{"record":{"id":"8e1ae5c02408a5d3","repo":"moonD4rk/HackBrowserData","slug":"abe-base64-decode-w","errorCode":null,"errorMessage":"abe: base64 decode: %w","messagePattern":"abe: base64 decode: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/abe_windows.go","lineNumber":86,"sourceCode":"}\n\nfunc loadEncryptedKey(localStatePath string) ([]byte, error) {\n\tif localStatePath == \"\" {\n\t\treturn nil, errNoABEKey\n\t}\n\tdata, err := os.ReadFile(localStatePath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"abe: read Local State: %w\", err)\n\t}\n\n\traw := gjson.GetBytes(data, \"os_crypt.app_bound_encrypted_key\")\n\tif !raw.Exists() {\n\t\treturn nil, errNoABEKey\n\t}\n\n\tdecoded, err := base64.StdEncoding.DecodeString(raw.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"abe: base64 decode: %w\", err)\n\t}\n\tif len(decoded) <= len(appbPrefix) {\n\t\treturn nil, fmt.Errorf(\"abe: encrypted key too short: %d bytes\", len(decoded))\n\t}\n\tfor i, b := range appbPrefix {\n\t\tif decoded[i] != b {\n\t\t\treturn nil, fmt.Errorf(\"abe: unexpected prefix: got %q, want %q\",\n\t\t\t\tdecoded[:len(appbPrefix)], appbPrefix)\n\t\t}\n\t}\n\treturn decoded[len(appbPrefix):], nil\n}\n","sourceCodeStart":68,"sourceCodeEnd":99,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/abe_windows.go#L68-L99","documentation":"After reading Local State, loadEncryptedKey base64-decodes the app_bound_encrypted_key string. This error wraps a base64.StdEncoding.DecodeString failure, meaning the JSON field did not contain valid standard base64 text.","triggerScenarios":"Calling RetrieveKey when the Local State file contains a malformed app_bound_encrypted_key value (corrupted profile, hand-edited file, non-standard JSON content, or the field holding something other than base64 key material).","commonSituations":"Corrupted or truncated Chrome profile; tests with synthetic Local State containing invalid base64; parsing the wrong JSON field or an escaped/quoting issue when the file was generated by another tool.","solutions":["Inspect the os_crypt.app_bound_encrypted_key value in Local State and confirm it is valid standard base64.","Restore/copy a fresh Local State from the affected Chrome profile, or reinstall/repair Chrome if the profile is corrupt.","Confirm you are reading the right JSON field (not encrypted_key vs app_bound_encrypted_key) and that no surrounding quotes/whitespace were added.","For robustness, try base64.RawStdEncoding as a fallback if the payload lacks padding."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"v := gjson.Get(localStateJSON, \"os_crypt.app_bound_encrypted_key\").String()\nif _, err := base64.StdEncoding.DecodeString(strings.TrimSpace(v)); err != nil {\n\treturn fmt.Errorf(\"app_bound_encrypted_key is not valid base64: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"key, err := RetrieveKey(exePath, localStatePath)\nif err != nil {\n\tif strings.Contains(err.Error(), \"base64 decode\") {\n\t\tlog.Warnf(\"Local State key blob corrupt: %v\", err)\n\t\treturn fallbackDecrypt()\n\t}\n\treturn err\n}","preventionTips":["Never hand-edit Local State; regenerate it via Chrome if corrupted.","Trim whitespace/newlines before decoding values extracted from JSON.","Verify the field content with a quick base64 validation in tests using synthetic Local State fixtures."],"tags":["windows","chrome","base64","json"],"backgroundTag":"invalid-argument-format","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}