Bypassing WeChat’s Singleton Check: Run Multiple Instances on Windows

Running multiple WeChat instances with a batch file

On Windows, WeChat enforces a global singleton by creating a named mutex. A simple batch file can start several instances because the processes are launched almost simultaneously, before the first instance creates the mutex or its main window.

start D:\WeChat\WeChat.exe
start D:\WeChat\WeChat.exe
rem add more lines to start additional instances

Singleton implementation in WeChat

When WeChat starts it calls CreateMutex with the name _WeChat_App_Instance_Identity_Mutex_Name. If the call succeeds, the process continues. If the mutex already exists, GetLastError returns 0x000000b7 (ERROR_ALREADY_EXISTS).

Process Explorer can show the mutex; API Monitor can capture the CreateMutex and GetLastError calls.

Location of the mutex creation

Static analysis of WeChatWin.dll (the main UI DLL) shows the mutex creation at offset 0x8e271b inside function sub_108e26d0, which is called by sub_108e2660.

Decision logic after mutex creation

If CreateMutex succeeds, the process proceeds to start the UI.

If it fails, the code searches for windows named WeChatMainWndForPC or WeChatLoginWndForPC. If either is found, BringWindowToTop is invoked to activate the existing instance, and the new process exits.

If no such windows are found, the process falls back to launching a new instance.

if (CreateMutex() == SUCCESS) {
    // launch WeChat
} else {
    if (FindWindow("WeChatMainWndForPC") || FindWindow("WeChatLoginWndForPC")) {
        BringWindowToTop(existingWindow);
        // exit current process
    } else {
        // launch WeChat
    }
}

Why the batch script bypasses the singleton check

The start commands in a batch file are executed asynchronously. The second (or later) process begins before the first has created the mutex and before its main window appears. Consequently the CreateMutex call in the later process succeeds, allowing multiple processes to run concurrently.

Additional observations

Reverse‑engineering reveals that the exported entry point used to start the UI is named StartWaChat (a typo for StartWeChat) in older versions; newer releases have corrected the name.