支持朋友圈图片解密；视频解密；实况渲染

electron/main.ts

@@ -18,7 +18,7 @@ import { exportService, ExportOptions, ExportProgress } from './services/exportS
 import { KeyService } from './services/keyService'
 import { voiceTranscribeService } from './services/voiceTranscribeService'
 import { videoService } from './services/videoService'
-import { snsService } from './services/snsService'
+import { snsService, isVideoUrl } from './services/snsService'
 import { contactExportService } from './services/contactExportService'
 import { windowsHelloService } from './services/windowsHelloService'
 import { llamaService } from './services/llamaService'
@@ -104,7 +104,8 @@ function createWindow(options: { autoShow?: boolean } = {}) {
     webPreferences: {
       preload: join(__dirname, 'preload.js'),
       contextIsolation: true,
-      nodeIntegration: false
+      nodeIntegration: false,
+      webSecurity: false // Allow loading local files (video playback)
     },
     titleBarStyle: 'hidden',
     titleBarOverlay: {
@@ -938,6 +939,42 @@ function registerIpcHandlers() {
     return snsService.proxyImage(url, key)
   })
 
+  ipcMain.handle('sns:downloadImage', async (_, payload: { url: string; key?: string | number }) => {
+    try {
+      const { url, key } = payload
+      const result = await snsService.downloadImage(url, key)
+
+      if (!result.success || !result.data) {
+        return { success: false, error: result.error || '下载图片失败' }
+      }
+
+      const { dialog } = await import('electron')
+      const ext = (result.contentType || '').split('/')[1] || 'jpg'
+      const defaultPath = `SNS_${Date.now()}.${ext}`
+
+
+      const filters = isVideoUrl(url)
+        ? [{ name: 'Videos', extensions: ['mp4', 'mov', 'avi', 'mkv'] }]
+        : [{ name: 'Images', extensions: [ext, 'jpg', 'jpeg', 'png', 'webp', 'gif'] }]
+
+      const { filePath, canceled } = await dialog.showSaveDialog({
+        defaultPath,
+        filters
+      })
+
+      if (canceled || !filePath) {
+        return { success: false, error: '用户已取消' }
+      }
+
+      const fs = await import('fs/promises')
+      await fs.writeFile(filePath, result.data)
+
+      return { success: true, filePath }
+    } catch (e) {
+      return { success: false, error: String(e) }
+    }
+  })
+
   // 私聊克隆
 
 

electron/preload.ts

@@ -271,7 +271,8 @@ contextBridge.exposeInMainWorld('electronAPI', {
     getTimeline: (limit: number, offset: number, usernames?: string[], keyword?: string, startTime?: number, endTime?: number) =>
       ipcRenderer.invoke('sns:getTimeline', limit, offset, usernames, keyword, startTime, endTime),
     debugResource: (url: string) => ipcRenderer.invoke('sns:debugResource', url),
-    proxyImage: (payload: { url: string; key?: string | number }) => ipcRenderer.invoke('sns:proxyImage', payload)
+    proxyImage: (payload: { url: string; key?: string | number }) => ipcRenderer.invoke('sns:proxyImage', payload),
+    downloadImage: (payload: { url: string; key?: string | number }) => ipcRenderer.invoke('sns:downloadImage', payload)
   },
 
   // Llama AI

electron/services/chatService.ts

@@ -141,10 +141,10 @@ class ChatService {
 
   constructor() {
     this.configService = new ConfigService()
-    this.contactCacheService = new ContactCacheService(this.configService.get('cachePath'))
+    this.contactCacheService = new ContactCacheService(this.configService.getCacheBasePath())
     const persisted = this.contactCacheService.getAllEntries()
     this.avatarCache = new Map(Object.entries(persisted))
-    this.messageCacheService = new MessageCacheService(this.configService.get('cachePath'))
+    this.messageCacheService = new MessageCacheService(this.configService.getCacheBasePath())
   }
 
   /**

electron/services/config.ts

@@ -1,3 +1,5 @@
+import { join } from 'path'
+import { app } from 'electron'
 import Store from 'electron-store'
 
 interface ConfigSchema {
@@ -111,6 +113,14 @@ export class ConfigService {
     this.store.set(key, value)
   }
 
+  getCacheBasePath(): string {
+    const configured = this.get('cachePath')
+    if (configured && configured.trim().length > 0) {
+      return configured
+    }
+    return join(app.getPath('documents'), 'WeFlow')
+  }
+
   getAll(): ConfigSchema {
     return this.store.store
   }

electron/services/contactCacheService.ts

@@ -1,6 +1,7 @@
 import { join, dirname } from 'path'
 import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'fs'
 import { app } from 'electron'
+import { ConfigService } from './config'
 
 export interface ContactCacheEntry {
   displayName?: string
@@ -15,7 +16,7 @@ export class ContactCacheService {
   constructor(cacheBasePath?: string) {
     const basePath = cacheBasePath && cacheBasePath.trim().length > 0
       ? cacheBasePath
-      : join(app.getPath('documents'), 'WeFlow')
+      : ConfigService.getInstance().getCacheBasePath()
     this.cacheFilePath = join(basePath, 'contacts.json')
     this.ensureCacheDir()
     this.loadCache()

