{"record":{"id":"512ae403437a4db6","repo":"go-delve/delve","slug":"could-not-get-process-list-v","errorCode":null,"errorMessage":"could not get process list: %v","messagePattern":"could not get process list: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proc/native/proc_windows.go","lineNumber":227,"sourceCode":"\n\tvar tp sys.Tokenprivileges\n\ttp.PrivilegeCount = 1\n\ttp.Privileges[0].Luid = luid\n\ttp.Privileges[0].Attributes = sys.SE_PRIVILEGE_ENABLED\n\n\terr = sys.AdjustTokenPrivileges(token, false, &tp, 0, nil, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not acquire debug privilege (AdjustTokenPrivileges): %v\", err)\n\t}\n\n\treturn nil\n}\n\nfunc waitForSearchProcess(pfx string, seen map[int]struct{}) (int, error) {\n\tlog := logflags.DebuggerLogger()\n\thandle, err := sys.CreateToolhelp32Snapshot(sys.TH32CS_SNAPPROCESS, 0)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"could not get process list: %v\", err)\n\t}\n\tdefer sys.CloseHandle(handle)\n\n\tvar entry sys.ProcessEntry32\n\tentry.Size = uint32(unsafe.Sizeof(entry))\n\terr = sys.Process32First(handle, &entry)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"could not get process list: %v\", err)\n\t}\n\n\tfor err = sys.Process32First(handle, &entry); err == nil; err = sys.Process32Next(handle, &entry) {\n\t\tif _, isseen := seen[int(entry.ProcessID)]; isseen {\n\t\t\tcontinue\n\t\t}\n\t\tseen[int(entry.ProcessID)] = struct{}{}\n\n\t\thProcess, err := sys.OpenProcess(sys.PROCESS_QUERY_INFORMATION|sys.PROCESS_VM_READ, false, entry.ProcessID)\n\t\tif err != nil {","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/go-delve/delve/blob/a23773e6c31361e43246bc43a424ee009679b174/pkg/proc/native/proc_windows.go#L209-L245","documentation":"waitForSearchProcess polls the Windows process list (CreateToolhelp32Snapshot) to find a newly spawned process whose name matches a prefix — used for follow-exec style flows. If the snapshot cannot even be created, this error wraps the failure. A process snapshot fails when the caller lacks rights or the system is under resource pressure.","triggerScenarios":"Calling the attach/launch path that searches for a process by name prefix, and CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) returns an error (e.g. ERROR_ACCESS_DENIED on hardened systems).","commonSituations":"Running under restricted service accounts where process enumeration is blocked; EDR/AV blocking toolhelp snapshots; transient Win32 failures under heavy process churn.","solutions":["Run Delve with sufficient rights (elevated) so process enumeration is allowed.","Check EDR/AV policies that may block CreateToolhelp32Snapshot.","Retry after a short delay if the failure was transient (snapshot creation can fail under load).","Check the wrapped Win32 error in %v for the exact cause (access denied vs. out of memory)."],"exampleFix":"// before\nrestricted> dlv attach <pfx-search>\n// could not get process list: Access is denied.\n// after\nelevated> tasklist   // verify enumeration works\nelevated> dlv attach <pfx-search>","handlingStrategy":"retry","validationCode":"// powershell: confirm the account can enumerate processes\ntasklist /v /fo csv > $null; if ($LASTEXITCODE -ne 0) { Write-Error \"cannot enumerate processes\" }","typeGuard":null,"tryCatchPattern":"for i := 0; i < 3; i++ {\n    t, err := dbg.Attach(pid, nil)\n    if err == nil { _ = t; break }\n    if !strings.Contains(err.Error(), \"could not get process list\") { break }\n    time.Sleep(100 * time.Millisecond)\n}","preventionTips":["Run with sufficient rights to enumerate processes.","Exclude the debugger from EDR snapshot blocking.","Retry transient snapshot failures with backoff."],"tags":["windows","process-list","snapshot","privileges"],"backgroundTag":"process-enumeration-denied","analyzedSha":"a23773e6c31361e43246bc43a424ee009679b174","analyzedAt":"2026-08-31T15:12:45.221Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}