郭立 (leeguoo)

# Chatting on WeChat While Slacking at Work: Move It Into the Terminal, Disguise It as a Dev Tool, and How It Works

In an open office, WeChat’s fluorescent green icon and full-screen chat bubbles are far too obvious. Three tricks make it impossible to tell from your screen that you’re using WeChat: send and receive in the terminal by reading the decrypted database and sending in the background, disguise the WeChat app as a development tool by changing Info.plist/icons and re-signing the shell, and use a boss key to hide it instantly with a global hotkey and process hiding. Each trick explains exactly how it works.

Jun 30, 2026 · Posts · Public · Article

ON THIS PAGE

Open offices have an old problem: you sneak in a WeChat reply while slacking off, but that fluorescent green icon plus a screen full of chat bubbles is recognizable from three meters away. If your boss walks past behind you, they can tell at a glance that you are not working.

wechat-use, a project that turns WeChat for macOS into a local command-line tool, happens to solve this awkward problem. With three tricks, your screen no longer looks like you are chatting on WeChat. Each one is explained below, including how it works.

The three-piece slacking-off kit

Trick 1: Move Chat Into the Terminal

wechat-use chat opens a chat interface in the terminal. It looks like a TUI in the style of Claude Code: a conversation list on the left, the message stream on the right, and an input box at the bottom. Type and press Enter to send.

$ bash
wechat-use chat              # Enter the conversation list and select with up/down
wechat-use chat Zhang San    # Jump directly into a conversation with someone

How It Works

This TUI, drawn with Rust’s ratatui, does not touch the WeChat UI itself. It connects to three lower-level data streams:

  • Message history: WeChat stores chat records in a local SQLCipher-encrypted database. Once the account’s decryption key is obtained, the decrypted database can be read directly. Conversation lists, history, and search results all come from SQL queries, regardless of whether the WeChat client is open.
  • New messages: A persistent background process, the daemon, watches these database files for changes with FSEvents. As soon as the database is written to, it decrypts the new rows and pushes them to the TUI, so incoming messages appear in the terminal in real time.
  • Sending: After you press Enter in the input box, the message is sent in the background: no WeChat window pops up, and your mouse and keyboard are not taken over. I wrote a separate article about how this background sending chain works without attaching to WeChat or corrupting the database: From “attaching a debugger” to “zero attachment”. Received images are first shown as [image] in the TUI; only when you type /img are they opened in the system’s default image viewer.

The effect is this: when a coworker walks by, they see a black-background window, a bunch of monospaced text, and someone who looks like they are running commands. There is no trace of WeChat’s appearance on the screen, so naturally no one thinks you are chatting on WeChat.

Trick 2: Disguise the WeChat App Itself

Once the terminal part is handled, there are still giveaways: the green icon in the Dock, “WeChat” popping up in Cmd-Tab, and “WeChat” sitting plainly in Activity Monitor. One glance and the disguise is blown.

$ bash
wechat-use disguise list            # See available disguise skins
wechat-use disguise apply console   # Turn WeChat into Console, including the icon
wechat-use disguise status
wechat-use disguise restore         # Restore the original green WeChat with one command

How It Works

On macOS, an app’s “identity” really comes from a few things inside its .app bundle: CFBundleName / CFBundleDisplayName in Info.plist, which control the names shown in the Dock and Cmd-Tab, and the .icns icon file in Resources. Replace those, and the system sees a different app.

But there is one unavoidable step: if you change any file inside the .app bundle, the original code signature becomes invalid. Once the signature is broken, Gatekeeper will block it, and previously granted TCC permissions such as Accessibility or Screen Recording will no longer be recognized. So after changing the icon and name, the .app must be ad-hoc signed again before the system accepts it.

There is a critical boundary here, and it came from painful experience: re-signing only touches the .app shell and never modifies the core library responsible for sending messages. The reason is that sending depends on matching that library’s version precisely by file hash, specifically SHA-256, to load the corresponding adaptation data. If even one byte changes, the hash changes, matching fails, and sending stops working. Early on, for convenience, even the color scheme inside the library was modified, and send broke on the spot. So disguise is designed this way: the outer shell can be disguised freely, but not a single byte of the core is changed.

Trick 3: When the Boss Really Walks Over, Hide It With One Key

The first two tricks protect against someone “just glancing.” But if the boss walks directly up to your desk, you need an instant hard switch for hiding everything.

$ bash
wechat-use disguise bosskey on    # Install the global shortcut

After that, press ⌃⌥Space, Control + Option + Space, and WeChat is hidden instantly. When the boss leaves, press it again and everything comes back as it was.

How It Works

The boss key uses a macOS system-level global hotkey. A small persistent background program, a LaunchAgent, registers the ⌃⌥Space key combination with the system. No matter which app currently has focus, pressing it is intercepted by this program. When triggered, it sends a hide action to the WeChat process, equivalent to hiding that app, and pressing it again restores it. Because it is registered at the system level, it works the same whether you are in the terminal, browser, or IDE.

How to Use It / How to Restore It

All of this is included in wechat-use v1.17.0 (GitHub). After installing it, run wechat-use init to extract the key, and you can start using it. chat is read-only plus background sending; disguise only changes the app shell and does not touch chat data; disguise restore can bring back the original green WeChat at any time with one command.

Technically, there is no black magic here: read the decrypted local database, change the .app icon and name and re-sign it, then register a global hotkey. Put the three together, and you get a WeChat setup that gives nothing away on screen. As for whether you should slack off at work, that is another matter. If you really are going to, at least do not let that fluorescent green give you away.

next →
Letting WeChat Send Messages for You in the Background: I Once Corrupted Its Database — From “Attaching a Debugger” to “Zero Attachment”

Comments

Replies are public immediately and may be moderated for policy violations.

Max 1000 characters.