{"record":{"id":"c65eaa4429e49e40","repo":"moonD4rk/HackBrowserData","slug":"abe-local-state-has-no-app-bound-encrypted-key","errorCode":null,"errorMessage":"abe: Local State has no app_bound_encrypted_key","messagePattern":"abe: Local State has no app_bound_encrypted_key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"masterkey/abe_windows.go","lineNumber":24,"sourceCode":"\t\"encoding/base64\"\n\t\"errors\"\n\t\"fmt\"\n\t\"os\"\n\t\"strings\"\n\n\t\"github.com/tidwall/gjson\"\n\n\t\"github.com/moond4rk/hackbrowserdata/crypto/windows/payload\"\n\t\"github.com/moond4rk/hackbrowserdata/log\"\n\t\"github.com/moond4rk/hackbrowserdata/utils/injector\"\n\t\"github.com/moond4rk/hackbrowserdata/utils/winutil\"\n)\n\nconst envEncKeyB64 = \"HBD_ABE_ENC_B64\"\n\nvar appbPrefix = []byte{'A', 'P', 'P', 'B'}\n\nvar errNoABEKey = errors.New(\"abe: Local State has no app_bound_encrypted_key\")\n\ntype ABERetriever struct{}\n\nfunc (r *ABERetriever) RetrieveKey(hints Hints) ([]byte, error) {\n\t// Non-ABE forks (Opera/Vivaldi/Yandex) supply no WindowsABEKey — treat as \"not applicable\".\n\t// (Pre-v20 Chrome takes the errNoABEKey path below.)\n\tbrowserKey := strings.TrimSpace(hints.WindowsABEKey)\n\tif browserKey == \"\" {\n\t\treturn nil, nil\n\t}\n\n\tencKey, err := loadEncryptedKey(hints.LocalStatePath)\n\tif errors.Is(err, errNoABEKey) {\n\t\treturn nil, nil\n\t}\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/abe_windows.go#L6-L42","documentation":"The ABE (app-bound encryption) retriever found no app_bound_encrypted_key in the browser's Local State — either the Local State path was empty or the JSON lacked the key — meaning this browser either doesn't use ABE (pre-v20 Chrome, Opera/Vivaldi/Yandex forks) or the key is missing. RetrieveKey deliberately returns (nil, nil) for errNoABEKey so the master-key chain falls through to the next tier instead of failing.","triggerScenarios":"ABERetriever.RetrieveKey with hints.LocalStatePath == \"\" (non-ABE forks with no WindowsABEKey hint, or no path supplied); or loadEncryptedKey reading a Local State JSON that has no app_bound_encrypted_key field (pre-v20 Chrome, stripped/corrupt Local State).","commonSituations":"Running against Chrome < 127 (v10/v20 without ABE), against Opera/Vivaldi/Yandex which don't set the WindowsABEKey hint, or against a Local State copied without the encrypted key — usually harmless by design.","solutions":["No action needed if the browser legitimately doesn't use ABE — the retriever chain falls through to the next tier.","For Chrome 127+ cookies: ensure the correct Local State path is passed in hints.LocalStatePath.","Verify the Local State JSON actually contains os_crypt.app_bound_encrypted_key.","Set hints.WindowsABEKey appropriately only for ABE-capable browsers."],"exampleFix":"// before: empty path yields errNoABEKey even for Chrome\nhints := masterkey.Hints{WindowsABEKey: \"chrome\"}\n// after: supply the Local State path\nhints := masterkey.Hints{WindowsABEKey: \"chrome\", LocalStatePath: chromeLocalStatePath}","handlingStrategy":"fallback","validationCode":"data, err := os.ReadFile(localStatePath)\nif err == nil {\n    var ls struct{ OsCrypt struct{ AppBoundEncryptedKey string `json:\"app_bound_encrypted_key\"` } `json:\"os_crypt\"` }\n    if json.Unmarshal(data, &ls) == nil && ls.OsCrypt.AppBoundEncryptedKey == \"\" {\n        // ABE not applicable; skip ABE retriever\n    }\n}","typeGuard":null,"tryCatchPattern":"key, err := abeRetriever.RetrieveKey(hints)\nif errors.Is(err, errNoABEKey) || (key == nil && err == nil) {\n    // fall through to the next retriever tier\n}","preventionTips":["Only enable the ABE retriever for Chrome 127+ with a valid Local State path.","Always populate Hints.LocalStatePath when WindowsABEKey is set.","Treat (nil, nil) as 'not applicable', not as failure."],"tags":["windows","chrome","abe","app-bound-encryption","local-state"],"backgroundTag":"missing-config-key","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}