{"record":{"id":"c24cfdcfdc4523f6","repo":"moonD4rk/HackBrowserData","slug":"keychain-gcore-dump-not-built-in-rebuild-with-ta","errorCode":null,"errorMessage":"keychain gcore dump not built in (rebuild with -tags keychain_gcore)","messagePattern":"keychain gcore dump not built in \\(rebuild with -tags keychain_gcore\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"masterkey/gcoredump_stub_darwin.go","lineNumber":16,"sourceCode":"//go:build darwin && !keychain_gcore\n\npackage masterkey\n\nimport (\n\t\"errors\"\n\n\t\"github.com/moond4rk/keychainbreaker\"\n)\n\n// DecryptKeychainRecords returns an error in default builds so GcoredumpRetriever\n// falls through silently to the next tier. The CVE-2025-24204 securityd-dump\n// implementation (gcoredump_darwin.go) is only compiled with -tags keychain_gcore,\n// keeping the default `go build` free of the exploit code and its byte signatures.\nfunc DecryptKeychainRecords() ([]keychainbreaker.GenericPassword, error) {\n\treturn nil, errors.New(\"keychain gcore dump not built in (rebuild with -tags keychain_gcore)\")\n}\n","sourceCodeStart":1,"sourceCodeEnd":18,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/gcoredump_stub_darwin.go#L1-L18","documentation":"The default build of hack-browser-data intentionally excludes the CVE-2025-24204 securityd-dump implementation; DecryptKeychainRecords is a stub that always returns this error so GcoredumpRetriever falls through silently to the next master-key tier. The real implementation only compiles in with the keychain_gcore build tag, keeping default binaries free of the exploit code and its signatures.","triggerScenarios":"Calling DecryptKeychainRecords in any binary built without -tags keychain_gcore — always returns this error immediately, before any euid check.","commonSituations":"Running a stock `go build` binary on macOS and expecting keychain extraction via memory dump; CI builds without the tag; users unaware the feature is gated behind a build tag.","solutions":["Rebuild the binary with: go build -tags keychain_gcore ./cmd/hack-browser-data/ (requires zig per the payload build if applicable).","Rely on other master-key retriever tiers, which the stub's fall-through enables automatically.","Use `make build-windows`-style Makefile targets or add the tag to your build pipeline if gcore extraction is required."],"exampleFix":"// before\ngo build ./cmd/hack-browser-data/\n// after\ngo build -tags keychain_gcore ./cmd/hack-browser-data/","handlingStrategy":"fallback","validationCode":"// detect stub build at runtime\n_, err := masterkey.DecryptKeychainRecords()\ngcoreAvailable := err == nil || !strings.Contains(err.Error(), \"not built in\")","typeGuard":null,"tryCatchPattern":"pw, err := masterkey.DecryptKeychainRecords()\nif err != nil && strings.Contains(err.Error(), \"not built in\") {\n    // stub build: rely on the next retriever tier or rebuild with the tag\n}","preventionTips":["Build with -tags keychain_gcore when keychain memory-dump extraction is required.","Don't treat this stub error as fatal — the retriever chain falls through.","Keep exploit-gated features out of default CI builds intentionally."],"tags":["macos","keychain","build-tags","feature-flag","stub"],"backgroundTag":"feature-not-enabled","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}