ZZeo.
ZH
← Back to all posts
App Penetration Testing2 min read

Mini Program Penetration Testing—Unpacking, Debugging, and Decrypting the Front End

A guide to unpacking, decompiling, and debugging WeChat Mini Program front-end packages using Node.js, wxappUnpacker, WeChat Developer Tools, an Android 6 MuMu emulator, and MT Manager.

Published Aug 31, 2021
#Mini Program
Read in Chinese→

0x01 Environment Used

  • Node.js environment
  • wxappUnpacker
  • WeChat Developer Tools
  • NetEase MuMu Emulator (Android 6 version)
  • MT Manager (a file management tool in the emulator)

0x02 Compilation Stage

  • First, locate the Mini Program installation package. You can use a phone, open the Mini Program, and then find the relevant directory in the phone’s file system. It is usually a directory like this:
/data/data/com.tencent.mm/MicromMsg/c6dxxxxxxxxxxxxx/appbrand/pkg/*.wxapkg

Note: Root access is required at this point.

MT Manager

image-20210818135324406

Then find a way to export these packages from the phone. (If there are many wxapkg files, it is recommended that you clean them up and restart the target Mini Program.)

image-20210820140233664

0x03 Decompile wxapkg to Obtain the Source Files

An expert on GitHub has already written a Node.js version. There are also other versions, such as a Python version. The specific version does not matter as long as it works.

GitHub address:

https://github.com/qwerty472123/wxappUnpacker

Navigate to the directory containing the downloaded decompilation scripts, then install the required dependencies one by one in a Node.js command window.

The list of dependencies provided in the project is incomplete. If you encounter errors, check the issues. The dependencies below are those I installed to get it running.

1. 解包主包  
   - windows系统使用: `./bingo.bat testpkg/master-xxx.wxapkg`
   - Linux系统使用: `./bingo.sh testpkg/master-xxx.wxapkg`
2. 解包子包  
   - windows系统使用: `./bingo.bat testpkg/sub-1-xxx.wxapkg -s=../master-xxx`
   - Linux系统使用:  `./bingo.sh testpkg/sub-1-xxx.wxapkg -s=../master-xxx`

Actual execution results:

./bingo.sh /Users/zy/Documents/pentest_tools/xcx/rongegou/_1549897879_353.wxapkg

image-20210820150521776

Open it in VS Code to view the source code.

image-20210820150817422

0x04 Debugging with WeChat Developer Tools

Download WeChat Developer Tools.

https://developers.weixin.qq.com/miniprogram/dev/devtools/download.html

image-20210825160452205

项目-导入项目

image-20210831090412636

Click Compile to run it. You can then proceed with debugging.

image-20210825164654699

image-20210825163839953

0x05 Solution:

After seeking answers in the WeChat community, I found that the best approach is to use cloud functions to avoid embedding keys in the front-end application.

image-20210825133749060