{"record":{"id":"72150bb716a4a11d","repo":"moonD4rk/HackBrowserData","slug":"failed-to-open-core-dump-w","errorCode":null,"errorMessage":"failed to open core dump: %w","messagePattern":"failed to open core dump: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/gcoredump_darwin.go","lineNumber":137,"sourceCode":"\t\t\treturn records, nil\n\t\t}\n\t}\n\n\treturn nil, fmt.Errorf(\"tried %d candidates, none unlocked keychain\", len(candidates))\n}\n\n// scanMasterKeyCandidates scans the core dump for 24-byte master key candidates.\n//\n// securityd stores the master key in a MALLOC_SMALL region with the layout:\n//\n//\t[0x18 (8 bytes)] [pointer to key data (8 bytes)]\n//\n// 0x18 = 24 is the key length. The pointer references a 24-byte buffer\n// within the same region containing the raw master key.\nfunc scanMasterKeyCandidates(corePath string, regions []addressRange) ([]string, error) {\n\tcmf, err := macho.Open(corePath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to open core dump: %w\", err)\n\t}\n\tdefer cmf.Close()\n\n\tvar candidates []string\n\tseen := make(map[string]struct{})\n\tfor _, region := range regions {\n\t\tdata, vaddr, err := getMallocSmallRegionData(cmf, region)\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tfor i := 0; i < len(data)-16; i += 8 {\n\t\t\t// look for the length marker (0x18 = 24 bytes)\n\t\t\tval := binary.LittleEndian.Uint64(data[i : i+8])\n\t\t\tif val != 0x18 {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\t// next 8 bytes should be a pointer within this region\n\t\t\tptr := binary.LittleEndian.Uint64(data[i+8 : i+16])","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/gcoredump_darwin.go#L119-L155","documentation":"scanMasterKeyCandidates fails at macho.Open(corePath) when the gcore-produced core dump cannot be opened or parsed as a Mach-O file. This is the direct error surfaced as 'scan master key candidates: %w' to DecryptKeychainRecords callers.","triggerScenarios":"Calling DecryptKeychainRecords when the core dump path is invalid, the file was removed before parsing (race with defer os.Remove or tmp cleaners), or gcore wrote a partial/non-Mach-O file.","commonSituations":"Concurrent runs where one process's deferred os.Remove deletes another's file; /tmp cleanup; disk-full truncation during gcore; extremely large core files exceeding debug/macho practical limits; gcore flag differences across macOS versions producing unexpected formats.","solutions":["Re-run the operation — a transient gcore failure often produces an unreadable file; ensure only one run at a time to avoid tmp-file races.","Validate the core immediately after dumping: `file <corePath>` must report a Mach-O core.","Check free space and file size before parsing (`ls -la`); re-dump if truncated.","Unwrap the error for the specific macho.Open cause and match against the gcore/OS version in use.","Pin to a macOS/gcore combination known to emit standard Mach-O core format compatible with debug/macho."],"exampleFix":"// before\ncmf, err := macho.Open(corePath)\nif err != nil {\n    return nil, fmt.Errorf(\"failed to open core dump: %w\", err)\n}\n// after\ncmf, err := macho.Open(corePath)\nif err != nil {\n    return nil, fmt.Errorf(\"failed to open core dump %s: %w\", corePath, err)\n}","handlingStrategy":"validation","validationCode":"fi, err := os.Stat(corePath)\nif err != nil {\n    return fmt.Errorf(\"core dump not present: %v\", err)\n}\nif fi.Size() < 4096 {\n    return fmt.Errorf(\"core dump suspiciously small (%d bytes); re-dump\", fi.Size())\n}","typeGuard":null,"tryCatchPattern":"_, err := masterkey.DecryptKeychainRecords()\nif err != nil && strings.Contains(err.Error(), \"failed to open core dump\") {\n    // re-run with a fresh dump; check disk space and gcore behavior\n}","preventionTips":["Validate dumps with `file` before programmatic parsing.","Serialize runs to avoid tmp-file deletion races.","Monitor disk space; truncated cores fail macho.Open.","Test gcore output format compatibility with debug/macho per macOS version."],"tags":["macos","macho","core-dump","file-open"],"backgroundTag":"file-open-failed","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}