# WeChat_tweak: an injected iOS plugin for WeChat

> The WeChat_tweak repository is an Objective-C iOS tweak that injects a dylib into WeChat to add automatic red envelope collection, message blocking, group filtering, fake location, edited step counts and a chat background taken from the camera. It suits a jailbroken device owner who wants to modify WeChat's behaviour, and installing it means re-signing the app and its frameworks by hand.

**itenfay/WeChat_tweak** — iOS版功能最全的微信插件，支持最新版微信，具备自动抢红包，屏蔽消息和群消息，过滤特定的群聊，防止撤回消息，伪定位 (朋友圈和附近的人)，修改微信运动步数和实时取景做聊天页的背景等功能。

- Repository: https://github.com/itenfay/WeChat_tweak
- Website: https://itenfay.github.io/2017/04/20/ios-reverse-wechat-snatches-red-envelopes-automatically/
- Stars: 1,066 · Forks: 177
- Language: Objective-C
- License: NOASSERTION
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/itenfay-wechat-tweak

## A plugin, not a fork of WeChat

WeChat_tweak describes itself as the most feature-complete WeChat plugin for iOS, supporting the latest version of WeChat, and the mechanism matters for understanding the whole project. It is not a fork of the WeChat application. It is a dynamic library that gets injected into the running WeChat binary, and the repository root has a `Dynamic library/` directory holding both the raw dylib and a modified dylib that can be injected directly. The primary language is Objective-C, the topics list the usual iOS reverse engineering vocabulary with theos, tweak, hook, iosopendev, resign, dynamic-library, plist and xm among them, and the last push was on 2026-05-31. The licence is stated in the README as MIT, although the repository metadata classifies it as a custom licence that GitHub cannot categorise, so the file in the root is the thing to read. The homepage is a blog post about automatically snatching red envelopes on iOS.

## The six features, and the ones that are about discretion

The feature list is organised around six claims, and three of them are really about behaviour that a user would notice. The plugin UI is embedded in WeChat's own settings, and once the features are enabled all the tasks run silently without interfering with normal use. Second, the delay before a red envelope is taken is configurable, explicitly to avoid being blocked or kicked out of a group for grabbing too fast. Third, there is a setting to prevent grabbing multiple red envelopes at once, described as avoiding being detected as using a plugin. Those three are the design centre of the project, and they tell you the intended use is a group chat with friends rather than a competition. The other three are utility features: filtering specific group chats so you do not end up grabbing envelopes in a family, friends or work group; faking the location so you can change where the phone thinks it is, for the Moments feed and for people nearby; and blocking messages and group messages from specific people, plus preventing message recall so a retracted message stays visible. The list also includes editing the WeChat step count and using the live camera view as the chat page background.

## The tool chain for injecting a dylib

The `Hook-Tools/` directory is the practical part of the repository, and it is a curated set of the tools needed to reverse engineer and instrument an iOS app. `dumpdecrypted` decrypts the iOS executable, and the note says it may not be needed when the app is already decrypted. `otool` comes with macOS and is used to check the dependencies of the decrypted file, and `install_name_tool`, also standard on macOS, changes a dynamic library's dependencies. `yoyolib` injects a dylib into an iOS executable, and `optool` injects a dynamic library into a target binary. `class-dump` exports all of an app's headers, with the example `class-dump -s -S -H ~/Desktop/xx.app -o ~/Desktop/xx-headers`. `ldid` is used to sign iOS executables and replaces Xcode's own signing tool on a jailbroken device. `PackageApplication` packages an ipa file through a script, `010Editor701` is a hex editor with template and script support, and `MachOView` analyses mach-o files. `DYFCodesign` re-signs an iOS app by script, and ios-app-signer is a graphical tool for packaging and re-signing.

## Building the tweak source, and why theos is recommended

The plugin source lives in `WeChatPluginDev/`, in a directory named `wapleodtcorexpc`, which is the name of the WeChat extension process the tweak targets. The `Resources/` directory holds the AppIcon set, with an icon for the red envelope feature, and the audio files the plugin plays. The README points at iOSOpenDev for the Xcode enhancement tools used to generate the dylib for injection, and it recommends using theos to compile the tweak project to produce that dylib. The development instructions and the ipa extraction steps are in a separate `README-dev.md` in the root. The reason a plugin targets an extension process rather than the main app is worth understanding if you are new to this kind of work. WeChat runs parts of itself as separate helper processes, and a tweak that hooks into the process that handles a given feature is more stable than one that hooks the main binary.

## Modifying the app bundle before injection

The installation sequence is a set of bundle edits, and the README walks through them with screenshots. You unpack the ipa, enter the WeChat directory by right-clicking WeChat.app and choosing to show package contents, find the Info.plist and open it in Xcode by double-clicking, then change the Bundle display name and the Bundle identifier, set the value of WeChatBundleVersion to the value of Bundle version, change the URL types URL identifier to the new Bundle identifier, and delete the build_time, by, path, rev, tag, uuid and ver keys. You then delete the files in the PlugIns and Watch directories, and remove the `_CFBundleDisplayName` entries from the InfoPlist.strings files in the zh_CN, zh_HK, zh_TW and en localisations. Finally you delete the entitlements, and there are seven of them, `Entitlements_for_appstore.plist`, `Entitlements_for_ext.plist`, `Entitlements_for_jailbreak.plist`, `Entitlements_wc_for_ext.plist`, `Entitlements_wc.plist`, `Entitlements_wx_for_ext.plist` and `Entitlements_wx.plist`. Removing the entitlements is what allows the re-signed app to run with the injected library.

