moonD4rk/HackBrowserData · warning

region not found in core dump

Error message

region not found in core dump

What it means

getMallocSmallRegionData matches each vmmap MALLOC_SMALL region against Mach-O segments in the core dump by exact address (s.Addr == region.start && s.Addr+s.Memsz == region.end). When no segment lines up exactly with the vmmap range, it returns 'region not found in core dump'; scanMasterKeyCandidates silently skips such regions (continue), so this error usually causes missed regions rather than a surfaced failure.

Source

Thrown at masterkey/gcoredump_darwin.go:224

	}
	return regions, nil
}

// getMallocSmallRegionData returns the Mach-O segment data + vaddr for the given address range.
func getMallocSmallRegionData(f *macho.File, region addressRange) ([]byte, uint64, error) {
	for _, seg := range f.Loads {
		if s, ok := seg.(*macho.Segment); ok {
			if s.Addr == region.start && s.Addr+s.Memsz == region.end {
				data := make([]byte, s.Filesz)
				_, err := s.ReadAt(data, 0)
				if err != nil {
					return nil, 0, err
				}
				return data, s.Addr, nil
			}
		}
	}
	return nil, 0, fmt.Errorf("region not found in core dump")
}

func byteSliceToString(s []byte) string {
	for i, v := range s {
		if v == 0 {
			return string(s[:i])
		}
	}
	return string(s)
}

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Note this error is swallowed per-region by scanMasterKeyCandidates — check whether ALL regions are being skipped (leads to error 55) or only some.
2. Loosen the exact-match comparison to interval containment (segment overlaps region) instead of strict start/end equality.
3. Run vmmap and gcore as close together as possible (or derive regions from the core dump itself) to avoid address-layout drift between the two calls.
4. Review the gcore flags (-d -s -v): -s may strip data; test dumping without restrictive flags if regions go missing.
5. Log skipped regions (start/end) to identify whether specific regions systematically fail to map, indicating a format/flag issue.

Example fix

// before
if s.Addr == region.start && s.Addr+s.Memsz == region.end {
// after
if s.Addr <= region.start && s.Addr+s.Memsz >= region.end {

out, _ := exec.Command("sudo", "vmmap", "--wide", pid).Output()
// verify regions parse and dump immediately after, minimizing layout drift
if len(out) == 0 {
    return fmt.Errorf("vmmap produced no output")
}

records, err := masterkey.DecryptKeychainRecords()
if err != nil && strings.Contains(err.Error(), "no master key candidates") {
    // some regions may have been skipped with 'region not found in core dump'; retry promptly or relax segment matching
}

When it happens

Trigger: Any mismatch between vmmap-reported region boundaries and the core dump's segment addresses: gcore omitted that region (e.g. with -s flag stripping some memory), vmmap region merged/split differently than the dump segments, or address layout changed between the vmmap call and the gcore dump (ASLR re-read).

Common situations: gcore's -s flag or dump limits excluding regions vmmap reports; timing gaps between vmmap and gcore on a live process; macOS versions where segment granularity differs from vmmap line ranges; end-address off-by-one/granularity mismatches.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• scan master key candidates: %w
• failed to open core dump: %w
• requires root privileges
• keychain gcore dump not built in (rebuild with -tags keychai
• not found in credential store

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/066ebd5a4337e31c. Report an issue: GitHub.