{"record":{"id":"2f915f5e7565f103","repo":"moonD4rk/HackBrowserData","slug":"yandex-v10-marker-not-found-in-local-encryptor-da","errorCode":null,"errorMessage":"yandex: v10 marker not found in local_encryptor_data","messagePattern":"yandex: v10 marker not found in local_encryptor_data","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crypto/yandex.go","lineNumber":19,"sourceCode":"package crypto\n\nimport (\n\t\"bytes\"\n\t\"errors\"\n)\n\n// yandexSignature is the protobuf wire-format header (field1 varint=1, field2 len=32) on every wrapped key.\nvar yandexSignature = []byte{0x08, 0x01, 0x12, 0x20}\n\nvar localEncryptorPrefix = []byte(\"v10\")\n\nconst (\n\tyandexIntKeyBlobLen = 96 // 12B nonce + 68B ciphertext + 16B GCM tag\n\tyandexDataKeyLen    = 32\n)\n\nvar (\n\terrYandexMarkerNotFound = errors.New(\"yandex: v10 marker not found in local_encryptor_data\")\n\terrYandexBlobShort      = errors.New(\"yandex: encrypted intermediate key truncated\")\n\terrYandexBadSignature   = errors.New(\"yandex: invalid protobuf signature on decrypted key\")\n\terrYandexKeyTooShort    = errors.New(\"yandex: decrypted intermediate key shorter than 32 bytes\")\n)\n\n// DecryptYandexIntermediateKey unwraps the per-DB data key from meta.local_encryptor_data.\nfunc DecryptYandexIntermediateKey(masterKey, blob []byte) ([]byte, error) {\n\tidx := bytes.Index(blob, localEncryptorPrefix)\n\tif idx < 0 {\n\t\treturn nil, errYandexMarkerNotFound\n\t}\n\tpayload := blob[idx+len(localEncryptorPrefix):]\n\tif len(payload) < yandexIntKeyBlobLen {\n\t\treturn nil, errYandexBlobShort\n\t}\n\n\tplaintext, err := AESGCMDecryptBlob(masterKey, payload[:yandexIntKeyBlobLen], nil)\n\tif err != nil {","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/crypto/yandex.go#L1-L37","documentation":"errYandexMarkerNotFound is returned by DecryptYandexIntermediateKey when the v10 marker (localEncryptorPrefix) cannot be located in the local_encryptor_data blob. The Yandex v10 format requires a fixed prefix inside the blob to locate the encrypted intermediate key; without it the payload offset cannot be determined.","triggerScenarios":"Calling DecryptYandexIntermediateKey with a blob that does not contain the v10 marker — e.g. an empty DB field, a Chromium-style v10 cookie value passed by mistake, or a Yandex database using an older/newer storage format without the prefix.","commonSituations":"Reading a Yandex Browser profile whose local_encryptor_data format differs (pre-v10 or updated versions); selecting the wrong column/row from the SQLite DB; pointing the Yandex path at a plain Chromium profile by accident.","solutions":["Verify the blob actually comes from Yandex's local_encryptor_data and contains the v10 marker prefix; inspect the raw bytes.","Check you selected the correct SQLite field — not a cookie value or an empty cell.","Handle older/newer Yandex formats separately; add a branch if the marker changed between Yandex Browser versions.","Skip such records and log a warning instead of failing the whole extraction run."],"exampleFix":"// before\nkey, err := crypto.DecryptYandexIntermediateKey(masterKey, blob)\n// after\nif !bytes.Contains(blob, localEncryptorPrefix) {\n    return nil, fmt.Errorf(\"skipping record: %w\", errYandexMarkerNotFound)\n}\nkey, err := crypto.DecryptYandexIntermediateKey(masterKey, blob)","handlingStrategy":"validation","validationCode":"if !bytes.Contains(blob, markerPrefix) {\n    return fmt.Errorf(\"v10 marker absent; len=%d\", len(blob))\n}","typeGuard":"func hasYandexMarker(blob, prefix []byte) bool { return bytes.Index(blob, prefix) >= 0 }","tryCatchPattern":"key, err := crypto.DecryptYandexIntermediateKey(master, blob)\nif errors.Is(err, crypto.ErrYandexMarkerNotFound) {\n    log.Warnf(\"yandex record lacks v10 marker; skipping\")\n    return nil\n}","preventionTips":["Verify the record comes from Yandex's local_encryptor_data, not a cookie or Chromium value.","Check the Yandex Browser version — formats changed across releases.","Inspect raw bytes when a new profile fails marker lookup.","Skip-and-log rather than fail the whole extraction on one bad record."],"tags":["crypto","yandex","marker","parsing"],"backgroundTag":"resource-not-found","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}