wx-tablet-mode (微信安卓平板模式辅助与环境治理套件)

微信安卓平板副设备登录的外观伪装、官方底包校验、第一方登录 Hook 与运行环境治理套件
Appearance disguise, official APK verification, first-party pad-login hook, and environment governance toolkit for running WeChat in secondary Android tablet mode.

中文 | English

中文

⚠️ 核心前置声明与项目边界
⚡ 30 秒极速上手 (Quickstart)
🛠️ 从源码构建
📦 仓库范围与功能定位
❓ 常见问题与排错指南 (FAQ)
📚 详细文档索引
🤝 兄弟项目 (Sibling Projects)
🙏 致谢 (Credits)
🔒 安全政策与免责声明
📄 开源许可证
💬 讨论与交流 (Discussions & Community)

⚠️ 核心前置声明与项目边界

重要声明 (Crucial Prerequisite & Boundary)：

内置第一方 Pad 登录资格 Hook (v1.0.2+)：自 v1.0.2 起，本项目实现真正自包含——在开源模块中内置了第一方 GPL-3.0 实现的 PadLoginHook，匹配器设计参考/衍生自 Houvven/I-Am-Pad (GPL-3.0) 并保留完整署名（基于 LuckyPray/DexKit 动态特征匹配）。它动态定位并拦截微信平板环境检测（inTabletEnv）与副设备扫码预检协程（checkloginaspad），单 APK 即可完整赋予平板扫码同登资格，彻底无需任何未授权或闭源第三方 APK。

本项目包含什么：开源模块 com.wx.pad 同时包含外观与断点伪装（PadDisguise，伪装 sw600dp 与强制竖屏锁定）与副设备登录资格赋予（PadLoginHook），并配套提供官方底包哈希校验、白纸认证态重置与守护自愈脚本。外部第三方 Hook 现已转为完全可选的兼容项（若偏好使用外部 Hook，可通过系统属性 persist.wx.pad.loginhook 0 随时切换，详见 docs/EXTERNAL_HOOK_SPEC.md）。

数据导出伴侣：如需只读导出微信聊天记录接入 AI 助理，请搭配使用兄弟项目 wx-pad-exporter。

法律与合规诚实声明：本项目属于个人设备上的系统适配与逆向工程研究，绝不分发或修改任何微信专有二进制，亦不包含任何第三方专有代码。模块在运行时 Hook 商业专有软件，仅供使用者在个人合法拥有的硬件与账号上用于学习与研究；使用者须自行对遵守《微信个人账号使用规范》与服务条款承担全部责任。

物理安卓平板同样需要 Root（关键说明）：本项目所有能力（PadDisguise、PadLoginHook、认证态治理、数据导出伴侣）均以 Xposed/LSPosed 模块形态运行，底层强依赖 Root（Magisk 或 KernelSU）+ Zygisk + LSPosed/Vector。即便是一台“原生支持微信平板副设备登录”的物理安卓平板，本项目模块仍必须运行在已 Root 的设备上才能生效；若平板未 Root，整套流水线将无法部署。

📋 完整前置条件清单 (Complete Prerequisites)

💡 单 APK 自包含方案：v1.0.2+ 已内置第一方 Pad 登录资格 Hook，只需安装本仓库的单一 APK。第三方外部 Hook 变为可选兼容项。详见 docs/EXTERNAL_HOOK_SPEC.md。

#	前置条件	说明 / 验证
①	已 Root 的安卓设备	Magisk 27.0+ 或 KernelSU；`adb shell su -c id` 返回 `uid=0`。物理平板也必须 Root，否则模块无法安装。
②	Zygisk + LSPosed 或 Vector	推荐 Vector v2.2+（API-102，无参构造 `XposedModule()`）；旧版 LSPosed (API-100) 亦受支持。二者只保留其一，避免 Zygote 竞争崩溃。
③	官方微信 `8.0.78 / 0x28004e32`	MD5 `846b411199ae49d335d31b3a17036440`；SHA-256 `41f7dc1f720767fa78fa20dd13ea034b817bbf6ebd23dfd1324c647499c9c1ba`。Beta 版（`0x28004e38`）会被服务端拦截。
④	平板登录资格 Hook（✅ 已内置，无需第三方）	内置于当前模块 `com.wx.pad`（`PadLoginHook`）。安装本模块并勾选 `com.tencent.mm` 作用域即可自动生效。亦支持保留用户自选的外部 Hook。
⑤	（可选）数据导出伴侣仓库	仅当你需要把聊天流只读导出到 AI 助理时，再搭配 `wx-pad-exporter`。与登录资格无关。

