{"record":{"id":"0cb4c71b4bc7f1a9","repo":"shadow1ng/fscan","slug":"local-pe-not-found-0cb4c7","errorCode":null,"errorMessage":"local_pe_not_found","messagePattern":"local_pe_not_found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/winwmi.go","lineNumber":34,"sourceCode":")\n\ntype WinWMIPlugin struct {\n\tplugins.BasePlugin\n}\n\nfunc NewWinWMIPlugin() *WinWMIPlugin {\n\treturn &WinWMIPlugin{\n\t\tBasePlugin: plugins.NewBasePlugin(\"winwmi\"),\n\t}\n}\n\nfunc (p *WinWMIPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {\n\tpePath := session.Config.WinPEFile\n\tif pePath == \"\" {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.GetText(\"local_pe_not_specified\"))}\n\t}\n\tif _, err := os.Stat(pePath); err != nil {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.Tr(\"local_pe_not_found\", pePath))}\n\t}\n\n\tabsPath, _ := filepath.Abs(pePath)\n\tbaseName := strings.TrimSuffix(filepath.Base(absPath), filepath.Ext(absPath))\n\n\tfilterName := fmt.Sprintf(\"SysMon_%s\", baseName)\n\tconsumerName := fmt.Sprintf(\"SysExec_%s\", baseName)\n\n\tps := fmt.Sprintf(`$ok = 0\ntry {\n  $f = ([wmiclass]\"\\\\.\\root\\subscription:__EventFilter\").CreateInstance()\n  $f.Name = \"%s\"; $f.EventNameSpace = \"root\\cimv2\"; $f.QueryLanguage = \"WQL\"\n  $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"\n  $f.Put() | Out-Null; $ok++; Write-Output \"[OK] EventFilter\"\n} catch { Write-Output \"[FAIL] EventFilter: $_\" }\ntry {\n  $c = ([wmiclass]\"\\\\.\\root\\subscription:CommandLineEventConsumer\").CreateInstance()\n  $c.Name = \"%s\"; $c.ExecutablePath = \"%s\"; $c.CommandLineTemplate = \"%s\"","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/winwmi.go#L16-L52","documentation":"WinWMIPlugin.Scan fails when the configured local Sysmon/PE file (session.Config.WinPEFile) does not exist on disk. Before running the WMI permanent-event setup, os.Stat is called to verify the file; a stat error (non-existent or inaccessible path) produces 'local_pe_not_found' with the offending path interpolated via i18n.Tr.","triggerScenarios":"Calling Scan with WinPEFile set to a path that does not exist, was deleted before the scan, is a broken relative path resolved against the wrong working directory, or is unreadable due to permissions so os.Stat fails.","commonSituations":"Users point --winpe-file at a copied/moved EXE, forget to sync the PE file to the machine running the tool, use a Windows path while running on a non-Windows host, or typo the filename.","solutions":["Check the file exists at the exact path (ls / dir) before running the scan","Pass an absolute path in session.Config.WinPEFile","Fix file permissions so the current user can stat/read it","Verify the working directory if using a relative path"],"exampleFix":"// before\npePath := \"~/tools/payload.exe\"\n// after (expand home, absolute path)\nabs, _ := filepath.ExpandEnv(pePath)\nabs, _ = filepath.Abs(abs)\nif _, err := os.Stat(abs); err != nil { return err }\nsession.Config.WinPEFile = abs","handlingStrategy":"validation","validationCode":"if info, err := os.Stat(cfg.WinPEFile); err != nil || info.IsDir() {\n    return fmt.Errorf(\"WinPE file %q is missing or inaccessible\", cfg.WinPEFile)\n}","typeGuard":null,"tryCatchPattern":"res, err := plugin.Scan(ctx, host, session)\nif err != nil && strings.Contains(err.Error(), \"local_pe_not_found\") {\n    // fix config path and retry\n}","preventionTips":["Always pass an absolute, pre-verified path for WinPEFile","Stat the PE file in setup code before invoking Scan","Include the PE file in deployment/checklist tooling","Run on a host where the file path is valid (Windows paths on Windows)"],"tags":["file-not-found","windows","wmi"],"backgroundTag":"file-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}