{"record":{"id":"d4df8b8bf527f374","repo":"shadow1ng/fscan","slug":"s-lasterror-d-minidump-write-dump-failed","errorCode":null,"errorMessage":"%s (LastError: %d) [minidump_write_dump_failed]","messagePattern":"(.+?) \\(LastError: (.+?)\\) \\[minidump_write_dump_failed\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":483,"sourceCode":"\t\tuintptr(dumpType),\n\t\t0, 0, 0,\n\t)\n\n\tif ret == 0 {\n\t\t// 尝试使用较小的转储类型作为后备\n\t\tfallbackDumpType := MiniDumpWithDataSegs | MiniDumpWithPrivateReadWriteMemory | MiniDumpWithHandleData\n\n\t\tret, _, _ = miniDumpWriteDump.Call(\n\t\t\tprocessHandle,\n\t\t\tuintptr(pid),\n\t\t\tfileHandle,\n\t\t\tuintptr(fallbackDumpType),\n\t\t\t0, 0, 0,\n\t\t)\n\n\t\tif ret == 0 {\n\t\t\t//nolint:errorlint // Windows LastError不应该wrapped\n\t\t\treturn fmt.Errorf(i18n.GetText(\"minidump_write_dump_failed\")+\" (LastError: %d)\", windows.GetLastError())\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// openProcess 打开进程\nfunc (pm *ProcessManager) openProcess(pid uint32) (uintptr, error) {\n\tproc, err := pm.kernel32.FindProc(\"OpenProcess\")\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"%s: %w\", i18n.Tr(\"minidump_find_proc_failed\", \"OpenProcess\"), err)\n\t}\n\n\thandle, _, callErr := proc.Call(uintptr(PROCESS_ALL_ACCESS), 0, uintptr(pid))\n\tif handle == 0 {\n\t\tlastError := windows.GetLastError()\n\t\t//nolint:errorlint // Windows LastError不应该wrapped\n\t\treturn 0, fmt.Errorf(i18n.GetText(\"minidump_open_process_failed\")+\": %v (LastError: %d)\", callErr, lastError)","sourceCodeStart":465,"sourceCodeEnd":501,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L465-L501","documentation":"Thrown by ProcessManager.dumpProcess when MiniDumpWriteDump returns 0 (call failed). The Windows last error code is embedded in the message (deliberately not wrapped, per the nolint comment, since it is not a Go error value). Common last errors are 5 (ERROR_ACCESS_DENIED), 6 (invalid handle), or disk errors while writing the dump file.","triggerScenarios":"dumpProcess invoking MiniDumpWriteDump on an opened process handle when access is denied (protected process, insufficient SeDebugPrivilege), the handle lacks required rights, or the output file cannot be written (disk full, permissions, antivirus blocking the dump file).","commonSituations":"Dumping protected processes (e.g. lsass on modern Windows with RunAsPPL) without appropriate rights; running non-elevated; target output path on a full or read-only volume; EDR deleting/blocking .dmp writes.","solutions":["Decode the printed LastError: 5 → run elevated / target is protected; 6 → check the process handle and output file handle.","Run as administrator with SeDebugPrivilege enabled (see elevatePrivileges) before dumping.","Write the dump to a writable local path and verify free disk space; exclude the output directory from antivirus/EDR interference.","If the target is a protected process (LSA Protection), use an alternate dump vector such as the comsvcs path the library already offers (tryComsvcsDump)."],"exampleFix":"// before\npm.dumpProcess(pid, \"\\\\\\\\server\\\\share\\\\dump.dmp\") // slow/networked path\n// after\npm.dumpProcess(pid, \"C:\\\\Temp\\\\dump.dmp\") // local writable path, run elevated","handlingStrategy":"fallback","validationCode":"// preflight: writable local output dir and free space\nif fi, err := os.Stat(filepath.Dir(outPath)); err != nil || !fi.IsDir() {\n    return errors.New(\"output directory not writable\")\n}","typeGuard":null,"tryCatchPattern":"err := pm.dumpProcess(pid, outPath)\nif err != nil && strings.Contains(err.Error(), \"minidump_write_dump_failed\") {\n    // parse LastError; on access-denied (5) retry elevated or fall back to tryComsvcsDump\n}","preventionTips":["Run elevated so the process handle has full access rights.","Write dumps to a local, writable, AV-excluded directory with sufficient free space.","Recognize protected processes (LSA Protection) and use the comsvcs fallback path.","Always decode the LastError printed in the message before changing code."],"tags":["windows","minidump","access-denied"],"backgroundTag":"file-write-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}