{"record":{"id":"c6b82f2f1578f354","repo":"shadow1ng/fscan","slug":"minidump-all-methods-failed","errorCode":null,"errorMessage":"minidump_all_methods_failed","messagePattern":"minidump_all_methods_failed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":133,"sourceCode":"\t\t}\n\t} else {\n\t\toutput.WriteString(i18n.GetText(\"minidump_av_skip_direct\") + \"\\n\")\n\t}\n\n\t// 方式2：comsvcs.dll（系统签名DLL，部分杀软不拦截）\n\toutput.WriteString(i18n.GetText(\"minidump_try_comsvcs\") + \"\\n\")\n\tif ok := p.tryComsvcsDump(pm, &output, session); ok {\n\t\treturn &plugins.Result{Success: true, Type: plugins.ResultTypeService, Output: output.String()}\n\t}\n\n\t// 方式3：reg save 导出注册表 hive（离线破解，不碰 LSASS）\n\toutput.WriteString(i18n.GetText(\"minidump_try_regsave\") + \"\\n\")\n\tif ok := p.tryRegSave(&output, session); ok {\n\t\treturn &plugins.Result{Success: true, Type: plugins.ResultTypeService, Output: output.String()}\n\t}\n\n\toutput.WriteString(i18n.GetText(\"minidump_all_failed\") + \"\\n\")\n\treturn &plugins.Result{Success: false, Output: output.String(), Error: errors.New(i18n.GetText(\"minidump_all_methods_failed\"))}\n}\n\nfunc (p *MiniDumpPlugin) tryDirectDump(ctx context.Context, pm *ProcessManager, output *strings.Builder, session *common.ScanSession) bool {\n\tpid, err := pm.findProcess(\"lsass.exe\")\n\tif err != nil {\n\t\toutput.WriteString(i18n.Tr(\"minidump_find_lsass_failed\", err) + \"\\n\")\n\t\treturn false\n\t}\n\n\tif privErr := pm.elevatePrivileges(); privErr != nil {\n\t\toutput.WriteString(i18n.Tr(\"minidump_privilege_failed\", privErr) + \"\\n\")\n\t\treturn false\n\t}\n\n\toutputPath := filepath.Join(\".\", fmt.Sprintf(\"lsass-%d.dmp\", pid))\n\tdumpCtx, cancel := context.WithTimeout(ctx, 15*time.Second)\n\tdefer cancel()\n","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L115-L151","documentation":"The MiniDump plugin tries several lsass dump techniques in sequence (direct dump, then regsave, etc.). If every method fails, Scan() writes the 'minidump_all_failed' marker and returns a failed Result whose Error is the localized 'minidump_all_methods_failed' sentinel. The real causes are hidden in the per-method output written to the Result's Output string.","triggerScenarios":"Scan() falls through all dump strategies: tryDirectDump fails (lsass not found, dump file write fails, antivirus blocks it), and tryRegSave also fails, reaching the final errors.New(i18n.GetText(\"minidump_all_methods_failed\")).","commonSituations":"EDR/antivirus blocking lsass access (common with Defender, CrowdStrike); lsass.exe running as PPL (Protected Process Light) on modern Windows; sysmon/secure output directory unwritable; non-English/renamed lsass on hardened hosts.","solutions":["Read the full Result.Output — each method appends a specific failure reason (find lsass failed, dump write failed, etc.) — and fix that root cause.","Add an exclusion for the tool in the EDR/antivirus or run from a trusted path.","Check if lsass runs as PPL (registry LSA Protection); PPL blocks user-mode dumps and requires kernel-level techniques.","Ensure the output directory is writable and has space, then retry the scan.","Confirm the process is elevated — without admin all methods will fail."],"exampleFix":"// before\nres := plugin.Scan(ctx, session)\nif !res.Success {\n    log.Println(res.Error)\n}\n// after\nres := plugin.Scan(ctx, session)\nif !res.Success {\n    log.Printf(\"%v\\n detail: %s\", res.Error, res.Output) // per-method reasons\n}","handlingStrategy":"fallback","validationCode":"// preconditions before scanning\n// 1) elevated process, 2) writable output dir, 3) lsass present\nif _, err := os.Stat(fmt.Sprintf(\"\\\\\\\\.\\\\pipe\\\\lsass\")); err != nil {\n    // cannot even probe; likely blocked by EDR\n}","typeGuard":null,"tryCatchPattern":"res := plugin.Scan(ctx, session)\nif !res.Success {\n    // Output carries per-method failure reasons; log all of them\n    for _, line := range strings.Split(res.Output, \"\\n\") {\n        log.Println(line)\n    }\n}","preventionTips":["Exclude the collector from EDR/AV lsass protections before deployments","Check LSA Protection (RunAsPPL) on target hosts and use PPL-compatible techniques","Ensure the dump output directory is writable with free disk space","Always read Result.Output, not just Result.Error, for the root cause"],"tags":["windows","minidump","lsass","edr"],"backgroundTag":"operation-not-supported","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}