A Rust-based WeChat Mini Program (WMPF) remote debugging toolchain — debug WeChat Mini Programs on Windows with Chrome DevTools.
# GitHub CLI
gh repo clone SinJayXie/WMPFDebugger
# Git
git clone https://github.com/SinJayXie/WMPFDebugger.git ┌─────────────┐ ┌────────────────────────────────────────────────────────────────────┐
│ Chrome │ │ wmpf-cli (Host Process) │
│ DevTools │ │ │
│ (Browser) │ │ ┌──────────┐ ┌────────┐ ┌──────────────┐ │
│ │─ws──→│ │ CDP Proxy│────→│ Router │────→│ Debug Server │──protobuf──→ WMPF │
│ │←─ws──│ │ :62000 │←────│ │←────│ :9421 │←─protobuf── Runtime│
└─────────────┘ │ └──────────┘ └────────┘ └──────────────┘ │
│ │ ▲ ▲ │
│ │ │ Command forward │ Message broadcast │
│ └────────┼─────────────────────────────┼──────────────────────────────┘
│ │ │
│ ┌──────────────────┘ │
│ │ ┌───────────────────────────────────┘
│ │ │
│ │ ┌─────────┴─────────────────────────────────────────────────────────────────┐
│ │ │ WeChatAppEx.exe (Target Process) │
│ │ │ │
│ │ │ ┌──────────────┐ ┌──────────────────┐ ┌───────────────────┐ │
│ │ │ │ ① Discovery │────→│ ② DLL Injection │────→│ ③ frida‑gum Hook │ │
└───┼──│ │ Version ID │ │ wmpf_agent.dll │ │ CDP Intercept │ │
│ │ └──────────────┘ └────────┬─────────┘ └─────────┬─────────┘ │
│ │ │ ④ IPC │ │
│ │ ┌─────────┴─────────┐ │ │
│ │ │ Named Pipe comms │←────────────────┘ │
│ │ │ Logs/Heartbeat/Cmd │ │
│ │ └───────────────────┘ │
│ └───────────────────────────────────────────────────────────────────────────┘
│
▼
┌───────────────────┐
│ wmpf-devtools │
│ Tauri v2 GUI │
│ One‑click connect │
└───────────────────┘
| Step | Description |
|---|---|
| ① | Process Discovery — Enumerate WeChatAppEx.exe, match offset config from 48+ supported versions |
| ② | DLL Injection — VirtualAllocEx → WriteProcessMemory → CreateRemoteThread(LoadLibraryW) |
| ③ | frida‑gum Hook — Intercept CDPFilter / OnLoadStart, patch debugging restrictions |
| ④ | IPC — Named Pipe bidirectional communication: agent sends logs & heartbeats, host sends shutdown |
# Clone
git clone https://github.com/SinJayXie/WMPFDebugger.git
cd WMPFDebugger
# Build (release)
cargo build --release
# One‑click packaging (requires Python 3)
python build.pyThe packaging script will: compile → collect exe/dll → UPX compress → output ZIP archive. Artifacts are in:
target/release/
wmpf-cli.exe [OPTIONS]| Option | Description |
|---|---|
--debug-port PORT |
Debug Server port (default: 9421) |
--cdp-port PORT |
CDP Proxy port (default: 62000) |
--debug-hook |
Enable hook debug logging |
--dll-path PATH |
Custom path to wmpf_agent.dll |
wmpf-devtools.exeEnter the WebSocket address and port in the toolbar, then click Connect.
| CLI | GUI |
|---|---|
 |
 |
| Crate | Description |
|---|---|
wmpf-core |
Core protocol: Protobuf codec, zlib compression, constants |
wmpf-net |
Network layer: WebSocket server, CDP proxy, message routing |
wmpf-hook |
Hook support: process enumeration, version detection, config |
wmpf-cli |
CLI entry: arg parsing, server lifecycle, DLL injection, IPC |
wmpf-agent |
frida‑gum Hook Agent DLL, injected into the target process |
wmpf-devtools |
Tauri v2 desktop GUI with embedded Chrome DevTools frontend |
| 11581 | 11633 | 13331 | 13341 | 13487 | 13639 |
| 13655 | 13871 | 13909 | 14161 | 14199 | 14315 |
| 16133 | 16203 | 16389 | 16467 | 16771 | 16815 |
| 16965 | 17037 | 17071 | 17127 | 18055 | 18151 |
| 18787 | 18891 | 18955 | 19027 | 19201 | 19339 |
| 19459 | 19481 | 19749 | 19769 | 19823 | 19841 |
| 19871 | 19881 | 19899 | 19921 | 19977 | 20001 |
| 20005 | 20079 | 20089 | 25268 | 25297 | 25364 |
Config files at
config/addresses.{version}.json, embedded at compile time.
| Domain | Crate |
|---|---|
| Async Runtime | tokio |
| WebSocket | tokio‑tungstenite |
| JSON | serde + serde_json |
| Protobuf | prost |
| Compression | flate2 (zlib) |
| Hook Engine | frida‑gum |
| Windows API | windows |
| GUI | tauri v2 |
Uses frida‑gum instead of full Frida (no V8 engine). Release package size: ~5–10 MB, ~75% smaller than the previous implementation.
- DllMain strictly follows Windows best practices: no I/O, locks, or heap allocation
panic = "abort"prevents unwind across FFI boundaries- Agent IPC fault‑tolerant: pipe disconnection does not break running hooks
- Graceful shutdown: Shutdown → ACK → FreeLibrary
- All blocking waits have a 5‑second timeout to prevent deadlocks
This project is a Rust rewrite inspired by the original WMPFDebugger project created by evi0s.
This project is intended for educational, research, and security testing purposes only.
- This project is not an official Tencent product and has no affiliation with Tencent.
- This tool enables debugging capabilities through runtime analysis and interception of WMPF processes. Do not use it for any purpose that violates the WeChat Mini Program Platform Operation Guidelines or any other applicable laws and regulations.
- Users assume all legal risks and liabilities arising from the use of this tool. The developer shall not be liable for any damages (including but not limited to account bans, legal liability, or commercial losses) resulting from the use of this project.
- If you do not agree with the above terms, do not use, distribute, or modify any part of this code.
GPL-2.0