electron/services/isaac64.ts

@@ -0,0 +1,121 @@
+/**
+ * ISAAC-64: A fast cryptographic PRNG
+ * Re-implemented in TypeScript using BigInt for 64-bit support.
+ * Used for WeChat Channels/SNS video decryption.
+ */
+
+export class Isaac64 {
+    private mm = new BigUint64Array(256);
+    private aa = 0n;
+    private bb = 0n;
+    private cc = 0n;
+    private randrsl = new BigUint64Array(256);
+    private randcnt = 0;
+    private static readonly MASK = 0xFFFFFFFFFFFFFFFFn;
+
+    constructor(seed: number | string | bigint) {
+        const seedBig = BigInt(seed);
+        // 通常单密钥初始化是将密钥放在第一个槽位，其余清零（或者按某种规律填充）
+        // 这里我们尝试仅设置第一个槽位，这在很多 WASM 移植版本中更为常见
+        this.randrsl.fill(0n);
+        this.randrsl[0] = seedBig;
+        this.init(true);
+    }
+
+    private init(flag: boolean) {
+        let a: bigint, b: bigint, c: bigint, d: bigint, e: bigint, f: bigint, g: bigint, h: bigint;
+        a = b = c = d = e = f = g = h = 0x9e3779b97f4a7c15n;
+
+        const mix = () => {
+            a = (a - e) & Isaac64.MASK; f ^= (h >> 9n); h = (h + a) & Isaac64.MASK;
+            b = (b - f) & Isaac64.MASK; g ^= (a << 9n) & Isaac64.MASK; a = (a + b) & Isaac64.MASK;
+            c = (c - g) & Isaac64.MASK; h ^= (b >> 23n); b = (b + c) & Isaac64.MASK;
+            d = (d - h) & Isaac64.MASK; a ^= (c << 15n) & Isaac64.MASK; c = (c + d) & Isaac64.MASK;
+            e = (e - a) & Isaac64.MASK; b ^= (d >> 14n); d = (d + e) & Isaac64.MASK;
+            f = (f - b) & Isaac64.MASK; c ^= (e << 20n) & Isaac64.MASK; e = (e + f) & Isaac64.MASK;
+            g = (g - c) & Isaac64.MASK; d ^= (f >> 17n); f = (f + g) & Isaac64.MASK;
+            h = (h - d) & Isaac64.MASK; e ^= (g << 14n) & Isaac64.MASK; g = (g + h) & Isaac64.MASK;
+        };
+
+        for (let i = 0; i < 4; i++) mix();
+
+        for (let i = 0; i < 256; i += 8) {
+            if (flag) {
+                a = (a + this.randrsl[i]) & Isaac64.MASK;
+                b = (b + this.randrsl[i + 1]) & Isaac64.MASK;
+                c = (c + this.randrsl[i + 2]) & Isaac64.MASK;
+                d = (d + this.randrsl[i + 3]) & Isaac64.MASK;
+                e = (e + this.randrsl[i + 4]) & Isaac64.MASK;
+                f = (f + this.randrsl[i + 5]) & Isaac64.MASK;
+                g = (g + this.randrsl[i + 6]) & Isaac64.MASK;
+                h = (h + this.randrsl[i + 7]) & Isaac64.MASK;
+            }
+            mix();
+            this.mm[i] = a; this.mm[i + 1] = b; this.mm[i + 2] = c; this.mm[i + 3] = d;
+            this.mm[i + 4] = e; this.mm[i + 5] = f; this.mm[i + 6] = g; this.mm[i + 7] = h;
+        }
+
+        if (flag) {
+            for (let i = 0; i < 256; i += 8) {
+                a = (a + this.mm[i]) & Isaac64.MASK;
+                b = (b + this.mm[i + 1]) & Isaac64.MASK;
+                c = (c + this.mm[i + 2]) & Isaac64.MASK;
+                d = (d + this.mm[i + 3]) & Isaac64.MASK;
+                e = (e + this.mm[i + 4]) & Isaac64.MASK;
+                f = (f + this.mm[i + 5]) & Isaac64.MASK;
+                g = (g + this.mm[i + 6]) & Isaac64.MASK;
+                h = (h + this.mm[i + 7]) & Isaac64.MASK;
+                mix();
+                this.mm[i] = a; this.mm[i + 1] = b; this.mm[i + 2] = c; this.mm[i + 3] = d;
+                this.mm[i + 4] = e; this.mm[i + 5] = f; this.mm[i + 6] = g; this.mm[i + 7] = h;
+            }
+        }
+
+        this.isaac64();
+        this.randcnt = 256;
+    }
+
+    private isaac64() {
+        this.cc = (this.cc + 1n) & Isaac64.MASK;
+        this.bb = (this.bb + this.cc) & Isaac64.MASK;
+        for (let i = 0; i < 256; i++) {
+            let x = this.mm[i];
+            switch (i & 3) {
+                case 0: this.aa = (this.aa ^ (((this.aa << 21n) & Isaac64.MASK) ^ Isaac64.MASK)) & Isaac64.MASK; break;
+                case 1: this.aa = (this.aa ^ (this.aa >> 5n)) & Isaac64.MASK; break;
+                case 2: this.aa = (this.aa ^ ((this.aa << 12n) & Isaac64.MASK)) & Isaac64.MASK; break;
+                case 3: this.aa = (this.aa ^ (this.aa >> 33n)) & Isaac64.MASK; break;
+            }
+            this.aa = (this.mm[(i + 128) & 255] + this.aa) & Isaac64.MASK;
+            const y = (this.mm[Number(x >> 3n) & 255] + this.aa + this.bb) & Isaac64.MASK;
+            this.mm[i] = y;
+            this.bb = (this.mm[Number(y >> 11n) & 255] + x) & Isaac64.MASK;
+            this.randrsl[i] = this.bb;
+        }
+    }
+
+    public getNext(): bigint {
+        if (this.randcnt === 0) {
+            this.isaac64();
+            this.randcnt = 256;
+        }
+        return this.randrsl[256 - (this.randcnt--)];
+    }
+
+    /**
+     * Generates a keystream of the specified size (in bytes).
+     * @param size Size of the keystream in bytes (must be multiple of 8)
+     * @returns Buffer containing the keystream
+     */
+    public generateKeystream(size: number): Buffer {
+        const stream = new BigUint64Array(size / 8);
+        for (let i = 0; i < stream.length; i++) {
+            stream[i] = this.getNext();
+        }
+        // WeChat's logic specifically reverses the entire byte array
+        const buffer = Buffer.from(stream.buffer);
+        // 注意：根据 worker.html 的逻辑，它是对 Uint8Array 执行 reverse()
+        // Array.from(wasmArray).reverse()
+        return buffer.reverse();
+    }
+}

