{"record":{"id":"fe505392cd8b3286","repo":"moonD4rk/HackBrowserData","slug":"read-keychain-w","errorCode":null,"errorMessage":"read keychain: %w","messagePattern":"read keychain: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/gcoredump_darwin.go","lineNumber":102,"sourceCode":"\n\t// vmmap identifies MALLOC_SMALL heap regions where securityd stores keys\n\tregions, err := findMallocSmallRegions(pid)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to find malloc small regions: %w\", err)\n\t}\n\n\tcandidates, err := scanMasterKeyCandidates(corePath, regions)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"scan master key candidates: %w\", err)\n\t}\n\tif len(candidates) == 0 {\n\t\treturn nil, fmt.Errorf(\"no master key candidates found in securityd memory\")\n\t}\n\n\t// read keychain file once, reuse buffer for each candidate\n\tkeychainBuf, err := os.ReadFile(loginKeychainPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"read keychain: %w\", err)\n\t}\n\n\tfor _, candidate := range candidates {\n\t\tkc, err := keychainbreaker.Open(keychainbreaker.WithBytes(keychainBuf))\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif err := kc.Unlock(keychainbreaker.WithKey(candidate)); err != nil {\n\t\t\tcontinue\n\t\t}\n\n\t\trecords, err := kc.GenericPasswords()\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif len(records) > 0 {\n\t\t\treturn records, nil\n\t\t}","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/gcoredump_darwin.go#L84-L120","documentation":"This wraps os.ReadFile failure for loginKeychainPath (~/Library/Keychains/login.keychain-db). The keychain bytes are needed to attempt unlocking with each candidate master key; without the file nothing can be decrypted.","triggerScenarios":"Calling DecryptKeychainRecords when the login keychain file does not exist, is a symlink to a missing target, or cannot be read even as root (SIP-protected paths, APFS issues, unusual HOME).","commonSituations":"Running with a HOME pointing at another user or a service account so os.UserHomeDir() resolves to the wrong path; keychain renamed (custom keychain, or `login.keychain-db` missing on accounts created with iCloud-only keychains); keychain stored on an unmounted/mismatched volume; partially deleted user profile.","solutions":["Verify the file exists: `ls -la ~/Library/Keychains/login.keychain-db` for the target user.","Fix HOME/SUDO_USER handling — run with the target user's home resolved explicitly rather than relying on os.UserHomeDir() under sudo.","Point the tool at the correct keychain path if a custom keychain is in use (code currently hardcodes loginKeychainPath).","Grant Full Disk Access to the terminal/tool if sandbox/TCC blocks reading user Library data even as root.","If the user has no local login keychain (iCloud keychain only), this path is not applicable — use another extraction method."],"exampleFix":"// before\nkeychainBuf, err := os.ReadFile(loginKeychainPath)\n// after\nkeychainBuf, err := os.ReadFile(loginKeychainPath)\nif err != nil {\n    return nil, fmt.Errorf(\"read keychain %s: %w (check HOME resolves to the target user and file exists)\", loginKeychainPath, err)\n}","handlingStrategy":"validation","validationCode":"home, err := os.UserHomeDir()\nif err != nil {\n    return err\n}\nkcPath := filepath.Join(home, \"Library\", \"Keychains\", \"login.keychain-db\")\nif fi, err := os.Stat(kcPath); err != nil || fi.IsDir() {\n    return fmt.Errorf(\"login keychain not found at %s\", kcPath)\n}","typeGuard":null,"tryCatchPattern":"_, err := masterkey.DecryptKeychainRecords()\nif err != nil && strings.Contains(err.Error(), \"read keychain\") {\n    // resolve correct keychain path or request Full Disk Access\n}","preventionTips":["Confirm the target user's login.keychain-db exists before running.","Under sudo, resolve the target user's HOME explicitly (SUDO_USER), not root's.","Grant Full Disk Access to the tool/terminal for Library access.","Handle users with iCloud-only keychains (no local login.keychain-db)."],"tags":["macos","file-read","keychain","home-dir"],"backgroundTag":"file-read-failed","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}