# Bug: `wx history` / `wx export` fails on WeChat Linux 4.1.1

[Caulkin]

Bug: wx history / wx export fails on WeChat Linux 4.1.1

Description

wx history and wx export fail with 找不到 XXX 的消息记录 on WeChat Linux 4.1.1. The root cause is that crypto::full_decrypt decrypts message databases but produces files that are not valid SQLite databases.

Environment

• wx-cli: v0.3.0
• OS: Linux 6.17.0-29-generic (Ubuntu 24.04)
• WeChat: 4.1.1.4 (deb package, amd64)

Steps to reproduce

1. sudo wx init --force → 16 keys extracted successfully ✅
2. wx history <contact> → 找不到 XXX 的消息记录 ❌
3. wx export <contact> -f markdown → same error ❌

Debug findings

• Daemon log shows [cache] 全量解密 message/message_0.db (64ms) — reports success
• But decrypted cache file header is 9552 ba8b 67e2 bd38... instead of SQLite format 3\x00
• Manual AES-256-CBC with the extracted key also produces garbage
• Only message/*.db and media_0.db are affected;
  contact/*.db, session/*.db, sns/*.db decrypt correctly

Commands that still work

• wx sessions ✅
• wx contacts ✅
• wx biz-articles ✅
• wx sns-feed / sns-notifications / sns-search ✅

Suspected cause

SQLCipher parameters at src/crypto/mod.rs:

• PAGE_SZ = 4096, SALT_SZ = 16, RESERVE_SZ = 80
• Direct AES-256-CBC without KDF (enc_key is used as AES key directly)

WeChat 4.x may use different page size, reserve size, or KDF method for message databases.