🤖 交给 AI Agent 自动部署？ 本仓库提供 AGENT.md：你只需 Root 设备、开启 USB 调试、插上电脑，然后让任意具备 shell 权限的编码 Agent（omp / Claude Code / Codex）读取并执行 AGENT.md 即可端到端自动完成部署与校验。

⚡ 30 秒极速上手 (Quickstart)

极速路径：无需配置 Gradle 开发环境，直接下载预编译产物即可在 30 秒内装配就绪。

步骤 1：下载预编译 APK

前往 GitHub Releases 最新发布页下载最新的 ARM 架构 APK（wx-tablet-mode-*-arm.apk）。

步骤 2：安装并激活 Xposed 模块

# 1. 安装模块至设备 (下载的最新 release APK)
adb install -r wx-tablet-mode-*-arm.apk

# 2. 在 LSPosed 或 Vector 管理器中：
#    - 启用 "com.wx.pad" (WX Tablet Mode) 模块
#    - 将目标微信 "com.tencent.mm" 勾选加入作用域 (Scope)

提示：内置的 PadLoginHook 默认启用，无需额外安装任何第三方 Hook 即可直接获得扫码登录资格！若您偏好使用自己专属的外部 Hook，可随时通过 su -c 'setprop persist.wx.pad.loginhook 0' 关闭内置 Hook。

步骤 3：环境自检与认证态重置 (可选但推荐)

若微信曾尝试登录失败导致认证态死锁，运行自带脚本一键自检与白纸化重置：

# 克隆仓库运行自检脚本
git clone https://github.com/yaping-pro/wx-tablet-mode.git
cd wx-tablet-mode

# 环境就绪检查 (Root / 框架 / 官方底包哈希)
bash scripts/preflight_check.sh

# 清理历史认证死锁并隔离静默下发的 Tinker 补丁
bash scripts/reset_wechat_auth.sh
bash scripts/quarantine_tinker.sh

步骤 4：扫码登录

强制停止并重新打开微信（重要：必须使用 am force-stop com.tencent.mm 或重启设备，从最近任务上滑划掉微信无法真正杀死主进程，Hook 不会重新注入），在登录界面即可选择作为平板设备登录（扫码登录），用主力手机扫码即可实现双设备同号同时在线！

📖 完整端到端分步手册（从已 Root 手机到可用扫码登录）：请直接查阅权威 SOP docs/TABLET_LOGIN_SOP.md。交给 Agent 自动执行见 AGENT.md。

🛠️ 从源码构建

如果您希望自行审计代码并编译 APK：

# 1. 准备构建环境 (需要 JDK 17+)
git clone https://github.com/yaping-pro/wx-tablet-mode.git
cd wx-tablet-mode

# 2. 执行 Gradle 构建
./gradlew assembleRelease

# 3. 输出路径
# app/build/outputs/apk/release/app-release.apk

📦 仓库范围与功能定位

模块 / 能力	归属状态	说明
官方底包校验 SOP	✅ 包含	提供 `8.0.78 / 0x28004e32` 正式版 SHA-256 哈希比对与来源验证
外观与断点伪装 (`PadDisguise`)	✅ 包含	伪装 `smallestScreenWidthDp >= 600`，锁定竖屏避免手机旋转变形
第一方登录资格 Hook (`PadLoginHook`)	✅ 包含	基于 DexKit 动态扫描并拦截环境检测与登录协程，实现自包含副设备登录
运维与自愈工具	✅ 包含	提供 Tinker 热更补丁隔离、认证态白纸重置及多用户环境自检
外部协议 Hook 兼容模式	✅ 包含	具备系统属性软开关，可平滑回退至第三方 Hook（详见 `docs/EXTERNAL_HOOK_SPEC.md`）
聊天记录嗅探 / AI 导出	❌ 不包含	独立数据管道请参阅 `wx-pad-exporter`
微信专有二进制分发	❌ 不包含	绝不分发修改版或专有微信底包，详见 `NO_PROPRIETARY_BINARIES.md`

