From 67358deeefd472c57d0a80b22323d32cc48e7195 Mon Sep 17 00:00:00 2001
From: 2977094657 <2977094657@qq.com>
Date: Wed, 31 Dec 2025 11:35:51 +0800
Subject: [PATCH] =?UTF-8?q?improvement(chat):=20packed=5Finfo=20md5=20?=
 =?UTF-8?q?=E6=8F=90=E5=8F=96=E4=BC=98=E5=85=88=E5=8C=B9=E9=85=8D=20.dat?=
 =?UTF-8?q?=20=E6=96=87=E4=BB=B6=E5=90=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- packed_info 同时包含多个 32hex 时，优先从形如 xxx_t.dat/.t.dat 的文件名中提取 md5；无匹配再回退到原 32hex 众数策略

- 对齐 echotrace 的选择思路，降低取错 md5 概率
---
 src/wechat_decrypt_tool/chat_helpers.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/wechat_decrypt_tool/chat_helpers.py b/src/wechat_decrypt_tool/chat_helpers.py
index 6a82822..242b66b 100644
--- a/src/wechat_decrypt_tool/chat_helpers.py
+++ b/src/wechat_decrypt_tool/chat_helpers.py
@@ -426,6 +426,7 @@ def _decode_message_content(compress_value: Any, message_value: Any) -> str:
 
 
 _MD5_HEX_RE = re.compile(rb"(?i)[0-9a-f]{32}")
+_DAT_MD5_RE = re.compile(rb"(?i)([0-9a-f]{32})(?:[._][thbc])?\.dat")
 
 
 def _extract_md5_from_blob(blob: Any) -> str:
@@ -443,6 +444,21 @@ def _extract_md5_from_blob(blob: Any) -> str:
 
     if not data:
         return ""
+
+    # Prefer md5 that appears as an actual `.dat` filename (incl. _t.dat/.t.dat variants).
+    # This matches echotrace's idea: packed_info often contains multiple 32-hex tokens, but only
+    # the one referenced by a file path is the correct on-disk basename.
+    try:
+        m2 = _DAT_MD5_RE.findall(data)
+    except Exception:
+        m2 = []
+    if m2:
+        best2 = Counter([x.lower() for x in m2]).most_common(1)[0][0]
+        try:
+            return best2.decode("ascii", errors="ignore")
+        except Exception:
+            return ""
+
     m = _MD5_HEX_RE.findall(data)
     if not m:
         return ""