{"record":{"id":"2a58d8de1c9acd6d","repo":"shadow1ng/fscan","slug":"local-invalid-pe","errorCode":null,"errorMessage":"local_invalid_pe","messagePattern":"local_invalid_pe","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/winschtask.go","lineNumber":38,"sourceCode":"}\n\nfunc NewWinSchTaskPlugin() *WinSchTaskPlugin {\n\treturn &WinSchTaskPlugin{\n\t\tBasePlugin: plugins.NewBasePlugin(\"winschtask\"),\n\t}\n}\n\nfunc (p *WinSchTaskPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {\n\tpePath := session.Config.WinPEFile\n\tif pePath == \"\" {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.GetText(\"local_pe_not_specified\"))}\n\t}\n\tif _, err := os.Stat(pePath); err != nil {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.Tr(\"local_pe_not_found\", pePath))}\n\t}\n\text := strings.ToLower(filepath.Ext(pePath))\n\tif ext != \".exe\" && ext != \".dll\" {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.Tr(\"local_invalid_pe\", pePath))}\n\t}\n\n\tabsPath, _ := filepath.Abs(pePath)\n\tbaseName := strings.TrimSuffix(filepath.Base(absPath), filepath.Ext(absPath))\n\n\ttasks := []struct {\n\t\tname     string\n\t\tschedule string\n\t\tmodifier string\n\t}{\n\t\t{fmt.Sprintf(\"WindowsUpdateCheck_%s\", baseName), \"DAILY\", \"1\"},\n\t\t{fmt.Sprintf(\"SystemSecurityScan_%s\", baseName), \"ONLOGON\", \"\"},\n\t\t{fmt.Sprintf(\"MaintenanceTask_%s\", baseName), \"ONSTART\", \"\"},\n\t\t{fmt.Sprintf(\"BackgroundService_%s\", baseName), \"HOURLY\", \"2\"},\n\t}\n\n\tvar output strings.Builder\n\tvar successCount int","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/winschtask.go#L20-L56","documentation":"After confirming the PE file exists, WinSchTaskPlugin.Scan checks its extension: only .exe and .dll are accepted because scheduled-task actions must reference executable images. Any other extension (.bin, .ps1, .sys, no extension) produces this localized 'invalid PE' error with the path interpolated.","triggerScenarios":"session.Config.WinPEFile points to an existing file whose lowercased filepath.Ext is neither \".exe\" nor \".dll\", e.g. a raw payload with no extension, a .sys driver, or a script file.","commonSituations":"Pointing the plugin at a shellcode/payload blob without an extension; mistakenly configuring a script (.ps1/.bat) or driver (.sys) where a PE image is required; case-only extensions are fine (handled via strings.ToLower), but files like 'agent.exe.bak' are not.","solutions":["Configure a path to an actual .exe or .dll file.","Rename/copy the sample with an .exe or .dll extension only if it genuinely is a PE image; do not rename non-PE files.","If you need to scan scripts or drivers, use the appropriate plugin rather than the schtask PE matcher."],"exampleFix":"// before\nsession.Config.WinPEFile = \"C:\\\\samples\\\\payload.bin\" // ext not allowed\n// after\nsession.Config.WinPEFile = \"C:\\\\samples\\\\payload.dll\" // valid PE extension\np.Scan(ctx, host, session)","handlingStrategy":"validation","validationCode":"ext := strings.ToLower(filepath.Ext(cfg.WinPEFile))\nif ext != \".exe\" && ext != \".dll\" {\n    return fmt.Errorf(\"WinPEFile must be .exe or .dll, got %q\", ext)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure only PE image files (.exe/.dll) for scheduled-task matching.","Check the extension when accepting user-supplied sample paths.","Rename raw payloads to .exe/.dll only if they truly are PE images."],"tags":["validation","windows","pe-file","file-extension"],"backgroundTag":"invalid-argument-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}