moonD4rk/HackBrowserData · error

sysctl kern.proc.all returned invalid data length

Error message

sysctl kern.proc.all returned invalid data length

What it means

After the kern.proc.all sysctl succeeds, findProcessByName validates that the returned buffer is a whole number of KinfoProc structs. This error means the buffer length is not a multiple of sizeof(KinfoProc), so the kernel returned data in an unexpected layout and parsing it would read out of bounds or produce garbage process entries.

Source

Thrown at masterkey/gcoredump_darwin.go:42

	"github.com/moond4rk/keychainbreaker"
)

var (
	homeDir, _        = os.UserHomeDir()
	loginKeychainPath = homeDir + "/Library/Keychains/login.keychain-db"
)

// findProcessByName returns the PID of the first process matching name.
// If forceRoot is true, only matches processes owned by root (uid 0).
func findProcessByName(name string, forceRoot bool) (int, error) {
	buf, err := unix.SysctlRaw("kern.proc.all")
	if err != nil {
		return 0, fmt.Errorf("sysctl kern.proc.all failed: %w", err)
	}

	kinfoSize := int(unsafe.Sizeof(unix.KinfoProc{}))
	if len(buf)%kinfoSize != 0 {
		return 0, fmt.Errorf("sysctl kern.proc.all returned invalid data length")
	}

	count := len(buf) / kinfoSize
	for i := 0; i < count; i++ {
		proc := (*unix.KinfoProc)(unsafe.Pointer(&buf[i*kinfoSize]))
		pname := byteSliceToString(proc.Proc.P_comm[:])
		if pname == name {
			if !forceRoot || proc.Eproc.Pcred.P_ruid == 0 {
				return int(proc.Proc.P_pid), nil
			}
		}
	}
	return 0, fmt.Errorf("securityd process not found")
}

type addressRange struct {
	start uint64
	end   uint64

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Update golang.org/x/sys/unix and rebuild for the exact target macOS version/architecture.
2. Log len(buf) and the expected struct size to confirm how far off the layout is.
3. Use a different process enumeration API (libproc, pgrep) if the kinfo_proc layout cannot be matched.
4. Guard with the existing length check and fail fast — do not remove the validation to 'make it work', as parsing misaligned structs is unsafe.

Example fix

// before
kinfoSize := int(unsafe.Sizeof(unix.KinfoProc{}))
if len(buf)%kinfoSize != 0 {
	return 0, fmt.Errorf("sysctl kern.proc.all returned invalid data length")
}
// after - include sizes in the error for diagnosis
kinfoSize := int(unsafe.Sizeof(unix.KinfoProc{}))
if len(buf)%kinfoSize != 0 {
	return 0, fmt.Errorf("sysctl kern.proc.all returned invalid data length: %d bytes, not a multiple of kinfo_proc size %d (rebuild for this OS version?)", len(buf), kinfoSize)
}

kinfoSize := int(unsafe.Sizeof(unix.KinfoProc{}))
if buf == nil || len(buf) == 0 || len(buf)%kinfoSize != 0 {
	return fmt.Errorf("unexpected kern.proc.all buffer: %d bytes (kinfo_proc=%d)", len(buf), kinfoSize)
}

pid, err := findProcessByName(name, forceRoot)
if err != nil {
	if strings.Contains(err.Error(), "invalid data length") {
		log.Warnf("kernel layout mismatch; rebuild for this macOS version: %v", err)
	}
	return err
}

When it happens

Trigger: Calling DecryptKeychainRecords on a macOS build whose kinfo_proc layout differs from the KinfoProc size the compiled binary expects — e.g. a binary built against an older x/sys/unix running on a newer macOS, or truncated sysctl output.

Common situations: Architecture/OS version mismatch (binary built for a different macOS release); stale golang.org/x/sys dependency with an outdated KinfoProc definition; exotic environments where sysctl returns partial data.

Related errors

• sysctl kern.proc.all failed: %w
• requires root privileges
• keychain gcore dump not built in (rebuild with -tags keychai
• not found in credential store
• securityd process not found

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/37abb679957cc362. Report an issue: GitHub.