electron/services/messageCacheService.ts

@@ -1,6 +1,7 @@
 import { join, dirname } from 'path'
 import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'fs'
 import { app } from 'electron'
+import { ConfigService } from './config'
 
 export interface SessionMessageCacheEntry {
   updatedAt: number
@@ -15,7 +16,7 @@ export class MessageCacheService {
   constructor(cacheBasePath?: string) {
     const basePath = cacheBasePath && cacheBasePath.trim().length > 0
       ? cacheBasePath
-      : join(app.getPath('documents'), 'WeFlow')
+      : ConfigService.getInstance().getCacheBasePath()
     this.cacheFilePath = join(basePath, 'session-messages.json')
     this.ensureCacheDir()
     this.loadCache()

electron/services/snsService.ts

@@ -1,8 +1,11 @@
 import { wcdbService } from './wcdbService'
 import { ConfigService } from './config'
 import { ContactCacheService } from './contactCacheService'
-import { existsSync } from 'fs'
+import { existsSync, mkdirSync } from 'fs'
+import { readFile, writeFile, mkdir } from 'fs/promises'
 import { basename, join } from 'path'
+import crypto from 'crypto'
+import { WasmService } from './wasmService'
 
 export interface SnsLivePhoto {
     url: string
@@ -37,81 +40,140 @@ export interface SnsPost {
     rawXml?: string
 }
 
-const WEIXIN_DLL_OFFSET = 0x2674280n
 
-const fixSnsUrl = (url: string, token?: string) => {
+
+const fixSnsUrl = (url: string, token?: string, isVideo: boolean = false) => {
     if (!url) return url
 
-    let fixedUrl = url.replace('http://', 'https://').replace(/\/150($|\?)/, '/0$1')
+    let fixedUrl = url.replace('http://', 'https://')
+
+    // 只有非视频（即图片）才需要处理 /150 变 /0
+    if (!isVideo) {
+        fixedUrl = fixedUrl.replace(/\/150($|\?)/, '/0$1')
+    }
+
     if (!token || fixedUrl.includes('token=')) return fixedUrl
 
+    // 根据用户要求，视频链接组合方式为: BASE_URL + "?" + "token=" + token + "&idx=1" + 原有参数
+    if (isVideo) {
+        const urlParts = fixedUrl.split('?')
+        const baseUrl = urlParts[0]
+        const existingParams = urlParts[1] ? `&${urlParts[1]}` : ''
+        return `${baseUrl}?token=${token}&idx=1${existingParams}`
+    }
+
     const connector = fixedUrl.includes('?') ? '&' : '?'
     return `${fixedUrl}${connector}token=${token}&idx=1`
 }
 
 const detectImageMime = (buf: Buffer, fallback: string = 'image/jpeg') => {
     if (!buf || buf.length < 4) return fallback
+
+    // JPEG
     if (buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return 'image/jpeg'
 
+    // PNG
     if (
         buf.length >= 8 &&
         buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47 &&
         buf[4] === 0x0d && buf[5] === 0x0a && buf[6] === 0x1a && buf[7] === 0x0a
     ) return 'image/png'
 
+    // GIF
     if (buf.length >= 6) {
         const sig = buf.subarray(0, 6).toString('ascii')
         if (sig === 'GIF87a' || sig === 'GIF89a') return 'image/gif'
     }
 
+    // WebP
     if (
         buf.length >= 12 &&
         buf[0] === 0x52 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x46 &&
         buf[8] === 0x57 && buf[9] === 0x45 && buf[10] === 0x42 && buf[11] === 0x50
     ) return 'image/webp'
 
+    // BMP
     if (buf[0] === 0x42 && buf[1] === 0x4d) return 'image/bmp'
+
+    // MP4: 00 00 00 18 / 20 / ... + 'ftyp'
+    if (buf.length > 8 && buf[4] === 0x66 && buf[5] === 0x74 && buf[6] === 0x79 && buf[7] === 0x70) return 'video/mp4'
+
+    // Fallback logic for video
+    if (fallback.includes('video') || fallback.includes('mp4')) return 'video/mp4'
+
     return fallback
 }
 
+export const isVideoUrl = (url: string) => {
+    if (!url) return false
+    // 排除 vweixinthumb 域名 (缩略图)
+    if (url.includes('vweixinthumb')) return false
+    return url.includes('snsvideodownload') || url.includes('video') || url.includes('.mp4')
+}
+
+import { Isaac64 } from './isaac64'
+
+const extractVideoKey = (xml: string): string | undefined => {
+    if (!xml) return undefined
+    // 匹配 <enc key="2105122989" ... /> 或 <enc key="2105122989">
+    const match = xml.match(/<enc\s+key="(\d+)"/i)
+    return match ? match[1] : undefined
+}
+
 class SnsService {
     private configService: ConfigService
     private contactCache: ContactCacheService
     private imageCache = new Map<string, string>()
 
-    private nativeDecryptInit = false
-    private nativeDecryptReady = false
-    private nativeDecryptError = ''
-    private nativeDecryptDllPath = ''
-    private nativeKoffi: any = null
-    private nativeWeixinLib: any = null
-    private nativeDecryptFn: any = null
-
     constructor() {
         this.configService = new ConfigService()
         this.contactCache = new ContactCacheService(this.configService.get('cachePath') as string)
     }
 
