{"record":{"id":"8adb8b108f46eb2b","repo":"moonD4rk/HackBrowserData","slug":"tried-d-candidates-none-unlocked-keychain","errorCode":null,"errorMessage":"tried %d candidates, none unlocked keychain","messagePattern":"tried (.+?) candidates, none unlocked keychain","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/gcoredump_darwin.go","lineNumber":123,"sourceCode":"\tfor _, candidate := range candidates {\n\t\tkc, err := keychainbreaker.Open(keychainbreaker.WithBytes(keychainBuf))\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif err := kc.Unlock(keychainbreaker.WithKey(candidate)); err != nil {\n\t\t\tcontinue\n\t\t}\n\n\t\trecords, err := kc.GenericPasswords()\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif len(records) > 0 {\n\t\t\treturn records, nil\n\t\t}\n\t}\n\n\treturn nil, fmt.Errorf(\"tried %d candidates, none unlocked keychain\", len(candidates))\n}\n\n// scanMasterKeyCandidates scans the core dump for 24-byte master key candidates.\n//\n// securityd stores the master key in a MALLOC_SMALL region with the layout:\n//\n//\t[0x18 (8 bytes)] [pointer to key data (8 bytes)]\n//\n// 0x18 = 24 is the key length. The pointer references a 24-byte buffer\n// within the same region containing the raw master key.\nfunc scanMasterKeyCandidates(corePath string, regions []addressRange) ([]string, error) {\n\tcmf, err := macho.Open(corePath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to open core dump: %w\", err)\n\t}\n\tdefer cmf.Close()\n\n\tvar candidates []string","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/gcoredump_darwin.go#L105-L141","documentation":"After extracting N candidate 24-byte keys from the securityd core, each is tried against the login keychain via keychainbreaker. This error reports that every candidate failed to unlock (or produced zero records), i.e. the true master key was not among the candidates.","triggerScenarios":"Calling DecryptKeychainRecords when all scanned candidates fail kc.Unlock or return zero generic passwords — the memory-scan heuristic matched decoy 0x18-length patterns but not the real master key, or the real key was not resident in the dumped MALLOC_SMALL regions.","commonSituations":"macOS versions where securityd stores the key with a different layout so the true key is missed; keychain locked/never unlocked so key not in memory; keychain protected by additional security measures; scan timing (dump taken before keychain use).","solutions":["Unlock the keychain and perform a keychain operation first so the master key is materialized in securityd memory, then re-run.","Review scanMasterKeyCandidates' heuristic (0x18 length marker + intra-region pointer) against the actual securityd memory layout on your macOS build; adjust if needed.","Increase coverage: scan other heap regions (MALLOC_LARGE, default zone) if MALLOC_SMALL misses the key on this version.","Verify the keychain file being opened matches the securityd instance's user (same HOME) — a mismatched keychain will never unlock.","Check the count in the message: if it is 0, the real problem is upstream (error 55 — no candidates at all)."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// ensure keychain is unlocked first\nerr := exec.Command(\"security\", \"unlock-keychain\", \"-p\", password, \"login.keychain\").Run()\nif err != nil {\n    return fmt.Errorf(\"keychain could not be unlocked; memory candidates will not work\")\n}","typeGuard":null,"tryCatchPattern":"records, err := masterkey.DecryptKeychainRecords()\nif err != nil && strings.Contains(err.Error(), \"none unlocked keychain\") {\n    // fall back to explicit user-provided keychain password path\n}","preventionTips":["Perform a keychain operation before dumping so the master key is resident.","Check the candidate count in the message; 0 means upstream scanning failed, not key mismatch.","Match the keychain file to the same user as the securityd instance.","Keep the memory-scan heuristic current for your macOS version."],"tags":["macos","keychain","decryption","heuristic"],"backgroundTag":"checksum-mismatch","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}