See Wxapkg

See Wxapkg lets you decompile .wxapkg files directly in the browser. It automatically detects the package type, uses the AppID for decryption when needed, and completes unpacking, decompilation, formatting, and result validation.

[!IMPORTANT] "Decompilation" means best-effort static recovery of compiled output, not source extraction. Results may lack variable names, comments, structure, or runtime content; "result generated" ≠ identical to or runnable from the original.

Key Features

• Supports standard packages, encrypted packages, and common WeChat 4.x structures; encrypted packages require a matching AppID.
• Static decompilation without executing in-package JavaScript via eval, Function, or a VM.
• Automatically decompiles and organizes JSON, JavaScript, WXML, and WXSS; content that cannot be confirmed is explicitly flagged.
• Provides real-time progress, result status, static quality score, inspection hints, and a technical report.
• The downloaded ZIP contains only src/; raw unpacking artifacts are not mixed into the deliverable files.
• Supports online use and standalone Docker Compose self-hosting, with no dependency on external databases, caches, or message queues.

Quick Start

Online

Open seewxapkg.keepbuild.cn and select or drag in a .wxapkg file. Code formatting and deep decompilation are enabled by default; encrypted packages also require the corresponding AppID.

The public demo stores uploads temporarily; originals are deleted on normal completion, and stranded data is cleaned per a 72h max policy. Do not upload sensitive or unauthorized packages; self-host in a controlled environment.

Docker Compose (Recommended)

All you need is Docker Engine and Docker Compose:

git clone https://github.com/Leslie-SSS/seeWxapkg.git
cd seeWxapkg
docker compose up -d --build

Once started:

• Web interface: http://localhost:3004
• Health check: http://localhost:9090/api/health
• API base URL: http://localhost:9090/api

Default Compose uses a local-file task repo, file queue, and a dedicated Worker; task data lives only in the configured local volume. This is a single-node setup with no database, cache, or message queue. To stop:

docker compose down

Named volumes retain task state and files; ordinary unfinished tasks in the file queue resume on next startup. Auto-cleanup is paused while the service is down. To avoid storing credentials long-term, the AppID is destroyed after one decryption attempt, so encrypted tasks must be resubmitted if the process is interrupted afterward. To delete all uploads, task records, and artifacts immediately, verify you no longer need them and run docker compose down -v.

Usage

1. Select a .wxapkg file; for encrypted packages, enter the 18-character AppID (wx + 16 lowercase hexadecimal characters).
2. Click "Start decompilation" and wait for the system to process automatically.
3. Review the result hints and download the decompilation output, which contains only src/.

Decompilation Output

The download is a clean project for reading and analysis:

wxapkg-result.zip
└── src/
    ├── app.json
    ├── app.js
    ├── app.wxss
    └── ...

The reports/ technical report is available via the results page or task API and is not included in the downloaded ZIP. Fallback temp copies created during processing are deleted right after merging; duplicate source files are not kept long-term.

The score reflects structural completeness and static parseability, not original source fidelity or runtime correctness.

Scope & Limitations

Decompilation cannot regenerate compile-time lost comments, variable names, directories, or configs, nor statically resolve all dynamic, runtime-injected, or obfuscated content. Output is not guaranteed to recompile or run; fallbacks and inferences retain provenance and are not presented as original source.

Privacy & Deployment

• No external database, cache, or message queue is used; task state, queues, and artifacts are stored only in the configured local directory or Docker volume.
• Homepage star count is queried server-side from a fixed GitHub repository API and briefly cached; the browser never contacts GitHub directly, and no visitor IP, task info, or upload content is forwarded to GitHub. The decompilation Worker retains no outbound network access.
• To allow the standalone Worker to decrypt, the AppID is briefly written to a one-time credential file with 0600 permissions; it never enters task state, queues, or reports. It is deleted immediately after one decryption attempt or task failure. If the process exits before deletion, the credential is cleaned up with the task directory per the retention policy; if the task is interrupted after deletion, encrypted packages must be resubmitted. Original filenames and file sizes are also not written to task records; upgrades automatically clean up legacy sensitive fields in old task state.
• Task directories use 0700 permissions; task state, queue files, and artifacts use 0600. Production Workers have external networking disabled by default.
• Application request logs do not record client IPs, query parameters, or real task IDs; production gateways have access logs disabled by default. The small number of severe infrastructure error logs should still be treated as sensitive data. Task IDs should be treated as temporary access credentials and must not be shared publicly.
• Unpacking and packaging check for path traversal, absolute paths, duplicate ZIP entries, and symlinks.
• Node helper processes have execution timeouts, output limits, and V8 old-space limits; strict memory isolation should rely on container resource limits.
• The API has no built-in user authentication or per-user task scoping. Public deployments must add TLS, authentication, and rate limiting at the front gateway, and isolate the Worker network.
• Normal terminal states immediately delete original uploads, AppID, fallback workspaces, and raw duplicate copies; abnormal stranded data, task records, recovered source, reports, failed queue records, and ZIPs are cleaned up per the RETAIN_ARTIFACTS_HOURS cycle. The code default is 24 hours; the public demo site currently uses 72 hours.

Dev & Deploy

npm ci --prefix backend/internal/beautify
npm ci --prefix backend/internal/beautify/wxappUnpacker

mkdir -p /tmp/seewxapkg-tasks /tmp/seewxapkg-output
cd backend
TEMP_DIR=/tmp/seewxapkg-tasks \
OUTPUT_DIR=/tmp/seewxapkg-output \
go run ./cmd/server

cd frontend
npm ci
npm run dev

deploy/production/ provides a reference single-machine production deployment, but does not include authentication. Before using it on the public internet, you must replace the image, domain, and certificate, and integrate authentication at the gateway.

API endpoints

curl -fsS -X POST http://localhost:9090/api/compile \
  -F 'file=@/path/to/__APP__.wxapkg' \
  -F 'beautify=true' \
  -F 'decompile=true'

Settings

Testing

npm ci --prefix backend/internal/beautify
npm ci --prefix backend/internal/beautify/wxappUnpacker
npm test --prefix backend/internal/beautify

cd backend
go test -race ./...
go vet ./...
go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...

WXAPKG_PATH='/absolute/path/to/__APP__.wxapkg'
./scripts/manual_validate.sh "$WXAPKG_PATH" http://127.0.0.1:9090 completed

Docs & help

• Architecture & Design Constraints
• Task State Machine
• Test Fixture Specification
• Decompilation Report Specification
• Third-Party Components & Licenses

Contributing

Issues and Pull Requests are both welcome. For larger feature changes, please submit a Feature Request first; for bugs, use the Bug Report template and include a minimal reproduction along with redacted logs. Do not submit real packages you have no right to distribute; changes to decompilation logic and third-party code must include tests, provenance and license information.

Star Growth Trend

The trend chart is updated by repository automation via the GitHub API and stores only per-UTC-date aggregated counts, never Stargazer usernames.

License

The project's own code is released under the MIT License. The compatibility fallback in backend/internal/beautify/wxappUnpacker/ is derived from wxappUnpacker and is released under GPL-3.0-or-later; its source, modifications and license are provided together with the repository. Please read THIRD_PARTY_NOTICES.md and the license files in that directory before redistributing or modifying.

Disclaimer

For authorized packages only: learning, research, compatibility and debugging. Users confirm their rights and comply with laws, platform rules and licenses. Provided "AS IS" without warranty.