❓ 常见问题与排错指南 (FAQ)

Q1: 打开微信直接跳出账号密码/手机号登录，为什么没有出现扫码登录界面？

A: 说明 Hook 尚未正确注入或未命中。请按以下顺序排查：

模块 com.wx.pad 是否已在 LSPosed / Vector 管理器中启用；
作用域 (Scope) 是否已勾选 com.tencent.mm；
是否误将内置资格 Hook 停用（检查 adb shell getprop persist.wx.pad.loginhook，若为 0 则可通过 setprop persist.wx.pad.loginhook 1 重新启用）；
如果微信运行在多用户/分身空间下（如 User 999），模块是否已映射至该空间（执行 pm install-existing --user <UID> com.wx.pad）。

Q2: 扫码后提示“当前设备登录异常”或二维码不断刷新失败？

A: 通常是先前的登录流程中断导致认证态死锁（auth_ishold=true）。请运行：

bash scripts/reset_wechat_auth.sh

该脚本将安全移走受损的 autoauth.cfg 和 auth_hold_prefs.xml，恢复纯净白纸状态。

Q3: 提示“The beta version is only for eligible users”？

A: 微信后台静默下载了 Tinker 热修复补丁并将内部版本号抬升到了内测通道。请执行：

bash scripts/quarantine_tinker.sh

该脚本会将 Tinker 下载目录置空并锁定权限，阻止内测补丁加载。

Q4: 应用双开 / 多用户环境（如 MIUI 分身用户 999）如何正确定位 UID？

A: 绝不要盲目硬编码 999。请使用 Android 官方 dumpsys 动态查找目标用户的真实 UID：

TARGET_USER=999 # 替换为目标分身用户编号
dumpsys package --user "$TARGET_USER" com.tencent.mm 2>/dev/null | grep "userId=" | head -1 | awk -F= '{print $2}' | tr -d ' \r\n'

并在执行自检时传入参数：

TARGET_USER=999 bash scripts/preflight_check.sh

Q5: 执行 `pm install-existing --user <UID>` 报错找不到包？

A: pm install-existing 的前提是主用户（User 0）或系统底层中已经安装了该 APK。如果主空间从未安装过，必须先执行 adb install <apk>，然后再向特定分身空间映射。

Q6: 重启手机后微信无法自启或报错找不到数据目录？

A: Android 12 基于文件加密 (FBE)。开机后在用户首次输入锁屏密码前，凭据加密存储 (CE) 处于锁定状态，分身空间（User 999）微信与数据目录不可访问，必须先解锁屏幕一次方可启动。若设备开机后需验证自启与 Hook 注入状态，可运行后置校验脚本：

TARGET_USER=999 bash scripts/verify_post_boot.sh

作为常驻副设备的备用机，亦可在“开发者选项/安全设置”中取消锁屏密码，实现冷启动免解锁全自动拉起。

Q7: 在分身空间（如 User 999）安装模块后，微信仍没有生效 / 扫码页不出现？

A: 这是 Vector 守护进程克隆空间缓存未失效 的已知问题，与模块本身无关：

即便已执行 pm install-existing --user <UID> com.wx.pad，Vector 守护进程内存态的 DaemonState.validUserIds 仍停留在 {0}，会静默跳过 u999 注入，直到缓存被强制重建。

修复命令（强制 Vector 重建内存派发表）：

su -c "/data/adb/modules/zygisk_vector/cli modules disable com.wx.pad"
su -c "/data/adb/modules/zygisk_vector/cli modules enable  com.wx.pad"
su -c "/data/adb/modules/zygisk_vector/cli scope set com.wx.pad com.tencent.mm/<UID>"