+    private getSnsCacheDir(): string {
+        const cachePath = this.configService.getCacheBasePath()
+        const snsCacheDir = join(cachePath, 'sns_cache')
+        if (!existsSync(snsCacheDir)) {
+            mkdirSync(snsCacheDir, { recursive: true })
+        }
+        return snsCacheDir
+    }
+
+    private getCacheFilePath(url: string): string {
+        const hash = crypto.createHash('md5').update(url).digest('hex')
+        const ext = isVideoUrl(url) ? '.mp4' : '.jpg'
+        return join(this.getSnsCacheDir(), `${hash}${ext}`)
+    }
+
     async getTimeline(limit: number = 20, offset: number = 0, usernames?: string[], keyword?: string, startTime?: number, endTime?: number): Promise<{ success: boolean; timeline?: SnsPost[]; error?: string }> {
         const result = await wcdbService.getSnsTimeline(limit, offset, usernames, keyword, startTime, endTime)
 
         if (result.success && result.timeline) {
             const enrichedTimeline = result.timeline.map((post: any) => {
                 const contact = this.contactCache.get(post.username)
+                const isVideoPost = post.type === 15
+
+                // 尝试从 rawXml 中提取视频解密密钥 (针对视频号视频)
+                const videoKey = extractVideoKey(post.rawXml || '')
+
                 const fixedMedia = (post.media || []).map((m: any) => ({
-                    url: fixSnsUrl(m.url, m.token),
-                    thumb: fixSnsUrl(m.thumb, m.token),
+                    // 如果是视频动态，url 是视频，thumb 是缩略图
+                    url: fixSnsUrl(m.url, m.token, isVideoPost),
+                    thumb: fixSnsUrl(m.thumb, m.token, false),
                     md5: m.md5,
                     token: m.token,
-                    key: m.key,
+                    // 只有在视频动态 (Type 15) 下才尝试将 XML 提取的 videoKey 赋予主媒体
+                    // 对于图片或实况照片的静态部分，应保留原始 m.key (由 DLL/DB 提供)，避免由于错误的 Isaac64 密钥导致图片解密损坏
+                    key: isVideoPost ? (videoKey || m.key) : m.key,
                     encIdx: m.encIdx || m.enc_idx,
                     livePhoto: m.livePhoto
                         ? {
                             ...m.livePhoto,
-                            url: fixSnsUrl(m.livePhoto.url, m.livePhoto.token),
-                            thumb: fixSnsUrl(m.livePhoto.thumb, m.livePhoto.token),
+                            url: fixSnsUrl(m.livePhoto.url, m.livePhoto.token, true),
+                            thumb: fixSnsUrl(m.livePhoto.thumb, m.livePhoto.token, false),
                             token: m.livePhoto.token,
-                            key: m.livePhoto.key,
+                            // 实况照片的视频部分优先使用从 XML 提取的 Key
+                            key: videoKey || m.livePhoto.key || m.key,
                             encIdx: m.livePhoto.encIdx || m.livePhoto.enc_idx
                         }
                         : undefined
@@ -172,126 +234,9 @@ class SnsService {
         })
     }
 
-    private parseSnsKey(key?: string | number): bigint | null {
-        if (key === undefined || key === null) return null
-        if (typeof key === 'number') return BigInt(Math.trunc(key))
-        const raw = String(key).trim()
-        if (!raw) return null
-        try {
-            return BigInt(raw)
-        } catch {
-            return null
-        }
-    }
-    private resolveWeixinDllPath(): string | null {
-        const candidates: string[] = []
 
-        if (process.env.WEFLOW_WEIXIN_DLL) candidates.push(process.env.WEFLOW_WEIXIN_DLL)
 
-        const configuredPath = String(this.configService.get('weixinDllPath') || '').trim()
-        if (configuredPath) candidates.push(configuredPath)
-
-        const weixinExe = process.env.WEFLOW_WEIXIN_EXE
-        if (weixinExe) {
-            const dir = weixinExe.replace(/\\Weixin\.exe$/i, '')
-            if (dir && dir !== weixinExe) candidates.push(join(dir, 'Weixin.dll'))
-        }
-
-        const programFiles = process.env.ProgramFiles || 'C:\\Program Files'
-        const localAppData = process.env.LOCALAPPDATA || ''
-        candidates.push(join(programFiles, 'Tencent', 'Weixin', 'Weixin.dll'))
-        if (localAppData) candidates.push(join(localAppData, 'Tencent', 'xwechat', 'Weixin.dll'))
-
-        const seen = new Set<string>()
-        for (const p of candidates) {
-            if (!p) continue
-            const normalized = p.trim()
-            if (!normalized || seen.has(normalized)) continue
-            seen.add(normalized)
-            if (existsSync(normalized)) return normalized
-        }
-        return null
-    }
-    private ensureNativeDecryptor(): boolean {
-        const configuredPath = String(this.configService.get('weixinDllPath') || '').trim()
-        if (this.nativeDecryptInit && !this.nativeDecryptReady && configuredPath && configuredPath !== this.nativeDecryptDllPath) {
-            this.nativeDecryptInit = false
-        }
-
-        if (this.nativeDecryptInit) return this.nativeDecryptReady
-        this.nativeDecryptInit = true
-
-        try {
-            const dllPath = this.resolveWeixinDllPath()
-            if (!dllPath) {
-                this.nativeDecryptError = 'Weixin.dll not found, please set it in Settings or WEFLOW_WEIXIN_DLL'
-                return false
-            }
-
-            const koffi = require('koffi')
-            const kernel32 = koffi.load('kernel32.dll')
-            const getModuleHandleW = kernel32.func('void* __stdcall GetModuleHandleW(str16 lpModuleName)')
-
-            const weixinLib = koffi.load(dllPath)
-
-            let modulePtr = getModuleHandleW('Weixin.dll')
-            if (!modulePtr) modulePtr = getModuleHandleW(basename(dllPath))
-            if (!modulePtr) {
-                this.nativeDecryptError = `GetModuleHandleW 失败: ${dllPath}`
-                return false
-            }
-
-            const base = koffi.address(modulePtr) as bigint
-            const decryptAddr = base + WEIXIN_DLL_OFFSET
-
-            // Koffi requires an external pointer object (not raw Number/BigInt).
-            // Build a temporary uint64 box, decode it to void*, then decode function pointer.
-            const addrBox = new BigUint64Array(1)
-            addrBox[0] = decryptAddr
-            const decryptPtr = koffi.decode(addrBox, 'void *')
-            if (!decryptPtr) {
-                this.nativeDecryptError = `Decode function pointer failed: ${decryptAddr.toString(16)}`
-                return false
-            }
-
-            const decryptProto = koffi.proto('uint64 __fastcall SnsImageDecrypt(void* src, uint64 len, void* dst, uint64 key)')
-            this.nativeDecryptFn = koffi.decode(decryptPtr, decryptProto)
-            this.nativeKoffi = koffi
-            this.nativeWeixinLib = weixinLib
-            this.nativeDecryptReady = true
-            this.nativeDecryptDllPath = dllPath
-            console.info('[SNS] Native decrypt enabled:', this.nativeDecryptDllPath)
-            return true
-        } catch (e: any) {
-            this.nativeDecryptError = e?.message || String(e)
-            this.nativeDecryptReady = false
-            console.warn('[SNS] Native decrypt init failed:', this.nativeDecryptError)
-            return false
-        }
-    }
-
-    private decryptSnsEncryptedImage(data: Buffer, key: string | number): Buffer {
-        const parsedKey = this.parseSnsKey(key)
-        if (!parsedKey) return data
-        if (!this.ensureNativeDecryptor()) return data
-
-        const out = Buffer.allocUnsafe(data.length)
-        try {
-            this.nativeDecryptFn(
-                data,
-                BigInt(data.length),
-                out,
-                parsedKey
-            )
-            return out
-        } catch (e: any) {
-            this.nativeDecryptError = e?.message || String(e)
-            console.warn('[SNS] Native decrypt call failed:', this.nativeDecryptError)
-            return data
-        }
-    }
-
-    async proxyImage(url: string, key?: string | number): Promise<{ success: boolean; dataUrl?: string; error?: string }> {
+    async proxyImage(url: string, key?: string | number): Promise<{ success: boolean; dataUrl?: string; videoPath?: string; error?: string }> {
         if (!url) return { success: false, error: 'url 不能为空' }
         const cacheKey = `${url}|${key ?? ''}`
 
