{"record":{"id":"50076da057e36246","repo":"moonD4rk/HackBrowserData","slug":"abe-unexpected-prefix-got-q-want-q","errorCode":null,"errorMessage":"abe: unexpected prefix: got %q, want %q","messagePattern":"abe: unexpected prefix: got %q, want %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/abe_windows.go","lineNumber":93,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"abe: read Local State: %w\", err)\n\t}\n\n\traw := gjson.GetBytes(data, \"os_crypt.app_bound_encrypted_key\")\n\tif !raw.Exists() {\n\t\treturn nil, errNoABEKey\n\t}\n\n\tdecoded, err := base64.StdEncoding.DecodeString(raw.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"abe: base64 decode: %w\", err)\n\t}\n\tif len(decoded) <= len(appbPrefix) {\n\t\treturn nil, fmt.Errorf(\"abe: encrypted key too short: %d bytes\", len(decoded))\n\t}\n\tfor i, b := range appbPrefix {\n\t\tif decoded[i] != b {\n\t\t\treturn nil, fmt.Errorf(\"abe: unexpected prefix: got %q, want %q\",\n\t\t\t\tdecoded[:len(appbPrefix)], appbPrefix)\n\t\t}\n\t}\n\treturn decoded[len(appbPrefix):], nil\n}\n","sourceCodeStart":75,"sourceCodeEnd":99,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/abe_windows.go#L75-L99","documentation":"The decoded app_bound_encrypted_key is expected to start with the 'APPB' magic prefix, which is stripped before decryption. This error means the decoded bytes begin with something else, so the blob is not Chrome app-bound encrypted key material.","triggerScenarios":"Calling RetrieveKey when the decoded Local State value lacks the APPB prefix — e.g. reading a Chromium-variant (Brave, Edge, etc.) that stores a differently-prefixed key, decoding the wrong field, or a Chrome version change to the key format.","commonSituations":"Targeting a Chromium fork with a different key envelope; mixing profiles between browsers; Chrome updating the app-bound key format; accidentally decrypting v10/v20 cookies with the wrong blob.","solutions":["Print both got/want prefixes (the error already does via %q) and confirm which browser produced the Local State file.","Point the tool at a genuine Google Chrome profile, or extend prefix handling for the specific Chromium variant you're targeting.","Re-read the correct JSON path os_crypt.app_bound_encrypted_key rather than another key field.","Check for a Chrome version change in key format and update appbPrefix handling if Google changed the envelope."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"decoded, _ := base64.StdEncoding.DecodeString(rawKey)\nif !bytes.HasPrefix(decoded, []byte(\"APPB\")) {\n\treturn fmt.Errorf(\"key blob lacks APPB prefix; not a Chrome app-bound key (got %q)\", decoded[:min(4, len(decoded))])\n}","typeGuard":null,"tryCatchPattern":"key, err := RetrieveKey(exePath, localStatePath)\nif err != nil {\n\tif strings.Contains(err.Error(), \"unexpected prefix\") {\n\t\tlog.Warnf(\"profile is not Google Chrome or format changed: %v\", err)\n\t\treturn fallbackDecrypt()\n\t}\n\treturn err\n}","preventionTips":["Confirm the target profile belongs to Google Chrome before running ABE (Chromium forks differ).","Check the browser type from the discovery layer instead of assuming Chrome.","Watch for Chrome updates that change the key envelope and update prefix handling."],"tags":["windows","chrome","key-extraction","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}