{"record":{"id":"8ab79e69bcc411f5","repo":"moonD4rk/HackBrowserData","slug":"os-crypt-encrypted-key-not-found-in-local-state","errorCode":null,"errorMessage":"os_crypt.encrypted_key not found in Local State","messagePattern":"os_crypt\\.encrypted_key not found in Local State","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/retriever_windows.go","lineNumber":26,"sourceCode":"\t\"os\"\n\n\t\"github.com/tidwall/gjson\"\n\n\t\"github.com/moond4rk/hackbrowserdata/crypto\"\n)\n\n// DPAPIRetriever unwraps Chrome's Local State os_crypt.encrypted_key via Windows DPAPI.\ntype DPAPIRetriever struct{}\n\nfunc (r *DPAPIRetriever) RetrieveKey(hints Hints) ([]byte, error) {\n\tdata, err := os.ReadFile(hints.LocalStatePath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"read Local State: %w\", err)\n\t}\n\n\tencryptedKey := gjson.GetBytes(data, \"os_crypt.encrypted_key\")\n\tif !encryptedKey.Exists() {\n\t\treturn nil, fmt.Errorf(\"os_crypt.encrypted_key not found in Local State\")\n\t}\n\n\tkeyBytes, err := base64.StdEncoding.DecodeString(encryptedKey.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"base64 decode encrypted_key: %w\", err)\n\t}\n\n\tconst dpapiPrefix = \"DPAPI\"\n\tif len(keyBytes) <= len(dpapiPrefix) {\n\t\treturn nil, fmt.Errorf(\"encrypted_key too short: %d bytes\", len(keyBytes))\n\t}\n\tif string(keyBytes[:len(dpapiPrefix)]) != dpapiPrefix {\n\t\treturn nil, fmt.Errorf(\"encrypted_key unexpected prefix: got %q, want %q\", keyBytes[:len(dpapiPrefix)], dpapiPrefix)\n\t}\n\n\tmasterKey, err := crypto.DecryptDPAPI(keyBytes[len(dpapiPrefix):])\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"DPAPI decrypt: %w\", err)","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/retriever_windows.go#L8-L44","documentation":"Local State was read successfully, but the JSON path os_crypt.encrypted_key does not exist. Chrome stores the DPAPI-encrypted AES key there; without it the V10 key cannot be derived. This indicates a malformed, truncated, or very old/unusual Local State file.","triggerScenarios":"gjson.GetBytes(data, \"os_crypt.encrypted_key\") returns !Exists(): the key is absent from the JSON, the file is empty/corrupt/truncated, or it is not the User Data-level Local State (e.g. a per-profile file that lacks os_crypt).","commonSituations":"Chrome crash or disk full left Local State truncated; pointing the hint at Default/Preferences instead of Local State; new profile never used for cookie encryption; Chromium forks with a different os_crypt layout; file partially synced by OneDrive/roaming.","solutions":["Point hints.LocalStatePath at the User Data root's 'Local State' file (not a profile subfolder) and confirm the JSON contains os_crypt.encrypted_key: type \"Local State\" | findstr encrypted_key","Launch Chrome once and let it encrypt cookies, which creates the encrypted_key entry, then retry","If the file is truncated, close Chrome, restore the file (or delete and let Chrome rebuild it), then re-run","Check file size — a 0-byte or tiny Local State means corruption; re-copy from a healthy profile backup"],"exampleFix":"// before\nHints{LocalStatePath: userDataDir + \"\\\\Default\\\\Local State\"}\n// after\nHints{LocalStatePath: userDataDir + \"\\\\Local State\"} // User Data root, not the Default profile","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(localStatePath)\nif err == nil && !gjson.GetBytes(data, \"os_crypt.encrypted_key\").Exists() {\n    // encrypted_key missing — file corrupt, wrong file, or profile never encrypted cookies\n}","typeGuard":null,"tryCatchPattern":"key, err := dpapiRetriever.RetrieveKey(hints)\nif err != nil && strings.Contains(err.Error(), \"os_crypt.encrypted_key not found\") {\n    // fall back to ABE (v20) tier or restore the Local State file\n}","preventionTips":["Validate Local State JSON contains os_crypt.encrypted_key before attempting DPAPI unwrap","Use the User Data root 'Local State' file, not per-profile JSON files","Run the browser once on a fresh profile so encrypted_key is generated","Watch for truncated/0-byte files after crashes or OneDrive sync and restore from backup"],"tags":["windows","dpapi","json","local-state","missing-key"],"backgroundTag":"missing-required-config-field","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}