@@ -299,6 +244,153 @@ class SnsService {
             return { success: true, dataUrl: this.imageCache.get(cacheKey) }
         }
 
+        const result = await this.fetchAndDecryptImage(url, key)
+        if (result.success) {
+            // 如果是视频，返回本地文件路径 (需配合 webSecurity: false 或自定义协议)
+            if (result.contentType?.startsWith('video/')) {
+                // Return cachePath directly for video
+                // 注意：fetchAndDecryptImage 需要修改以返回 cachePath
+                return { success: true, videoPath: result.cachePath }
+            }
+
+            if (result.data && result.contentType) {
+                const dataUrl = `data:${result.contentType};base64,${result.data.toString('base64')}`
+                this.imageCache.set(cacheKey, dataUrl)
+                return { success: true, dataUrl }
+            }
+        }
+        return { success: false, error: result.error }
+    }
+
+    async downloadImage(url: string, key?: string | number): Promise<{ success: boolean; data?: Buffer; contentType?: string; error?: string }> {
+        return this.fetchAndDecryptImage(url, key)
+    }
+
+    private async fetchAndDecryptImage(url: string, key?: string | number): Promise<{ success: boolean; data?: Buffer; contentType?: string; cachePath?: string; error?: string }> {
+        if (!url) return { success: false, error: 'url 不能为空' }
+
+        const isVideo = isVideoUrl(url)
+        const cachePath = this.getCacheFilePath(url)
+
+        // 1. 尝试从磁盘缓存读取
+        if (existsSync(cachePath)) {
+            try {
+                // 对于视频，不读取整个文件到内存，只确认存在即可
+                if (isVideo) {
+                    return { success: true, cachePath, contentType: 'video/mp4' }
+                }
+
+                const data = await readFile(cachePath)
+                const contentType = detectImageMime(data)
+                return { success: true, data, contentType, cachePath }
+            } catch (e) {
+                console.warn(`[SnsService] 读取缓存失败: ${cachePath}`, e)
+            }
+        }
+
+        if (isVideo) {
+            // 视频专用下载逻辑 (下载 -> 解密 -> 缓存)
+            return new Promise(async (resolve) => {
+                const tmpPath = join(require('os').tmpdir(), `sns_video_${Date.now()}_${Math.random().toString(36).slice(2)}.enc`)
+                console.log(`[SnsService] 开始下载视频到临时文件: ${tmpPath}`)
+
+                try {
+                    const https = require('https')
+                    const urlObj = new URL(url)
+                    const fs = require('fs')
+
+                    const fileStream = fs.createWriteStream(tmpPath)
+
+                    const options = {
+                        hostname: urlObj.hostname,
+                        path: urlObj.pathname + urlObj.search,
+                        method: 'GET',
+                        headers: {
+                            'User-Agent': 'MicroMessenger Client',
+                            'Accept': '*/*',
+                            // 'Accept-Encoding': 'gzip, deflate, br', // 视频流通常不压缩，去掉以免 stream 处理复杂
+                            'Connection': 'keep-alive'
+                        }
+                    }
+
+                    const req = https.request(options, (res: any) => {
+                        if (res.statusCode !== 200 && res.statusCode !== 206) {
+                            fileStream.close()
+                            fs.unlink(tmpPath, () => { }) // 删除临时文件
+                            resolve({ success: false, error: `HTTP ${res.statusCode}` })
+                            return
+                        }
+
+                        res.pipe(fileStream)
+
+                        fileStream.on('finish', async () => {
+                            fileStream.close()
+                            console.log(`[SnsService] 视频下载完成，开始解密... Key: ${key}`)
+
+                            try {
+                                const encryptedBuffer = await readFile(tmpPath)
+                                const raw = encryptedBuffer // 引用，方便后续操作
+
+
+                                if (key && String(key).trim().length > 0) {
+                                    try {
+                                        console.log(`[SnsService] 使用 WASM Isaac64 解密视频... Key: ${key}`)
+                                        const wasmService = WasmService.getInstance()
+                                        // 只需要前 128KB (131072 bytes) 用于解密头部
+                                        const keystream = await wasmService.getKeystream(String(key), 131072)
+
+                                        const decryptLen = Math.min(keystream.length, raw.length)
+
+                                        // XOR 解密
+                                        for (let i = 0; i < decryptLen; i++) {
+                                            raw[i] ^= keystream[i]
+                                        }
+
+                                        // 验证 MP4 签名 ('ftyp' at offset 4)
+                                        const ftyp = raw.subarray(4, 8).toString('ascii')
+                                        if (ftyp === 'ftyp') {
+                                            console.log(`[SnsService] 视频解密成功: ${url}`)
+                                        } else {
+                                            console.warn(`[SnsService] 视频解密可能失败: ${url}, 未找到 ftyp 签名: ${ftyp}`)
+                                            // 打印前 32 字节用于调试
+                                            console.warn(`[SnsService] Decrypted Header (first 32 bytes): ${raw.subarray(0, 32).toString('hex')}`)
+                                        }
+                                    } catch (err) {
+                                        console.error(`[SnsService] 视频解密出错: ${err}`)
+                                    }
+                                } else {
+                                    console.warn(`[SnsService] 未提供 Key，跳过解密，直接保存`)
+                                }
+
+                                // 写入最终缓存 (覆盖)
+                                await writeFile(cachePath, raw)
+                                console.log(`[SnsService] 视频已保存到缓存: ${cachePath}`)
+
+                                // 删除临时文件
+                                try { await import('fs/promises').then(fs => fs.unlink(tmpPath)) } catch (e) { }
+
+                                resolve({ success: true, data: raw, contentType: 'video/mp4', cachePath })
+                            } catch (e: any) {
+                                console.error(`[SnsService] 视频处理失败:`, e)
+                                resolve({ success: false, error: e.message })
+                            }
+                        })
+                    })
+
+                    req.on('error', (e: any) => {
+                        fs.unlink(tmpPath, () => { })
+                        resolve({ success: false, error: e.message })
+                    })
+
+                    req.end()
+
+                } catch (e: any) {
+                    resolve({ success: false, error: e.message })
+                }
+            })
+        }
+
+        // 图片逻辑 (保持流式处理)
         return new Promise((resolve) => {
             try {
                 const https = require('https')
@@ -310,8 +402,8 @@ class SnsService {
                     path: urlObj.pathname + urlObj.search,
                     method: 'GET',
                     headers: {
-                        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 MicroMessenger/7.0.20.1781(0x6700143B) WindowsWechat(0x63090719) XWEB/8351',
-                        'Accept': 'image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8',
+                        'User-Agent': 'MicroMessenger Client',
+                        'Accept': '*/*',
                         'Accept-Encoding': 'gzip, deflate, br',
                         'Accept-Language': 'zh-CN,zh;q=0.9',
                         'Connection': 'keep-alive'
@@ -319,7 +411,7 @@ class SnsService {
                 }
 