## Re-signing the dynamic libraries, one by one

The re-signing step is the longest command sequence in the README, and the reason is that a modified bundle invalidates every signature inside it. You open Keychain Access, go to My Certificates, find the certificate to sign with, right-click for Show Info, take the common name and copy the string after it. Then each library is re-signed in turn with `codesign -f -s`, and the list is longer than most people expect:

```
codesign -f -s "iPhone Developer: xxx@qq.com (9ZU3R2F3D4)" Payload/WeChat.app/waplesubstrate
codesign -f -s "iPhone Developer: xxx@qq.com (9ZU3R2F3D4)" Payload/WeChat.app/wapleodtcorexpc
codesign -f -s "iPhone Developer: xxx@qq.com (9ZU3R2F3D4)" Payload/WeChat.app/Frameworks/andromeda.framework
codesign -f -s "iPhone Developer: xxx@qq.com (9ZU3R2F3D4)" Payload/WeChat.app/Frameworks/mars.framework
codesign -f -s "iPhone Developer: xxx@qq.com (9ZU3R2F3D4)" Payload/WeChat.app/Frameworks/marsbridgenetwork.framework
codesign -f -s "iPhone Developer: xxx@qq.com (9ZU3R2F3D4)" Payload/WeChat.app/Frameworks/matrixreport.framework
codesign -f -s "iPhone Developer: xxx@qq.com (9ZU3R2F3D4)" Payload/WeChat.app/Frameworks/OpenSSL.framework
codesign -f -s "iPhone Developer: xxx@qq.com (9ZU3R2F3D4)" Payload/WeChat.app/Frameworks/ProtobufLite.framework
```

Each command prints a line saying it is replacing the existing signature. The list covers two injected binaries and six frameworks that WeChat ships with their own signatures, and each has to be re-signed in turn.

## Provisioning profiles, and the cost of this approach

The app itself is re-signed afterwards, and the profile step is what makes the difference between an ad hoc install and one that survives. You open the Provisioning Profiles directory, which the README gives as `open ~/Library/MobileDevice/Provisioning\ Profiles/`, switch the Finder view to a column or gallery layout and click through the `.mobileprovision` files to find the one whose Bundle identifier matches, or you download the certificate and the profile from the Apple developer portal and import them. You can also inspect the files with `cat`, or copy the one you want to the desktop with `cp`. The practical cost of this whole approach is the maintenance loop. Every WeChat release changes the binary, and a plugin that hooks internal classes and methods can break when the class it hooks is renamed or its signature changes. The repository says it supports the latest WeChat, and the last push was on 2026-05-31, so the maintainer is updating against releases, but a user installing this is taking on the work of re-doing the bundle edits, the injection and the re-signing after each update, and the `Dynamic library/` directory with prebuilt binaries is there so most people do not have to compile it themselves.

## Conclusion

Adopt WeChat_tweak only on a device you own, if you already have a jailbroken iOS setup and the patience to re-sign WeChat and several of its frameworks after every update. Skip it if you have no jailbreak, if you are on a device you do not own, or if you rely on the official app store version of WeChat, since this is an injected dylib rather than an app store release. Before you start, note that the repository ships prebuilt dynamic libraries alongside the source, that the injection targets the `Payload/WeChat.app` bundle, and that a WeChat update will invalidate the injection until the tweak is recompiled and re-signed.

## FAQ

### What does the WeChat_tweak plugin add to WeChat?

Automatic red envelope collection with a configurable delay and an option to avoid grabbing several at once, blocking of messages and group messages from specific people, filtering of particular group chats, prevention of message recall, fake location for the Moments feed and people nearby, editing of the WeChat step count, and using the live camera view as the chat page background.

### How is the WeChat_tweak plugin installed?

By injecting a dylib into the WeChat app. You unpack the ipa, edit Info.plist and remove the entitlements and the PlugIns and Watch contents, place the dynamic library in the bundle, then re-sign each embedded library and framework with codesign -f -s and re-sign the app with a matching provisioning profile.

### Which tools does the WeChat_tweak repository bundle?

The Hook-Tools directory holds dumpdecrypted for decrypting iOS executables, yoyolib and optool for injecting dylibs, class-dump for exporting headers, ldid for signing, MachOView for mach-o analysis, 010Editor for hex editing, plus otool and install_name_tool, which ship with macOS, and PackageApplication and DYFCodesign for packaging and re-signing.

### Does WeChat_tweak need a jailbroken iPhone?

The repository's tooling includes ldid described as replacing Xcode's own signing tool on a jailbroken iOS device, and the injection is into a WeChat bundle you re-sign yourself, which is the jailbreak tweak model. The README does not describe an alternative path that avoids a jailbroken device.

## Sources

- [Issues](https://github.com/itenfay/WeChat_tweak/issues)
- [itenfay/WeChat_tweak on GitHub](https://github.com/itenfay/WeChat_tweak)
- [Project website](https://itenfay.github.io/2017/04/20/ios-reverse-wechat-snatches-red-envelopes-automatically/)
- [README](https://github.com/itenfay/WeChat_tweak/blob/master/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/itenfay-wechat-tweak