{"record":{"id":"5edeb60c7d62fc21","repo":"shadow1ng/fscan","slug":"s-minidump-process-not-found-s","errorCode":null,"errorMessage":"%s [minidump_process_not_found: %s]","messagePattern":"(.+?) \\[minidump_process_not_found: (.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":347,"sourceCode":"\t\t\treturn 0, fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_process_name_convert_failed\"), err)\n\t\t}\n\n\t\tret, _, _ = lstrcmpi.Call(\n\t\t\tuintptr(unsafe.Pointer(namePtr)),\n\t\t\tuintptr(unsafe.Pointer(&pe32.szExeFile[0])),\n\t\t)\n\n\t\tif ret == 0 {\n\t\t\treturn pe32.th32ProcessID, nil\n\t\t}\n\n\t\tret, _, _ = proc32Next.Call(snapshot, uintptr(unsafe.Pointer(&pe32)))\n\t\tif ret == 0 {\n\t\t\tbreak\n\t\t}\n\t}\n\n\treturn 0, fmt.Errorf(\"%s\", i18n.Tr(\"minidump_process_not_found\", name))\n}\n\n// elevatePrivileges 提升权限\nfunc (pm *ProcessManager) elevatePrivileges() error {\n\thandle, err := pm.getCurrentProcess()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar token syscall.Token\n\terr = syscall.OpenProcessToken(handle, syscall.TOKEN_ADJUST_PRIVILEGES|syscall.TOKEN_QUERY, &token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_open_process_token_failed\"), err)\n\t}\n\tdefer func() { _ = token.Close() }()\n\n\tvar tokenPrivileges TOKEN_PRIVILEGES\n","sourceCodeStart":329,"sourceCodeEnd":365,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L329-L365","documentation":"Thrown by ProcessManager.findProcessInSnapshot when iterating a Windows toolhelp32 process snapshot (proc32Next loop) and no entry matches the requested process name. The library throws it because a dump can only target an existing process; it returns PID 0 plus this error instead of a bogus handle. It means the lookup completed successfully but found zero matching processes.","triggerScenarios":"Calling findProcess(name) (via findProcessInSnapshot) with a name that matches no process in the current toolhelp32 snapshot: the process is not running, the name is misspelled, or the name includes/excludes the .exe extension inconsistently with what the snapshot reports.","commonSituations":"Targeting a process that already exited; typos like 'lsass' vs 'lsass.exe'; using the full path instead of the image name; on non-English or stripped systems where the expected service process differs.","solutions":["Verify the process is running with `tasklist /FI \"IMAGENAME eq name.exe\"` and use the exact image name shown (usually with .exe).","Retry the lookup after confirming the process is started — the snapshot is taken at call time, so a process started after the call requires a new call.","If matching by name is unreliable, use a PID-based path (openProcess) instead of name lookup."],"exampleFix":"// before\npid, err := pm.findProcess(\"lsass\")\n// after\npid, err := pm.findProcess(\"lsass.exe\") // exact image name as shown in tasklist","handlingStrategy":"validation","validationCode":"// confirm the process exists before calling findProcess\nout, err := exec.Command(\"tasklist\", \"/FI\", \"IMAGENAME eq target.exe\").Output()\nif err != nil || !strings.Contains(strings.ToLower(string(out)), \"target.exe\") {\n    return fmt.Errorf(\"target.exe is not running\")\n}","typeGuard":null,"tryCatchPattern":"pid, err := pm.findProcess(\"target.exe\")\nif err != nil && strings.Contains(err.Error(), \"minidump_process_not_found\") {\n    // handle: target absent — start it or abort\n}","preventionTips":["Always use the exact image name from tasklist (typically with .exe).","Confirm the target is running immediately before dumping; snapshots are point-in-time.","Prefer PID-based openProcess when the PID is already known."],"tags":["windows","process","minidump"],"backgroundTag":"entity-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}