{"record":{"id":"c12d60ce21ac7cd5","repo":"shadow1ng/fscan","slug":"s-w-minidump-open-process-token-failed","errorCode":null,"errorMessage":"%s: %w [minidump_open_process_token_failed]","messagePattern":"(.+?): %w \\[minidump_open_process_token_failed\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":360,"sourceCode":"\t\tif ret == 0 {\n\t\t\tbreak\n\t\t}\n\t}\n\n\treturn 0, fmt.Errorf(\"%s\", i18n.Tr(\"minidump_process_not_found\", name))\n}\n\n// elevatePrivileges 提升权限\nfunc (pm *ProcessManager) elevatePrivileges() error {\n\thandle, err := pm.getCurrentProcess()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar token syscall.Token\n\terr = syscall.OpenProcessToken(handle, syscall.TOKEN_ADJUST_PRIVILEGES|syscall.TOKEN_QUERY, &token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_open_process_token_failed\"), err)\n\t}\n\tdefer func() { _ = token.Close() }()\n\n\tvar tokenPrivileges TOKEN_PRIVILEGES\n\n\tprivilegeName, err := syscall.UTF16PtrFromString(\"SeDebugPrivilege\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_privilege_name_convert_failed\"), err)\n\t}\n\n\tlookupPrivilegeValue := pm.advapi32.MustFindProc(\"LookupPrivilegeValueW\")\n\tret, _, err := lookupPrivilegeValue.Call(\n\t\t0,\n\t\tuintptr(unsafe.Pointer(privilegeName)),\n\t\tuintptr(unsafe.Pointer(&tokenPrivileges.Privileges[0].Luid)),\n\t)\n\tif ret == 0 {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_lookup_privilege_failed\"), err)","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L342-L378","documentation":"Thrown by ProcessManager.elevatePrivileges when syscall.OpenProcessToken fails to open the current process token with TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY. This is the first step of enabling SeDebugPrivilege before dumping; without a token handle the privilege cannot be adjusted. The underlying Windows error is wrapped via %w.","triggerScenarios":"elevatePrivileges (called from tryDirectDump or tryComsvcsDump) runs while the calling process cannot open its own token — e.g. running under a heavily restricted token, a sandbox, or when malware/EDR blocks token operations.","commonSituations":"Running inside a restricted service account or containerized/jailed environment; EDR hooking OpenProcessToken; corrupted user profile/token after account issues.","solutions":["Re-run the tool from an elevated (Run as administrator) shell so the process token is openable and adjustable.","Check the wrapped cause (%w) for the concrete Win32 error (e.g. ERROR_ACCESS_DENIED) and address it accordingly.","Exclude the binary from EDR/AV interference or run on an unrestricted account."],"exampleFix":"// before\ncmd := exec.Command(\"tool.exe\")\ncmd.Run()\n// after — ensure elevation before calling dump paths\nif !windows.CurrentProcessToken().IsElevated() { /* relaunch with ShellExecute \"runas\" or require admin */ }","handlingStrategy":"try-catch","validationCode":"// verify the process token is openable/elevated before dumping\ntoken := windows.CurrentProcessToken()\nelevated, err := token.IsElevated()\nif err != nil || !elevated {\n    return fmt.Errorf(\"must run elevated for minidump\")\n}","typeGuard":null,"tryCatchPattern":"err := pm.dumpProcess(...)\nif err != nil && strings.Contains(err.Error(), \"minidump_open_process_token_failed\") {\n    // inspect wrapped Win32 cause; require elevation and retry once elevated\n}","preventionTips":["Launch the tool from an administrator prompt.","Avoid restricted service accounts, sandboxes, and containers for dump operations.","Check EDR/AV policies that hook OpenProcessToken."],"tags":["windows","token","privileges"],"backgroundTag":"permission-denied","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}