{"record":{"id":"4e64b6df3660ff44","repo":"shadow1ng/fscan","slug":"local-pe-not-found-4e64b6","errorCode":null,"errorMessage":"local_pe_not_found","messagePattern":"local_pe_not_found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/winifeo.go","lineNumber":32,"sourceCode":"\t\"github.com/shadow1ng/fscan/common/i18n\"\n\t\"github.com/shadow1ng/fscan/plugins\"\n)\n\ntype WinIFEOPlugin struct {\n\tplugins.BasePlugin\n}\n\nfunc NewWinIFEOPlugin() *WinIFEOPlugin {\n\treturn &WinIFEOPlugin{BasePlugin: plugins.NewBasePlugin(\"winifeo\")}\n}\n\nfunc (p *WinIFEOPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {\n\tpePath := session.Config.WinPEFile\n\tif pePath == \"\" {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.GetText(\"local_pe_not_specified\"))}\n\t}\n\tif _, err := os.Stat(pePath); err != nil {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.Tr(\"local_pe_not_found\", pePath))}\n\t}\n\n\tabsPath, _ := filepath.Abs(pePath)\n\n\t// 劫持目标：不常用但系统存在的程序\n\ttargets := []struct {\n\t\texe  string\n\t\tdesc string\n\t}{\n\t\t{\"sethc.exe\", i18n.GetText(\"winifeo_sticky_keys\")},\n\t\t{\"utilman.exe\", i18n.GetText(\"winifeo_accessibility\")},\n\t\t{\"narrator.exe\", i18n.GetText(\"winifeo_narrator\")},\n\t}\n\n\tvar output strings.Builder\n\tvar successCount int\n\n\tfor _, t := range targets {","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/winifeo.go#L14-L50","documentation":"WinIFEOPlugin.Scan checks that the configured PE path actually exists via os.Stat before writing IFEO registry values. When Stat fails, Scan returns a failed Result with the localized \"local_pe_not_found\" message including the path. This prevents creating a Debugger hijack entry pointing at a nonexistent executable.","triggerScenarios":"os.Stat(pePath) errors for a non-empty WinPEFile: wrong path, file moved/deleted, relative path broken by CWD, permission denied, or path on an unavailable drive.","commonSituations":"Path copied from docs or another machine without adjusting the drive, UNC path not reachable from the scanning host, antivirus quarantine, or case/typo mistakes in the executable name.","solutions":["Run Test-Path <pePath> on the scanning machine and fix the path in the config.","Switch to an absolute local path (avoid UNC/network shares unless verified reachable).","Check antivirus quarantine logs and restore/exclude the PE if it was removed.","Verify read permission on the file and parent directories for the user running the tool."],"exampleFix":"// before\nsession.Config.WinPEFile = \"C:\\\\tools\\\\payl0ad.exe\" // typo -> os.Stat fails\n// after\np := \"C:\\\\tools\\\\payload.exe\"\nif _, err := os.Stat(p); err != nil {\n    log.Fatalf(\"fix WinPEFile: %v\", err)\n}\nsession.Config.WinPEFile = p","handlingStrategy":"validation","validationCode":"// Verify the IFEO payload exists locally before running\nif _, err := os.Stat(session.Config.WinPEFile); err != nil {\n    return fmt.Errorf(\"check WinPEFile path %q: %w\", session.Config.WinPEFile, err)\n}","typeGuard":null,"tryCatchPattern":"result := plugin.Scan(ctx, host, session)\nif result != nil && !result.Success && strings.Contains(result.Error.Error(), i18n.GetText(\"local_pe_not_found\")) {\n    // fix path (typos, quarantine, UNC reachability) and retry\n}","preventionTips":["Avoid UNC/network paths; copy the PE to a local absolute path first.","Check antivirus quarantine when a previously-working path suddenly fails.","Verify with Test-Path immediately before each scan run."],"tags":["file","configuration","windows","ifeo"],"backgroundTag":"file-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}