moonD4rk/HackBrowserData · error

DPAPI not supported on this platform

Error message

DPAPI not supported on this platform

What it means

errDPAPINotSupported is returned by DecryptDPAPI on darwin and linux builds, where the Windows Data Protection API does not exist. On these platforms the function is a stub that always fails, since DPAPI blob decryption is only implemented in the windows build (crypto/crypto_windows.go).

Source

Thrown at crypto/errors.go:14

package crypto

import "errors"

// Sentinel errors for crypto operations.
var (
	errShortCiphertext   = errors.New("ciphertext too short")
	errInvalidBlockSize  = errors.New("ciphertext is not a multiple of the block size")
	errInvalidIVLength   = errors.New("IV length must equal block size")
	errInvalidPadding    = errors.New("invalid PKCS5 padding")
	errInvalidNonceLen   = errors.New("nonce length must equal GCM nonce size")
	errUnsupportedIVLen  = errors.New("unsupported IV length")
	errDecodeASN1        = errors.New("failed to decode ASN1 data")
	errDPAPINotSupported = errors.New("DPAPI not supported on this platform") //nolint:unused // used on darwin/linux only
)

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Only call DecryptDPAPI when runtime.GOOS == "windows"; branch or skip the DPAPI path otherwise.
2. To decrypt Windows DPAPI blobs from another OS, copy the blobs to a Windows machine (or VM) and run the tool there.
3. Handle the sentinel with errors.Is so unsupported-platform results degrade gracefully instead of aborting extraction.
4. Check build tags on files calling DecryptDPAPI so it is only referenced from _windows.go code.

Example fix

// before
key, err := crypto.DecryptDPAPI(encryptedKey)
// after
if runtime.GOOS != "windows" {
    return nil, errDPAPINotSupported // or skip DPAPI step
}
key, err := crypto.DecryptDPAPI(encryptedKey)

if runtime.GOOS != "windows" { return nil, errors.New("DPAPI requires Windows") }

key, err := crypto.DecryptDPAPI(blob)
if errors.Is(err, crypto.ErrDPAPINotSupported) {
    return nil, fmt.Errorf("DPAPI unavailable on %s; run on Windows", runtime.GOOS)
}

When it happens

Trigger: Calling DecryptDPAPI in code compiled for GOOS=darwin or GOOS=linux. Any attempt to decrypt a DPAPI-protected blob (e.g. DPAPI-wrapped Chromium master keys) on a non-Windows host hits this sentinel.

Common situations: Cross-platform tooling that unconditionally calls DecryptDPAPI without checking runtime.GOOS; testing Windows key decryption on a mac/linux dev machine; Windows browser profiles copied to another OS for offline analysis.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• read Local State: %w
• os_crypt.encrypted_key not found in Local State
• base64 decode encrypted_key: %w
• encrypted_key too short: %d bytes
• encrypted_key unexpected prefix: got %q, want %q

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/4e7d31914acd1ee8. Report an issue: GitHub.