随后 am force-stop --user <UID> com.tencent.mm 并重新拉起微信即可。详见 AGENT.md。

Q8: 运行时软开关 `persist.wx.pad.loginhook` / `persist.wx.pad.disguise` 的取值行为对照？

A: 两个属性均为 Android 系统属性软开关（setprop），无需重装或重编译即可即时调控。修改后需 am force-stop 或重启微信 方可生效（见下方重启说明）。

系统属性 (Property)	取值	`padlogin` 行为 / `disguise` 行为	说明
`persist.wx.pad.loginhook`	`1` 或未设置	启用内置 `PadLoginHook`（默认开启；源码中任何非精确 `"0"` 的值均视为启用）	单 APK 自包含，无需任何第三方 Hook
`persist.wx.pad.loginhook`	`0`	停用内置 `PadLoginHook`	便于回退至外部第三方 Hook（如 `com.roro.tablethook`）或纯外观伪装
`persist.wx.pad.disguise`	`1` 或未设置	启用 `PadDisguise`（`sw600dp` 断点与竖屏锁定，默认开启）	伪装平板环境
`persist.wx.pad.disguise`	`0`	停用 `PadDisguise`	由外部模块独占外观伪装

⚠️ 重启微信的正确方式：修改上述属性后，必须通过 am force-stop com.tencent.mm（root）或重启设备来重启微信进程，才能重新触发 Hook 注入。从最近任务（Recents）上滑划掉微信并不能杀死微信主进程——微信的 :support / :push 等常驻子进程仍在后台，使新属性与 Hook 注入不生效。只有 am force-stop 或整机重启能确保主进程 com.tencent.mm 被真正终止。

Q9: 如何从外部闭源 Hook `com.roro.tablethook` 平滑“毕业”迁移到内置 `PadLoginHook`？

A: 内置 PadLoginHook 已实机验证与 com.roro.tablethook 完全对等（DexKit 候选平板 2/1、资格 1/1，logcat 签名 微信平板登录模式已启用 一致）。推荐按以下 SOP 零风险迁移：

并行启用：保持 com.roro.tablethook 启用，同时确保内置 com.wx.pad 已安装且作用域勾选 com.tencent.mm，persist.wx.pad.loginhook 保持默认（1）。
验证 logcat 签名：am force-stop 并重启微信，抓取 logcat 确认出现 微信平板登录模式已启用（来自 com.wx.pad）与既有 roro 签名并存；内置 Hook 命中即证明可独立承担资格赋予。
停用外部 Hook：su -c 'setprop persist.wx.pad.loginhook 1'（确保内置开启），并在 Vector / LSPosed 管理器中取消 com.roro.tablethook 对 com.tencent.mm 的作用域勾选（或直接禁用该模块）。再次 am force-stop 重启微信确认仅凭内置 Hook 仍正常扫码。
回滚预案：若迁移后出现异常，可立即 setprop persist.wx.pad.loginhook 0 重新启用 com.roro.tablethook 作用域，进程重启即可回退；必要时运行 scripts/rollback_wechat_auth.sh 还原认证态。外部 Hook 现已为完全可选项。

📚 详细文档索引

🙏 致谢 (Credits)

本项目在研发与设计过程中汲取并采用了以下优秀开源项目的成果与思路，特此致谢：

Houvven/I-Am-Pad (GPL-3.0) by Houvven：提供了优秀的平板模式 DexKit 靶点设计参考，为第一方纯开源自包含方案奠定了关键基础。
LuckyPray/DexKit (LGPL-3.0) by LuckyPray：强大的 Android 运行时高性能 Dex 字节码动态匹配与解析引擎。
rovo89 / XposedBridge (Apache-2.0)：经典 Xposed 运行时接口标准。

🤝 兄弟项目 (Sibling Projects)

本项目是微信个人数据自主权与本地 AI 助理工具套件的一部分：

项目	说明	状态 / 链接
`wx-tablet-mode` (本仓库)	微信安卓平板模式辅助与环境治理套件（外观伪装 + 内置第一方平板登录资格 Hook，单 APK 自包含）	yaping-pro/wx-tablet-mode
`wx-pad-exporter`	Pad 版微信实时聊天流只读导出守护进程 + 通用 Webhook / 个人 AI 助理数据管道（Xposed 探针 + Go 守护进程）	yaping-pro/wx-pad-exporter
`wx-linux-exporter`	Linux 原生 / 容器化微信导出管道（Linux 端微信消息只读导出与助理桥接）	yaping-pro/wx-linux-exporter

