{"record":{"id":"e70ce037c4b482ab","repo":"shadow1ng/fscan","slug":"local-pe-not-specified-e70ce0","errorCode":null,"errorMessage":"local_pe_not_specified","messagePattern":"local_pe_not_specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/winwmi.go","lineNumber":31,"sourceCode":"\t\"github.com/shadow1ng/fscan/common\"\n\t\"github.com/shadow1ng/fscan/common/i18n\"\n\t\"github.com/shadow1ng/fscan/plugins\"\n)\n\ntype WinWMIPlugin struct {\n\tplugins.BasePlugin\n}\n\nfunc NewWinWMIPlugin() *WinWMIPlugin {\n\treturn &WinWMIPlugin{\n\t\tBasePlugin: plugins.NewBasePlugin(\"winwmi\"),\n\t}\n}\n\nfunc (p *WinWMIPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {\n\tpePath := session.Config.WinPEFile\n\tif pePath == \"\" {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.GetText(\"local_pe_not_specified\"))}\n\t}\n\tif _, err := os.Stat(pePath); err != nil {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.Tr(\"local_pe_not_found\", pePath))}\n\t}\n\n\tabsPath, _ := filepath.Abs(pePath)\n\tbaseName := strings.TrimSuffix(filepath.Base(absPath), filepath.Ext(absPath))\n\n\tfilterName := fmt.Sprintf(\"SysMon_%s\", baseName)\n\tconsumerName := fmt.Sprintf(\"SysExec_%s\", baseName)\n\n\tps := fmt.Sprintf(`$ok = 0\ntry {\n  $f = ([wmiclass]\"\\\\.\\root\\subscription:__EventFilter\").CreateInstance()\n  $f.Name = \"%s\"; $f.EventNameSpace = \"root\\cimv2\"; $f.QueryLanguage = \"WQL\"\n  $f.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"\n  $f.Put() | Out-Null; $ok++; Write-Output \"[OK] EventFilter\"\n} catch { Write-Output \"[FAIL] EventFilter: $_\" }","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/winwmi.go#L13-L49","documentation":"WinWMIPlugin.Scan requires a local PE file path in session.Config.WinPEFile to compare against WMI persistence artifacts (e.g. event consumer payloads). If the field is empty, the plugin returns this localized error before doing any WMI queries. It is the same required-input guard used by the other local Windows plugins.","triggerScenarios":"Calling Scan with Config.WinPEFile left empty — the PE-file option was not supplied via CLI, config file, or programmatic Config construction when the winwmi plugin runs.","commonSituations":"Forgetting the PE-file flag while running the WMI persistence check; a config file missing the win-pe-file field; constructing ScanSession in code/tests without initializing WinPEFile; a rename in the config struct that silently drops the value.","solutions":["Set session.Config.WinPEFile to the target PE path before invoking Scan.","Confirm the CLI/config layer actually populates Config.WinPEFile for the winwmi plugin.","Add a pre-run config validation that reports which required field is missing per plugin."],"exampleFix":"// before\nsession.Config.WinPEFile = \"\"\np.Scan(ctx, host, session) // local_pe_not_specified\n// after\nsession.Config.WinPEFile = \"C:\\\\samples\\\\wmipersist.dll\"\np.Scan(ctx, host, session)","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(cfg.WinPEFile) == \"\" {\n    return errors.New(\"winwmi plugin requires Config.WinPEFile\")\n}","typeGuard":"func winPEConfigured(c *common.Config) bool { return c != nil && strings.TrimSpace(c.WinPEFile) != \"\" }","tryCatchPattern":null,"preventionTips":["Set Config.WinPEFile whenever any win* local plugin is enabled.","Validate plugin prerequisites centrally before Scan dispatch.","Document the PE-file requirement alongside each plugin selection flag."],"tags":["configuration","windows","wmi","pe-file"],"backgroundTag":"missing-required-config-field","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}