{"record":{"id":"a6ef67e00f36dd3a","repo":"shadow1ng/fscan","slug":"s-minidump-current-process-failed","errorCode":null,"errorMessage":"%s [minidump_current_process_failed]","messagePattern":"(.+?) \\[minidump_current_process_failed\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/local/minidump.go","lineNumber":403,"sourceCode":"\tret, _, err = adjustTokenPrivileges.Call(\n\t\tuintptr(token),\n\t\t0,\n\t\tuintptr(unsafe.Pointer(&tokenPrivileges)),\n\t\t0, 0, 0,\n\t)\n\tif ret == 0 {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_adjust_token_failed\"), err)\n\t}\n\n\treturn nil\n}\n\n// getCurrentProcess 获取当前进程句柄\nfunc (pm *ProcessManager) getCurrentProcess() (syscall.Handle, error) {\n\tproc := pm.kernel32.MustFindProc(\"GetCurrentProcess\")\n\thandle, _, _ := proc.Call()\n\tif handle == 0 {\n\t\treturn 0, fmt.Errorf(\"%s\", i18n.GetText(\"minidump_current_process_failed\"))\n\t}\n\treturn syscall.Handle(handle), nil\n}\n\n// dumpProcessWithTimeout 带超时的转储进程内存\nfunc (pm *ProcessManager) dumpProcessWithTimeout(ctx context.Context, pid uint32, outputPath string) error {\n\tresultChan := make(chan error, 1)\n\n\tgo func() {\n\t\tresultChan <- pm.dumpProcess(pid, outputPath)\n\t}()\n\n\tselect {\n\tcase err := <-resultChan:\n\t\treturn err\n\tcase <-ctx.Done():\n\t\treturn fmt.Errorf(\"%s\", i18n.GetText(\"minidump_timeout\"))\n\t}","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L385-L421","documentation":"Thrown by ProcessManager.getCurrentProcess when kernel32!GetCurrentProcess returns a zero handle. GetCurrentProcess always returns a valid pseudo-handle (-1) on real Windows, so this is a defensive guard against an impossible condition — a zero value indicates a broken syscall bridge or non-Windows environment rather than any user mistake.","triggerScenarios":"elevatePrivileges calls getCurrentProcess and the kernel32 proc.Call returns 0 — only realistic under Wine/CrossOver with a broken kernel32 shim, or if the binary was tampered with.","commonSituations":"Running the tool on Linux/macOS under Wine; corrupted system files; testing harnesses stubbing kernel32.","solutions":["Run the tool on genuine Windows — check runtime.GOOS before invoking dump paths.","If under Wine, retry on native Windows; kernel32 pseudo-handle behavior is not guaranteed there.","Verify binary integrity (rebuild from source) if the binary may have been patched."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if runtime.GOOS != \"windows\" {\n    return errors.New(\"minidump requires native Windows\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"minidump_current_process_failed\") {\n    // impossible on genuine Windows — check environment (Wine/emulation) and rebuild\n}","preventionTips":["Run only on native Windows.","Keep the binary unmodified; rebuild from source if in doubt."],"tags":["windows","defensive","kernel32"],"backgroundTag":"internal-invariant-violation","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}