moonD4rk/HackBrowserData · error

securityd process not found

Error message

securityd process not found

What it means

findProcessByName walks the kern.proc.all sysctl table looking for a process whose p_comm equals "securityd" and (with forceRoot=true) whose real uid is 0. It throws "securityd process not found" when no entry matches both conditions, meaning the caller cannot proceed to dump securityd memory.

Solutions

1. Verify securityd is running: `ps aux | grep securityd` — it must appear with UID root.
2. Run on a normal, non-sandboxed macOS host (not a container) where launchd has started securityd.
3. Confirm the process name is exactly "securityd" (p_comm is 16-char truncated; custom builds renamed differently will not match).
4. Check that sysctl kern.proc.all returns data as root (SIP/hardening profiles can restrict it).
5. Ensure the binary is built with the `keychain_gcore` darwin build tag and run as root (euid 0), as DecryptKeychainRecords requires.

Example fix

// before
pid, err := findProcessByName("securityd", true)
// after
pid, err := findProcessByName("securityd", true)
if err != nil {
    log.Fatalf("securityd not running as root on this host; aborting keychain dump: %v", err)
}

out, err := exec.Command("ps", "-U", "root", "-o", "comm=").Output()
if err != nil || !strings.Contains(string(out), "securityd") {
    return fmt.Errorf("securityd not running as root on this host")
}

records, err := masterkey.DecryptKeychainRecords()
if err != nil {
    if strings.Contains(err.Error(), "securityd process not found") {
        // surface actionable message: not a standard macOS host or securityd not root
    }
}

When it happens

Trigger: Calling DecryptKeychainRecords on a macOS system where no process named exactly "securityd" runs as root. p_comm is truncated to 16 chars, so any renamed/prefixed securityd binary will not match; also, any non-root securityd-like process is skipped when forceRoot is true.

Common situations: Running the tool in a container/VM without normal macOS system daemons; a hardened/modified system where securityd runs under a different name; securityd running as non-root (unusual); a broken or restricted sysctl kern.proc.all returning no entries.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• failed to find securityd pid
• create output dir
• failed to dump securityd memory
• failed to find malloc small regions
• failed to open core dump

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/ea5d3cf52920f0fa. Report an issue: GitHub.

Appendix: source

Thrown at masterkey/gcoredump_darwin.go:55

		return 0, fmt.Errorf("sysctl kern.proc.all failed: %w", err)
	}

	kinfoSize := int(unsafe.Sizeof(unix.KinfoProc{}))
	if len(buf)%kinfoSize != 0 {
		return 0, fmt.Errorf("sysctl kern.proc.all returned invalid data length")
	}

	count := len(buf) / kinfoSize
	for i := 0; i < count; i++ {
		proc := (*unix.KinfoProc)(unsafe.Pointer(&buf[i*kinfoSize]))
		pname := byteSliceToString(proc.Proc.P_comm[:])
		if pname == name {
			if !forceRoot || proc.Eproc.Pcred.P_ruid == 0 {
				return int(proc.Proc.P_pid), nil
			}
		}
	}
	return 0, fmt.Errorf("securityd process not found")
}

type addressRange struct {
	start uint64
	end   uint64
}

// DecryptKeychainRecords dumps securityd memory, scans for the keychain master key, and uses it to
// read login.keychain-db's generic password records. Requires root.
func DecryptKeychainRecords() ([]keychainbreaker.GenericPassword, error) {
	if os.Geteuid() != 0 {
		return nil, errors.New("requires root privileges")
	}

	pid, err := findProcessByName("securityd", true)
	if err != nil {
		return nil, fmt.Errorf("failed to find securityd pid: %w", err)
	}

View on GitHub (pinned to 0503d04d7a)