moonD4rk/HackBrowserData · error

read via file mapping: %w

Error message

read via file mapping: %w

What it means

Wrapped error from copyLocked's read stage on Windows: a handle to the locked file was found and duplicated, but reading its bytes through the kernel cache via CreateFileMapping/MapViewOfFile failed. The underlying error comes from the winapi mapping calls; ReadFile is the documented fallback if mapping fails, so reaching this wrapped error means the primary mapped-read path errored and is being surfaced to the caller.

Source

Thrown at filemanager/copy_windows.go:35

//
// Approach: DuplicateHandle + FileMapping
//  1. Enumerate all open file handles via NtQuerySystemInformation
//  2. Find the handle matching the target file path
//  3. Duplicate that handle into our process via DuplicateHandle
//  4. Read file content through memory-mapped I/O (CreateFileMapping + MapViewOfFile)
//  5. Write content to destination
//
// This requires only normal user privileges (no admin needed).
func copyLocked(src, dst string) error {
	handle, err := findFileHandle(src)
	if err != nil {
		return fmt.Errorf("find file handle for %s: %w", src, err)
	}
	defer windows.CloseHandle(handle)

	data, err := readFileContent(handle)
	if err != nil {
		return fmt.Errorf("read via file mapping: %w", err)
	}

	return os.WriteFile(dst, data, 0o600)
}

// findFileHandle enumerates all system handles, finds the one matching the
// target file path, and duplicates it into the current process.
func findFileHandle(targetPath string) (windows.Handle, error) {
	// Extract a stable suffix for matching that avoids short path name issues
	// (e.g., RUNNER~1 vs runneradmin in the username portion).
	// We match from AppData onwards, which uniquely identifies each browser:
	//   Google\Chrome\User Data\Default\Network\Cookies  (Chrome)
	//   Microsoft\Edge\User Data\Default\Network\Cookies (Edge)
	targetSuffix := extractStableSuffix(targetPath)
	currentProcess := windows.CurrentProcess()

	handles, err := winapi.QuerySystemHandles()
	if err != nil {

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Inspect the wrapped winapi error for access-denied (handle lacks read rights) or mapping-size failures
2. Retry after the browser checkpoints its WAL so the file size is stable
3. Fall back to a plain ReadFile loop on the duplicated handle
4. If mapping is persistently unsupported for this handle type, copy the file after closing the owning process

When it happens

Trigger: Thrown at filemanager/copy_windows.go:35 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/4dcd3c2a00ddda14. Report an issue: GitHub.