                 const req = https.request(options, (res: any) => {
-                    if (res.statusCode !== 200) {
+                    if (res.statusCode !== 200 && res.statusCode !== 206) {
                         resolve({ success: false, error: `HTTP ${res.statusCode}` })
                         return
                     }
@@ -333,17 +425,28 @@ class SnsService {
                     else if (encoding === 'br') stream = res.pipe(zlib.createBrotliDecompress())
 
                     stream.on('data', (chunk: Buffer) => chunks.push(chunk))
-                    stream.on('end', () => {
+                    stream.on('end', async () => {
                         const raw = Buffer.concat(chunks)
                         const xEnc = String(res.headers['x-enc'] || '').trim()
-                        const shouldDecrypt = xEnc === '1' && key !== undefined && key !== null && String(key).trim().length > 0
-                        const decoded = shouldDecrypt ? this.decryptSnsEncryptedImage(raw, key as string | number) : raw
+
+                        let decoded = raw
+
+                        // 图片逻辑
+                        const shouldDecrypt = (xEnc === '1' || !!key) && key !== undefined && key !== null && String(key).trim().length > 0
+                        if (shouldDecrypt) {
+                            const decrypted = await wcdbService.decryptSnsImage(raw, String(key))
+                            decoded = Buffer.from(decrypted)
+                        }
+
+                        // 写入磁盘缓存
+                        try {
+                            await writeFile(cachePath, decoded)
+                        } catch (e) {
+                            console.warn(`[SnsService] 写入缓存失败: ${cachePath}`, e)
+                        }
 
                         const contentType = detectImageMime(decoded, (res.headers['content-type'] || 'image/jpeg') as string)
-                        const dataUrl = `data:${contentType};base64,${decoded.toString('base64')}`
-
-                        this.imageCache.set(cacheKey, dataUrl)
-                        resolve({ success: true, dataUrl })
+                        resolve({ success: true, data: decoded, contentType, cachePath })
                     })
                     stream.on('error', (e: any) => resolve({ success: false, error: e.message }))
                 })

electron/services/videoService.ts

@@ -36,7 +36,7 @@ class VideoService {
      * 获取缓存目录（解密后的数据库存放位置）
      */
     private getCachePath(): string {
-        return this.configService.get('cachePath') || ''
+        return this.configService.getCacheBasePath()
     }
 
     /**
@@ -110,7 +110,7 @@ class VideoService {
             const wxidLower = wxid.toLowerCase()
             const cleanedWxidLower = cleanedWxid.toLowerCase()
             const dbPathContainsWxid = dbPathLower.includes(wxidLower) || dbPathLower.includes(cleanedWxidLower)
-            
+
             const encryptedDbPaths: string[] = []
             if (dbPathContainsWxid) {
                 // dbPath 已包含 wxid，不需要再拼接
@@ -120,15 +120,15 @@ class VideoService {
                 encryptedDbPaths.push(join(dbPath, wxid, 'db_storage', 'hardlink', 'hardlink.db'))
                 encryptedDbPaths.push(join(dbPath, cleanedWxid, 'db_storage', 'hardlink', 'hardlink.db'))
             }
-            
+
             for (const p of encryptedDbPaths) {
                 if (existsSync(p)) {
                     try {
                         const escapedMd5 = md5.replace(/'/g, "''")
-                        
+
                         // 用 md5 字段查询，获取 file_name
                         const sql = `SELECT file_name FROM video_hardlink_info_v4 WHERE md5 = '${escapedMd5}' LIMIT 1`
-                        
+
                         const result = await wcdbService.execQuery('media', p, sql)
 
