moonD4rk/HackBrowserData · error

find file handle for %s: %w

Error message

find file handle for %s: %w

What it means

Wrapped error from copyLocked's first step on Windows: findFileHandle failed while enumerating system handles via NtQuerySystemInformation to locate a process holding the source file open. The %s is the locked source path. Failure here means the handle enumeration/duplication machinery could not run or found nothing usable, before any file-mapping read is attempted.

Source

Thrown at filemanager/copy_windows.go:29

	"github.com/moond4rk/hackbrowserdata/utils/winapi"
)

// copyLocked copies a file that is locked by another process (e.g., Chrome's
// Cookies database with PRAGMA locking_mode=EXCLUSIVE).
//
// Approach: DuplicateHandle + FileMapping
//  1. Enumerate all open file handles via NtQuerySystemInformation
//  2. Find the handle matching the target file path
//  3. Duplicate that handle into our process via DuplicateHandle
//  4. Read file content through memory-mapped I/O (CreateFileMapping + MapViewOfFile)
//  5. Write content to destination
//
// This requires only normal user privileges (no admin needed).
func copyLocked(src, dst string) error {
	handle, err := findFileHandle(src)
	if err != nil {
		return fmt.Errorf("find file handle for %s: %w", src, err)
	}
	defer windows.CloseHandle(handle)

	data, err := readFileContent(handle)
	if err != nil {
		return fmt.Errorf("read via file mapping: %w", err)
	}

	return os.WriteFile(dst, data, 0o600)
}

// findFileHandle enumerates all system handles, finds the one matching the
// target file path, and duplicates it into the current process.
func findFileHandle(targetPath string) (windows.Handle, error) {
	// Extract a stable suffix for matching that avoids short path name issues
	// (e.g., RUNNER~1 vs runneradmin in the username portion).
	// We match from AppData onwards, which uniquely identifies each browser:
	//   Google\Chrome\User Data\Default\Network\Cookies  (Chrome)

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Ensure the target browser process is actually running and holds the file open
2. Check the underlying NtQuerySystemInformation/DuplicateHandle error for privilege or handle-count limits
3. Close other heavy-handle processes and retry enumeration
4. Fall back to closing the browser so the file is no longer exclusively locked

When it happens

Trigger: Thrown at filemanager/copy_windows.go:29 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/81d1aa7511efc420. Report an issue: GitHub.