moonD4rk/HackBrowserData · error

abe: unexpected prefix: got %q, want %q

Error message

abe: unexpected prefix: got %q, want %q

What it means

The decoded app_bound_encrypted_key is expected to start with the 'APPB' magic prefix, which is stripped before decryption. This error means the decoded bytes begin with something else, so the blob is not Chrome app-bound encrypted key material.

Source

Thrown at masterkey/abe_windows.go:93

	if err != nil {
		return nil, fmt.Errorf("abe: read Local State: %w", err)
	}

	raw := gjson.GetBytes(data, "os_crypt.app_bound_encrypted_key")
	if !raw.Exists() {
		return nil, errNoABEKey
	}

	decoded, err := base64.StdEncoding.DecodeString(raw.String())
	if err != nil {
		return nil, fmt.Errorf("abe: base64 decode: %w", err)
	}
	if len(decoded) <= len(appbPrefix) {
		return nil, fmt.Errorf("abe: encrypted key too short: %d bytes", len(decoded))
	}
	for i, b := range appbPrefix {
		if decoded[i] != b {
			return nil, fmt.Errorf("abe: unexpected prefix: got %q, want %q",
				decoded[:len(appbPrefix)], appbPrefix)
		}
	}
	return decoded[len(appbPrefix):], nil
}

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Print both got/want prefixes (the error already does via %q) and confirm which browser produced the Local State file.
2. Point the tool at a genuine Google Chrome profile, or extend prefix handling for the specific Chromium variant you're targeting.
3. Re-read the correct JSON path os_crypt.app_bound_encrypted_key rather than another key field.
4. Check for a Chrome version change in key format and update appbPrefix handling if Google changed the envelope.

decoded, _ := base64.StdEncoding.DecodeString(rawKey)
if !bytes.HasPrefix(decoded, []byte("APPB")) {
	return fmt.Errorf("key blob lacks APPB prefix; not a Chrome app-bound key (got %q)", decoded[:min(4, len(decoded))])
}

key, err := RetrieveKey(exePath, localStatePath)
if err != nil {
	if strings.Contains(err.Error(), "unexpected prefix") {
		log.Warnf("profile is not Google Chrome or format changed: %v", err)
		return fallbackDecrypt()
	}
	return err
}

When it happens

Trigger: Calling RetrieveKey when the decoded Local State value lacks the APPB prefix — e.g. reading a Chromium-variant (Brave, Edge, etc.) that stores a differently-prefixed key, decoding the wrong field, or a Chrome version change to the key format.

Common situations: Targeting a Chromium fork with a different key envelope; mixing profiles between browsers; Chrome updating the app-bound key format; accidentally decrypting v10/v20 cookies with the wrong blob.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• abe: encrypted key too short: %d bytes
• abe: unexpected key length %d (want 32)
• abe: Local State has no app_bound_encrypted_key
• abe: read Local State: %w
• abe: base64 decode: %w

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/50076da057e36246. Report an issue: GitHub.