCVOID, wintypes.LPVOID,
+                    ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
+    vqe = k32.VirtualQueryEx
+    vqe.argtypes = [wintypes.HANDLE, wintypes.LPCVOID, ctypes.c_void_p, ctypes.c_size_t]
+    vqe.restype = ctypes.c_size_t
+
+    pid = None
+    for p in pymem.process.list_processes():
+        try:
+            name = p.szExeFile
+            if isinstance(name, bytes):
+                name = name.decode('utf-8', 'ignore')
+            if name.lower() == 'weixin.exe':
+                pid = p.th32ProcessID
+                break
+        except Exception:
+            pass
+    if not pid:
+        return []
+
+    h = k32.OpenProcess(0x0010 | 0x0400, False, pid)
+    if not h:
+        return []
+
+    pat = _re.compile(rb'\d{5,20}')
+    seen = set()
+    addr = 0x10000
+    try:
+        while addr < 0x7FFFFFFFFFFF:
+            mbi = MBI()
+            if vqe(h, c_void_p(addr), byref(mbi), sizeof(mbi)) == 0:
+                break
+            ba, rs = mbi.BaseAddress or 0, mbi.RegionSize or 0
+            if rs == 0:
+                break
+            if (mbi.State == 0x1000 and 256 < rs < 200 * 1024 * 1024
+                    and mbi.Protect not in (0, 0x01, 0x100)):
+                pos, end = ba, ba + rs
+                while pos < end:
+                    n = min(65536, end - pos)
+                    buf = create_string_buffer(n)
+                    br = c_size_t(0)
+                    if rpm(h, c_void_p(pos), buf, n, byref(br)) and br.value:
+                        for m in pat.finditer(buf.raw[:br.value]):
+                            s = m.group(0).decode()
+                            if s not in seen:
+                                seen.add(s)
+                                yield s
+                    pos += 65536
+            addr = ba + rs
+    finally:
+        k32.CloseHandle(h)
+
+
+def find_seed(wxid, sample_file, candidates=None):
+    """The seed that decrypts `sample_file`, or None.
+
+    Proven per candidate by decrypting the sample and looking for a known
+    image magic - so a false positive is essentially impossible.
+    """
+    raw = open(sample_file, 'rb').read(64) if sample_file else b''
+    if not raw:
+        return None
+    for seed in (candidates or find_seed_candidates()):
+        if sniff(decrypt(raw, derive_key(seed, wxid)))[0]:
+            return seed
+    return None
+
+
+def _ffmpeg_exe():
+    try:
+        import imageio_ffmpeg
+        return imageio_ffmpeg.get_ffmpeg_exe()
+    except Exception:
+        return None
+
+
+_FFMPEG = None
+_FFMPEG_CHECKED = False
+
+
+WXGF_MAX_FRAMES = 4
+
+# Below this share of non-dominant pixels a frame is treated as blank rather
+# than as artwork. Line drawings on white still score well above it; the blank
+# transition frames and truncated payloads sit at essentially 0.
+BLANK_FRAME_SCORE = 0.005
+
+# Animation output. The page shows a sticker at ~240px, and uncapped frame
+# rates on a 50-frame clip produce a multi-megabyte GIF.
+GIF_MAX_SIDE = 240
+GIF_FPS = 10
+
+
+def _frame_score(path):
+    """How much artwork a decoded frame carries, in [0, 1].
+
+    The share of pixels that are not the frame's dominant colour. Sticker
+    streams routinely open with a blank transition frame, which scores ~0.01
+    while the drawn frame scores several times that.
+    """
+    try:
+        from PIL import Image
+        from collections import Counter
+    except ImportError:
+        return None
+    try:
+        with Image.open(path) as image:
+            pixels = list(image.convert('RGB').getdata())
+        if not pixels:
+            return 0.0
+        dominant = Counter(pixels).most_common(1)[0][1]
+        return 1.0 - dominant / len(pixels)
+    except Exception:
+        return None
+
+
+def _encode_animated_gif(source, target):
+    """Animated GIF from an H.265 stream, scaled for a chat bubble.