🔒 安全政策与免责声明

📄 开源许可证

本项目核心源码与构建脚本依据 GNU General Public License v3.0 (GPL-3.0) 获得许可。
第三方组件版权与授权细节请参阅项目根目录下的 NOTICE 文件。

💬 讨论与交流 (Discussions & Community)

群名称：微信个人助理交流

⚠️ 微信群二维码已过期（2026-10-20 失效）：已暂时移除，避免误扫。请改用下方 Telegram 交流群，或在 GitHub Discussions 留言获取新群码。

💬 在线交流：使用疑问、配置答疑与技术探讨亦可直接前往 GitHub Discussions。

✈️ Telegram 交流群：t.me/WeChatExporter（长期有效，二维码过期时的备用联系通道）

🛠️ 维护者须知：拿到新群码后，将图片提交为 assets/wechat-group-qr.png，并在上两节恢复 <img> 引用与新的有效期日期。

English

⚠️ Core Prerequisite & Project Boundary

Crucial Notice (Prerequisite & Scope Boundary):

First-Party Pad Login Hook Built-In (v1.0.2+): Starting with v1.0.2, this repository is genuinely self-contained — shipping our own first-party GPL-3.0 implementation of PadLoginHook (matcher design referenced/derived from Houvven/I-Am-Pad (GPL-3.0) with full attribution preserved, powered dynamically by LuckyPray/DexKit). It intercepts WeChat's tablet environment check (inTabletEnv) and secondary-device pre-qualification coroutine (checkloginaspad) at runtime, granting tablet QR scan-login eligibility in a single APK with zero dependency on unlicensed third-party binaries.

What this repository provides: The open-source com.wx.pad module provides BOTH appearance disguise (PadDisguise, sw600dp breakpoint and portrait locking) AND pad-login qualification (PadLoginHook), alongside official APK verification and self-healing governance scripts. Third-party external hooks are now entirely optional (and can be toggled via persist.wx.pad.loginhook 0; see docs/EXTERNAL_HOOK_SPEC.md).

Chat Stream Export: For read-only chat export to AI assistants, see companion project wx-pad-exporter.

Legal & Compliance Honesty: This project is personal technical research into Android system adaptation and runtime hooking on personal hardware. It distributes zero proprietary WeChat binaries and zero closed-source third-party binaries. Hooking commercial proprietary applications carries account risk; users are solely responsible for compliance with WeChat Terms of Service.

A physical Android tablet STILL needs Root: Every capability in this project runs as an Xposed/LSPosed module, which fundamentally requires Root (Magisk or KernelSU) + Zygisk + LSPosed/Vector. Even on a physical tablet, this module must run on a rooted device to be installed; an unrooted tablet cannot deploy the pipeline.

📋 Complete Prerequisites

💡 Self-Contained Single APK: v1.0.2+ includes the first-party pad-login hook out of the box. Installing our single APK gives you both disguise and login entitlement. External hooks are optional. See docs/EXTERNAL_HOOK_SPEC.md.

#	Prerequisite	Notes / Verification
①	Rooted Android device	Magisk 27.0+ or KernelSU; `adb shell su -c id` returns `uid=0`. A physical tablet must also be rooted, or the module cannot be installed.
②	Zygisk + LSPosed or Vector	Vector v2.2+ (API-102, no-arg `XposedModule()`) recommended; legacy LSPosed (API-100) also supported. Keep only one active to avoid Zygote injection races.
③	Official WeChat `8.0.78 / 0x28004e32`	MD5 `846b411199ae49d335d31b3a17036440`; SHA-256 `41f7dc1f720767fa78fa20dd13ea034b817bbf6ebd23dfd1324c647499c9c1ba`. The Beta build (`0x28004e38`) is rejected by the server.
④	Pad-login hook (✅ Built-in, no third-party APK needed)	Built directly into `com.wx.pad` (`PadLoginHook`). Simply install our module and enable scope for `com.tencent.mm`. Users may still bring their own external hook if preferred.
⑤	(Optional) companion export repo	Only if you want to read-only export chat streams to an AI assistant, pair with `wx-pad-exporter`. Unrelated to login entitlement.

