{"record":{"id":"4dcd3c2a00ddda14","repo":"moonD4rk/HackBrowserData","slug":"read-via-file-mapping-w","errorCode":null,"errorMessage":"read via file mapping: %w","messagePattern":"read via file mapping: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"filemanager/copy_windows.go","lineNumber":35,"sourceCode":"//\n// Approach: DuplicateHandle + FileMapping\n//  1. Enumerate all open file handles via NtQuerySystemInformation\n//  2. Find the handle matching the target file path\n//  3. Duplicate that handle into our process via DuplicateHandle\n//  4. Read file content through memory-mapped I/O (CreateFileMapping + MapViewOfFile)\n//  5. Write content to destination\n//\n// This requires only normal user privileges (no admin needed).\nfunc copyLocked(src, dst string) error {\n\thandle, err := findFileHandle(src)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"find file handle for %s: %w\", src, err)\n\t}\n\tdefer windows.CloseHandle(handle)\n\n\tdata, err := readFileContent(handle)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read via file mapping: %w\", err)\n\t}\n\n\treturn os.WriteFile(dst, data, 0o600)\n}\n\n// findFileHandle enumerates all system handles, finds the one matching the\n// target file path, and duplicates it into the current process.\nfunc findFileHandle(targetPath string) (windows.Handle, error) {\n\t// Extract a stable suffix for matching that avoids short path name issues\n\t// (e.g., RUNNER~1 vs runneradmin in the username portion).\n\t// We match from AppData onwards, which uniquely identifies each browser:\n\t//   Google\\Chrome\\User Data\\Default\\Network\\Cookies  (Chrome)\n\t//   Microsoft\\Edge\\User Data\\Default\\Network\\Cookies (Edge)\n\ttargetSuffix := extractStableSuffix(targetPath)\n\tcurrentProcess := windows.CurrentProcess()\n\n\thandles, err := winapi.QuerySystemHandles()\n\tif err != nil {","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/filemanager/copy_windows.go#L17-L53","documentation":"Wrapped error from copyLocked's read stage on Windows: a handle to the locked file was found and duplicated, but reading its bytes through the kernel cache via CreateFileMapping/MapViewOfFile failed. The underlying error comes from the winapi mapping calls; ReadFile is the documented fallback if mapping fails, so reaching this wrapped error means the primary mapped-read path errored and is being surfaced to the caller.","triggerScenarios":"Thrown at filemanager/copy_windows.go:35 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the wrapped winapi error for access-denied (handle lacks read rights) or mapping-size failures","Retry after the browser checkpoints its WAL so the file size is stable","Fall back to a plain ReadFile loop on the duplicated handle","If mapping is persistently unsupported for this handle type, copy the file after closing the owning process"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}