{"record":{"id":"ea4909e8da391b9b","repo":"shadow1ng/fscan","slug":"s-v-lasterror-d-file-create-failed","errorCode":null,"errorMessage":"%s: %v (LastError: %d) [file_create_failed]","messagePattern":"(.+?): (.+?) \\(LastError: (.+?)\\) \\[file_create_failed\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/minidump.go","lineNumber":530,"sourceCode":"\n\tcreateFile, err := pm.kernel32.FindProc(\"CreateFileW\")\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"%s: %w\", i18n.Tr(\"minidump_find_proc_failed\", \"CreateFileW\"), err)\n\t}\n\n\thandle, _, callErr := createFile.Call(\n\t\tuintptr(unsafe.Pointer(pathPtr)),\n\t\tsyscall.GENERIC_WRITE,\n\t\t0, 0,\n\t\tsyscall.CREATE_ALWAYS,\n\t\tsyscall.FILE_ATTRIBUTE_NORMAL,\n\t\t0,\n\t)\n\n\tif handle == INVALID_HANDLE_VALUE {\n\t\tlastError := windows.GetLastError()\n\t\t//nolint:errorlint // Windows LastError不应该wrapped\n\t\treturn 0, fmt.Errorf(i18n.GetText(\"file_create_failed\")+\": %v (LastError: %d)\", callErr, lastError)\n\t}\n\n\treturn handle, nil\n}\n\n// closeHandle 关闭句柄\nfunc (pm *ProcessManager) closeHandle(handle uintptr) {\n\tif proc, err := pm.kernel32.FindProc(\"CloseHandle\"); err == nil {\n\t\t_, _, _ = proc.Call(handle)\n\t}\n}\n\n// isAVBlocking 检测是否有杀软会拦截 LSASS dump\nfunc (p *MiniDumpPlugin) isAVBlocking() bool {\n\tavProcesses := []string{\n\t\t\"MsMpEng.exe\", \"MsSense.exe\",\n\t\t\"CylanceSvc.exe\",\n\t\t\"csfalconservice.exe\",","sourceCodeStart":512,"sourceCodeEnd":548,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/minidump.go#L512-L548","documentation":"CreateFileW returned INVALID_HANDLE_VALUE, so the dump output file could not be created. The syscall error plus the captured windows.GetLastError() (e.g. 5 access denied, 3 path not found, 80 file exists) are included.","triggerScenarios":"createFile.Call(pathPtr, GENERIC_WRITE, 0, 0, ...) yields INVALID_HANDLE_VALUE in createDumpFile — bad output path, read-only directory, or the path is locked by another process.","commonSituations":"Writing dumps to a protected directory (C:\\Windows\\System32) without elevation; output path contains invalid characters or points to a nonexistent directory; antivirus quarantining .dmp files; disk full.","solutions":["Choose a writable output path (e.g. %TEMP% or a user-writable directory) and ensure parent directories exist.","Run elevated if writing to protected locations.","Decode the LastError code (5=access denied, 3=path not found, 80=already exists) to pick the right fix.","Delete/rename an existing locked dump file or pick a new filename before retrying."],"exampleFix":"// before\nreturn 0, fmt.Errorf(i18n.GetText(\"file_create_failed\")+\": %v (LastError: %d)\", callErr, lastError)\n// after — validate the destination before calling CreateFileW\nif dir := filepath.Dir(path); dir != \".\" {\n\tif err := os.MkdirAll(dir, 0o755); err != nil {\n\t\treturn 0, fmt.Errorf(\"mkdir %s: %w\", dir, err)\n\t}\n}\nhandle, _, callErr := createFile.Call(...)","handlingStrategy":"validation","validationCode":"func validateDumpPath(path string) error {\n\tif filepath.Ext(path) != \".dmp\" {\n\t\treturn fmt.Errorf(\"expected .dmp output path, got %q\", path)\n\t}\n\tdir := filepath.Dir(path)\n\tif fi, err := os.Stat(dir); err != nil || !fi.IsDir() {\n\t\treturn fmt.Errorf(\"dump directory %q missing\", dir)\n\t}\n\tf, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0o644)\n\tif err != nil {\n\t\treturn err\n\t}\n\t_ = f.Close()\n\treturn nil\n}","typeGuard":"func isInvalidHandle(h uintptr) bool { return h == uintptr(windows.InvalidHandle) || h == 0 }","tryCatchPattern":"handle, err := pm.createDumpFile(path)\nif err != nil {\n\tif le := lastErrCode(err); le == 5 { // ERROR_ACCESS_DENIED\n\t\t// switch to a writable dir (e.g. %TEMP%) and retry once\n\t}\n\treturn err\n}","preventionTips":["Always dump into a user-writable directory","Create parent directories before opening the file","Pick unique filenames (timestamped) to avoid existing-file conflicts","Decode GetLastError codes in logs for faster triage"],"tags":["windows","file","winapi","minidump"],"backgroundTag":"file-create-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}