🤖 Hand setup to an AI agent? This repo ships AGENT.md: just root the device, enable USB debugging, plug it in, then let any shell-capable coding agent (omp / Claude Code / Codex) read and execute AGENT.md to complete the whole deployment and verification end-to-end.

⚡ 30-Second Quickstart

Shortest Path: Skip Gradle compilation and set up everything within 30 seconds using prebuilt release assets.

Step 1: Download Prebuilt APK

Visit the GitHub Releases Latest Page and download the latest ARM APK (wx-tablet-mode-*-arm.apk).

Step 2: Install & Enable Xposed Module

# 1. Install module APK onto target device (downloaded release APK)
adb install -r wx-tablet-mode-*-arm.apk

# 2. Inside LSPosed or Vector Manager:
#    - Enable "com.wx.pad" (WX Tablet Mode)
#    - Add target WeChat "com.tencent.mm" to its Scope

Notice: The built-in PadLoginHook is active by default. No additional third-party hook is needed to get the QR login screen! If you prefer your own external hook, disable the built-in hook anytime via su -c 'setprop persist.wx.pad.loginhook 0'.

Step 3: Run Preflight Check & Clean State Reset (Optional but Recommended)

If previous login attempts failed or hung, clean up lingering locks:

# Clone repository for governance scripts
git clone https://github.com/yaping-pro/wx-tablet-mode.git
cd wx-tablet-mode

# Check environment readiness (Root / Framework / Official APK hash)
bash scripts/preflight_check.sh

# Reset credentials and isolate silent Tinker hotfix patches
bash scripts/reset_wechat_auth.sh
bash scripts/quarantine_tinker.sh

Step 4: Scan QR Code to Log In

Force-stop and re-open WeChat (important: use am force-stop com.tencent.mm or reboot the device — swiping WeChat away from Recents does not kill the main process, so the hook will not be re-injected). The interface will display a tablet dual-pane layout with a tablet login QR code. Scan the QR code using your primary mobile device to authorize tablet-mode coexistence!

📖 Authoritative 5-Step SOP: See docs/TABLET_LOGIN_SOP.md. Handing setup to an AI Agent? See AGENT.md.

🛠️ Build from Source

If you prefer compiling from source code directly:

# Requires JDK 17+
git clone https://github.com/yaping-pro/wx-tablet-mode.git
cd wx-tablet-mode

# Compile APK
./gradlew assembleRelease

# Output artifact:
# app/build/outputs/apk/release/app-release.apk

📦 Scope & Capability Positioning

Feature / Capability	Scope Status	Description
Official APK Verification SOP	✅ Included	Hash verification for official `8.0.78 / 0x28004e32` release
Appearance Disguise (`PadDisguise`)	✅ Included	Disguises `smallestScreenWidthDp >= 600` and enforces portrait locking
First-Party Pad Login Hook (`PadLoginHook`)	✅ Included	Dynamic DexKit matchers for environment and CGI pre-qualification checks
Governance & Self-Healing Tooling	✅ Included	Tinker patch isolation, clean-slate auth reset, and multi-user preflight
External Protocol Hook Compatibility	✅ Included	System property toggles allow smooth fallback to user-supplied hooks
Chat Stream Sniffing & AI Pipeline	❌ Excluded	Dedicated export pipeline is handled in `wx-pad-exporter`
Proprietary WeChat Binary Distribution	❌ Excluded	Strictly distributes zero modified WeChat APKs; see `NO_PROPRIETARY_BINARIES.md`

❓ FAQ & Troubleshooting

Q1: WeChat launches directly into phone number/password login without a QR code?

A: The qualification hook is inactive or not loaded. Verify:

That com.wx.pad is enabled in Vector / LSPosed Manager and com.tencent.mm is in its scope;
That the built-in hook was not inadvertently disabled (adb shell getprop persist.wx.pad.loginhook; if 0, re-enable via setprop persist.wx.pad.loginhook 1);
If running inside a secondary profile or clone user (e.g. MIUI User 999), map the package: pm install-existing --user <UID> com.wx.pad.

