moonD4rk/HackBrowserData · error

failed to open core dump: %w

Error message

failed to open core dump: %w

What it means

scanMasterKeyCandidates fails at macho.Open(corePath) when the gcore-produced core dump cannot be opened or parsed as a Mach-O file. This is the direct error surfaced as 'scan master key candidates: %w' to DecryptKeychainRecords callers.

Source

Thrown at masterkey/gcoredump_darwin.go:137

			return records, nil
		}
	}

	return nil, fmt.Errorf("tried %d candidates, none unlocked keychain", len(candidates))
}

// scanMasterKeyCandidates scans the core dump for 24-byte master key candidates.
//
// securityd stores the master key in a MALLOC_SMALL region with the layout:
//
//	[0x18 (8 bytes)] [pointer to key data (8 bytes)]
//
// 0x18 = 24 is the key length. The pointer references a 24-byte buffer
// within the same region containing the raw master key.
func scanMasterKeyCandidates(corePath string, regions []addressRange) ([]string, error) {
	cmf, err := macho.Open(corePath)
	if err != nil {
		return nil, fmt.Errorf("failed to open core dump: %w", err)
	}
	defer cmf.Close()

	var candidates []string
	seen := make(map[string]struct{})
	for _, region := range regions {
		data, vaddr, err := getMallocSmallRegionData(cmf, region)
		if err != nil {
			continue
		}
		for i := 0; i < len(data)-16; i += 8 {
			// look for the length marker (0x18 = 24 bytes)
			val := binary.LittleEndian.Uint64(data[i : i+8])
			if val != 0x18 {
				continue
			}
			// next 8 bytes should be a pointer within this region
			ptr := binary.LittleEndian.Uint64(data[i+8 : i+16])

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Re-run the operation — a transient gcore failure often produces an unreadable file; ensure only one run at a time to avoid tmp-file races.
2. Validate the core immediately after dumping: `file <corePath>` must report a Mach-O core.
3. Check free space and file size before parsing (`ls -la`); re-dump if truncated.
4. Unwrap the error for the specific macho.Open cause and match against the gcore/OS version in use.
5. Pin to a macOS/gcore combination known to emit standard Mach-O core format compatible with debug/macho.

Example fix

// before
cmf, err := macho.Open(corePath)
if err != nil {
    return nil, fmt.Errorf("failed to open core dump: %w", err)
}
// after
cmf, err := macho.Open(corePath)
if err != nil {
    return nil, fmt.Errorf("failed to open core dump %s: %w", corePath, err)
}

fi, err := os.Stat(corePath)
if err != nil {
    return fmt.Errorf("core dump not present: %v", err)
}
if fi.Size() < 4096 {
    return fmt.Errorf("core dump suspiciously small (%d bytes); re-dump", fi.Size())
}

_, err := masterkey.DecryptKeychainRecords()
if err != nil && strings.Contains(err.Error(), "failed to open core dump") {
    // re-run with a fresh dump; check disk space and gcore behavior
}

When it happens

Trigger: Calling DecryptKeychainRecords when the core dump path is invalid, the file was removed before parsing (race with defer os.Remove or tmp cleaners), or gcore wrote a partial/non-Mach-O file.

Common situations: Concurrent runs where one process's deferred os.Remove deletes another's file; /tmp cleanup; disk-full truncation during gcore; extremely large core files exceeding debug/macho practical limits; gcore flag differences across macOS versions producing unexpected formats.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

• scan master key candidates: %w
• region not found in core dump
• requires root privileges
• keychain gcore dump not built in (rebuild with -tags keychai
• not found in credential store

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/72150bb716a4a11d. Report an issue: GitHub.