{"record":{"id":"c517424fc8ab3265","repo":"shadow1ng/fscan","slug":"s-w-minidump-adjust-token-failed","errorCode":null,"errorMessage":"%s: %w [minidump_adjust_token_failed]","messagePattern":"(.+?): %w \\[minidump_adjust_token_failed\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":392,"sourceCode":"\t\tuintptr(unsafe.Pointer(privilegeName)),\n\t\tuintptr(unsafe.Pointer(&tokenPrivileges.Privileges[0].Luid)),\n\t)\n\tif ret == 0 {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_lookup_privilege_failed\"), err)\n\t}\n\n\ttokenPrivileges.PrivilegeCount = 1\n\ttokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED\n\n\tadjustTokenPrivileges := pm.advapi32.MustFindProc(\"AdjustTokenPrivileges\")\n\tret, _, err = adjustTokenPrivileges.Call(\n\t\tuintptr(token),\n\t\t0,\n\t\tuintptr(unsafe.Pointer(&tokenPrivileges)),\n\t\t0, 0, 0,\n\t)\n\tif ret == 0 {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_adjust_token_failed\"), err)\n\t}\n\n\treturn nil\n}\n\n// getCurrentProcess 获取当前进程句柄\nfunc (pm *ProcessManager) getCurrentProcess() (syscall.Handle, error) {\n\tproc := pm.kernel32.MustFindProc(\"GetCurrentProcess\")\n\thandle, _, _ := proc.Call()\n\tif handle == 0 {\n\t\treturn 0, fmt.Errorf(\"%s\", i18n.GetText(\"minidump_current_process_failed\"))\n\t}\n\treturn syscall.Handle(handle), nil\n}\n\n// dumpProcessWithTimeout 带超时的转储进程内存\nfunc (pm *ProcessManager) dumpProcessWithTimeout(ctx context.Context, pid uint32, outputPath string) error {\n\tresultChan := make(chan error, 1)","sourceCodeStart":374,"sourceCodeEnd":410,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L374-L410","documentation":"Thrown by ProcessManager.elevatePrivileges when advapi32!AdjustTokenPrivileges returns 0, meaning the API call itself failed (as opposed to returning success with a not-adjusted result). The SeDebugPrivilege could not be applied to the process token, so subsequent process-opening with elevated access may fail. The Win32 error is wrapped via %w.","triggerScenarios":"elevatePrivileges (from tryDirectDump/tryComsvcsDump) calling AdjustTokenPrivileges with TOKEN_ADJUST_PRIVILEGES on a token that cannot be adjusted — token restricted by policy, integrity level too low, or handle opened without sufficient rights.","commonSituations":"Running as a standard (non-admin) user where SeDebugPrivilege is not held and cannot be enabled; AppLocker/sandbox policies stripping privileges; running from a low-integrity process.","solutions":["Start the tool from an elevated administrator prompt so the token actually holds SeDebugPrivilege.","Check the wrapped Win32 error (ERROR_NOT_ALL_ASSIGNED means the privilege is not held — elevation is required).","Verify with `whoami /priv` that SeDebugPrivilege is present and enabled for the running account."],"exampleFix":"// before\nC:\\> tool.exe --dump lsass.exe\n// after\nC:\\> (elevated PowerShell) tool.exe --dump lsass.exe","handlingStrategy":"try-catch","validationCode":"// check SeDebugPrivilege is held before attempting dump\nout, _ := exec.Command(\"whoami\", \"/priv\").Output()\nif !strings.Contains(string(out), \"SeDebugPrivilege\") {\n    return fmt.Errorf(\"run elevated: SeDebugPrivilege not held\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"minidump_adjust_token_failed\") {\n    // ERROR_NOT_ALL_ASSIGNED means elevation required — relaunch elevated and retry\n}","preventionTips":["Always run dump operations from an elevated session.","Confirm with `whoami /priv` that SeDebugPrivilege is present and enabled.","Watch for policies (AppLocker, sandboxes) that strip token privileges."],"tags":["windows","privileges","token"],"backgroundTag":"insufficient-permissions","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}