{"record":{"id":"14667ab4316ef502","repo":"moonD4rk/HackBrowserData","slug":"keychain-s","errorCode":null,"errorMessage":"keychain: %s","messagePattern":"keychain: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/retriever_darwin.go","lineNumber":151,"sourceCode":"\tvar stdout, stderr bytes.Buffer\n\tcmd := exec.CommandContext(ctx, \"security\", \"find-generic-password\", \"-wa\", strings.TrimSpace(storage)) //nolint:gosec\n\tcmd.Stdout = &stdout\n\tcmd.Stderr = &stderr\n\n\tif err := cmd.Run(); err != nil {\n\t\tif errors.Is(ctx.Err(), context.DeadlineExceeded) {\n\t\t\treturn nil, fmt.Errorf(\"security command timed out after %s\", securityCmdTimeout)\n\t\t}\n\t\t// `security` exits non-zero with empty stderr when the user denies the prompt or mistypes;\n\t\t// surface that instead of the cryptic \"exit status 128 ()\".\n\t\tstderrStr := strings.TrimSpace(stderr.String())\n\t\tif stderrStr == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"security command: %w (likely keychain access denied or wrong password)\", err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"security command: %w (%s)\", err, stderrStr)\n\t}\n\tif stderr.Len() > 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: %s\", strings.TrimSpace(stderr.String()))\n\t}\n\n\tsecret := bytes.TrimSpace(stdout.Bytes())\n\tif len(secret) == 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: empty secret for %s\", storage)\n\t}\n\n\treturn darwinParams.deriveKey(secret), nil\n}\n\n// DefaultRetrievers wires the macOS V10 chain (the only tier Chromium uses here), first success wins:\n//  1. GcoredumpRetriever        — CVE-2025-24204 exploit (root only)\n//  2. KeychainPasswordRetriever — direct unlock, skipped when password is empty\n//  3. SecurityCmdRetriever      — `security` CLI fallback (may prompt)\nfunc DefaultRetrievers(keychainPassword string) Retrievers {\n\tchain := []Retriever{&GcoredumpRetriever{}}\n\tif keychainPassword != \"\" {\n\t\tchain = append(chain, &KeychainPasswordRetriever{Password: keychainPassword})","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/retriever_darwin.go#L133-L169","documentation":"SecurityCmdRetriever on macOS runs `security find-generic-password -wa <storage>` to read the Chromium safe-storage secret from the login keychain. The command exited 0 (so the prompt was accepted and the item was found), but something was written to stderr — the library treats any non-empty stderr on a successful run as a failure rather than decrypting with possibly-bad data.","triggerScenarios":"`security` exits 0 but prints to stderr, e.g. warnings about keychain state, deprecated output, or partial access notices emitted alongside the secret. retrieveKeyOnce unconditionally fails in that case.","commonSituations":"macOS versions where `security` emits benign warnings (e.g. keychain migration notices, securityd hiccups) while still succeeding; locked-but-auto-unlocking keychains; unusual keychain search paths.","solutions":["Read the stderr text embedded in the error — it is the raw `security` output and states what the tool complained about","Check `security find-generic-password -wa 'Chrome Safe Storage'` manually in a terminal to reproduce and inspect the warning","Unlock the keychain first (`security unlock-keychain login.keychain-db`) or remove/repair the offending keychain in Keychain Access","Fall back to another retriever: pass the keychain password to KeychainPasswordRetriever or run with root so GcoredumpRetriever succeeds","Upgrade macOS/security tooling if the stderr is a known benign warning"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"// Best-effort pre-check (may still prompt)\ncmd := exec.Command(\"security\", \"find-generic-password\", \"-wa\", \"Chrome Safe Storage\")\nvar stderr bytes.Buffer; cmd.Stderr = &stderr\nif err := cmd.Run(); err != nil { /* denied or wrong password */ }","typeGuard":null,"tryCatchPattern":"key, err := retriever.RetrieveKey(hints)\nif err != nil {\n    if strings.Contains(err.Error(), \"keychain: \") {\n        log.Warnf(\"security CLI warned: %v — trying password retriever\", err)\n    }\n}","preventionTips":["Prefer KeychainPasswordRetriever with the login password to avoid `security` CLI quirks","Run the `security` command manually once per macOS version to surface benign stderr warnings","Keep the chain configured (Gcoredump + password + CLI) so stderr failures fall through to another tier","Read the embedded stderr in the error message before assuming keychain corruption"],"tags":["macos","keychain","security-cli","subprocess"],"backgroundTag":"http-error-response","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}