Q2: WeChat displays "Login error" or QR code fails to refresh?

A: Caused by aborted prior attempts leaving a lingering auth_ishold=true state. Run:

bash scripts/reset_wechat_auth.sh

This safely archives corrupt autoauth.cfg and auth_hold_prefs.xml files and restores a clean slate.

Q3: Error banner: "The beta version is only for eligible users"?

A: WeChat's background Tinker engine downloaded a beta hotfix patch. Run:

bash scripts/quarantine_tinker.sh

This empties and locks the patch directory against future downloads.

Q4: How to detect the exact UID in dual-app / clone environments (e.g. MIUI User 999)?

A: Never hardcode user ID 999. Query the real assigned UID dynamically via dumpsys:

TARGET_USER=999 # Target secondary profile
dumpsys package --user "$TARGET_USER" com.tencent.mm 2>/dev/null | grep "userId=" | head -1 | awk -F= '{print $2}' | tr -d ' \r\n'

Pass the parameter when testing:

TARGET_USER=999 bash scripts/preflight_check.sh

Q5: `pm install-existing --user <UID>` fails with package not found?

A: pm install-existing requires the APK to already exist under User 0. If it has never been installed on the device, run adb install <apk> first.

Q6: WeChat fails to start after phone reboot?

A: Android 12 File-Based Encryption (FBE) keeps Credential Encrypted (CE) storage locked until the user unlocks the screen (PIN/pattern) for the first time. WeChat under clone space (User 999) cannot access its data or run until this first unlock. After unlocking, you can optionally run the post-boot verification protocol:

TARGET_USER=999 bash scripts/verify_post_boot.sh

For an always-on dedicated secondary device, you may also remove the lockscreen credential in Android settings to allow full automatic start upon cold reboot.

Q7: Module installed in a clone space (e.g. User 999) but WeChat still not working / no QR code?

A: This is the known Vector daemon clone-space cache quirk, unrelated to the module itself:

Even after pm install-existing --user <UID> com.wx.pad, Vector daemon's in-memory DaemonState.validUserIds stays at {0} and silently skips u999 injection until the cache is force-rebuilt.

Fix (force Vector to rebuild its in-memory dispatch tables):

su -c "/data/adb/modules/zygisk_vector/cli modules disable com.wx.pad"
su -c "/data/adb/modules/zygisk_vector/cli modules enable  com.wx.pad"
su -c "/data/adb/modules/zygisk_vector/cli scope set com.wx.pad com.tencent.mm/<UID>"

Then am force-stop --user <UID> com.tencent.mm and relaunch WeChat. See AGENT.md.

Q8: Runtime toggle behavior matrix for `persist.wx.pad.loginhook` / `persist.wx.pad.disguise`?

A: Both are Android system-property soft toggles (setprop) that take effect immediately without reinstalling or recompiling. After changing them you must am force-stop or reboot WeChat for the new value to apply (see the restart note below).

Property	Value	`padlogin` / `disguise` behavior	Notes
`persist.wx.pad.loginhook`	`1` or unset	Built-in `PadLoginHook` enabled (default ON; any value other than exactly `"0"` is treated as enabled)	Self-contained single APK, no third-party hook needed
`persist.wx.pad.loginhook`	`0`	Built-in `PadLoginHook` disabled	Fall back to external hook (e.g. `com.roro.tablethook`) or appearance-only mode
`persist.wx.pad.disguise`	`1` or unset	`PadDisguise` enabled (`sw600dp` breakpoint + portrait lock, default ON)	Disguises tablet environment
`persist.wx.pad.disguise`	`0`	`PadDisguise` disabled	External module owns appearance disguise exclusively

⚠️ Correct way to restart WeChat: After changing a property, you must use am force-stop com.tencent.mm (as root) or reboot the device to restart the WeChat process and re-trigger hook injection. Swiping WeChat away from Recents does NOT kill the main process — WeChat's :support / :push helper processes keep running in the background, so the new property and hook injection never take effect. Only am force-stop or a full reboot truly terminates the com.tencent.mm main process.

