Gwxapkg
A Go-based wxapkg unpacker with AST-level deobfuscation and a built-in security scanner: 920 sensitive-data rules, API/route maps, and Excel/HTML audit reports with risk grading.
Try it now
GPT-4oWhat is Gwxapkg?
Gwxapkg is a Go command-line tool that goes beyond plain unpacking: it auto-scans the macOS/Windows WeChat cache, auto-decrypts PC packages, processes an AppID's main and sub packages together, and fully restores wxml/wxss/js/json/wxs while beautifying and de-obfuscating JavaScript (expanding string arrays and \x/\u escapes). Its AST 'deep' mode renames minified symbols to semantic names and writes traceable rename maps/diffs/patches with rollback. For auditors it builds an API semantic view (api_map, call chains, pseudo-code, Burp request linking) and a page-route map, then runs 920 built-in sensitive-information rules with false-positive filtering and de-duplication, extracts endpoints (exportable to Postman), and produces multi-sheet Excel and interactive HTML reports with file paths, line numbers and high/mid/low risk levels. MIT-licensed; it is a CLI (run from a terminal, not by double-clicking).
Pros
- Combines unpacking, deobfuscation and security auditing in one tool.
- Traceable AST rename with rollback is unique for audits.
- Ready-made Excel/HTML reports speed up compliance work.
- Endpoint extraction with Postman export.
- MIT-licensed and cross-platform.
Cons
- Feature-rich CLI with a steeper learning curve.
- Security rules still need manual review to confirm findings.
- Large packages can be memory-intensive.
- Terminal only; double-clicking the exe just closes it.
Compare with Alternatives
| Feature | Gwxapkg | KillWxapkg | unveilr | wedecode |
|---|---|---|---|---|
| Rating | 0.0 | 0.0 | 0.0 | 0.0 |
| Pricing | Free | Free | Free | Free |
| Starting From | — | — | — | — |
| API | — | — | — | — |
| Free Tier | — | — | — | — |
| Mobile App | — | — | — | — |
Who is it for
Security teams
Run sensitive-data and secret leakage audits on authorized apps.
Penetration testers
Map endpoints and link Burp traffic back to source code.
Compliance auditors
Produce risk-graded Excel/HTML evidence reports.
Reverse engineers
Deobfuscate and semantically rename compressed JS.
Developers
Rebuild and understand a multi-subpackage project structure.