moonD4rk/HackBrowserData · error

scan master key candidates: %w

Error message

scan master key candidates: %w

What it means

This wraps errors from scanMasterKeyCandidates, the only fallible step of which is macho.Open on the gcore-produced core dump. It means the core file could not be parsed as a Mach-O core, so no key candidates could be extracted.

Source

Thrown at masterkey/gcoredump_darwin.go:93

	// gcore appends ".PID" to the -o prefix, e.g. prefix.123
	corePrefix := filepath.Join(os.TempDir(), fmt.Sprintf("securityd-core-%d", time.Now().UnixNano()))
	corePath := fmt.Sprintf("%s.%d", corePrefix, pid)
	defer os.Remove(corePath)

	cmd := exec.Command("gcore", "-d", "-s", "-v", "-o", corePrefix, strconv.Itoa(pid))
	if err := cmd.Run(); err != nil {
		return nil, fmt.Errorf("failed to dump securityd memory: %w", err)
	}

	// vmmap identifies MALLOC_SMALL heap regions where securityd stores keys
	regions, err := findMallocSmallRegions(pid)
	if err != nil {
		return nil, fmt.Errorf("failed to find malloc small regions: %w", err)
	}

	candidates, err := scanMasterKeyCandidates(corePath, regions)
	if err != nil {
		return nil, fmt.Errorf("scan master key candidates: %w", err)
	}
	if len(candidates) == 0 {
		return nil, fmt.Errorf("no master key candidates found in securityd memory")
	}

	// read keychain file once, reuse buffer for each candidate
	keychainBuf, err := os.ReadFile(loginKeychainPath)
	if err != nil {
		return nil, fmt.Errorf("read keychain: %w", err)
	}

	for _, candidate := range candidates {
		kc, err := keychainbreaker.Open(keychainbreaker.WithBytes(keychainBuf))
		if err != nil {
			continue
		}
		if err := kc.Unlock(keychainbreaker.WithKey(candidate)); err != nil {
			continue

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Check the core file exists and is non-empty right after gcore runs (`ls -la $TMPDIR/securityd-core-*`).
2. Free disk space in $TMPDIR; re-run if a previous dump was truncated by ENOSPC.
3. Verify the file is a Mach-O core: `file <corePath>` should report 'Mach-O 64-bit core'.
4. Re-run the whole DecryptKeychainRecords flow — a transient gcore failure may have produced a bad dump.
5. Unwrap the %w chain for the underlying macho.Open cause (e.g. 'unknown load command', 'not a Mach-O file') to pinpoint the corruption.

Example fix

// before
if err := cmd.Run(); err != nil {
    return nil, fmt.Errorf("failed to dump securityd memory: %w", err)
}
// after
if err := cmd.Run(); err != nil {
    return nil, fmt.Errorf("failed to dump securityd memory: %w", err)
}
if fi, statErr := os.Stat(corePath); statErr != nil || fi.Size() == 0 {
    return nil, fmt.Errorf("core dump %s missing or empty", corePath)
}

fi, err := os.Stat(corePath)
if err != nil || fi.Size() == 0 {
    return fmt.Errorf("core dump missing or empty")
}
if _, err := macho.Open(corePath); err != nil {
    return fmt.Errorf("core dump is not a valid Mach-O file: %v", err)
}

_, err := masterkey.DecryptKeychainRecords()
if err != nil && strings.Contains(err.Error(), "scan master key candidates") {
    // inspect underlying macho.Open failure; re-dump if file corrupt
}

When it happens

Trigger: Calling DecryptKeychainRecords when the gcore output file at corePath is missing, truncated, empty, or not a valid Mach-O core dump — e.g. gcore wrote a partial file, the dump was cleaned up concurrently, or disk pressure corrupted the write.

Common situations: /tmp cleanup daemons deleting the file between gcore and macho.Open; gcore partially failing but exiting 0 on some systems; architecture mismatch or unusual core layout confusing debug/macho; disk-full during the dump leaving a truncated file.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

• failed to open core dump: %w
• region not found in core dump
• requires root privileges
• keychain gcore dump not built in (rebuild with -tags keychai
• not found in credential store

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/890b685cfb1507eb. Report an issue: GitHub.