Q9: How to "graduate" from the external closed-source hook `com.roro.tablethook` to the built-in `PadLoginHook`?

A: The built-in PadLoginHook is proven on-device to be fully on par with com.roro.tablethook (DexKit candidates tablet 2/1, qualification 1/1, identical logcat signature 微信平板登录模式已启用). Migrate risk-free via this SOP:

Enable both in parallel: Keep com.roro.tablethook enabled, but also ensure built-in com.wx.pad is installed with com.tencent.mm in its scope and persist.wx.pad.loginhook at its default (1).
Verify logcat signature: am force-stop and relaunch WeChat; capture logcat and confirm 微信平板登录模式已启用 (from com.wx.pad) appears alongside the existing roro signature — proving the built-in hook independently grants qualification.
Disable the external hook: ensure setprop persist.wx.pad.loginhook 1, then uncheck com.roro.tablethook from com.tencent.mm's scope in Vector / LSPosed (or disable that module). am force-stop and relaunch WeChat again to confirm the built-in hook alone still yields the QR login.
Rollback plan: If anything misbehaves after migration, immediately setprop persist.wx.pad.loginhook 0 and re-enable com.roro.tablethook scope, then restart the process to fall back; if needed, run scripts/rollback_wechat_auth.sh to restore auth state. The external hook is now entirely optional.

📚 Documentation Index

🙏 Credits

We gratefully acknowledge the following open-source projects and their contributors:

Houvven/I-Am-Pad (GPL-3.0) by Houvven: Pioneered the DexKit matcher architecture and CGI interception design for WeChat tablet mode.
LuckyPray/DexKit (LGPL-3.0) by LuckyPray: High-performance runtime Dex parsing and bytecode query engine.
rovo89 / XposedBridge (Apache-2.0): Foundational Xposed framework API.

🤝 Sibling Projects

This repository is part of a toolkit suite for WeChat personal data sovereignty and local AI assistant pipelines:

Project	Description	Link
`wx-tablet-mode` (this repo)	Android tablet-mode coexistence toolkit with built-in first-party pad-login hook & appearance disguise (self-contained single APK).	yaping-pro/wx-tablet-mode
`wx-pad-exporter`	Read-only realtime chat stream exporter daemon & universal assistant webhook bridge for tablet-mode WeChat (Xposed hook + Go daemon).	yaping-pro/wx-pad-exporter
`wx-linux-exporter`	Linux-native / containerized WeChat chatstream exporter pipeline & assistant bridge.	yaping-pro/wx-linux-exporter

🔒 Security & Disclaimer

📄 License

The core source code of wx-tablet-mode is licensed under the GNU General Public License v3.0 (GPL-3.0).
For third-party components, dependencies, and license notices, see NOTICE.

💬 Discussions & Community

Group name: 微信个人助理交流 (WeChat Personal Assistant Community)

⚠️ The WeChat group QR code expired on 2026-10-20 and has been removed to prevent mistaken scans. Use the Telegram group below, or leave a message in GitHub Discussions to request a new code.

💬 Online discussions: For questions, troubleshooting, and general discussions, you can also directly visit GitHub Discussions.

✈️ Telegram group: t.me/WeChatExporter (durable fallback when the QR expires)

🛠️ Maintainer note: Once a new code is available, commit it as assets/wechat-group-qr.png, restore the <img> reference in both sections, and set a new validity date.

Name		Name	Last commit message	Last commit date
.github		.github
app		app
assets		assets
docs		docs
gradle/wrapper		gradle/wrapper
scripts		scripts
.cnb.yml		.cnb.yml
.gitignore		.gitignore
AGENT.md		AGENT.md
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
DISCLAIMER.md		DISCLAIMER.md
LICENSE		LICENSE
NOTICE		NOTICE
NO_PROPRIETARY_BINARIES.md		NO_PROPRIETARY_BINARIES.md
README.md		README.md
SECURITY.md		SECURITY.md
build.gradle.kts		build.gradle.kts
gradlew		gradlew
gradlew.bat		gradlew.bat
settings.gradle.kts		settings.gradle.kts

Latest commit

History

Folders and files

Repository files navigation