+
+    The stream is a sticker animation, not a still. Frames are capped at
+    `GIF_FPS` and `GIF_MAX_SIDE`, and quantised through a generated palette -
+    without that a 50-frame clip runs to megabytes instead of a few hundred KB.
+    """
+    try:
+        subprocess.run(
+            [_FFMPEG, '-y', '-loglevel', 'error', '-f', 'hevc', '-i', source,
+             '-vf', (f'fps={GIF_FPS},scale={GIF_MAX_SIDE}:-1:flags=lanczos,'
+                     'split[a][b];[a]palettegen[p];[b][p]paletteuse'),
+             '-loop', '0', target],
+            capture_output=True, timeout=120,
+        )
+        return os.path.isfile(target) and os.path.getsize(target) > 0
+    except Exception:
+        return False
+
+
+def decode_wxgf(data):
+    """A `wxgf` payload as image bytes (animated GIF or PNG), or b''.
+
+    The container is 'wxgf' + a small header, then a raw H.265 stream. Multi
+    frame streams are sticker animations and are re-encoded as an animated GIF;
+    taking a single frame from those - which is what this used to do - shows a
+    still of what the sender saw moving.
+
+    Single frame streams are handled by picking the frame with the most
+    artwork rather than frame 1: many begin with a blank transition frame, so
+    frame 1 yields a white square.
+    """
+    global _FFMPEG, _FFMPEG_CHECKED
+    if not _FFMPEG_CHECKED:
+        _FFMPEG = _ffmpeg_exe()
+        _FFMPEG_CHECKED = True
+    if not _FFMPEG:
+        return b''
+    tmp_in = None
+    tmp_dir = None
+    try:
+        with tempfile.NamedTemporaryFile(suffix='.hevc', delete=False) as fh:
+            fh.write(data[4:])
+            tmp_in = fh.name
+        tmp_dir = tempfile.mkdtemp(prefix='weflow-wxgf-')
+        # Probe the frame count cheaply: all frames, no scaling.
+        subprocess.run(
+            [_FFMPEG, '-y', '-loglevel', 'error', '-f', 'hevc', '-i', tmp_in,
+             '-vsync', '0', os.path.join(tmp_dir, 'f%04d.png')],
+            capture_output=True, timeout=120,
+        )
+        frames = sorted(glob.glob(os.path.join(tmp_dir, 'f*.png')))
+        if not frames:
+            return b''
+        if len(frames) > 1:
+            gif_path = os.path.join(tmp_dir, 'anim.gif')
+            if _encode_animated_gif(tmp_in, gif_path):
+                with open(gif_path, 'rb') as fh:
+                    return fh.read()
+            # Fall through to a still frame if the animation could not be built.
+        best = frames[0]
+        best_score = None
+        for frame in frames[:WXGF_MAX_FRAMES]:
+            score = _frame_score(frame)
+            if score is None:
+                break
+            if best_score is None or score > best_score:
+                best, best_score = frame, score
+        # Every frame blank means the cached payload is not decodable (a
+        # truncated download, typically). Report failure so the caller tries
+        # another source rather than embedding a white square.
+        if best_score is not None and best_score < BLANK_FRAME_SCORE:
+            return b''
+        with open(best, 'rb') as fh:
+            return fh.read()
+    except Exception:
+        return b''
+    finally:
+        if tmp_in:
+            try:
+                os.remove(tmp_in)
+            except OSError:
+                pass
+        if tmp_dir:
+            import shutil
+            shutil.rmtree(tmp_dir, ignore_errors=True)
+
+
+def load_sticker(cache_dirs, md5_hex, key, decode_cache_dir=''):
+    """(image bytes, mime) for a sticker by md5, or (b'', '').
+
+    Decoding wxgf needs ffmpeg and is slow, so results are cached under
+    `decode_cache_dir` keyed by md5.
