{"record":{"id":"275c609787fddb80","repo":"shadow1ng/fscan","slug":"local-pe-not-found-275c60","errorCode":null,"errorMessage":"local_pe_not_found","messagePattern":"local_pe_not_found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/winstartup.go","lineNumber":34,"sourceCode":")\n\ntype WinStartupPlugin struct {\n\tplugins.BasePlugin\n}\n\nfunc NewWinStartupPlugin() *WinStartupPlugin {\n\treturn &WinStartupPlugin{\n\t\tBasePlugin: plugins.NewBasePlugin(\"winstartup\"),\n\t}\n}\n\nfunc (p *WinStartupPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {\n\tpePath := session.Config.WinPEFile\n\tif pePath == \"\" {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.GetText(\"local_pe_not_specified\"))}\n\t}\n\tif _, err := os.Stat(pePath); err != nil {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.Tr(\"local_pe_not_found\", pePath))}\n\t}\n\n\tabsPath, _ := filepath.Abs(pePath)\n\tfileName := filepath.Base(absPath)\n\n\tlocations := []struct {\n\t\tname string\n\t\tdir  string\n\t}{\n\t\t{i18n.GetText(\"winstartup_user_folder\"), filepath.Join(os.Getenv(\"APPDATA\"), \"Microsoft\", \"Windows\", \"Start Menu\", \"Programs\", \"Startup\")},\n\t\t{i18n.GetText(\"winstartup_common_folder\"), filepath.Join(os.Getenv(\"ProgramData\"), \"Microsoft\", \"Windows\", \"Start Menu\", \"Programs\", \"Startup\")},\n\t}\n\n\tvar output strings.Builder\n\tvar successCount int\n\n\tfor _, loc := range locations {\n\t\ttarget := filepath.Join(loc.dir, fileName)","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/winstartup.go#L16-L52","documentation":"WinStartupPlugin.Scan stats the configured PE path to confirm the local file exists before scanning Startup folders and Run keys for references to it. When os.Stat fails, it returns this localized 'local PE not found' error with the path embedded. No startup locations are inspected afterwards.","triggerScenarios":"Config.WinPEFile is set but unresolvable: the file does not exist, a relative path resolves against the wrong CWD, the sample was removed/quarantined, or the path is inaccessible.","commonSituations":"Typo in the sample path; moving the tool or running it from another directory breaks a relative path; AV deleted the sample; the drive/share hosting the sample is unavailable.","solutions":["Check the file exists (Test-Path / os.Stat) and fix the configured path.","Prefer absolute paths so behavior is CWD-independent.","Restore the sample or update Config.WinPEFile to a valid copy.","Verify permissions on the containing directory."],"exampleFix":"// before\nsession.Config.WinPEFile = \"sample.exe\" // wrong CWD\n// after\npe, _ := filepath.Abs(\"sample.exe\")\nif _, err := os.Stat(pe); err == nil {\n    session.Config.WinPEFile = pe\n}","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(cfg.WinPEFile); err != nil {\n    return fmt.Errorf(\"startup sample %q unavailable: %w\", cfg.WinPEFile, err)\n}","typeGuard":null,"tryCatchPattern":"res := plugin.Scan(ctx, host, session)\nif !res.Success {\n    log.Errorf(\"winstartup scan failed: %v\", res.Error) // inspect for not-found\n}","preventionTips":["Use absolute sample paths; recompute Abs at load time.","Confirm the file exists after any config edit or tool move.","Guard against AV quarantine by checking presence right before the scan."],"tags":["file-not-found","windows","startup","pe-file"],"backgroundTag":"file-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}