RevokeMsgPatcher: A Hex Patch for WeChat, QQ and TIM Recall Messages on Windows

The problem: recalled messages disappear from the recipient's client

WeChat, QQ and TIM let a sender withdraw a message after it has been delivered. On the desktop Windows clients the withdrawn message is removed from the conversation on the receiving side as well, so the recipient has no record that anything was sent. RevokeMsgPatcher targets exactly that behaviour: it modifies the local client binary so the withdrawal instruction no longer removes the message from view. The project's own tagline makes the intent plain, and the README describes it as a patch for the PC versions of WeChat, QQ and TIM, with an optional multi-instance feature for WeChat. The audience is narrow and practical: people who run these desktop clients on Windows and want a local record of what was sent to them. It is not a server-side tool, it does not intercept network traffic, and it does not work on mobile clients or on the web versions.

How the patch works: byte-level edits to two DLLs

The mechanism is a hex edit of the client's own library. According to the README, the program modifies WeChat's WeChatWin.dll and QQ/TIM's IM.dll. The repository describes the project as a hex editor for these clients, and the author states that he does not participate in finding the patch methods, only in carrying the signatures (the README puts it as making feature transplants). That distinction matters for evaluating the project: the research into which byte sequences correspond to the recall handler comes from other projects, and RevokeMsgPatcher packages those signatures into a Windows GUI that locates the installed client, applies the edit and reports success. The README credits wechat_anti_revoke for the early content, BetterWX for the WeChat 4.0 signatures, and NTQQAntiRecall for the QQNT signatures in version 2.1. Before 2.0, QQNT support depended on LiteLoaderQQNT and a DLL hijack patch from QQNTFileVerifyPatch. So the architecture is a signature database plus a patcher front end, not a runtime hook or a proxy.

Running it: administrator rights, closed clients, and a re-patch after every update

The README lays out a short procedure. Your system needs Windows 7 or later (XP is explicitly unsupported) and .NET Framework 4.5.2 or later; the README warns that below that version the program may open with no response or throw an error. Close WeChat, QQ or TIM first. Run the program as administrator and wait for it to fetch the latest patch information in the lower right corner. Then select the installation path: for installed builds the program normally reads the path from the registry, while portable builds require you to pick the folder manually. Click the anti-recall button. The interface may become unresponsive for a while, which the README attributes to the patch work. Because WeChatWin.dll or IM.dll is modified, antivirus software may raise a warning and the README says to allow it. The final instruction is the one that defines the maintenance model: after WeChat, QQ or TIM updates, the patch must be installed again. There is no configuration file to edit and no daemon to keep running; the state lives in the patched binary, and the client update overwrites it.

Where it breaks: version drift, antivirus and no XP

The main failure mode is version drift. A signature that matches one build of WeChatWin.dll or IM.dll will not match the next one, and the README's support page is a wiki list of supported versions rather than a guarantee. If your client build is newer than the signatures the program has fetched, the patch either fails to find its target or, in the worst case, edits the wrong location. The README does not describe a rollback button, so recovery depends on reinstalling the client or restoring a copy of the DLL you made beforehand. Antivirus interference is the second constraint, and the README treats it as expected rather than exceptional: modifying a signed chat client's library is exactly the kind of behaviour heuristic scanners flag. Third, the platform floor is real. Windows XP is not supported, and .NET Framework 4.5.2 is a hard requirement, which rules out stripped-down or heavily locked-down Windows installations. Finally, the project is Windows-only by construction: it edits DLLs that only exist in the desktop clients, so anyone using the mobile apps or the web clients gets nothing from it.

Compared with LiteLoaderQQNT: plugin runtime versus binary patch

The most direct alternative for QQNT users is LiteLoaderQQNT with the Anti-Recall plugin, which is what RevokeMsgPatcher itself depended on before version 2.0. The difference in approach is structural. LiteLoaderQQNT loads a mod loader into the QQNT client and the anti-recall behaviour arrives as a plugin, so the logic lives in JavaScript running alongside the client rather than in edited machine code inside IM.dll. That makes updates easier to reason about, because a broken plugin can be disabled or replaced without touching the client binary, and it avoids the antivirus warning that comes from modifying a signed DLL. The trade-off is that you are now maintaining a mod loader plus its plugins, and the loader itself has to keep pace with QQNT releases. RevokeMsgPatcher's advantage is that it is a single executable with no runtime component and it covers WeChat and TIM as well as QQ, which the LiteLoader route does not. The README also notes that version 2.1's QQNT signatures come from NTQQAntiRecall, so the two projects are not fully independent: the patcher consumes research produced elsewhere.

Maintenance cost and the GPL-3.0 question

The recurring cost is the re-patch cycle. Every WeChat, QQ or TIM update invalidates the edit, and the README states this plainly. In practice that means keeping the RevokeMsgPatcher release zip on hand, re-running it as administrator after each client update, and accepting a brief period where the old signatures may not match the new binary. The release history shows the project tracking client changes rather than setting its own schedule: version 2.1 arrived in August 2025 with a new QQNT anti-recall method, version 2.0 in November 2024 added support for the WeChat 4.0 test build, and 1.9 preceded it in September 2024. The licence is GPL-3.0. For an end user running the released binary this changes little. For anyone who wants to redistribute a modified build, or embed the patching logic in another product, the copyleft terms apply to the whole derived work, and the signature data carried from other projects sits inside that. This is a description of the licence text, not legal advice; if redistribution is your plan, read the GPL-3.0 terms and the upstream projects' licences yourself.

Who should install it, and what to check first

Install it if you use the desktop Windows clients of WeChat, QQ or TIM, you are comfortable running a patcher as administrator, and you accept that you will repeat the process after every client update. The WeChat multi-instance tool bundled in the repository is a separate, smaller reason to look at the project, and it is documented as a general-purpose WeChat multi-instance utility. Skip it if you are on XP, if .NET Framework 4.5.2 is not available on the machine, if your organisation's antivirus policy will not allow modification of the client DLLs, or if you want a fix that survives updates without you doing anything. Before you click the anti-recall button, check the version support wiki page against your exact client build, and make a copy of WeChatWin.dll or IM.dll so you have a way back that does not involve reinstalling the client. The project's own README is the authority on supported versions, and it is the page to read before anything else.

Editorial conclusion

Adopt RevokeMsgPatcher if you run the desktop Windows clients of WeChat, QQ or TIM and accept that every client update means re-running the patch as administrator. Do not adopt it if you need XP support, cannot run .NET Framework 4.5.2 or later, or want a solution that survives automatic client updates without intervention. Before installing, verify three things: that your exact client build appears on the project's version support wiki page, that you can restore the original DLL from a backup or a fresh client install, and that your antivirus policy permits modifying WeChatWin.dll or IM.dll, since the README states the patch will trigger warnings.

Official sources

1. huiyadanli/RevokeMsgPatcher on GitHub
2. Issues
3. License: GPL-3.0
4. README
5. Releases