moonD4rk/HackBrowserData · info

abe: Local State has no app_bound_encrypted_key

Error message

abe: Local State has no app_bound_encrypted_key

What it means

The ABE (app-bound encryption) retriever found no app_bound_encrypted_key in the browser's Local State — either the Local State path was empty or the JSON lacked the key — meaning this browser either doesn't use ABE (pre-v20 Chrome, Opera/Vivaldi/Yandex forks) or the key is missing. RetrieveKey deliberately returns (nil, nil) for errNoABEKey so the master-key chain falls through to the next tier instead of failing.

Source

Thrown at masterkey/abe_windows.go:24

	"encoding/base64"
	"errors"
	"fmt"
	"os"
	"strings"

	"github.com/tidwall/gjson"

	"github.com/moond4rk/hackbrowserdata/crypto/windows/payload"
	"github.com/moond4rk/hackbrowserdata/log"
	"github.com/moond4rk/hackbrowserdata/utils/injector"
	"github.com/moond4rk/hackbrowserdata/utils/winutil"
)

const envEncKeyB64 = "HBD_ABE_ENC_B64"

var appbPrefix = []byte{'A', 'P', 'P', 'B'}

var errNoABEKey = errors.New("abe: Local State has no app_bound_encrypted_key")

type ABERetriever struct{}

func (r *ABERetriever) RetrieveKey(hints Hints) ([]byte, error) {
	// Non-ABE forks (Opera/Vivaldi/Yandex) supply no WindowsABEKey — treat as "not applicable".
	// (Pre-v20 Chrome takes the errNoABEKey path below.)
	browserKey := strings.TrimSpace(hints.WindowsABEKey)
	if browserKey == "" {
		return nil, nil
	}

	encKey, err := loadEncryptedKey(hints.LocalStatePath)
	if errors.Is(err, errNoABEKey) {
		return nil, nil
	}
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 0503d04d7a)

Solutions

1. No action needed if the browser legitimately doesn't use ABE — the retriever chain falls through to the next tier.
2. For Chrome 127+ cookies: ensure the correct Local State path is passed in hints.LocalStatePath.
3. Verify the Local State JSON actually contains os_crypt.app_bound_encrypted_key.
4. Set hints.WindowsABEKey appropriately only for ABE-capable browsers.

Example fix

// before: empty path yields errNoABEKey even for Chrome
hints := masterkey.Hints{WindowsABEKey: "chrome"}
// after: supply the Local State path
hints := masterkey.Hints{WindowsABEKey: "chrome", LocalStatePath: chromeLocalStatePath}

data, err := os.ReadFile(localStatePath)
if err == nil {
    var ls struct{ OsCrypt struct{ AppBoundEncryptedKey string `json:"app_bound_encrypted_key"` } `json:"os_crypt"` }
    if json.Unmarshal(data, &ls) == nil && ls.OsCrypt.AppBoundEncryptedKey == "" {
        // ABE not applicable; skip ABE retriever
    }
}

key, err := abeRetriever.RetrieveKey(hints)
if errors.Is(err, errNoABEKey) || (key == nil && err == nil) {
    // fall through to the next retriever tier
}

When it happens

Trigger: ABERetriever.RetrieveKey with hints.LocalStatePath == "" (non-ABE forks with no WindowsABEKey hint, or no path supplied); or loadEncryptedKey reading a Local State JSON that has no app_bound_encrypted_key field (pre-v20 Chrome, stripped/corrupt Local State).

Common situations: Running against Chrome < 127 (v10/v20 without ABE), against Opera/Vivaldi/Yandex which don't set the WindowsABEKey hint, or against a Local State copied without the encrypted key — usually harmless by design.

Related errors

• abe: read Local State: %w
• abe: %w
• abe: inject into %s: %w
• abe: unexpected key length %d (want 32)
• abe: base64 decode: %w

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/c65eaa4429e49e40. Report an issue: GitHub.