+    """
+    if not md5_hex or not key:
+        return b'', ''
+    if decode_cache_dir:
+        cached = os.path.join(decode_cache_dir, md5_hex)
+        if os.path.isfile(cached):
+            try:
+                with open(cached, 'rb') as fh:
+                    data = fh.read()
+                mime, _ = sniff(data)
+                if mime:
+                    return data, mime
+            except OSError:
+                pass
+
+    src = ''
+    for base in cache_dirs:
+        candidate = os.path.join(base, md5_hex[:2], md5_hex)
+        if os.path.isfile(candidate):
+            src = candidate
+            break
+    if not src:
+        return b'', ''
+
+    try:
+        with open(src, 'rb') as fh:
+            raw = fh.read()
+    except OSError:
+        return b'', ''
+    data = decrypt(raw, key)
+    mime, _ = sniff(data)
+    if mime == 'image/hevc':
+        # Re-sniff rather than assuming PNG: an animated stream decodes to a
+        # GIF, and labelling that `image/png` sent it down the JPEG path
+        # downstream, flattening the animation this was meant to preserve.
+        data = decode_wxgf(data)
+        mime = sniff(data)[0] or ''
+    if not mime:
+        return b'', ''
+
+    # Sticker art is often 512-1024px; the reader renders it at ~240px, so
+    # embedding it untouched is pure weight.
+    try:
+        from wechat_image import shrink
+        data, mime = shrink(data, mime, max_side=360)
+    except Exception:
+        pass
+
+    if decode_cache_dir and data:
+        try:
+            os.makedirs(decode_cache_dir, exist_ok=True)
+            with open(os.path.join(decode_cache_dir, md5_hex), 'wb') as fh:
+                fh.write(data)
+        except OSError:
+            pass
+    return data, mime
+
+
+def sticker_cache_dirs(account_root):
+    """Where WeChat stores cached stickers for this account."""
+    dirs = []
+    cache_root = os.path.join(account_root, 'cache')
+    if os.path.isdir(cache_root):
+        for month in sorted(os.listdir(cache_root)):
+            d = os.path.join(cache_root, month, 'Emoticon')
+            if os.path.isdir(d):
+                dirs.append(d)
+    for sub in ('Persist', 'Thumb', 'Temp'):
+        d = os.path.join(account_root, 'business', 'emoticon', sub)
+        if os.path.isdir(d):
+            dirs.append(d)
+    return dirs
+
+
+def any_sticker_file(dirs):
+    """Some cached sticker, used as the verification sample."""
+    for base in dirs:
+        for sub in sorted(os.listdir(base)) if os.path.isdir(base) else []:
+            path = os.path.join(base, sub)
+            if os.path.isdir(path):
+                for name in sorted(os.listdir(path)):
+                    f = os.path.join(path, name)
+                    if os.path.isfile(f) and os.path.getsize(f) > 32:
+                        return f
+    return ''
+
+
+def _main():
+    import argparse
+    ap = argparse.ArgumentParser(description='WeChat sticker cache helper')
+    ap.add_argument('--find-seed', metavar='ACCOUNT_ROOT',
+                    help='Scan WeChat memory for the sticker seed of this account')
+    ap.add_argument('--json', action='store_true')
+    args = ap.parse_args()
+
+    if not args.find_seed:
+        ap.print_help()
+        return
+
+    account_root = args.find_seed
+    wxid = account_wxid(os.path.basename(os.path.normpath(account_root)))
+    dirs = sticker_cache_dirs(account_root)
+    sample = any_sticker_file(dirs)
+    if not sample:
+        print('未找到可用的表情缓存文件，请先在微信里查看几个表情包')
+        return
+
+    seed = find_seed(wxid, sample)
+    if not seed:
+        print('未找到 seed。请确认微信正在运行，且曾在微信中查看过表情包。')
+        return
+
+    import json as _json
+    if args.json:
+        print(_json.dumps({'success': True, 'seed': seed, 'wxid': wxid, 'sample': sample}))
+    else:
+        print(f'✓ seed = {seed}')
+        print(f'  账号: {wxid}')
+        print(f'  样本: {sample}')
+
+
+if __name__ == '__main__':
+    _main()