{"record":{"id":"da27eabb33227831","repo":"shadow1ng/fscan","slug":"s-v-lasterror-d-minidump-open-process-fail","errorCode":null,"errorMessage":"%s: %v (LastError: %d) [minidump_open_process_failed]","messagePattern":"(.+?): (.+?) \\(LastError: (.+?)\\) \\[minidump_open_process_failed\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":501,"sourceCode":"\t\t\treturn fmt.Errorf(i18n.GetText(\"minidump_write_dump_failed\")+\" (LastError: %d)\", windows.GetLastError())\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// openProcess 打开进程\nfunc (pm *ProcessManager) openProcess(pid uint32) (uintptr, error) {\n\tproc, err := pm.kernel32.FindProc(\"OpenProcess\")\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"%s: %w\", i18n.Tr(\"minidump_find_proc_failed\", \"OpenProcess\"), err)\n\t}\n\n\thandle, _, callErr := proc.Call(uintptr(PROCESS_ALL_ACCESS), 0, uintptr(pid))\n\tif handle == 0 {\n\t\tlastError := windows.GetLastError()\n\t\t//nolint:errorlint // Windows LastError不应该wrapped\n\t\treturn 0, fmt.Errorf(i18n.GetText(\"minidump_open_process_failed\")+\": %v (LastError: %d)\", callErr, lastError)\n\t}\n\treturn handle, nil\n}\n\n// createDumpFile 创建转储文件\nfunc (pm *ProcessManager) createDumpFile(path string) (uintptr, error) {\n\tpathPtr, err := syscall.UTF16PtrFromString(path)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\n\tcreateFile, err := pm.kernel32.FindProc(\"CreateFileW\")\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"%s: %w\", i18n.Tr(\"minidump_find_proc_failed\", \"CreateFileW\"), err)\n\t}\n\n\thandle, _, callErr := createFile.Call(\n\t\tuintptr(unsafe.Pointer(pathPtr)),","sourceCodeStart":483,"sourceCodeEnd":519,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L483-L519","documentation":"OpenProcess(PROCESS_ALL_ACCESS) returned a zero handle, so the plugin could not open the target process to build a minidump. The syscall's returned error and the captured windows.GetLastError() value are reported. This library throws it because the Windows API refused access to the PID before MiniDumpWriteDump could run.","triggerScenarios":"proc.Call on kernel32!OpenProcess with PROCESS_ALL_ACCESS returns handle==0 for the given PID; typically the PID is protected, elevated, a system process, the plugin is not elevated, or the process has exited between enumeration and open.","commonSituations":"Dumping an LSASS/AV process from a non-admin shell; targeting a PID that terminated; running a 32-bit build against a 64-bit process; security software blocking handle creation.","solutions":["Re-run the scan/plugin from an elevated (Administrator) process so OpenProcess can obtain PROCESS_ALL_ACCESS.","Verify the PID still exists (Task Manager / tasklist) before dumping; retry with a fresh enumeration.","Retry with a reduced access mask (e.g. PROCESS_QUERY_INFORMATION|PROCESS_VM_READ) if full access is blocked by policy/AV.","Enable SeDebugPrivilege in the calling process before opening system processes."],"exampleFix":"// before\nhandle, _, callErr := proc.Call(uintptr(PROCESS_ALL_ACCESS), 0, uintptr(pid))\n// after — request only the access MiniDumpWriteDump needs\nconst desiredAccess = windows.PROCESS_QUERY_INFORMATION | windows.PROCESS_VM_READ\nhandle, _, callErr := proc.Call(uintptr(desiredAccess), 0, uintptr(pid))","handlingStrategy":"try-catch","validationCode":"// Go: pre-check the PID is alive and that we run elevated before attempting the dump\nfunc canAttemptDump(pid uint32) bool {\n\tif p, err := os.FindProcess(int(pid)); err != nil || p == nil {\n\t\treturn false\n\t}\n\tadmin, _ := isElevated() // token elevation check\n\treturn admin\n}","typeGuard":"func isOpenProcessSuccess(handle uintptr) bool { return handle != 0 }","tryCatchPattern":"handle, err := pm.openProcess(pid)\nif err != nil {\n\tvar winErr errno-like\n\tif windows.GetLastError() == windows.ERROR_ACCESS_DENIED {\n\t\t// fall back to reduced access mask or skip target\n\t}\n\tsession.LogWarning(\"skip %d: %v\", pid, err)\n}","preventionTips":["Run the tool elevated when dumping system processes","Verify the PID exists immediately before opening it","Enable SeDebugPrivilege at startup for privileged scans","Prefer the minimal access mask the API actually needs"],"tags":["windows","winapi","minidump","process"],"backgroundTag":"permission-denied","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}