{"record":{"id":"c64ce618ab87ad42","repo":"shadow1ng/fscan","slug":"s-w-minidump-lookup-privilege-failed","errorCode":null,"errorMessage":"%s: %w [minidump_lookup_privilege_failed]","messagePattern":"(.+?): %w \\[minidump_lookup_privilege_failed\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":378,"sourceCode":"\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_open_process_token_failed\"), err)\n\t}\n\tdefer func() { _ = token.Close() }()\n\n\tvar tokenPrivileges TOKEN_PRIVILEGES\n\n\tprivilegeName, err := syscall.UTF16PtrFromString(\"SeDebugPrivilege\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_privilege_name_convert_failed\"), err)\n\t}\n\n\tlookupPrivilegeValue := pm.advapi32.MustFindProc(\"LookupPrivilegeValueW\")\n\tret, _, err := lookupPrivilegeValue.Call(\n\t\t0,\n\t\tuintptr(unsafe.Pointer(privilegeName)),\n\t\tuintptr(unsafe.Pointer(&tokenPrivileges.Privileges[0].Luid)),\n\t)\n\tif ret == 0 {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_lookup_privilege_failed\"), err)\n\t}\n\n\ttokenPrivileges.PrivilegeCount = 1\n\ttokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED\n\n\tadjustTokenPrivileges := pm.advapi32.MustFindProc(\"AdjustTokenPrivileges\")\n\tret, _, err = adjustTokenPrivileges.Call(\n\t\tuintptr(token),\n\t\t0,\n\t\tuintptr(unsafe.Pointer(&tokenPrivileges)),\n\t\t0, 0, 0,\n\t)\n\tif ret == 0 {\n\t\treturn fmt.Errorf(\"%s: %w\", i18n.GetText(\"minidump_adjust_token_failed\"), err)\n\t}\n\n\treturn nil\n}","sourceCodeStart":360,"sourceCodeEnd":396,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L360-L396","documentation":"Thrown by ProcessManager.elevatePrivileges when advapi32!LookupPrivilegeValueW returns 0, i.e. Windows could not resolve the LUID for the SeDebugPrivilege name on the local system. The LUID is required to build the TOKEN_PRIVILEGES structure used by AdjustTokenPrivileges, so elevation aborts. The Win32 error is wrapped via %w.","triggerScenarios":"elevatePrivileges (from tryDirectDump/tryComsvcsDump) calling LookupPrivilegeValueW with system name 0 and \"SeDebugPrivilege\" when the local privilege name cannot be resolved — corrupted localization of privilege names, or an invalid/modified privilege string.","commonSituations":"Heavily customized or stripped Windows images where privilege name resolution fails; running under a non-Windows compatibility layer (Wine) with incomplete advapi32 support.","solutions":["Run on a standard Windows installation — verify with `secedit /export` or LsaEnumeratePrivileges that SeDebugPrivilege exists.","Check the wrapped Win32 error (e.g. ERROR_NO_SUCH_PRIVILEGE) to confirm the resolution failure and address system integrity (sfc /scannow).","If running under Wine or an emulation layer, use real Windows for minidump operations."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"minidump_lookup_privilege_failed\") {\n    // inspect wrapped Win32 error; verify SeDebugPrivilege exists on this system\n}","preventionTips":["Run on a standard, unmodified Windows installation.","Avoid emulation layers (Wine) for privilege operations.","Repair system files (sfc /scannow) if privilege resolution fails system-wide."],"tags":["windows","privileges","sedebug"],"backgroundTag":"resource-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}