moonD4rk/HackBrowserData · error

failed to find malloc small regions: %w

Error message

failed to find malloc small regions: %w

What it means

This wraps failures from findMallocSmallRegions(pid), which runs `vmmap --wide <pid>` and parses MALLOC_SMALL region lines. If vmmap fails to run (nonzero exit) the raw error propagates; note that vmmap succeeding but yielding zero MALLOC_SMALL regions returns an empty slice with no error, leading downstream to error 55 instead.

Source

Thrown at masterkey/gcoredump_darwin.go:88

	pid, err := findProcessByName("securityd", true)
	if err != nil {
		return nil, fmt.Errorf("failed to find securityd pid: %w", err)
	}

	// gcore appends ".PID" to the -o prefix, e.g. prefix.123
	corePrefix := filepath.Join(os.TempDir(), fmt.Sprintf("securityd-core-%d", time.Now().UnixNano()))
	corePath := fmt.Sprintf("%s.%d", corePrefix, pid)
	defer os.Remove(corePath)

	cmd := exec.Command("gcore", "-d", "-s", "-v", "-o", corePrefix, strconv.Itoa(pid))
	if err := cmd.Run(); err != nil {
		return nil, fmt.Errorf("failed to dump securityd memory: %w", err)
	}

	// vmmap identifies MALLOC_SMALL heap regions where securityd stores keys
	regions, err := findMallocSmallRegions(pid)
	if err != nil {
		return nil, fmt.Errorf("failed to find malloc small regions: %w", err)
	}

	candidates, err := scanMasterKeyCandidates(corePath, regions)
	if err != nil {
		return nil, fmt.Errorf("scan master key candidates: %w", err)
	}
	if len(candidates) == 0 {
		return nil, fmt.Errorf("no master key candidates found in securityd memory")
	}

	// read keychain file once, reuse buffer for each candidate
	keychainBuf, err := os.ReadFile(loginKeychainPath)
	if err != nil {
		return nil, fmt.Errorf("read keychain: %w", err)
	}

	for _, candidate := range candidates {
		kc, err := keychainbreaker.Open(keychainbreaker.WithBytes(keychainBuf))

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Ensure vmmap is installed: `xcrun vmmap <pid>` (part of Xcode / Command Line Tools).
2. Confirm the securityd PID is still alive when vmmap runs (`ps -p <pid>`); re-fetch the PID if securityd restarted.
3. Run `sudo vmmap --wide <securityd-pid>` manually to see the underlying vmmap error.
4. Check vmmap output format on your macOS version — unexpected formats silently yield zero regions (which then surfaces as 'no master key candidates').
5. Verify no EDR policy blocks vmmap from reading task ports of system daemons.

Example fix

// before
regions, err := findMallocSmallRegions(pid)
if err != nil {
    return nil, fmt.Errorf("failed to find malloc small regions: %w", err)
}
// after
regions, err := findMallocSmallRegions(pid)
if err != nil {
    return nil, fmt.Errorf("failed to find malloc small regions: %w (is Xcode/vmmap installed and pid %d alive?)", err, pid)
}

if _, err := exec.LookPath("vmmap"); err != nil {
    return fmt.Errorf("vmmap not found; install Xcode")
}
out, err := exec.Command("sudo", "vmmap", "--wide", strconv.Itoa(pid)).Output()
if err != nil || !strings.Contains(string(out), "MALLOC_SMALL") {
    return fmt.Errorf("vmmap failed or no MALLOC_SMALL regions for pid")
}

_, err := masterkey.DecryptKeychainRecords()
if err != nil && strings.Contains(err.Error(), "failed to find malloc small regions") {
    // verify vmmap installed and pid still alive
}

When it happens

Trigger: Calling DecryptKeychainRecords as root when `vmmap --wide <pid>` exits nonzero — vmmap not installed (needs Xcode), insufficient rights to inspect the target despite root, or the pid no longer existing by the time vmmap runs.

Common situations: Xcode Command Line Tools not installed (no vmmap); securityd exited/restarted between gcore and vmmap so the PID is stale; MDM/EDR blocking vmmap's task port access; parsing mismatch on a macOS version whose vmmap output format differs.

Related errors

• failed to dump securityd memory: %w
• requires root privileges
• keychain gcore dump not built in (rebuild with -tags keychai
• not found in credential store
• sysctl kern.proc.all failed: %w

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/9696030b4a76619d. Report an issue: GitHub.