keychain gcore dump not built in (rebuild with -tags keychai

Error message

keychain gcore dump not built in (rebuild with -tags keychain_gcore)

What it means

The default build of hack-browser-data intentionally excludes the CVE-2025-24204 securityd-dump implementation; DecryptKeychainRecords is a stub that always returns this error so GcoredumpRetriever falls through silently to the next master-key tier. The real implementation only compiles in with the keychain_gcore build tag, keeping default binaries free of the exploit code and its signatures.

Source

Thrown at masterkey/gcoredump_stub_darwin.go:16

//go:build darwin && !keychain_gcore

package masterkey

import (
	"errors"

	"github.com/moond4rk/keychainbreaker"
)

// DecryptKeychainRecords returns an error in default builds so GcoredumpRetriever
// falls through silently to the next tier. The CVE-2025-24204 securityd-dump
// implementation (gcoredump_darwin.go) is only compiled with -tags keychain_gcore,
// keeping the default `go build` free of the exploit code and its byte signatures.
func DecryptKeychainRecords() ([]keychainbreaker.GenericPassword, error) {
	return nil, errors.New("keychain gcore dump not built in (rebuild with -tags keychain_gcore)")
}

View on GitHub (pinned to 0503d04d7a)

Solutions

Rebuild the binary with: go build -tags keychain_gcore ./cmd/hack-browser-data/ (requires zig per the payload build if applicable).
Rely on other master-key retriever tiers, which the stub's fall-through enables automatically.
Use `make build-windows`-style Makefile targets or add the tag to your build pipeline if gcore extraction is required.

Example fix

// before
go build ./cmd/hack-browser-data/
// after
go build -tags keychain_gcore ./cmd/hack-browser-data/

Defensive patterns

Strategy: fallback

Validate before calling

// detect stub build at runtime
_, err := masterkey.DecryptKeychainRecords()
gcoreAvailable := err == nil || !strings.Contains(err.Error(), "not built in")

Try / catch

pw, err := masterkey.DecryptKeychainRecords()
if err != nil && strings.Contains(err.Error(), "not built in") {
    // stub build: rely on the next retriever tier or rebuild with the tag
}

Prevention

Build with -tags keychain_gcore when keychain memory-dump extraction is required.
Don't treat this stub error as fatal — the retriever chain falls through.
Keep exploit-gated features out of default CI builds intentionally.

When it happens

Trigger: Calling DecryptKeychainRecords in any binary built without -tags keychain_gcore — always returns this error immediately, before any euid check.

Common situations: Running a stock `go build` binary on macOS and expecting keychain extraction via memory dump; CI builds without the tag; users unaware the feature is gated behind a build tag.

Related errors

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/c24cfdcfdc4523f6. Report an issue: GitHub.