{"record":{"id":"7ba382e5ce5cc417","repo":"shadow1ng/fscan","slug":"s-w-minidump-privilege-name-convert-failed","errorCode":null,"errorMessage":"%s: %w [minidump_privilege_name_convert_failed]","messagePattern":"(.+?): %w \\[minidump_privilege_name_convert_failed\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/local/minidump.go","lineNumber":368,"sourceCode":"// elevatePrivileges 提升权限\nfunc (pm *ProcessManager) elevatePrivileges() error {\n\thandle, err := pm.getCurrentProcess()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar token syscall.Token\n\terr = syscall.OpenProcessToken(handle, syscall.TOKEN_ADJUST_PRIVILEGES|syscall.TOKEN_QUERY, &token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_open_process_token_failed\"), err)\n\t}\n\tdefer func() { _ = token.Close() }()\n\n\tvar tokenPrivileges TOKEN_PRIVILEGES\n\n\tprivilegeName, err := syscall.UTF16PtrFromString(\"SeDebugPrivilege\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_privilege_name_convert_failed\"), err)\n\t}\n\n\tlookupPrivilegeValue := pm.advapi32.MustFindProc(\"LookupPrivilegeValueW\")\n\tret, _, err := lookupPrivilegeValue.Call(\n\t\t0,\n\t\tuintptr(unsafe.Pointer(privilegeName)),\n\t\tuintptr(unsafe.Pointer(&tokenPrivileges.Privileges[0].Luid)),\n\t)\n\tif ret == 0 {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_lookup_privilege_failed\"), err)\n\t}\n\n\ttokenPrivileges.PrivilegeCount = 1\n\ttokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED\n\n\tadjustTokenPrivileges := pm.advapi32.MustFindProc(\"AdjustTokenPrivileges\")\n\tret, _, err = adjustTokenPrivileges.Call(\n\t\tuintptr(token),","sourceCodeStart":350,"sourceCodeEnd":386,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L350-L386","documentation":"Thrown by ProcessManager.elevatePrivileges when syscall.UTF16PtrFromString fails to convert the constant string \"SeDebugPrivilege\" to a UTF-16 pointer. This only fails if the string contains an interior NUL byte, which the hardcoded literal never does, so in practice this error indicates a library build/patch anomaly rather than a user-actionable condition.","triggerScenarios":"elevatePrivileges (from tryDirectDump/tryComsvcsDump) reaching the UTF16PtrFromString call — reachable only if the privilege-name constant was modified (e.g. by a fork or build-time injection) to contain a NUL byte.","commonSituations":"Custom forks or code-generation patches that alter the hardcoded privilege name; essentially never seen with the stock library.","solutions":["Inspect the built source for modifications to the \"SeDebugPrivilege\" literal and restore the original constant.","If using a fork, diff against upstream plugins/local/minidump.go to find injected changes.","Rebuild the library from a clean upstream checkout."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"minidump_privilege_name_convert_failed\") {\n    // library/build anomaly — rebuild from clean upstream source\n}","preventionTips":["Use the unmodified upstream minidump.go; do not patch the SeDebugPrivilege literal.","Verify binary integrity after vendor modifications."],"tags":["windows","encoding","defensive"],"backgroundTag":"invalid-argument-format","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}