WeChat-Hook: DLL injection to expose WeChat PC internals as a local HTTP API

version.dll proxy loading inserts the HTTP server into the WeChat process without a launcher

Windows loads version.dll early in a process's lifetime for version-checking functions. WeChat-Hook uses that fact by replacing the DLL at C:\Program Files\Tencent\Weixin\version.dll with one that proxies all of the system's real version.dll exports while running its own initialization code. Nothing in the WeChat startup sequence needs to change, and no separate injector or launcher process is required on the side.

dllmain.cpp is the entry point. It parses startup arguments, loads the real system version.dll from the Windows directory, and then initializes the hook only when it detects it is running inside the WeChat main process. That process-identity check matters because many Windows applications load version.dll, and the HTTP server should start exactly once in the right process.

src/inline_weixin_dll_load.cpp handles the timing problem: it waits until Weixin.dll is present in memory before starting the hook and the HTTP service. src/version_proxy.cpp provides the export-forwarding layer, ensuring that anything WeChat or Windows calls from version.dll still reaches the original system function. Without that forwarding, WeChat would likely crash on startup because version checks that succeed normally would silently fail.

The hook depends on MinHook, a library for inline function hooking included in the minhook/ subdirectory of the repository.

8 HTTP endpoints and 2 different return conventions

The HTTP API has 8 endpoints grouped by function. Message endpoints are POST /SendTextMsg, POST /SendImgMsg, and POST /ForwardXMLMsg. POST /Decode_Pic decodes WeChat's encrypted image .dat files to .jpg. POST /GetSelfProfile returns the logged-in account's data. Database endpoints are POST /QueryDB/execute, POST /QueryDB/GetAllDBName, and GET /QueryDB/status.

Message and image endpoints use ret and retmsg as return fields, where ret=0 means success and ret=1 means failure. Database endpoints use a different shape: status, desc, and data. When the server cannot parse the request body as JSON at all, it returns ret=-1 with the message "invalid json". That difference in return convention means code that checks ret for database calls will not catch the JSON-parse error on the correct field name.

SendTextMsg takes wxidorgid and msg as fields. SendImgMsg takes wxidorgid and path, where path is a local Windows file path. ForwardXMLMsg takes to_wxid and content, where content is an XML string. QueryDB/status returns IsLogin as 1 or 0 and hWeixin as an internal handle value.

Placing version.dll in C:\Program Files\Tencent\Weixin, then starting WeChat

Installation has 5 steps in the README: compile the DLL or download it from a release, copy it to the WeChat installation directory, start WeChat, wait for the HTTP service to start on port 30001, and then call the endpoints from any HTTP client.

Building requires Visual Studio or MSBuild. The command the README gives is:

MSBuild.exe x64_Version_dll.vcxproj /m /t:Build /p:Configuration=Release /p:Platform=x64

Release output lands at x64\Release\version.dll. Debug output lands at x64\Debug\version.dll.

Alternatively, pre-built binaries are available from the repository's release page. Releases include v411027_ (tagged 4.1.10.27_new, dated 2026-06-29), v4.1.10.27 (dated 2026-06-18), and v3.9.2.23 from 2023-07-26, which targets an older WeChat version.

The repository includes postman/WeChat-Hook.postman_collection.json, which can be imported directly into Postman to reach all endpoints without writing request bodies manually. A SendTextMsg call to confirm the setup responds with ret=0 and retmsg="success" when it works.

StartPort, RecvType, and CallBackURL are the 3 command-line startup parameters

3 startup parameters can be passed to WeChat.exe on launch. StartPort sets the HTTP service port and defaults to 30001. RecvType is described in the README table as a callback type parameter that is currently reserved for parsing; it defaults to 1 and has no other documented effect. CallBackURL accepts a URL string and is described as being used for configuration storage and port parsing; it defaults to empty.

The example the README shows for passing parameters:

WeChat.exe StartPort=30001 CallBackURL="http://127.0.0.1:8080/callback"

These arguments are parsed by dllmain.cpp when the DLL loads. Changing the port after WeChat is already running is not documented. Whether CallBackURL triggers live incoming message delivery or acts only as a configuration record is not explained; the README describes port parsing as one of its functions but says nothing about message push events to that address.

Internal offsets break on every WeChat upgrade

WeChat-Hook works by locating WeChat's functions through hardcoded memory offsets inside the running process. The README states directly: this project depends on WeChat internal offsets, and after a WeChat upgrade, offsets and calling conventions must be re-verified. That is not a corner case. WeChat updates its PC client regularly, and each new release invalidates the offsets.

Current support covers WeChat 4.1.10.27 on Windows x64. Interface documentation for 3.9.10.16 is linked from the README at showdoc.com.cn, and that older version had its own release (v3.9.2.23, dated 2023-07-26), but the main branch README and releases correspond to 4.1.10.27.

Any automation built on WeChat-Hook must be able to pause and wait for updated offsets each time Tencent ships a new version of the PC client. In an environment where WeChat updates automatically, the window between a WeChat update and updated offsets in the hook means the integration will silently fail rather than send an error until someone publishes corrected offsets.

QueryDB/execute runs SQL against any WeChat database, with no query restrictions documented

WeChat stores its data in multiple SQLite databases inside the running process, and QueryDB/execute can reach any of them. The endpoint takes 2 fields: optDbName, which identifies the target database by name, and SQL, which is the query string. Responses use status, desc, and data as fields, with data holding the result rows as an array. The example query in the README is SELECT * FROM ChatRoom LIMIT 10 against MicroMsg.db.

QueryDB/GetAllDBName lists every database the WeChat process currently has open. It accepts an empty JSON object and returns an array where each entry has dbName and dbHandle. The handle is an integer representing the in-process SQLite connection rather than a filesystem path, so dbHandle values change between WeChat sessions.

MicroMsg.db holds contact and chat room records according to the README example, but the full list of available databases and their schemas is not documented anywhere in the repository. Nothing in the API enforces read-only access. Any SQL statement the WeChat process itself could execute runs without further confirmation, so a poorly formed INSERT or DELETE will take effect immediately.

No license, 0.0.0.0 as the default bind address, and removed VMP protections in main

License is listed as unknown in the repository metadata, and no LICENSE file appears in the top-level directory listing. Anyone distributing, modifying, or incorporating the code has no documented terms to work from.

The default bind address for the HTTP service is 0.0.0.0:30001, not 127.0.0.1:30001. Binding to all network interfaces means the API is reachable from any device on the same network as the Windows host, not only from processes running locally. No authentication is documented. Any machine that can reach port 30001 can call SendTextMsg, QueryDB/execute, or GetSelfProfile without a credential. For a deployment on a shared or office network, that exposure is the first thing to address before using the tool.

The main branch README notes that several capabilities were removed from the source code that was made public: VMP protection checks, remote authorization verification, PB/NetSceneSendPB handling, CDN interaction, and WcProbe/CCD/NtQuery hook installation and processing. A release binary from the project page may behave differently from a build compiled from the current main branch source. The update.log file at the repository root is where change history is recorded.

The last push to the repository was on 2026-09-15.

Editorial conclusion

Use WeChat-Hook if you need programmatic control of WeChat PC on Windows x64 for a specific version of the client and can accept that every WeChat upgrade breaks the internal offsets. Skip it if you need multi-version support, a stable public API, or any documentation on HTTP security, because none of those exist in the repository. Before deploying, confirm that 0.0.0.0 is an acceptable bind address for port 30001 in your environment, since the default listener accepts connections from the local network rather than loopback only.

Frequently asked questions

Official sources

1. aixed/WeChat-Hook on GitHub
2. Issues
3. README
4. Releases