                         if (result.success && result.rows && result.rows.length > 0) {
@@ -181,7 +181,7 @@ class VideoService {
         const dbPathLower = dbPath.toLowerCase()
         const wxidLower = wxid.toLowerCase()
         const cleanedWxid = this.cleanWxid(wxid)
-        
+
         let videoBaseDir: string
         if (dbPathLower.includes(wxidLower) || dbPathLower.includes(cleanedWxid.toLowerCase())) {
             // dbPath 已经包含 wxid，直接使用
@@ -235,7 +235,7 @@ class VideoService {
      * 根据消息内容解析视频MD5
      */
     parseVideoMd5(content: string): string | undefined {
-        
+
         // 打印前500字符看看 XML 结构
 
         if (!content) return undefined
@@ -252,7 +252,7 @@ class VideoService {
             // 提取 md5（用于查询 hardlink.db）
             // 注意：不是 rawmd5，rawmd5 是另一个值
             // 格式: md5="xxx" 或 <md5>xxx</md5>
-            
+
             // 尝试从videomsg标签中提取md5
             const videoMsgMatch = /<videomsg[^>]*\smd5\s*=\s*['"]([a-fA-F0-9]+)['"]/i.exec(content)
             if (videoMsgMatch) {

electron/services/wasmService.ts

@@ -0,0 +1,175 @@
+
+import path from 'path';
+import fs from 'fs';
+import vm from 'vm';
+
+let app: any;
+try {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    app = require('electron').app;
+} catch (e) {
+    app = { isPackaged: false };
+}
+
+// This service handles the loading and execution of the WeChat WASM module
+// to generate the correct Isaac64 keystream for video decryption.
+export class WasmService {
+    private static instance: WasmService;
+    private module: any = null;
+    private wasmLoaded = false;
+    private initPromise: Promise<void> | null = null;
+    private capturedKeystream: Uint8Array | null = null;
+
+    private constructor() { }
+
+    public static getInstance(): WasmService {
+        if (!WasmService.instance) {
+            WasmService.instance = new WasmService();
+        }
+        return WasmService.instance;
+    }
+
+    private async init(): Promise<void> {
+        if (this.wasmLoaded) return;
+        if (this.initPromise) return this.initPromise;
+
+        this.initPromise = new Promise((resolve, reject) => {
+            try {
+                // For dev, files are in electron/assets/wasm
+                // __dirname in dev (from dist-electron) is .../dist-electron
+                // So we need to go up one level and then into electron/assets/wasm
+                const isDev = !app.isPackaged;
+                const basePath = isDev
+                    ? path.join(__dirname, '../electron/assets/wasm')
+                    : path.join(process.resourcesPath, 'assets/wasm'); // Adjust as needed for production build
+
+                const wasmPath = path.join(basePath, 'wasm_video_decode.wasm');
+                const jsPath = path.join(basePath, 'wasm_video_decode.js');
+
+                console.log('[WasmService] Loading WASM from:', wasmPath);
+
+                if (!fs.existsSync(wasmPath) || !fs.existsSync(jsPath)) {
+                    throw new Error(`WASM files not found at ${basePath}`);
+                }
+
+                const wasmBinary = fs.readFileSync(wasmPath);
+
+                // Emulate Emscripten environment
+                // We must use 'any' for global mocking
+                const mockGlobal: any = {
+                    console: console,
+                    Buffer: Buffer,
+                    Uint8Array: Uint8Array,
+                    Int8Array: Int8Array,
+                    Uint16Array: Uint16Array,
+                    Int16Array: Int16Array,
+                    Uint32Array: Uint32Array,
+                    Int32Array: Int32Array,
+                    Float32Array: Float32Array,
+                    Float64Array: Float64Array,
+                    BigInt64Array: BigInt64Array,
+                    BigUint64Array: BigUint64Array,
+                    Array: Array,
+                    Object: Object,
+                    Function: Function,
+                    String: String,
+                    Number: Number,
+                    Boolean: Boolean,
+                    Error: Error,
+                    Promise: Promise,
+                    require: require,
+                    process: process,
+                    setTimeout: setTimeout,
+                    clearTimeout: clearTimeout,
+                    setInterval: setInterval,
+                    clearInterval: clearInterval,
+                };
+
+                // Define Module
+                mockGlobal.Module = {
+                    onRuntimeInitialized: () => {
+                        console.log("[WasmService] WASM Runtime Initialized");
+                        this.wasmLoaded = true;
+                        resolve();
+                    },
+                    wasmBinary: wasmBinary,
+                    print: (text: string) => console.log('[WASM stdout]', text),
+                    printErr: (text: string) => console.error('[WASM stderr]', text)
+                };
+
+                // Define necessary globals for Emscripten loader
+                mockGlobal.self = mockGlobal;
+                mockGlobal.self.location = { href: jsPath };
+                mockGlobal.WorkerGlobalScope = function () { };
+                mockGlobal.VTS_WASM_URL = `file://${wasmPath}`; // Needs a URL, file protocol works in Node context for our mock?
+
+                // Define the callback function that WASM calls to return data
+                // The WASM module calls `wasm_isaac_generate(ptr, size)`
+                mockGlobal.wasm_isaac_generate = (ptr: number, size: number) => {
+                    // console.log(`[WasmService] wasm_isaac_generate called: ptr=${ptr}, size=${size}`);
+                    const buffer = new Uint8Array(mockGlobal.Module.HEAPU8.buffer, ptr, size);
+                    // Copy the data because WASM memory might change or be invalidated
+                    this.capturedKeystream = new Uint8Array(buffer);
+                };
+
+                // Execute the loader script in the context
+                const jsContent = fs.readFileSync(jsPath, 'utf8');
+                const script = new vm.Script(jsContent, { filename: jsPath });
+
+                // create context
+                const context = vm.createContext(mockGlobal);
+                script.runInContext(context);
+
+                // Store reference to module
+                this.module = mockGlobal.Module;
+
+            } catch (error) {
+                console.error('[WasmService] Failed to initialize WASM:', error);
+                reject(error);
+            }
+        });
+
+        return this.initPromise;
+    }
+
+    public async getKeystream(key: string, size: number = 131072): Promise<Buffer> {
+        await this.init();
+
+        if (!this.module || !this.module.WxIsaac64) {
+            // Fallback check for asm.WxIsaac64 logic if needed, but debug showed it on Module
+            if (this.module.asm && this.module.asm.WxIsaac64) {
+                this.module.WxIsaac64 = this.module.asm.WxIsaac64;
+            }
+        }
+
+        if (!this.module.WxIsaac64) {
+            throw new Error('[WasmService] WxIsaac64 not found in WASM module');
+        }
+
+        try {
+            this.capturedKeystream = null;
+            const isaac = new this.module.WxIsaac64(key);
+            isaac.generate(size); // This triggers the global.wasm_isaac_generate callback
+
+            // Cleanup if possible? isaac.delete()? 
+            // In worker code: p.decryptor.delete()
+            if (isaac.delete) {
+                isaac.delete();
+            }
+
+            if (this.capturedKeystream) {
+                // The worker_release.js logic does: 
+                // p.decryptor_array.set(r.reverse())
+                // So the actual keystream is the REVERSE of what is passed to the callback.
+                const reversed = new Uint8Array(this.capturedKeystream);
+                reversed.reverse();
+                return Buffer.from(reversed);
+            } else {
+                throw new Error('[WasmService] Failed to capture keystream (callback not called)');
+            }
+        } catch (error) {
+            console.error('[WasmService] Error generating keystream:', error);
+            throw error;
+        }
+    }
+}

