From c8752575676bc35beb3350c727e09080c2d488d1 Mon Sep 17 00:00:00 2001
From: YanAnHuaZai <me@huazai.cn>
Date: Tue, 1 Sep 2026 14:45:49 +0800
Subject: [PATCH 1/2] [version] new version 6.25529(darwin)

---
 frida/config/darwin/addresses.6.25529.json | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 frida/config/darwin/addresses.6.25529.json

diff --git a/frida/config/darwin/addresses.6.25529.json b/frida/config/darwin/addresses.6.25529.json
new file mode 100644
index 0000000..22212d8
--- /dev/null
+++ b/frida/config/darwin/addresses.6.25529.json
@@ -0,0 +1,13 @@
+{
+    "Version": 6.25529,
+    "LoadStartHookOffset": "0x5720430",
+    "CDPFilterHookOffset": "0x92e76a8",
+    "SceneOffsets": [
+        56,
+        1552,
+        8,
+        1488,
+        16,
+        456
+    ]
+}

From 2f7338563a1f14fb4f5536f81a97ee2561621216 Mon Sep 17 00:00:00 2001
From: YanAnHuaZai <me@huazai.cn>
Date: Tue, 1 Sep 2026 14:47:28 +0800
Subject: [PATCH 2/2] [doc] add notes for running macOS for the first time

---
 README.md    | 20 +++++++++++++++++++-
 README.zh.md | 20 +++++++++++++++++++-
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index b7763b0..7db5eaa 100644
--- a/README.md
+++ b/README.md
@@ -94,7 +94,8 @@ To debug web pages of WeChat embedded browser, please refer to [EXTENSION.md](EX
 
 **Version histories:**
 
-* 269136 (latest)
+* 6.25529 (latest, official download, credit @YanAnHuaZai)
+* 269136 (latest, Mac App Store)
 
 
 To check WMPF version on macOS:
@@ -104,6 +105,23 @@ To check WMPF version on macOS:
 grep CFBundleVersion -A 1 "/Applications/WeChat.app/Contents/MacOS/WeChatAppEx.app/Contents/Info.plist"
 ```
 
+Before running the debugger on macOS for the first time, quit WeChat completely and apply an Ad-Hoc signature to the `WeChatAppEx` executable. This allows Frida to attach to the process without disabling System Integrity Protection (SIP):
+
+```bash
+sudo codesign --force --sign - \
+  --preserve-metadata=identifier,entitlements,requirements \
+  "/Applications/WeChat.app/Contents/MacOS/WeChatAppEx.app/Contents/MacOS/WeChatAppEx"
+```
+
+Verify the signature:
+
+```bash
+codesign --verify --strict --verbose=4 \
+  "/Applications/WeChat.app/Contents/MacOS/WeChatAppEx.app/Contents/MacOS/WeChatAppEx"
+```
+
+Restart WeChat, then run the debugger as your normal user. Running `npx ts-node src/index.ts` with `sudo` does not bypass the target process's code-signing restrictions. You may need to repeat the Ad-Hoc signing step after updating or reinstalling WeChat.
+
 
 ## Prerequisites
 
diff --git a/README.zh.md b/README.zh.md
index 08129ad..4dce6bb 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -91,7 +91,8 @@
 
 **支持的 WMPF 版本：**
 
-* 269136 (最新)
+* 6.25529（最新, 官网下载版，credit @YanAnHuaZai）
+* 269136（最新, 苹果应用商店版）
 
 如何检查版本：
 
@@ -100,6 +101,23 @@
 grep CFBundleVersion -A 1 "/Applications/WeChat.app/Contents/MacOS/WeChatAppEx.app/Contents/Info.plist"
 ```
 
+首次在 macOS 上运行调试器前，请彻底退出微信，并对 `WeChatAppEx` 可执行文件进行 Ad-Hoc 重签名。这样无需关闭系统完整性保护（SIP），Frida 也可以附加到该进程：
+
+```bash
+sudo codesign --force --sign - \
+  --preserve-metadata=identifier,entitlements,requirements \
+  "/Applications/WeChat.app/Contents/MacOS/WeChatAppEx.app/Contents/MacOS/WeChatAppEx"
+```
+
+验证签名：
+
+```bash
+codesign --verify --strict --verbose=4 \
+  "/Applications/WeChat.app/Contents/MacOS/WeChatAppEx.app/Contents/MacOS/WeChatAppEx"
+```
+
+重新启动微信后，请使用普通用户运行调试器。使用 `sudo` 执行 `npx ts-node src/index.ts` 并不能绕过目标进程的代码签名限制。更新或重新安装微信后，可能需要再次执行 Ad-Hoc 签名。
+
 ## 准备
 
 * node.js (需要至少 LTS v22)