{"record":{"id":"9c2649044758b359","repo":"shadow1ng/fscan","slug":"s-w-minidump-find-proc-failed-s","errorCode":null,"errorMessage":"%s: %w [minidump_find_proc_failed: %s]","messagePattern":"(.+?): %w \\[minidump_find_proc_failed: (.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":288,"sourceCode":"\n// ProcessManager 方法实现\n\n// findProcess 查找进程\nfunc (pm *ProcessManager) findProcess(name string) (uint32, error) {\n\tsnapshot, err := pm.createProcessSnapshot()\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tdefer pm.closeHandle(snapshot)\n\n\treturn pm.findProcessInSnapshot(snapshot, name)\n}\n\n// createProcessSnapshot 创建进程快照\nfunc (pm *ProcessManager) createProcessSnapshot() (uintptr, error) {\n\tproc, err := pm.kernel32.FindProc(\"CreateToolhelp32Snapshot\")\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"%s: %w\", i18n.Tr(\"minidump_find_proc_failed\", \"CreateToolhelp32Snapshot\"), err)\n\t}\n\n\thandle, _, err := proc.Call(uintptr(TH32CS_SNAPPROCESS), 0)\n\tif handle == uintptr(INVALID_HANDLE_VALUE) {\n\t\tlastError := windows.GetLastError()\n\t\t//nolint:errorlint // Windows LastError不应该wrapped\n\t\treturn 0, fmt.Errorf(i18n.GetText(\"minidump_snapshot_create_failed\")+\": %v (LastError: %d)\", err, lastError)\n\t}\n\treturn handle, nil\n}\n\n// findProcessInSnapshot 在快照中查找进程\nfunc (pm *ProcessManager) findProcessInSnapshot(snapshot uintptr, name string) (uint32, error) {\n\tvar pe32 PROCESSENTRY32\n\tpe32.dwSize = uint32(unsafe.Sizeof(pe32))\n\n\tproc32First, err := pm.kernel32.FindProc(\"Process32FirstW\")\n\tif err != nil {","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L270-L306","documentation":"Wrap of a kernel32 lookup failure in ProcessManager.createProcessSnapshot: FindProc could not locate the CreateToolhelp32Snapshot export in kernel32.dll, so no process snapshot can be taken on the Windows target. The i18n minidump_find_proc_failed message names the missing API and %w preserves the underlying syscall lookup error.","triggerScenarios":"Thrown at plugins/local/minidump.go:288 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the Windows version supports CreateToolhelp32Snapshot (very old builds may not)","Check that the loaded kernel32 is genuine and unhooked","Fall back to another process-discovery method (e.g. enumerate via WMI-like paths)"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}