electron/services/wcdbCore.ts

@@ -64,7 +64,9 @@ export class WcdbCore {
   private wcdbVerifyUser: any = null
   private wcdbStartMonitorPipe: any = null
   private wcdbStopMonitorPipe: any = null
+
   private monitorPipeClient: any = null
+  private wcdbDecryptSnsImage: any = null
 
   private avatarUrlCache: Map<string, { url?: string; updatedAt: number }> = new Map()
   private readonly avatarCacheTtlMs = 10 * 60 * 1000
@@ -137,11 +139,48 @@ export class WcdbCore {
       this.writeLog('Monitor started via named pipe IPC')
       return true
     } catch (e) {
-      console.error('startMonitor failed:', e)
+      console.error('打开数据库异常:', e)
       return false
     }
   }
 
+  /**
+   * 解密朋友圈图片
+   */
+  async decryptSnsImage(encryptedData: Buffer, key: string): Promise<Buffer> {
+    if (!this.initialized) {
+      const initOk = await this.initialize()
+      if (!initOk) return encryptedData
+    }
+
+    if (!this.wcdbDecryptSnsImage) return encryptedData
+
+    try {
+      if (!this.wcdbDecryptSnsImage) {
+        console.error('[WCDB] wcdbDecryptSnsImage func is null')
+        return encryptedData
+      }
+
+      const outPtr = [null as any]
+      // Koffi pass Buffer as char* pointer
+      const result = this.wcdbDecryptSnsImage(encryptedData, encryptedData.length, key, outPtr)
+
+      if (result === 0 && outPtr[0]) {
+        const hex = this.decodeJsonPtr(outPtr[0])
+        if (hex) {
+          return Buffer.from(hex, 'hex')
+        }
+      } else {
+        console.error(`[WCDB] Decrypt SNS image failed with code: ${result}`)
+        // 主动获取 DLL 内部日志以诊断问题
+        await this.printLogs(true)
+      }
+    } catch (e) {
+      console.error('解密图片失败:', e)
+    }
+    return encryptedData
+  }
+
   stopMonitor(): void {
     if (this.monitorPipeClient) {
       this.monitorPipeClient.destroy()
@@ -563,6 +602,13 @@ export class WcdbCore {
         this.wcdbVerifyUser = null
       }
 
+      // wcdb_status wcdb_decrypt_sns_image(const char* encrypted_data, int32_t data_len, const char* key, char** out_hex)
+      try {
+        this.wcdbDecryptSnsImage = this.lib.func('int32 wcdb_decrypt_sns_image(const char* data, int32 len, const char* key, _Out_ void** outHex)')
+      } catch {
+        this.wcdbDecryptSnsImage = null
+      }
+
       // 初始化
       const initResult = this.wcdbInit()
       if (initResult !== 0) {

electron/services/wcdbService.ts

@@ -431,6 +431,13 @@ export class WcdbService {
     return this.callWorker('verifyUser', { message, hwnd })
   }
 
+  /**
+   * 解密朋友圈图片
+   */
+  async decryptSnsImage(encryptedData: Buffer, key: string): Promise<Buffer> {
+    return this.callWorker<Buffer>('decryptSnsImage', { encryptedData, key })
+  }
+
 }
 
 export const wcdbService = new WcdbService()

electron/wcdbWorker.ts

@@ -150,6 +150,9 @@ if (parentPort) {
                 case 'verifyUser':
                     result = await core.verifyUser(payload.message, payload.hwnd)
                     break
+                case 'decryptSnsImage':
+                    result = await core.decryptSnsImage(payload.encryptedData, payload.key)
+                    break
                 default:
                     result = { success: false, error: `Unknown method: ${type}` }
             }

electron/windows/notificationWindow.ts

@@ -76,12 +76,10 @@ export async function showNotification(data: any) {
         const isInList = filterList.includes(sessionId)
         if (filterMode === 'whitelist' && !isInList) {
             // 白名单模式：不在列表中则不显示
-            console.log('[NotificationWindow] Filtered by whitelist:', sessionId)
             return
         }
         if (filterMode === 'blacklist' && isInList) {
             // 黑名单模式：在列表中则不显示
-            console.log('[NotificationWindow] Filtered by blacklist:', sessionId)
             return
         }
     }